<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong><ahref="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
Lengo la PoCs na Polygloths hizi ni kumpa mtihani mchunguzi **muhtasari wa haraka** wa udhaifu ambao anaweza kudukua ikiwa **matokeo ya kuingiza kwake yanarudi kwenye jibu**.
Hati hii ya kudanganya **haitoi orodha kamili ya vipimo kwa kila udhaifu**, bali inatoa vipimo vichache vya msingi tu. Ikiwa unatafuta vipimo kamili zaidi, tafadhali fikia kila udhaifu uliopendekezwa.
Hutapata kuingizwa kwa aina ya Maudhui kama XXE, kwa sababu kawaida utajaribu mwenyewe ikiwa utapata ombi linalotuma data ya xml. Hapa pia hutapata kuingizwa kwenye database kwani hata ikiwa baadhi ya maudhui yanaweza kurejelewa, inategemea sana teknolojia na muundo wa DB ya nyuma.
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumiwa kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumiwa kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
* **Lengo**: Kuingiza msimbo wa HTML katika sehemu ya maoni ya wavuti.
* **Maelezo**: Jaribu kuingiza msimbo wa HTML kwenye sehemu ya maoni ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
* **Matokeo yanayotarajiwa**: Ikiwa msimbo wa HTML unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kama vile XSS (Cross-Site Scripting).
* **Lengo**: Kuingiza msimbo wa HTML katika uwanja wa fomu ya wavuti.
* **Maelezo**: Jaribu kuingiza msimbo wa HTML kwenye uwanja wa fomu ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
* **Matokeo yanayotarajiwa**: Ikiwa msimbo wa HTML unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kama vile XSS (Cross-Site Scripting).
* **Lengo**: Kuingiza msimbo wa SSTI katika uwanja wa fomu ya wavuti.
* **Maelezo**: Jaribu kuingiza msimbo wa SSTI kwenye uwanja wa fomu ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
* **Matokeo yanayotarajiwa**: Ikiwa msimbo wa SSTI unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kwenye mazingira ya seva.
* **Lengo**: Kuingiza msimbo wa SSTI katika sehemu ya maoni ya wavuti.
* **Maelezo**: Jaribu kuingiza msimbo wa SSTI kwenye sehemu ya maoni ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
* **Matokeo yanayotarajiwa**: Ikiwa msimbo wa SSTI unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kwenye mazingira ya seva.
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumika kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to execute code within the file.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi wanavyoweza kutumika kufikia matokeo yanayotakiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum za kutekeleza nambari ndani ya faili.
Polygloths can be used in various hacking scenarios, such as bypassing file upload restrictions, evading antivirus detection, or executing arbitrary code on a target system. However, it is important to note that the use of polygloths for malicious purposes is illegal and unethical.
Wapolygloths wanaweza kutumika katika mazingira mbalimbali ya kudukua, kama vile kuepuka vizuizi vya kupakia faili, kuepuka kugunduliwa na programu za antivirus, au kutekeleza nambari isiyo na kikomo kwenye mfumo wa lengo. Hata hivyo, ni muhimu kuzingatia kwamba matumizi ya wapolygloths kwa madhumuni mabaya ni kinyume cha sheria na si maadili.
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web pentesting, polygloths can be used to exploit vulnerabilities in web applications.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa pentesting ya wavuti, wapolygloths wanaweza kutumika kudukua udhaifu katika programu za wavuti.
### File Signatures
### Saini za Faili
File signatures, also known as magic numbers, are unique sequences of bytes that can be used to identify the file type. By manipulating the file signature, a polyglot file can be created that appears as one file type but is interpreted as another.
Saini za faili, pia hujulikana kama nambari za uchawi, ni mfuatano wa pekee wa herufi ambazo zinaweza kutumika kutambua aina ya faili. Kwa kubadilisha saini ya faili, faili ya polyglot inaweza kuundwa ambayo inaonekana kama aina moja ya faili lakini inachukuliwa kama nyingine.
Polygloths can be powerful tools in the hands of a skilled hacker. By exploiting the ability of files to be interpreted differently depending on the context, polyglot files can be used to bypass security measures and execute malicious code. It is important for web pentesters to be aware of the existence and potential dangers of polyglot files in order to effectively assess and secure web applications.
Wapolygloths wanaweza kuwa zana zenye nguvu mikononi mwa hacker mwenye ujuzi. Kwa kudukua uwezo wa faili kuwa na tafsiri tofauti kulingana na muktadha, faili za polyglot zinaweza kutumika kuepuka hatua za usalama na kutekeleza nambari mbaya. Ni muhimu kwa wapentesters wa wavuti kufahamu uwepo na hatari za faili za polyglot ili kuweza kutathmini na kusaidia programu za wavuti kwa ufanisi.
Stored XSS ni aina ya mashambulizi ya msalaba wa tovuti ambapo msanidi programu anaruhusu mtumiaji kuingiza data ambayo inaweza kutekelezwa kwenye ukurasa wa wavuti. Hii inaweza kusababisha shambulio la XSS ambapo msimbo mbaya unaweza kutekelezwa kwenye kivinjari cha mtumiaji.
Mifano ya majaribio ya msingi ya Stored XSS ni pamoja na:
Reflected XSS ni aina ya mashambulizi ya msalaba wa tovuti ambapo msanidi programu anaruhusu mtumiaji kuingiza data ambayo inaweza kutekelezwa kwenye ukurasa wa wavuti. Hii inaweza kusababisha shambulio la XSS ambapo msimbo mbaya unaweza kutekelezwa kwenye kivinjari cha mtumiaji.
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumika kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong><ahref="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
