From b0dfcfd438983aba61ae3ffe01ad5b8cacc332c5 Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Thu, 24 Aug 2023 22:15:11 +0200 Subject: [PATCH] Hidden Parameters --- GraphQL Injection/README.md | 13 +++++++--- Hidden Parameters/README.md | 51 +++++++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+), 4 deletions(-) create mode 100644 Hidden Parameters/README.md diff --git a/GraphQL Injection/README.md b/GraphQL Injection/README.md index 609c5b9..4a1846d 100644 --- a/GraphQL Injection/README.md +++ b/GraphQL Injection/README.md @@ -33,6 +33,7 @@ * [swisskyrepo/GraphQLmap](https://github.com/swisskyrepo/GraphQLmap) - Scripting engine to interact with a graphql endpoint for pentesting purposes * [doyensec/graph-ql](https://github.com/doyensec/graph-ql/) - GraphQL Security Research Material * [doyensec/inql](https://github.com/doyensec/inql) - A Burp Extension for GraphQL Security Testing +* [doyensec/GQLSpection](https://github.com/doyensec/GQLSpection) - GQLSpection - parses GraphQL introspection schema and generates possible queries * [dee-see/graphql-path-enum](https://gitlab.com/dee-see/graphql-path-enum) - Lists the different ways of reaching a given type in a GraphQL schema * [andev-software/graphql-ide](https://github.com/andev-software/graphql-ide) - An extensive IDE for exploring GraphQL API's * [mchoji/clairvoyancex](https://github.com/mchoji/clairvoyancex) - Obtain GraphQL API schema despite disabled introspection @@ -205,6 +206,9 @@ When you use an unknown keyword, the GraphQL backend will respond with a suggest } ``` +You can also try to bruteforce known keywords, field and type names using wordlists such as [Escape-Technologies/graphql-wordlist](https://github.com/Escape-Technologies/graphql-wordlist) when the schema of a GraphQL API is not accessible. + + ### Enumerate the types' definition @@ -271,7 +275,7 @@ example.com/graphql?query={TYPE_1{FIELD_1,FIELD_2}} :warning: Don’t forget to escape the " inside the **options**. -```json +```js {doctors(options: "{\"patients.ssn\" :1}"){firstName lastName id patients{ssn}}} ``` @@ -347,7 +351,7 @@ mutation { Use `$regex`, `$ne` from []() inside a `search` parameter. -```json +```js { doctors( options: "{\"limit\": 1, \"patients.ssn\" :1}", @@ -363,7 +367,7 @@ Use `$regex`, `$ne` from []() inside a `search` parameter. Send a single quote `'` inside a graphql parameter to trigger the SQL injection -```powershell +```js { bacon(id: "1'") { id, @@ -398,4 +402,5 @@ curl -X POST http://localhost:8080/graphql\?embedded_submission_form_uuid\=1%27% * [Graphql Bug to Steal Anyone’s Address - Sept 1, 2019 - Pratik Yadav](https://medium.com/@pratiky054/graphql-bug-to-steal-anyones-address-fc34f0374417) * [GraphQL Batching Attack - RENATAWALLARM - DECEMBER 13, 2019](https://lab.wallarm.com/graphql-batching-attack/) * [GraphQL for Pentesters presentation by ACCEIS - 01/12/2022](https://acceis.github.io/prez-graphql/) - [source](https://github.com/Acceis/prez-graphql) -* [Exploiting GraphQL - Aug 29, 2021 - AssetNote - Shubham Shah](https://blog.assetnote.io/2021/08/29/exploiting-graphql/) \ No newline at end of file +* [Exploiting GraphQL - Aug 29, 2021 - AssetNote - Shubham Shah](https://blog.assetnote.io/2021/08/29/exploiting-graphql/) +* [Building a free open source GraphQL wordlist for penetration testing - Nohé Hinniger-Foray - Aug 17, 2023](https://escape.tech/blog/graphql-security-wordlist/) \ No newline at end of file diff --git a/Hidden Parameters/README.md b/Hidden Parameters/README.md new file mode 100644 index 0000000..30a5958 --- /dev/null +++ b/Hidden Parameters/README.md @@ -0,0 +1,51 @@ +# HTTP Hidden Parameters + +> Web applications often have hidden or undocumented parameters that are not exposed in the user interface. Fuzzing can help discover these parameters, which might be vulnerable to various attacks. + +## Summary + +* [Tools](#tools) +* [Exploit](#exploit) + * [Bruteforce parameters](#bruteforce-parameters) + * [Old parameters](#old-parameters) +* [References](#references) + + +## Tools + +* [PortSwigger/param-miner](https://github.com/PortSwigger/param-miner) - Burp extension to identify hidden, unlinked parameters. +* [s0md3v/Arjun](https://github.com/s0md3v/Arjun) - HTTP parameter discovery suite +* [Sh1Yo/x8](https://github.com/Sh1Yo/x8) - Hidden parameters discovery suite +* [tomnomnom/waybackurls](https://github.com/tomnomnom/waybackurls) - Fetch all the URLs that the Wayback Machine knows about for a domain +* [devanshbatham/ParamSpider](https://github.com/devanshbatham/ParamSpider) - Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing + + +## Exploit + +### Bruteforce parameters + +* Use wordlists of common parameters and send them, look for unexpected behavior from the backend. + ```ps1 + x8 -u "https://example.com/" -w + x8 -u "https://example.com/" -X POST -w + ``` + +Wordlist examples: +- [Arjun/large.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/large.txt) +- [Arjun/medium.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/medium.txt) +- [Arjun/small.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/small.txt) +- [samlists/sam-cc-parameters-lowercase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-lowercase-all.txt) +- [samlists/sam-cc-parameters-mixedcase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-mixedcase-all.txt) + +### Old parameters + +Explore all the URL from your targets to find old parameters. +* Browse the [Wayback Machine](http://web.archive.org/) +* Look through the JS files to discover unused parameters + + +## References + +* [Hacker tools: Arjun – The parameter discovery tool - 17TH MAY 2021 - Intigriti](https://blog.intigriti.com/2021/05/17/hacker-tools-arjun-the-parameter-discovery-tool/) +* [Parameter Discovery: A quick guide to start - 20/04/2022 - YesWeHack](https://blog.yeswehack.com/yeswerhackers/parameter-discovery-quick-guide-to-start/) +