mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 22:52:06 +00:00
Translated ['pentesting-web/grpc-web-pentest.md'] to es
This commit is contained in:
Translator
parent
a78f8176ac
commit
8c04bb20c3
1 changed files with 155 additions and 0 deletions
155
pentesting-web/grpc-web-pentest.md
Normal file
155
pentesting-web/grpc-web-pentest.md
Normal file
|
|
@ -0,0 +1,155 @@
|
||||||
|
# Pentesting gRPC-Web
|
||||||
|
|
||||||
|
<details>
|
||||||
|
|
||||||
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||||
|
|
||||||
|
* ¿Trabajas en una **empresa de ciberseguridad**? ¿Quieres ver tu **empresa anunciada en HackTricks**? o ¿quieres acceder a la **última versión de PEASS o descargar HackTricks en PDF**? Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop).
|
||||||
|
* Descubre [**La Familia PEASS**](https://opensea.io/collection/the-peass-family), nuestra colección de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos.
|
||||||
|
* Consigue el [**merchandising oficial de PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||||
|
* **Únete al** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de Telegram**](https://t.me/peass) o **sígueme** en **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||||
|
* **Comparte tus trucos de hacking enviando PRs al** [**repositorio de hacktricks**](https://github.com/carlospolop/hacktricks) **y al** [**repositorio de hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
## **Manipulación de Cargas Útiles de gRPC-Web**
|
||||||
|
gRPC-Web utiliza Content-Type: `application/grpc-web-text` en las solicitudes, que es una especie de protobuf en forma codificada en base64, puedes usar la herramienta [gprc-coder](https://github.com/nxenon/grpc-pentest-suite), y también puedes instalar su [Extensión de Burp Suite](https://github.com/nxenon/grpc-pentest-suite).
|
||||||
|
|
||||||
|
### **Manual con la Herramienta gGRPC Coder**
|
||||||
|
1. Primero decodifica la carga útil:
|
||||||
|
```bash
|
||||||
|
echo "AAAAABYSC0FtaW4gTmFzaXJpGDY6BVhlbm9u" | python3 grpc-coder.py --decode --type grpc-web-text | protoscope > out.txt
|
||||||
|
```
|
||||||
|
2. Edita el contenido del payload decodificado
|
||||||
|
```
|
||||||
|
nano out.txt
|
||||||
|
2: {"Amin Nasiri Xenon GRPC"}
|
||||||
|
3: 54
|
||||||
|
7: {"<script>alert(origin)</script>"}
|
||||||
|
```
|
||||||
|
3. Codifica el nuevo payload
|
||||||
|
```bash
|
||||||
|
protoscope -s out.txt | python3 grpc-coder.py --encode --type grpc-web-text
|
||||||
|
```
|
||||||
|
4. Utilice la salida en el interceptor de Burp:
|
||||||
|
```
|
||||||
|
AAAAADoSFkFtaW4gTmFzaXJpIFhlbm9uIEdSUEMYNjoePHNjcmlwdD5hbGVydChvcmlnaW4pPC9zY3JpcHQ+
|
||||||
|
```
|
||||||
|
### **Manual con la Extensión gRPC-Web Coder para Burp Suite**
|
||||||
|
Puedes utilizar la Extensión gRPC-Web Coder para Burp Suite en [gRPC-Web Pentest Suite](https://github.com/nxenon/grpc-pentest-suite) que es más fácil. Puedes leer las instrucciones de instalación y uso en su repositorio.
|
||||||
|
|
||||||
|
## **Análisis de Archivos Javascript gRPC-Web**
|
||||||
|
Hay al menos un archivo Javascript en cada aplicación gRPC-Web. Puedes analizar el archivo para encontrar nuevos mensajes, endpoints y servicios. Intenta usar la herramienta [gRPC-Scan](https://github.com/nxenon/grpc-pentest-suite).
|
||||||
|
1. Descarga el Archivo Javascript gRPC-Web
|
||||||
|
2. Escanéalo con grpc-scan.py:
|
||||||
|
```bash
|
||||||
|
python3 grpc-scan.py --file main.js
|
||||||
|
```
|
||||||
|
3. Analice la salida y pruebe los nuevos endpoints y servicios:
|
||||||
|
```
|
||||||
|
Output:
|
||||||
|
Found Endpoints:
|
||||||
|
/grpc.gateway.testing.EchoService/Echo
|
||||||
|
/grpc.gateway.testing.EchoService/EchoAbort
|
||||||
|
/grpc.gateway.testing.EchoService/NoOp
|
||||||
|
/grpc.gateway.testing.EchoService/ServerStreamingEcho
|
||||||
|
/grpc.gateway.testing.EchoService/ServerStreamingEchoAbort
|
||||||
|
|
||||||
|
Found Messages:
|
||||||
|
|
||||||
|
grpc.gateway.testing.EchoRequest:
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Field Name | Field Type | Field Number |
|
||||||
|
+============+====================+==============+
|
||||||
|
| Message | Proto3StringField | 1 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Name | Proto3StringField | 2 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Age | Proto3IntField | 3 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| IsAdmin | Proto3BooleanField | 4 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Weight | Proto3FloatField | 5 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Test | Proto3StringField | 6 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Test2 | Proto3StringField | 7 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Test3 | Proto3StringField | 16 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
| Test4 | Proto3StringField | 20 |
|
||||||
|
+------------+--------------------+--------------+
|
||||||
|
|
||||||
|
grpc.gateway.testing.EchoResponse:
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Field Name | Field Type | Field Number |
|
||||||
|
+==============+====================+==============+
|
||||||
|
| Message | Proto3StringField | 1 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Name | Proto3StringField | 2 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Age | Proto3IntField | 3 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| IsAdmin | Proto3BooleanField | 4 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Weight | Proto3FloatField | 5 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Test | Proto3StringField | 6 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Test2 | Proto3StringField | 7 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Test3 | Proto3StringField | 16 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| Test4 | Proto3StringField | 20 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
| MessageCount | Proto3IntField | 8 |
|
||||||
|
+--------------+--------------------+--------------+
|
||||||
|
|
||||||
|
grpc.gateway.testing.ServerStreamingEchoRequest:
|
||||||
|
+-----------------+-------------------+--------------+
|
||||||
|
| Field Name | Field Type | Field Number |
|
||||||
|
+=================+===================+==============+
|
||||||
|
| Message | Proto3StringField | 1 |
|
||||||
|
+-----------------+-------------------+--------------+
|
||||||
|
| MessageCount | Proto3IntField | 2 |
|
||||||
|
+-----------------+-------------------+--------------+
|
||||||
|
| MessageInterval | Proto3IntField | 3 |
|
||||||
|
+-----------------+-------------------+--------------+
|
||||||
|
|
||||||
|
grpc.gateway.testing.ServerStreamingEchoResponse:
|
||||||
|
+------------+-------------------+--------------+
|
||||||
|
| Field Name | Field Type | Field Number |
|
||||||
|
+============+===================+==============+
|
||||||
|
| Message | Proto3StringField | 1 |
|
||||||
|
+------------+-------------------+--------------+
|
||||||
|
|
||||||
|
grpc.gateway.testing.ClientStreamingEchoRequest:
|
||||||
|
+------------+-------------------+--------------+
|
||||||
|
| Field Name | Field Type | Field Number |
|
||||||
|
+============+===================+==============+
|
||||||
|
| Message | Proto3StringField | 1 |
|
||||||
|
+------------+-------------------+--------------+
|
||||||
|
|
||||||
|
grpc.gateway.testing.ClientStreamingEchoResponse:
|
||||||
|
+--------------+----------------+--------------+
|
||||||
|
| Field Name | Field Type | Field Number |
|
||||||
|
+==============+================+==============+
|
||||||
|
| MessageCount | Proto3IntField | 1 |
|
||||||
|
+--------------+----------------+--------------+
|
||||||
|
```
|
||||||
|
## Referencias
|
||||||
|
|
||||||
|
* [Artículo Hacking into gRPC-Web por Amin Nasiri](https://infosecwriteups.com/hacking-into-grpc-web-a54053757a45)
|
||||||
|
* [Suite de Pentest gRPC-Web](https://github.com/nxenon/grpc-pentest-suite)
|
||||||
|
|
||||||
|
<details>
|
||||||
|
|
||||||
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||||
|
|
||||||
|
* ¿Trabajas en una **empresa de ciberseguridad**? ¿Quieres ver tu **empresa anunciada en HackTricks**? o ¿quieres acceder a la **última versión de PEASS o descargar HackTricks en PDF**? Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
||||||
|
* Descubre [**La Familia PEASS**](https://opensea.io/collection/the-peass-family), nuestra colección de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos
|
||||||
|
* Consigue el [**merchandising oficial de PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||||
|
* **Únete al** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **sígueme** en **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||||
|
* **Comparte tus trucos de hacking enviando PRs al** [**repositorio de hacktricks**](https://github.com/carlospolop/hacktricks) **y al** [**repositorio de hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||||
|
|
||||||
|
</details>
|
||||||
Loading…
Reference in a new issue