mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-21 20:23:18 +00:00
GITBOOK-4347: No subject
This commit is contained in:
CPol
gitbook-bot
parent
eeb6f9cea4
commit
9f006fd993
11 changed files with 176 additions and 9 deletions
|
|
@ -637,6 +637,7 @@
|
|||
* [Reverse Tab Nabbing](pentesting-web/reverse-tab-nabbing.md)
|
||||
* [Unicode Injection](pentesting-web/unicode-injection/README.md)
|
||||
* [Unicode Normalization](pentesting-web/unicode-injection/unicode-normalization.md)
|
||||
* [UUID Insecurities](pentesting-web/uuid-insecurities.md)
|
||||
* [WebSocket Attacks](pentesting-web/websocket-attacks.md)
|
||||
* [Web Tool - WFuzz](pentesting-web/web-tool-wfuzz.md)
|
||||
* [XPATH injection](pentesting-web/xpath-injection.md)
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
@ -29,6 +29,7 @@ A note about **PCAP** vs **PCAPNG**: there are two versions of the PCAP file for
|
|||
* If the header of your pcap is **broken** you should try to **fix** it using: [http://f00l.de/hacking/**pcapfix.php**](http://f00l.de/hacking/pcapfix.php)
|
||||
* Extract **information** and search for **malware** inside a pcap in [**PacketTotal**](https://packettotal.com)
|
||||
* Search for **malicious activity** using [**www.virustotal.com**](https://www.virustotal.com) and [**www.hybrid-analysis.com**](https://www.hybrid-analysis.com)
|
||||
* **Full pcap analysis from the browser in** [**https://apackets.com/**](https://apackets.com/)
|
||||
|
||||
## Extract Information
|
||||
|
||||
|
|
@ -46,6 +47,10 @@ You can find some Wireshark tricks in:
|
|||
[wireshark-tricks.md](wireshark-tricks.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### [**https://apackets.com/**](https://apackets.com/)
|
||||
|
||||
Pcap analysis from the browser.
|
||||
|
||||
### Xplico Framework
|
||||
|
||||
[**Xplico** ](https://github.com/xplico/xplico)_(only linux)_ can **analyze** a **pcap** and extract information from it. For example, from a pcap file Xplico, extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on.
|
||||
|
|
@ -266,7 +271,7 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -169,6 +169,10 @@ x64:
|
|||
| **6th argument** | **r9** | **4th argument to the method** |
|
||||
| **7th+ argument** | <p><strong>rsp+</strong><br><strong>(on the stack)</strong></p> | **5th+ argument to the method** |
|
||||
|
||||
### Dynadump
|
||||
|
||||
[**Dynadump**](https://github.com/DerekSelander/dynadump) is a tool to get Objc-Classes from dylibs.
|
||||
|
||||
### Swift
|
||||
|
||||
With Swift binaries, since there is Objective-C compatibility, sometimes you can extract declarations using [class-dump](https://github.com/nygard/class-dump/) but not always.
|
||||
|
|
|
|||
|
|
@ -52,7 +52,7 @@ Sometimes it is interesting to **modify the application code** to access **hidde
|
|||
## Other interesting tricks
|
||||
|
||||
* [Spoofing your location in Play Store](spoofing-your-location-in-play-store.md)
|
||||
* **Download APKs**: [https://apps.evozi.com/apk-downloader/](https://apps.evozi.com/apk-downloader/), [https://apkpure.com/es/](https://apkpure.com/es/), [https://www.apkmirror.com/](https://www.apkmirror.com), [https://apkcombo.com/es-es/apk-downloader/](https://apkcombo.com/es-es/apk-downloader/)
|
||||
* **Download APKs**: [https://apps.evozi.com/apk-downloader/](https://apps.evozi.com/apk-downloader/), [https://apkpure.com/es/](https://apkpure.com/es/), [https://www.apkmirror.com/](https://www.apkmirror.com), [https://apkcombo.com/es-es/apk-downloader/](https://apkcombo.com/es-es/apk-downloader/), [https://github.com/kiber-io/apkd](https://github.com/kiber-io/apkd)
|
||||
* Extract APK from device:
|
||||
|
||||
```bash
|
||||
|
|
@ -64,7 +64,9 @@ package:/data/app/com.android.insecurebankv2-Jnf8pNgwy3QA_U5f-n_4jQ==/base.apk
|
|||
|
||||
adb pull /data/app/com.android.insecurebankv2-Jnf8pNgwy3QA_U5f-n_4jQ==/base.apk
|
||||
```
|
||||
|
||||
* Merge all splits and base apks with [APKEditor](https://github.com/REAndroid/APKEditor):
|
||||
|
||||
```bash
|
||||
mkdir splits
|
||||
adb shell pm path com.android.insecurebankv2 | cut -d ':' -f 1 | xargs -n1 -i adb pull {} splits
|
||||
|
|
|
|||
|
|
@ -24,9 +24,18 @@ The email of an account should be attempted to be changed, and the confirmation
|
|||
2. An account should be created using Unicode\
|
||||
for example: `vićtim@gmail.com`
|
||||
|
||||
As explained in [**this talk**](https://www.youtube.com/watch?v=CiIyaZ3x49c), the previous attack could also be done abusing third party identity providers:
|
||||
|
||||
* Create an account in the third party identity with similar email to the victim using some unicode character (`vićtim@company.com`).
|
||||
* The third party provider shouldn't verify the email
|
||||
* If the identity provider verifies the email, maybe you can attack the domain part like: `victim@ćompany.com` and register that domain and hope that the identity provider generates the ascii version of the domain while the victim platform normalize the domain name.
|
||||
* Login via this identity provider in the victim platform who should normalize the unicode character and allow you to access the victim account.
|
||||
|
||||
For further details, refer to the document on Unicode Normalization:
|
||||
|
||||
{% content-ref url="unicode-injection/unicode-normalization.md" %}
|
||||
[unicode-normalization.md](unicode-injection/unicode-normalization.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## **Reusing Reset Token**
|
||||
|
||||
|
|
@ -40,7 +49,7 @@ Should the target system allow the **reset link to be reused**, efforts should b
|
|||
|
||||
## **CORS Misconfiguration to Account Takeover**
|
||||
|
||||
If the page contains **CORS missconfigurations** you might be able to **steal sensitive information** from the user to **takeover his account** or make him change auth information for the same purpose:
|
||||
If the page contains **CORS misconfigurations** you might be able to **steal sensitive information** from the user to **takeover his account** or make him change auth information for the same purpose:
|
||||
|
||||
{% content-ref url="cors-bypass.md" %}
|
||||
[cors-bypass.md](cors-bypass.md)
|
||||
|
|
@ -56,7 +65,7 @@ If the page is vulnerable to CSRF you might be able to make the **user modify hi
|
|||
|
||||
## **XSS to Account Takeover**
|
||||
|
||||
If you find a XSS in application you might be able to stal cookies, local storage, or info from the web page that could allow you takeover the account:
|
||||
If you find a XSS in application you might be able to steal cookies, local storage, or info from the web page that could allow you takeover the account:
|
||||
|
||||
{% content-ref url="xss-cross-site-scripting/" %}
|
||||
[xss-cross-site-scripting](xss-cross-site-scripting/)
|
||||
|
|
@ -114,6 +123,11 @@ From [this report](https://dynnyd20.medium.com/one-click-account-take-over-e5009
|
|||
|
||||
This also happened in [**this report**](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea).
|
||||
|
||||
### Old Cookies
|
||||
|
||||
As explained [**in this post**](https://medium.com/@niraj1mahajan/uncovering-the-hidden-vulnerability-how-i-found-an-authentication-bypass-on-shopifys-exchange-cc2729ea31a9), it was possible to login into an account, save the cookies as an authenticated user, logout, and then login again.\
|
||||
With the new login, although different cookies might be generated the old ones became to work again.
|
||||
|
||||
## References
|
||||
|
||||
* [https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050](https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050)
|
||||
|
|
|
|||
|
|
@ -710,6 +710,10 @@ Stay informed with the newest bug bounties launching and crucial platform update
|
|||
|
||||
## Unsafe Technologies to Bypass CSP
|
||||
|
||||
### PHP Errors when too many params
|
||||
|
||||
According to the [**last technique commented in this video**](https://www.youtube.com/watch?v=Sm4G6cAHjWM), sending too many parameters (1001 GET parameters although you can also do it with POST params and more that 20 files). Any defined **`header()`** in the PHP web code **won't be sent** because of the error that this will trigger.
|
||||
|
||||
### PHP response buffer overload
|
||||
|
||||
PHP is known for **buffering the response to 4096** bytes by default. Therefore, if PHP is showing a warning, by providing **enough data inside warnings**, the **response** will be **sent** **before** the **CSP header**, causing the header to be ignored.\
|
||||
|
|
|
|||
|
|
@ -863,6 +863,45 @@ puts Base64.encode64(payload)
|
|||
|
||||
Other RCE chain to exploit Ruby On Rails: [https://codeclimate.com/blog/rails-remote-code-execution-vulnerability-explained/](https://codeclimate.com/blog/rails-remote-code-execution-vulnerability-explained/)
|
||||
|
||||
### Ruby .send() method
|
||||
|
||||
As explained in [**this vulnerability report**](https://starlabs.sg/blog/2024/04-sending-myself-github-com-environment-variables-and-ghes-shell/), if some user unsanitized input reaches the `.send()` method of a ruby object, this method allows to **invoke any other method** of the object with any parameters.
|
||||
|
||||
For example, calling eval and then ruby code as second parameter will allow to execute arbitrary code:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```ruby
|
||||
<Object>.send('eval', '<user input with Ruby code>') == RCE
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
Moreover, if only one parameter of **`.send()`** is controlled by an attacker, as mentioned in the previous writeup, it's possible to call any method of the object that **doesn't need arguments** or whose arguments have **default values**.\
|
||||
For this, it's possible to enumerate all the methods of the object to **find some interesting methods that fulfil those requirements**.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```ruby
|
||||
<Object>.send('<user_input>')
|
||||
|
||||
# This code is taken from the original blog post
|
||||
# <Object> in this case is Repository
|
||||
## Find methods with those requirements
|
||||
repo = Repository.find(1) # get first repo
|
||||
repo_methods = [ # get names of all methods accessible by Repository object
|
||||
repo.public_methods(),
|
||||
repo.private_methods(),
|
||||
repo.protected_methods(),
|
||||
].flatten()
|
||||
|
||||
repo_methods.length() # Initial number of methods => 5542
|
||||
|
||||
## Filter by the arguments requirements
|
||||
candidate_methods = repo_methods.select() do |method_name|
|
||||
[0, -1].include?(repo.method(method_name).arity())
|
||||
end
|
||||
candidate_methods.length() # Final number of methods=> 3595
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
|
|
|||
|
|
@ -448,6 +448,12 @@ For a detailed understanding of exploiting deserialization vulnerabilities in th
|
|||
[phar-deserialization.md](phar-deserialization.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### CVE-2024-2961
|
||||
|
||||
It was possible to abuse **any arbitrary file read from PHP that supports php filters** to get a RCE. The detailed description can be [**found in this post**](https://www.ambionics.io/blog/iconv-cve-2024-2961-p1)**.**\
|
||||
Very quick summary: a **3 byte overflow** in the PHP heap was abused to **alter the chain of free chunks** of anspecific size in order to be able to **write anything in any address**, so a hook was added to call **`system`**.\
|
||||
It was possible to alloc chunks of specific sizes abusing more php filters.
|
||||
|
||||
### More protocols
|
||||
|
||||
Check more possible[ **protocols to include here**](https://www.php.net/manual/en/wrappers.php)**:**
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
@ -39,12 +39,12 @@ The loop to generate arbitrary content is:
|
|||
|
||||
## How to add also suffixes to the resulting data
|
||||
|
||||
[**This writeup explains**](https://www.ambionics.io/blog/wrapwrap-php-filters-suffix) how you can still abuse PHP filters to add suffixes to the resulting string.
|
||||
[**This writeup explains**](https://www.ambionics.io/blog/wrapwrap-php-filters-suffix) how you can still abuse PHP filters to add suffixes to the resulting string. This is great in case you need the output to have some specific format (like json or maybe adding some PNG magic bytes)
|
||||
|
||||
## Automatic Tools
|
||||
|
||||
* [https://github.com/synacktiv/php\_filter\_chain\_generator](https://github.com/synacktiv/php\_filter\_chain\_generator)
|
||||
* [https://github.com/ambionics/wrapwrap](https://github.com/ambionics/wrapwrap) (can add suffixes)
|
||||
* [**https://github.com/ambionics/wrapwrap**](https://github.com/ambionics/wrapwrap) **(can add suffixes)**
|
||||
|
||||
## Full script
|
||||
|
||||
|
|
@ -282,7 +282,7 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -43,6 +43,8 @@ Then, you can search the request in your proxy or dump the used JWT for that req
|
|||
python3 jwt_tool.py -Q "jwttool_706649b802c9f5e41052062a3787b291"
|
||||
```
|
||||
|
||||
You can also use the [**Burp Extension SignSaboteur**](https://github.com/d0ge/sign-saboteur) to launch JWT attacks from Burp.
|
||||
|
||||
### Tamper data without modifying anything
|
||||
|
||||
You can just tamper with the data leaving the signature as is and check if the server is checking the signature. Try to change your username to "admin" for example.
|
||||
|
|
|
|||
90
pentesting-web/uuid-insecurities.md
Normal file
90
pentesting-web/uuid-insecurities.md
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
# UUID Insecurities
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Other ways to support HackTricks:
|
||||
|
||||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
||||
## Basic Information
|
||||
|
||||
Universally Unique Identifiers (UUIDs) are **128-bit numbers used to uniquely identify information** in computer systems. UUIDs are essential in applications where unique identifiers are necessary without central coordination. They are commonly used as database keys and can refer to various elements like documents and sessions.
|
||||
|
||||
UUIDs are designed to be unique and **hard to guess**. They are structured in a specific format, divided into five groups represented as 32 hexadecimal digits. There are different versions of UUIDs, each serving different purposes:
|
||||
|
||||
* **UUID v1** is time-based, incorporating the timestamp, clock sequence, and node ID (MAC address), but it can potentially expose system information.
|
||||
* **UUID v2** is similar to v1 but includes modifications for local domains (not eidly used).
|
||||
* **UUID v3 and v5** generate UUIDs using hash values from namespace and name, with v3 using MD5 and v5 using SHA-1.
|
||||
* **UUID v4** is generated almost entirely randomly, providing a high level of anonymity but with a slight risk of duplicates.
|
||||
|
||||
{% hint style="success" %}
|
||||
Note that the version and subversion of the UUID usually appears in the same possition inside the UUID. For example in:\
|
||||
12345678 - abcd - 1a56 - a539 - 103755193864\
|
||||
xxxxxxxx - xxxx - Mxxx - Nxxx - xxxxxxxxxxxx
|
||||
|
||||
* The **position of the M** Indicates the UUID **version**. In the example above, it’s UUID v**1**.
|
||||
* The **position of the N** Indicates the UUID variant.
|
||||
{% endhint %}
|
||||
|
||||
## Sandwich attack
|
||||
|
||||
The "Sandwich Attack" is a specific type of attack that **exploits the predictability of UUID v1 generation in web applications**, particularly in features like password resets. UUID v1 is generated based on time, clock sequence, and the node's MAC address, which can make it somewhat predictable if an attacker can obtain some of these UUIDs generated close in time.
|
||||
|
||||
### Example
|
||||
|
||||
Imagine a web application that uses UUID v1 for generating password reset links. Here’s how an attacker might exploit this to gain unauthorized access:
|
||||
|
||||
1. **Initial Setup**:
|
||||
|
||||
* The attacker has control over two email accounts: \`attacker1@acme.com\` and \`attacker2@acme.com\`.
|
||||
* The target's email account is \`victim@acme.com\`.
|
||||
|
||||
2. **Execution**:
|
||||
|
||||
* The attacker triggers a password reset for their first account (\`attacker1@acme.com\`) and receives a password reset link with a UUID, say \`99874128-7592-11e9-8201-bb2f15014a14\`.
|
||||
* Immediately after, the attacker triggers a password reset for the victim's account (\`victim@acme.com\`) and then quickly for the second attacker-controlled account (\`attacker2@acme.com\`).
|
||||
* The attacker receives a reset link for the second account with a UUID, say \`998796b4-7592-11e9-8201-bb2f15014a14\`.
|
||||
|
||||
3. **Analysis**:
|
||||
|
||||
* The attacker now has two UUIDs generated close in time (\`99874128\` and \`998796b4\`). Given the sequential nature of time-based UUIDs, the UUID for the victim's account will likely fall between these two values.
|
||||
|
||||
4. **Brute Force Attack:**
|
||||
|
||||
* The attacker uses a tool to generate UUIDs between these two values and tests each generated UUID by attempting to access the password reset link (e.g., \`https://www.acme.com/reset/\<generated-UUID>\`).
|
||||
* If the web application does not adequately rate limit or block such attempts, the attacker can quickly test all possible UUIDs in the range.
|
||||
|
||||
5. **Access Gained:**
|
||||
|
||||
* Once the correct UUID for the victim's password reset link is discovered, the attacker can reset the victim's password and gain unauthorized access to their account.
|
||||
|
||||
### Tools
|
||||
|
||||
* You can perform the sandwich attack automatically with the tool: [**https://github.com/Lupin-Holmes/sandwich**](https://github.com/Lupin-Holmes/sandwich)
|
||||
* You can detect these type of UUIds in Burp Suite with the extension [**UUID Detector**](https://portswigger.net/bappstore/65f32f209a72480ea5f1a0dac4f38248).
|
||||
|
||||
## References
|
||||
|
||||
* [https://versprite.com/blog/universally-unique-identifiers/](https://versprite.com/blog/universally-unique-identifiers/)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Other ways to support HackTricks:
|
||||
|
||||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
Loading…
Reference in a new issue