diff --git a/.gitbook/assets/image (1250).png b/.gitbook/assets/image (1250).png new file mode 100644 index 000000000..5cdaa3f27 Binary files /dev/null and b/.gitbook/assets/image (1250).png differ diff --git a/.gitbook/assets/image (1251).png b/.gitbook/assets/image (1251).png new file mode 100644 index 000000000..ac0656bc0 Binary files /dev/null and b/.gitbook/assets/image (1251).png differ diff --git a/.gitbook/assets/image (1252).png b/.gitbook/assets/image (1252).png new file mode 100644 index 000000000..a526a8805 Binary files /dev/null and b/.gitbook/assets/image (1252).png differ diff --git a/.gitbook/assets/image (1253).png b/.gitbook/assets/image (1253).png new file mode 100644 index 000000000..7dd3a1a71 Binary files /dev/null and b/.gitbook/assets/image (1253).png differ diff --git a/SUMMARY.md b/SUMMARY.md index f9518a74c..87eee4342 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -531,6 +531,7 @@ * [Bypass Payment Process](pentesting-web/bypass-payment-process.md) * [Captcha Bypass](pentesting-web/captcha-bypass.md) * [Cache Poisoning and Cache Deception](pentesting-web/cache-deception/README.md) + * [Cache Poisoning via URL discrepancies](pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md) * [Cache Poisoning to DoS](pentesting-web/cache-deception/cache-poisoning-to-dos.md) * [Clickjacking](pentesting-web/clickjacking.md) * [Client Side Template Injection (CSTI)](pentesting-web/client-side-template-injection-csti.md) diff --git a/network-services-pentesting/pentesting-smtp/smtp-smuggling.md b/network-services-pentesting/pentesting-smtp/smtp-smuggling.md index 261470971..6d3954eea 100644 --- a/network-services-pentesting/pentesting-smtp/smtp-smuggling.md +++ b/network-services-pentesting/pentesting-smtp/smtp-smuggling.md @@ -1,8 +1,8 @@ # SMTP Smuggling {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
@@ -30,14 +30,14 @@ This is because in the SMTP protocol, the **data of the message** to be sent in In order to exploit this vulnerability an attacker needs to send some data that the **Outbound SMPT server thinks that it's just 1 email but the Inbound SMTP server thinks that there are several emails**. The researchers discovered that different **Inboud servers considers different characters as the end of the data** of the email message that Outbound servers doesn't.\ -For example, a regular end of the data is `\r\n.\r\n`. But if the Inbound SMTP server also supports `\n.\n`, an attacker could just add **that data in his email and start indicating the SMTP commands** of a new new ones to smuggle it just like in the previous image. +For example, a regular end of the data is `\r\n.\r`. But if the Inbound SMTP server also supports `\n.`, an attacker could just add **that data in his email and start indicating the SMTP commands** of a new new ones to smuggle it just like in the previous image. Ofc, this could only work if the **Outbound SMTP server doesn't also treat this data** as the end of the message data, because in that case it will see 2 emails instead of just 1, so at the end this is the desynchronization that is being abused in this vulnerability. Potential desynchronization data: -* `\n.\n` -* `\n.\r\n` +* `\n.` +* `\n.\r` Also note that the SPF is bypassed because if you smuggle an email from `admin@outlook.com` from an email from `user@outlook.com`, **the sender is still `outlook.com`.** @@ -46,8 +46,8 @@ Also note that the SPF is bypassed because if you smuggle an email from `admin@o * [https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/](https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/) {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
diff --git a/pentesting-web/cache-deception/README.md b/pentesting-web/cache-deception/README.md index 64fcc7723..b2907004e 100644 --- a/pentesting-web/cache-deception/README.md +++ b/pentesting-web/cache-deception/README.md @@ -1,8 +1,8 @@ # Cache Poisoning and Cache Deception {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
@@ -18,7 +18,7 @@ Learn & practice GCP Hacking:
\ -Use [**Trickest**](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_term=trickest&utm_content=cache-deception) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\ +Use [**Trickest**](https://trickest.com/?utm\_source=hacktricks\&utm\_medium=text\&utm\_campaign=ppc\&utm\_term=trickest\&utm\_content=cache-deception) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\ Get Access Today: {% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=cache-deception" %} @@ -44,7 +44,7 @@ The execution of a cache poisoning assault involves several steps: Usually, when a response was **stored in the cache** there will be a **header indicating so**, you can check which headers you should pay attention to in this post: [**HTTP Cache headers**](../../network-services-pentesting/pentesting-web/special-http-headers.md#cache-headers). -### Discovery: Caching error codes +### Discovery: Caching error codes If you are thinking that the response is being stored in a cache, you could try to **send requests with a bad header**, which should be responded to with a **status code 400**. Then try to access the request normally and if the **response is a 400 status code**, you know it's vulnerable (and you could even perform a DoS). @@ -70,10 +70,13 @@ With the parameter/header identified check how it is being **sanitised** and **w ### Get the response cached -Once you have **identified** the **page** that can be abused, which **parameter**/**header** to use and **how** to **abuse** it, you need to get the page cached. Depending on the resource you are trying to get in the cache this could take some time, you might need to be trying for several seconds.\ +Once you have **identified** the **page** that can be abused, which **parameter**/**header** to use and **how** to **abuse** it, you need to get the page cached. Depending on the resource you are trying to get in the cache this could take some time, you might need to be trying for several seconds. + The header **`X-Cache`** in the response could be very useful as it may have the value **`miss`** when the request wasn't cached and the value **`hit`** when it is cached.\ -The header **`Cache-Control`** is also interesting to know if a resource is being cached and when will be the next time the resource will be cached again: `Cache-Control: public, max-age=1800`\ -Another interesting header is **`Vary`**. This header is often used to **indicate additional headers** that are treated as **part of the cache key** even if they are normally unkeyed. Therefore, if the user knows the `User-Agent` of the victim he is targeting, he can poison the cache for the users using that specific `User-Agent`.\ +The header **`Cache-Control`** is also interesting to know if a resource is being cached and when will be the next time the resource will be cached again: `Cache-Control: public, max-age=1800` + +Another interesting header is **`Vary`**. This header is often used to **indicate additional headers** that are treated as **part of the cache key** even if they are normally unkeyed. Therefore, if the user knows the `User-Agent` of the victim he is targeting, he can poison the cache for the users using that specific `User-Agent`. + One more header related to the cache is **`Age`**. It defines the times in seconds the object has been in the proxy cache. When caching a request, be **careful with the headers you use** because some of them could be **used unexpectedly** as **keyed** and the **victim will need to use that same header**. Always **test** a Cache Poisoning with **different browsers** to check if it's working. @@ -101,7 +104,7 @@ _Note that this will poison a request to `/en?region=uk` not to `/en`_ ### Using web cache poisoning to exploit cookie-handling vulnerabilities -Cookies could also be reflected on the response of a page. If you can abuse it to cause an XSS for example, you could be able to exploit XSS in several clients that load the malicious cache response. +Cookies could also be reflected on the response of a page. If you can abuse it to cause a XSS for example, you could be able to exploit XSS in several clients that load the malicious cache response. ```markup GET / HTTP/1.1 @@ -111,9 +114,23 @@ Cookie: session=VftzO7ZtiBj5zNLRAuFpXpSQLjS4lBmU; fehost=asd"%2balert(1)%2b" Note that if the vulnerable cookie is very used by the users, regular requests will be cleaning the cache. +### Generating discrepancies with delimiters, normalization and dots + +Check: + +{% content-ref url="cache-poisoning-via-url-discrepancies.md" %} +[cache-poisoning-via-url-discrepancies.md](cache-poisoning-via-url-discrepancies.md) +{% endcontent-ref %} + ### Cache poisoning with path traversal to steal API key -[**This writeup explains**](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html) how it was possible to steal an OpenAI API key with an URL like `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123` because anything matching `/share/*` will be cached without Cloudflare normalising the URL, which was done when the request reached the web server. +[**This writeup explains**](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html) how it was possible to steal an OpenAI API key with an URL like `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123` because anything matching `/share/*` will be cached without Cloudflare normalising the URL, which was done when the request reached the web server. + +This is also explained better in: + +{% content-ref url="cache-poisoning-via-url-discrepancies.md" %} +[cache-poisoning-via-url-discrepancies.md](cache-poisoning-via-url-discrepancies.md) +{% endcontent-ref %} ### Using multiple headers to exploit web cache poisoning vulnerabilities @@ -168,18 +185,6 @@ The [Web Cache Vulnerability Scanner](https://github.com/Hackmanit/Web-Cache-Vul Example usage: `wcvs -u example.com` - - -
- -\ -Use [**Trickest**](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_term=trickest&utm_content=cache-deception) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\ -Get Access Today: - -{% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=cache-deception" %} - - - ## Vulnerable Examples ### Apache Traffic Server ([CVE-2021-27577](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27577)) @@ -257,14 +262,14 @@ Learn here about how to perform[ Cache Deceptions attacks abusing HTTP Request S
\ -Use [**Trickest**](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_term=trickest&utm_content=cache-deception) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\ +Use [**Trickest**](https://trickest.com/?utm\_source=hacktricks\&utm\_medium=text\&utm\_campaign=ppc\&utm\_term=trickest\&utm\_content=cache-deception) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\ Get Access Today: {% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=cache-deception" %} {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
diff --git a/pentesting-web/cache-deception/cache-poisoning-to-dos.md b/pentesting-web/cache-deception/cache-poisoning-to-dos.md index 94ffd72c9..b7993561c 100644 --- a/pentesting-web/cache-deception/cache-poisoning-to-dos.md +++ b/pentesting-web/cache-deception/cache-poisoning-to-dos.md @@ -1,8 +1,8 @@ # Cache Poisoning to DoS {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
@@ -31,7 +31,7 @@ X-Oversize-Hedear:Big-Value-000000000000000 * **HTTP Meta Character (HMC) & Unexpected values** -Send a header that contain some **harmfull meta characters** such as `\n` and `\r`. In order the attack to work you must bypass the cache first. +Send a header that contain some **harmfull meta characters** such as and . In order the attack to work you must bypass the cache first. ``` GET / HTTP/1.1 @@ -74,8 +74,6 @@ Host: redacted.com HTTP-Method-Override: POST ``` - - * **Unkeyed Port** If port in the Host header is reflected in the response and not included in the cache key, it's possible to redirect it to an unused port: @@ -159,8 +157,8 @@ Cache: hit * [https://youst.in/posts/cache-poisoning-at-scale/?source=post\_page-----3a829f221f52--------------------------------](https://youst.in/posts/cache-poisoning-at-scale/?source=post\_page-----3a829f221f52--------------------------------) {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
diff --git a/pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md b/pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md new file mode 100644 index 000000000..9b28e61d9 --- /dev/null +++ b/pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md @@ -0,0 +1,79 @@ +# Cache Poisoning via URL discrepancies + +{% hint style="success" %} +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) + +
+ +Support HackTricks + +* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! +* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** +* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos. + +
+{% endhint %} + +This is a summary of the techniques proposed in the post [https://portswigger.net/research/gotta-cache-em-all](https://portswigger.net/research/gotta-cache-em-all) in order to perform cache poisoning attacks **abusing discrepancies between cache proxies and web servers.** + +{% hint style="info" %} +The goal of this attack is to **make the cache server think that a static resource is being loaded** so it caches it while the cache server stores as cache key part of the path but the web server responds resolving another path. The web server will resolve the real path which will be loading a dynamic page (which might store sensitive information about the user, a malicious payload like XSS or redirecting to lo load a JS file from the attackers website for example). +{% endhint %} + +## Delimiters + +**URL delimiters** vary by framework and server, impacting how requests are routed and responses are handled. Some common origin delimiters are: + +* **Semicolon**: Used in Spring for matrix variables (e.g. `/hello;var=a/world;var1=b;var2=c` → `/hello/world`). +* **Dot**: Specifies response format in Ruby on Rails (e.g. `/MyAccount.css` → `/MyAccount`) +* **Null Byte**: Truncates paths in OpenLiteSpeed (e.g. `/MyAccount%00aaa` → `/MyAccount`). +* **Newline Byte**: Separates URL components in Nginx (e.g. `/users/MyAccount%0aaaa` → `/account/MyAccount`). + +Other specific delimiters might be found following this process: + +* **Step 1**: Identify non-cacheable requests and use them to monitor how URLs with potential delimiters are handled. +* **Step 2**: Append random suffixes to paths and compare the server's response to determine if a character functions as a delimiter. +* **Step 3**: Introduce potential delimiters before the random suffix to see if the response changes, indicating delimiter usage. + +## Normalization & Encodings + +* **Purpose**: URL parsers in both cache and origin servers normalize URLs to extract paths for endpoint mapping and cache keys. +* **Process**: Identifies path delimiters, extracts and normalizes the path by decoding characters and removing dot-segments. + +### **Encodings** + +Different HTTP servers and proxies like Nginx, Node, and CloudFront decode delimiters differently, leading to inconsistencies across CDNs and origin servers that could be exploited. For example, if the web server perform this transformation `/myAccount%3Fparam` → `/myAccount?param` but the cache server keeps as key the path `/myAccount%3Fparam`, there is an inconsistency. + +A way to check for these inconsistencies is to send requests URL encoding different chars after loading the path without any encoding and check if the encoded path response came from the cached response. + +### Dot segment + +The path normalization where dots are involved is also very interesting for cache poisoning attacks. For example, `/static/../home/index` or `/aaa..\home/index`, some cache servers will cache these paths with themselves ad the keys while other might resolve the path and use `/home/index` as the cache key.\ +Just like before, sending these kind of requests and checking if the response was gathered from the cache helps to identify if the response to `/home/index` is the response sent when those paths are requested. + +## Static Resources + +Several cache servers will always cache a response if it's identified as static. This might be because: + +* **The extension**: Cloudflare will always cache files with the following extensions: 7z, csv, gif, midi, png, tif, zip, avi, doc, gz, mkv, ppt, tiff, zst, avif, docx, ico, mp3, pptx, ttf, apk, dmg, iso, mp4, ps, webm, bin, ejs, jar, ogg, rar, webp, bmp, eot, jpg, otf, svg, woff, bz2, eps, jpeg, pdf, svgz, woff2, class, exe, js, pict, swf, xls, css, flac, mid, pls, tar, xlsx + * It's possible to force a cache storing a dynamic response by using a delimiter and a static extension like a request to `/home$image.png` will cache `/home$image.png` and the origin server will respond with `/home` +* **Well-known static directories**: The following directories contains static files and therefore their response should be cached: /static, /assets, /wp-content, /media, /templates, /public, /shared + * It's possible to force a cache storing a dynamic response by using a delimiter, a static directory and dots like: `/home/..%2fstatic/something` will cache `/static/something` and the response will be`/home` + * **Static dirs + dots**: A request to `/static/..%2Fhome` or to `/static/..%5Chome` might be cached as is but the response might be `/home` +* **Static files:** Some specific files are always cached like `/robots.txt`, `/favicon.ico`, and `/index.html`. Which can be abused like `/home/..%2Frobots.txt` where the cace might store `/robots.txt` and the origin server respond to `/home`. + +{% hint style="success" %} +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) + +
+ +Support HackTricks + +* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! +* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** +* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos. + +
+{% endhint %} diff --git a/pentesting-web/ssti-server-side-template-injection/README.md b/pentesting-web/ssti-server-side-template-injection/README.md index b28d24d56..d6e532f30 100644 --- a/pentesting-web/ssti-server-side-template-injection/README.md +++ b/pentesting-web/ssti-server-side-template-injection/README.md @@ -1,8 +1,8 @@ # SSTI (Server Side Template Injection) {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
@@ -321,6 +321,7 @@ New version of Pebble : + {% set bytes = (1).TYPE .forName('java.lang.Runtime') .methods[6] @@ -850,6 +851,7 @@ Check out the following page to learn tricks about **arbitrary command execution + {{os.system('whoami')}} {{os.system('whoami')}} ``` @@ -884,6 +886,7 @@ Check out the following page to learn tricks about **arbitrary command execution + {{settings.SECRET_KEY}} {{4*4}}[[5*5]] {{7*'7'}} would result in 7777777 @@ -1059,8 +1062,8 @@ If you think it could be useful, read: {% embed url="https://www.rootedcon.com/" %} {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
diff --git a/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md b/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md index bd2eca99e..11c215a35 100644 --- a/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md +++ b/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md @@ -1,8 +1,8 @@ # Jinja2 SSTI {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
@@ -50,6 +50,7 @@ If the Debug Extension is enabled, a `debug` tag will be available to dump the c + ``` @@ -70,6 +71,7 @@ Source: [https://jinja.palletsprojects.com/en/2.11.x/templates/#debug-statement] + ``` ## **Jinja Injection** @@ -134,6 +136,7 @@ dict.__mro__[-1] + # Not sure if this will work, but I saw it somewhere {{ [].class.base.subclasses() }} {{ ''.class.mro()[1].subclasses() }} @@ -218,6 +221,7 @@ http://localhost:5000/?c={{request|attr(request.args.getlist(request.args.l)|joi + ``` * [**Return here for more options to access a global object**](jinja2-ssti.md#accessing-global-objects) @@ -266,6 +270,7 @@ Without **`{{`** **`.`** **`[`** **`]`** **`}}`** **`_`** + ``` ## Jinja Injection without **\** @@ -310,6 +315,7 @@ Once you have found some functions you can recover the builtins with: {% with a = request["application"]["\x5f\x5fglobals\x5f\x5f"]["\x5f\x5fbuiltins\x5f\x5f"]["\x5f\x5fimport\x5f\x5f"]("os")["popen"]("ls")["read"]() %} {{ a }} {% endwith %} {% endraw %} + ## Extra ## The global from config have a access to a function called import_string ## with this function you don't need to access the builtins @@ -357,8 +363,8 @@ The request will be urlencoded by default according to the HTTP format, which ca * [https://hackmd.io/@Chivato/HyWsJ31dI](https://hackmd.io/@Chivato/HyWsJ31dI) {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
diff --git a/pentesting-web/xss-cross-site-scripting/README.md b/pentesting-web/xss-cross-site-scripting/README.md index 63bb04086..13e63edd9 100644 --- a/pentesting-web/xss-cross-site-scripting/README.md +++ b/pentesting-web/xss-cross-site-scripting/README.md @@ -163,7 +163,7 @@ Some **examples**: When your input is reflected **inside the HTML page** or you can escape and inject HTML code in this context the **first** thing you need to do if check if you can abuse `<` to create new tags: Just try to **reflect** that **char** and check if it's being **HTML encoded** or **deleted** of if it is **reflected without changes**. **Only in the last case you will be able to exploit this case**.\ For this cases also **keep in mind** [**Client Side Template Injection**](../client-side-template-injection-csti.md)**.**\ -_**Note: A HTML comment can be closed using**** ****`-->`**** ****or**** ****`--!>`**_ +_**Note: A HTML comment can be closed using\*\*\*\***** ****`-->`**** ****or \*\*\*\*****`--!>`**_ In this case and if no black/whitelisting is used, you could use payloads like: @@ -1581,8 +1581,8 @@ If you are interested in **hacking career** and hack the unhackable - **we are h {% embed url="https://www.stmcyber.com/careers" %} {% hint style="success" %} -Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)