From 763b4e675a1bf3c05c3ac5a46b60a67cbb49b9d5 Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 12 Nov 2024 12:24:02 +0000 Subject: [PATCH] Translated ['pentesting-web/parameter-pollution.md'] to it --- SUMMARY.md | 2 +- pentesting-web/parameter-pollution.md | 133 +++++++++++++++++++++----- 2 files changed, 110 insertions(+), 25 deletions(-) diff --git a/SUMMARY.md b/SUMMARY.md index 60279767a..0103b2fa9 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -604,7 +604,7 @@ * [OAuth to Account takeover](pentesting-web/oauth-to-account-takeover.md) * [Open Redirect](pentesting-web/open-redirect.md) * [ORM Injection](pentesting-web/orm-injection.md) -* [Parameter Pollution](pentesting-web/parameter-pollution.md) +* [Parameter Pollution | JSON Injection](pentesting-web/parameter-pollution.md) * [Phone Number Injections](pentesting-web/phone-number-injections.md) * [PostMessage Vulnerabilities](pentesting-web/postmessage-vulnerabilities/README.md) * [Blocking main page to steal postmessage](pentesting-web/postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.md) diff --git a/pentesting-web/parameter-pollution.md b/pentesting-web/parameter-pollution.md index 0403e8489..04660c9e4 100644 --- a/pentesting-web/parameter-pollution.md +++ b/pentesting-web/parameter-pollution.md @@ -1,18 +1,18 @@ -# Inquinamento dei Parametri +# Parameter Pollution | JSON Injection -## Inquinamento dei Parametri +## Parameter Pollution {% hint style="success" %} -Impara e pratica Hacking AWS:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Impara e pratica Hacking GCP: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
-Supporta HackTricks +Support HackTricks -* Controlla i [**piani di abbonamento**](https://github.com/sponsors/carlospolop)! -* **Unisciti al** 💬 [**gruppo Discord**](https://discord.gg/hRep4RUj7f) o al [**gruppo telegram**](https://t.me/peass) o **seguici** su **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** -* **Condividi trucchi di hacking inviando PR ai** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos su github. +* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! +* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** +* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} @@ -21,11 +21,11 @@ Impara e pratica Hacking GCP:

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*llG22MF1gPTYZYFVCmCiVw.jpeg

1. POST RequestMapping == PostMapping & GET RequestMapping == GetMapping. -2. POST RequestMapping & PostMapping riconoscono name[]. -3. Preferisce name se name e name[] esistono. +2. POST RequestMapping & PostMapping riconoscono name\[]. +3. Preferisce name se name E name\[] esistono. 4. Concatenare i parametri e.g. first,last. 5. POST RequestMapping & PostMapping riconoscono i parametri di query con Content-Type. @@ -134,19 +134,104 @@ I risultati sono stati presi da [https://medium.com/@0xAwali/http-parameter-poll 1. NON riconosce name[]. 2. Preferisce l'ultimo parametro. +## JSON Injection + +### Chiavi duplicate +```ini +obj = {"test": "user", "test": "admin"} +``` +Il front-end potrebbe credere alla prima occorrenza mentre il backend utilizza la seconda occorrenza della chiave. + +### Collisione di Chiavi: Troncamento dei Caratteri e Commenti + +Alcaratteri non verranno interpretati correttamente dal frontend, ma il backend li interpreterà e utilizzerà quelle chiavi, questo potrebbe essere utile per **bypassare certe restrizioni**: +```json +{"test": 1, "test\[raw \x0d byte]": 2} +{"test": 1, "test\ud800": 2} +{"test": 1, "test"": 2} +{"test": 1, "te\st": 2} +``` +Nota come in questi casi il front end potrebbe pensare che `test == 1` e il backend penserà che `test == 2`. + +Questo può anche essere usato per bypassare le restrizioni sui valori come: +```json +{"role": "administrator\[raw \x0d byte]"} +{"role":"administrator\ud800"} +{"role": "administrator""} +{"role": "admini\strator"} +``` +### **Utilizzo della Troncatura dei Commenti** + +{% code overflow="wrap" %} +```ini +obj = {"description": "Duplicate with comments", "test": 2, "extra": /*, "test": 1, "extra2": */} +``` +{% endcode %} + +Qui utilizzeremo il serializer di ciascun parser per visualizzare il rispettivo output. + +Serializer 1 (ad esempio, la libreria GoJay di GoLang) produrrà: + +* `description = "Duplicate with comments"` +* `test = 2` +* `extra = ""` + +Serializer 2 (ad esempio, la libreria JSON-iterator di Java) produrrà: + +* `description = "Duplicate with comments"` +* `extra = "/*"` +* `extra2 = "*/"` +* `test = 1` + +In alternativa, l'uso diretto dei commenti può essere altrettanto efficace: +```ini +obj = {"description": "Comment support", "test": 1, "extra": "a"/*, "test": 2, "extra2": "b"*/} +``` +La libreria GSON di Java: +```json +{"description":"Comment support","test":1,"extra":"a"} +``` +La libreria simdjson di Ruby: +```json +{"description":"Comment support","test":2,"extra":"a","extra2":"b"} +``` +### **Precedenza Incoerente: Deserializzazione vs. Serializzazione** +```ini +obj = {"test": 1, "test": 2} + +obj["test"] // 1 +obj.toString() // {"test": 2} +``` +### Float e Intero + +Il numero +```undefined +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +``` +può essere decodificato in più rappresentazioni, inclusi: +```undefined +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +9.999999999999999e95 +1E+96 +0 +9223372036854775807 +``` +Which might create inconsistences + ## Riferimenti * [https://medium.com/@shahjerry33/http-parameter-pollution-its-contaminated-85edc0805654](https://medium.com/@shahjerry33/http-parameter-pollution-its-contaminated-85edc0805654) * [https://github.com/google/google-ctf/tree/master/2023/web-under-construction/solution](https://github.com/google/google-ctf/tree/master/2023/web-under-construction/solution) * [https://medium.com/@0xAwali/http-parameter-pollution-in-2024-32ec1b810f89](https://medium.com/@0xAwali/http-parameter-pollution-in-2024-32ec1b810f89) +* [https://bishopfox.com/blog/json-interoperability-vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities)
{% embed url="https://websec.nl/" %} {% hint style="success" %} -Impara e pratica Hacking AWS:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -Impara e pratica Hacking GCP: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
@@ -154,7 +239,7 @@ Impara e pratica Hacking GCP: {% endhint %}