mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-16 22:18:27 +00:00
Translated ['network-services-pentesting/pentesting-web/nextjs.md', 'pen
This commit is contained in:
Translator
parent
b4216f8fe4
commit
615be2cece
3 changed files with 77 additions and 33 deletions
|
|
@ -398,6 +398,7 @@
|
|||
* [Laravel](network-services-pentesting/pentesting-web/laravel.md)
|
||||
* [Moodle](network-services-pentesting/pentesting-web/moodle.md)
|
||||
* [Nginx](network-services-pentesting/pentesting-web/nginx.md)
|
||||
* [NextJS](network-services-pentesting/pentesting-web/nextjs.md)
|
||||
* [PHP Tricks](network-services-pentesting/pentesting-web/php-tricks-esp/README.md)
|
||||
* [PHP - Useful Functions & disable\_functions/open\_basedir bypass](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/README.md)
|
||||
* [disable\_functions bypass - php-fpm/FastCGI](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-fpm-fastcgi.md)
|
||||
|
|
|
|||
37
network-services-pentesting/pentesting-web/nextjs.md
Normal file
37
network-services-pentesting/pentesting-web/nextjs.md
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# NextJS
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
@ -3,14 +3,14 @@
|
|||
<figure><img src="../.gitbook/assets/image (48).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_term=trickest&utm_content=race-condition) kujenga na **kujiendesha kiotomatiki** kazi zinazotolewa na zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm\_source=hacktricks\&utm\_medium=text\&utm\_campaign=ppc\&utm\_term=trickest\&utm\_content=race-condition) kujenga na **kuandaa kazi** kwa urahisi kwa kutumia zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Pata Ufikiaji Leo:
|
||||
|
||||
{% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=race-condition" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
@ -18,7 +18,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
@ -29,43 +29,43 @@ Ili kupata uelewa wa kina wa mbinu hii angalia ripoti asili katika [https://port
|
|||
|
||||
## Kuimarisha Mashambulizi ya Race Condition
|
||||
|
||||
Kikwazo kikuu katika kuchukua faida ya hali za race ni kuhakikisha kwamba maombi mengi yanashughulikiwa kwa wakati mmoja, kwa **tofauti ndogo sana katika nyakati zao za usindikaji—kwa kawaida, chini ya 1ms**.
|
||||
Kikwazo kikuu katika kutumia faida ya race conditions ni kuhakikisha kwamba maombi mengi yanashughulikiwa kwa wakati mmoja, kwa **tofauti ndogo sana katika nyakati zao za usindikaji—kwa kawaida, chini ya 1ms**.
|
||||
|
||||
Hapa unaweza kupata mbinu za Kuisawazisha Maombi:
|
||||
|
||||
#### HTTP/2 Shambulio la Packet Moja dhidi ya HTTP/1.1 Usawazishaji wa Byte wa Mwisho
|
||||
#### HTTP/2 Single-Packet Attack vs. HTTP/1.1 Last-Byte Synchronization
|
||||
|
||||
* **HTTP/2**: Inasaidia kutuma maombi mawili kupitia muunganisho mmoja wa TCP, kupunguza athari za jitter za mtandao. Hata hivyo, kutokana na tofauti za upande wa seva, maombi mawili yanaweza kutotosha kwa shambulio la race condition linaloendelea.
|
||||
* **HTTP/1.1 'Usawazishaji wa Byte wa Mwisho'**: Inaruhusu kutuma sehemu nyingi za maombi 20-30 kabla, ikizuia kipande kidogo, ambacho kitatumwa pamoja, kufikia seva kwa wakati mmoja.
|
||||
* **HTTP/2**: Inasaidia kutuma maombi mawili kupitia muunganisho mmoja wa TCP, kupunguza athari za jitter za mtandao. Hata hivyo, kutokana na tofauti za upande wa seva, maombi mawili yanaweza kutokutosha kwa matumizi ya kudumu ya exploit ya race condition.
|
||||
* **HTTP/1.1 'Last-Byte Sync'**: Inaruhusu kutuma sehemu nyingi za maombi 20-30 kabla, ikizuia kipande kidogo, ambacho kitatumwa pamoja, kufikia seva kwa wakati mmoja.
|
||||
|
||||
**Maandalizi ya Usawazishaji wa Byte wa Mwisho** yanajumuisha:
|
||||
**Maandalizi ya Last-Byte Sync** yanajumuisha:
|
||||
|
||||
1. Kutuma vichwa na data ya mwili bila byte ya mwisho bila kumaliza mtiririko.
|
||||
2. Kusitisha kwa 100ms baada ya kutuma awali.
|
||||
3. Kuzima TCP\_NODELAY ili kutumia algorithimu ya Nagle kwa kuunganisha fremu za mwisho.
|
||||
2. Kusimamisha kwa 100ms baada ya kutuma awali.
|
||||
3. Kuzima TCP\_NODELAY ili kutumia algorithm ya Nagle kwa kuunganisha fremu za mwisho.
|
||||
4. Kupiga simu ili kuimarisha muunganisho.
|
||||
|
||||
Kutuma fremu zilizoshikiliwa baadaye inapaswa kusababisha kuwasili kwao katika packet moja, inayoweza kuthibitishwa kupitia Wireshark. Mbinu hii haitumiki kwa faili za statiki, ambazo kawaida hazihusiki katika mashambulizi ya RC.
|
||||
Kutuma fremu zilizoshikiliwa baadaye inapaswa kusababisha kuwasili kwao katika pakiti moja, inayoweza kuthibitishwa kupitia Wireshark. Mbinu hii haitumiki kwa faili za statiki, ambazo kawaida hazihusiki katika mashambulizi ya RC.
|
||||
|
||||
### Kurekebisha kwa Mifumo ya Seva
|
||||
|
||||
Kuelewa usanifu wa lengo ni muhimu. Seva za mbele zinaweza kuelekeza maombi tofauti, kuathiri nyakati. Kuimarisha muunganisho wa upande wa seva, kupitia maombi yasiyo na maana, kunaweza kuimarisha nyakati za maombi.
|
||||
Kuelewa usanifu wa lengo ni muhimu. Seva za mbele zinaweza kuelekeza maombi tofauti, kuathiri wakati. Kuimarisha muunganisho wa upande wa seva, kupitia maombi yasiyo na maana, kunaweza kurekebisha wakati wa maombi.
|
||||
|
||||
#### Kushughulikia Kufunga Kulingana na Kikao
|
||||
|
||||
Mifumo kama vile handler ya kikao ya PHP inasawazisha maombi kwa kikao, ambayo inaweza kuficha udhaifu. Kutumia tokeni tofauti za kikao kwa kila ombi kunaweza kuzunguka tatizo hili.
|
||||
Mifumo kama vile handler ya kikao ya PHP inasawazisha maombi kwa kikao, ambayo inaweza kuficha udhaifu. Kutumia tokeni tofauti za kikao kwa kila ombi kunaweza kuondoa tatizo hili.
|
||||
|
||||
#### Kushinda Mipaka ya Kiwango au Rasilimali
|
||||
|
||||
Ikiwa kuimarisha muunganisho hakufanyi kazi, kuanzisha ucheleweshaji wa mipaka ya kiwango au rasilimali za seva za wavuti kwa makusudi kupitia mafuriko ya maombi ya dummy kunaweza kuwezesha shambulio la packet moja kwa kuanzisha ucheleweshaji wa upande wa seva unaofaa kwa hali za race.
|
||||
Ikiwa kuimarisha muunganisho hakufanyi kazi, kuanzisha ucheleweshaji wa mipaka ya kiwango au rasilimali za seva za wavuti kwa makusudi kupitia mafuriko ya maombi ya dummy kunaweza kuwezesha shambulizi la pakiti moja kwa kuanzisha ucheleweshaji wa upande wa seva unaofaa kwa race conditions.
|
||||
|
||||
## Mifano ya Shambulio
|
||||
## Mifano ya Shambulizi
|
||||
|
||||
* **Tubo Intruder - shambulio la packet moja la HTTP2 (1 endpoint)**: Unaweza kutuma ombi kwa **Turbo intruder** (`Extensions` -> `Turbo Intruder` -> `Send to Turbo Intruder`), unaweza kubadilisha katika ombi thamani unayotaka kujaribu kwa nguvu kwa **`%s`** kama katika `csrf=Bn9VQB8OyefIs3ShR2fPESR0FzzulI1d&username=carlos&password=%s` na kisha chagua **`examples/race-single-packer-attack.py`** kutoka kwenye orodha:
|
||||
* **Tubo Intruder - HTTP2 single-packet attack (1 endpoint)**: Unaweza kutuma ombi kwa **Turbo intruder** (`Extensions` -> `Turbo Intruder` -> `Send to Turbo Intruder`), unaweza kubadilisha katika ombi thamani unayotaka kujaribu kwa nguvu kwa **`%s`** kama katika `csrf=Bn9VQB8OyefIs3ShR2fPESR0FzzulI1d&username=carlos&password=%s` na kisha chagua **`examples/race-single-packer-attack.py`** kutoka kwenye orodha:
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (57).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Ikiwa unataka **kutuma thamani tofauti**, unaweza kubadilisha msimbo na huu unaotumia orodha ya maneno kutoka kwenye clipboard:
|
||||
Ikiwa unataka **kutuma thamani tofauti**, unaweza kubadilisha msimbo huu unaotumia orodha ya maneno kutoka kwenye clipboard:
|
||||
```python
|
||||
passwords = wordlists.clipboard
|
||||
for password in passwords:
|
||||
|
|
@ -75,7 +75,7 @@ engine.queue(target.req, password, gate='race1')
|
|||
Ikiwa wavuti haitegemei HTTP2 (tu HTTP1.1) tumia `Engine.THREADED` au `Engine.BURP` badala ya `Engine.BURP2`.
|
||||
{% endhint %}
|
||||
|
||||
* **Tubo Intruder - HTTP2 shambulio la pakiti moja (Mikondo kadhaa)**: Ikiwa unahitaji kutuma ombi kwa 1 mkingo na kisha mengi kwa mkingo mingine ili kuanzisha RCE, unaweza kubadilisha skripti ya `race-single-packet-attack.py` na kitu kama:
|
||||
* **Tubo Intruder - HTTP2 shambulio la pakiti moja (Mikondo kadhaa)**: Ikiwa unahitaji kutuma ombi kwa mkomo 1 na kisha mengi kwa mikondo mingine ili kuanzisha RCE, unaweza kubadilisha skripti ya `race-single-packet-attack.py` na kitu kama:
|
||||
```python
|
||||
def queueRequests(target, wordlists):
|
||||
engine = RequestEngine(endpoint=target.endpoint,
|
||||
|
|
@ -109,7 +109,7 @@ engine.openGate(currentAttempt)
|
|||
* Inapatikana pia katika **Repeater** kupitia chaguo jipya la '**Send group in parallel**' katika Burp Suite.
|
||||
* Kwa **limit-overrun** unaweza tu kuongeza **ombile lile lile mara 50** katika kundi.
|
||||
* Kwa **connection warming**, unaweza **kuongeza** mwanzoni mwa **kundi** baadhi ya **ombile** kwa sehemu zisizo za kudumu za seva ya wavuti.
|
||||
* Kwa **delaying** mchakato **kati** ya kushughulikia **ombile moja na nyingine** katika hatua 2 za substate, unaweza **kuongeza ombile za ziada kati** ya ombile zote mbili.
|
||||
* Kwa **delaying** mchakato **kati** ya kusindika **ombile moja na jingine** katika hatua 2 za substate, unaweza **kuongeza ombile za ziada kati** ya ombile zote mbili.
|
||||
* Kwa **multi-endpoint** RC unaweza kuanza kutuma **ombile** ambalo **linakwenda kwenye hali ya siri** na kisha **ombile 50** mara tu baada yake ambayo **inatumia hali ya siri**.
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (58).png" alt=""><figcaption></figcaption></figure>
|
||||
|
|
@ -219,9 +219,6 @@ temp_data_bytes += bytes(d)
|
|||
|
||||
h2_conn.send_bytes(temp_headers_bytes)
|
||||
|
||||
|
||||
|
||||
|
||||
# wait some time
|
||||
sleep(0.1)
|
||||
|
||||
|
|
@ -243,12 +240,21 @@ h2_conn.close_connection()
|
|||
|
||||
response = requests.get(url, verify=False)
|
||||
```
|
||||
### Raw BF
|
||||
### Kuboresha Shambulio la Pakiti Moja
|
||||
|
||||
Katika utafiti wa awali, imeelezwa kwamba shambulio hili lina kikomo cha 1,500 bytes. Hata hivyo, katika [**post hii**](https://flatt.tech/research/posts/beyond-the-limit-expanding-single-packet-race-condition-with-first-sequence-sync/), imeelezwa jinsi inavyowezekana kupanua kikomo cha 1,500-byte cha shambulio la pakiti moja hadi **65,535 B kikomo cha dirisha cha TCP kwa kutumia upasuwaji wa tabaka la IP** (kugawanya pakiti moja kuwa pakiti nyingi za IP) na kuzituma kwa mpangilio tofauti, ambayo iliruhusu kuzuia kuunganishwa tena kwa pakiti hadi vipande vyote vifikie seva. Mbinu hii iliruhusu mtafiti kutuma maombi 10,000 katika takriban 166ms. 
|
||||
|
||||
Kumbuka kwamba ingawa kuboresha hii kunafanya shambulio kuwa na uaminifu zaidi katika RC inayohitaji pakiti mamia/elfu kufika kwa wakati mmoja, inaweza pia kuwa na baadhi ya vikwazo vya programu. Seva maarufu za HTTP kama Apache, Nginx na Go zina mipangilio ya `SETTINGS_MAX_CONCURRENT_STREAMS` ya 100, 128 na 250. Hata hivyo, zingine kama NodeJS na nghttp2 zina mipangilio isiyo na kikomo.\
|
||||
Hii inamaanisha kwamba Apache itazingatia tu muunganisho 100 wa HTTP kutoka kwa muunganisho mmoja wa TCP (ikizuiya shambulio hili la RC).
|
||||
|
||||
Unaweza kupata mifano kadhaa ukitumia mbinu hii katika repo [https://github.com/Ry0taK/first-sequence-sync/tree/main](https://github.com/Ry0taK/first-sequence-sync/tree/main).
|
||||
|
||||
## Raw BF
|
||||
|
||||
Kabla ya utafiti wa awali, hizi zilikuwa baadhi ya payloads zilizotumika ambazo zilijaribu kutuma pakiti haraka iwezekanavyo ili kusababisha RC.
|
||||
|
||||
* **Repeater:** Angalia mifano kutoka sehemu ya awali.
|
||||
* **Intruder**: Tuma **ombile** kwa **Intruder**, weka **idadi ya nyuzi** kuwa **30** ndani ya **Menyu ya Chaguo** na, chagua kama payload **Null payloads** na tengeneza **30.**
|
||||
* **Intruder**: Tuma **ombile** kwa **Intruder**, weka **idadi ya nyuzi** kuwa **30** ndani ya **menyu ya Chaguo** na, chagua kama payload **Null payloads** na tengeneza **30.**
|
||||
* **Turbo Intruder**
|
||||
```python
|
||||
def queueRequests(target, wordlists):
|
||||
|
|
@ -326,7 +332,7 @@ Kuchangamkia race conditions ngumu mara nyingi kunahusisha kutumia fursa za muda
|
|||
|
||||
### Time Sensitive Attacks
|
||||
|
||||
Usahihi katika kuomba maombi unaweza kufichua **vulnerabilities**, hasa wakati mbinu zinazoweza kutabiriwa kama vile alama za muda zinapotumika kwa token za usalama. Kwa mfano, kuunda token za kurekebisha nywila kulingana na alama za muda kunaweza kuruhusu token sawa kwa maombi ya wakati mmoja.
|
||||
Usahihi katika kuomba maombi unaweza kufichua **vulnerabilities**, hasa wakati mbinu zinazoweza kutabiriwa kama vile timestamps zinapotumika kwa token za usalama. Kwa mfano, kuunda token za kurekebisha nywila kulingana na timestamps kunaweza kuruhusu token sawa kwa maombi ya wakati mmoja.
|
||||
|
||||
**Ili Kutumia:**
|
||||
|
||||
|
|
@ -356,15 +362,15 @@ Kulingana na [**utafiti huu**](https://portswigger.net/research/smashing-the-sta
|
|||
|
||||
### Hidden Database states / Confirmation Bypass
|
||||
|
||||
Ikiwa **maandishi mawili tofauti** yanatumika ku **ongeza** **habari** ndani ya **database**, kuna sehemu ndogo ya muda ambapo **tu data ya kwanza imeandikwa** ndani ya database. Kwa mfano, wakati wa kuunda mtumiaji **jina la mtumiaji** na **nywila** vinaweza ku **andikwa** na **kisha token** ya kuthibitisha akaunti mpya iliyoundwa inaandikwa. Hii inamaanisha kwamba kwa muda mfupi **token ya kuthibitisha akaunti ni null**.
|
||||
Ikiwa **kuandikwa tofauti 2** zinatumika ku **ongeza** **habari** ndani ya **database**, kuna sehemu ndogo ya muda ambapo **tu data ya kwanza imeandikwa** ndani ya database. Kwa mfano, wakati wa kuunda mtumiaji **jina la mtumiaji** na **nywila** vinaweza ku **andikwa** na **kisha token** ya kuthibitisha akaunti mpya iliyoundwa inaandikwa. Hii inamaanisha kwamba kwa muda mfupi **token ya kuthibitisha akaunti ni null**.
|
||||
|
||||
Kwa hivyo **kujiandikisha akaunti na kutuma maombi kadhaa na token tupu** (`token=` au `token[]=` au toleo lolote lingine) ili kuthibitisha akaunti mara moja kunaweza kuruhusu **kuhakiki akaunti** ambayo hujatumia barua pepe.
|
||||
Hivyo **kujiandikisha akaunti na kutuma maombi kadhaa na token tupu** (`token=` au `token[]=` au toleo lolote lingine) ili kuthibitisha akaunti mara moja kunaweza kuruhusu **kuhakiki akaunti** ambayo hujatumia barua pepe.
|
||||
|
||||
**Angalia hii** [**PortSwigger Lab**](https://portswigger.net/web-security/race-conditions/lab-race-conditions-partial-construction) **kujaribu hii.**
|
||||
|
||||
### Bypass 2FA
|
||||
|
||||
Kifungu kinachofuata ni dhaifu kwa race condition kwa sababu katika muda mfupi sana **2FA haitekelezwi** wakati kikao kinaundwa:
|
||||
Kifungu kinachofuata cha pseudo-code kina **vulnerability** ya race condition kwa sababu katika muda mfupi sana **2FA haitekelezwi** wakati kikao kinaundwa:
|
||||
```python
|
||||
session['userid'] = user.userid
|
||||
if user.mfa_enabled:
|
||||
|
|
@ -383,7 +389,7 @@ Hivyo, hadi hapa ni kuingia kwa kawaida na google/linkedin/github... ambapo unap
|
|||
|
||||
#### Race Condition katika `Refresh Token`
|
||||
|
||||
Mara tu umepata **RT halali** unaweza kujaribu **kuitumia vibaya ili kuunda AT/RT kadhaa** na **hata kama mtumiaji anafuta ruhusa** kwa programu mbaya kufikia data zake, **RT kadhaa zitabaki kuwa halali.**
|
||||
Mara tu umepata **RT halali** unaweza kujaribu **kuitumia vibaya ili kuunda AT/RT kadhaa** na **hata kama mtumiaji anafuta ruhusa** kwa programu mbaya kufikia data zake, **RT kadhaa bado zitakuwa halali.**
|
||||
|
||||
## **RC katika WebSockets**
|
||||
|
||||
|
|
@ -398,8 +404,8 @@ Katika [**WS\_RaceCondition\_PoC**](https://github.com/redrays-io/WS\_RaceCondit
|
|||
* [https://portswigger.net/web-security/race-conditions](https://portswigger.net/web-security/race-conditions)
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
@ -415,7 +421,7 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
<figure><img src="../.gitbook/assets/image (48).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_term=trickest&utm_content=race-condition) kujenga na **kujiendesha kiotomatiki** kazi zinazotolewa na zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm\_source=hacktricks\&utm\_medium=text\&utm\_campaign=ppc\&utm\_term=trickest\&utm\_content=race-condition) kujenga na **kujiendesha kiotomatiki** kazi zinazotolewa na zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Pata Ufikiaji Leo:
|
||||
|
||||
{% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=race-condition" %}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue