From a78eefaa44ce21771a7dff8e4651fd7a5ebaa7ee Mon Sep 17 00:00:00 2001 From: CPol Date: Tue, 16 Apr 2024 03:52:03 +0000 Subject: [PATCH] GITBOOK-4312: No subject --- SUMMARY.md | 2 +- .../privilege-escalation/README.md | 2 +- .../pentesting-web/README.md | 1 + .../pentesting-web/web-api-pentesting.md | 3 +- .../README.md | 4 + pentesting-web/hacking-jwt-json-web-tokens.md | 2 +- todo/online-platforms-with-api.md | 91 ++++++++++--------- 7 files changed, 56 insertions(+), 49 deletions(-) diff --git a/SUMMARY.md b/SUMMARY.md index eb12c8af2..de7a8f844 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -49,7 +49,7 @@ * [Specific Software/File-Type Tricks](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/README.md) * [Decompile compiled python binaries (exe, elf) - Retreive from .pyc](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md) * [Browser Artifacts](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.md) - * [Desofuscation vbs (cscript.exe)](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/desofuscation-vbs-cscript.exe.md) + * [Deofuscation vbs (cscript.exe)](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/desofuscation-vbs-cscript.exe.md) * [Local Cloud Storage](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.md) * [Office file analysis](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/office-file-analysis.md) * [PDF File analysis](generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.md) diff --git a/linux-hardening/privilege-escalation/README.md b/linux-hardening/privilege-escalation/README.md index f732bffb6..a3101c8e0 100644 --- a/linux-hardening/privilege-escalation/README.md +++ b/linux-hardening/privilege-escalation/README.md @@ -1500,7 +1500,7 @@ find / -type f -iname ".*" -ls 2>/dev/null ```bash for d in `echo $PATH | tr ":" "\n"`; do find $d -name "*.sh" 2>/dev/null; done -for d in `echo $PATH | tr ":" "\n"`; do find $d -type -f -executable 2>/dev/null; done +for d in `echo $PATH | tr ":" "\n"`; do find $d -type f -executable 2>/dev/null; done ``` ### **Web files** diff --git a/network-services-pentesting/pentesting-web/README.md b/network-services-pentesting/pentesting-web/README.md index acbaa6fa3..895cb29d5 100644 --- a/network-services-pentesting/pentesting-web/README.md +++ b/network-services-pentesting/pentesting-web/README.md @@ -254,6 +254,7 @@ Launch some kind of **spider** inside the web. The goal of the spider is to **fi * [**SpiderSuite**](https://github.com/3nock/SpiderSuite): Spider Suite is an advance multi-feature GUI web security Crawler/Spider designed for cyber security professionals. * [**jsluice**](https://github.com/BishopFox/jsluice) (go): It's a Go package and [command-line tool](https://github.com/BishopFox/jsluice/blob/main/cmd/jsluice) for extracting URLs, paths, secrets, and other interesting data from JavaScript source code. * [**ParaForge**](https://github.com/Anof-cyber/ParaForge): ParaForge is a simple **Burp Suite extension** to **extract the paramters and endpoints** from the request to create custom wordlist for fuzzing and enumeration. +* [**katana**](https://github.com/projectdiscovery/katana) (go): Awesome tool for this. ### Brute Force directories and files diff --git a/network-services-pentesting/pentesting-web/web-api-pentesting.md b/network-services-pentesting/pentesting-web/web-api-pentesting.md index 9f7bbcf67..8e7e2491e 100644 --- a/network-services-pentesting/pentesting-web/web-api-pentesting.md +++ b/network-services-pentesting/pentesting-web/web-api-pentesting.md @@ -49,7 +49,7 @@ Pentesting APIs involves a structured approach to uncovering vulnerabilities. Th ### **Tools and Resources for API Pentesting** -* **kiterunner**: Excellent for discovering API endpoints. Use it to scan and brute force paths and parameters against target APIs. +* [**kiterunner**](https://github.com/assetnote/kiterunner): Excellent for discovering API endpoints. Use it to scan and brute force paths and parameters against target APIs. ```bash kr scan https://domain.com/api/ -w routes-large.kite -x 20 @@ -59,6 +59,7 @@ kr brute https://domain.com/api/ -w /tmp/lang-english.txt -x 20 -d=0 ``` * Additional tools like **automatic-api-attack-tool**, **Astra**, and **restler-fuzzer** offer tailored functionalities for API security testing, ranging from attack simulation to fuzzing and vulnerability scanning. +* [**Cherrybomb**](https://github.com/blst-security/cherrybomb): It's an API security tool that audit your API based on an OAS file(the tool written in rust). ### **Learning and Practice Resources** diff --git a/pentesting-web/content-security-policy-csp-bypass/README.md b/pentesting-web/content-security-policy-csp-bypass/README.md index 7b0614067..c10f71e96 100644 --- a/pentesting-web/content-security-policy-csp-bypass/README.md +++ b/pentesting-web/content-security-policy-csp-bypass/README.md @@ -150,6 +150,10 @@ Working payload: `"/>` ### 'unsafe-eval' +{% hint style="danger" %} +This is not working, for more info [**check this**](https://github.com/HackTricks-wiki/hacktricks/issues/653). +{% endhint %} + ```yaml Content-Security-Policy: script-src https://google.com 'unsafe-eval'; ``` diff --git a/pentesting-web/hacking-jwt-json-web-tokens.md b/pentesting-web/hacking-jwt-json-web-tokens.md index c057ec09f..b84d318d4 100644 --- a/pentesting-web/hacking-jwt-json-web-tokens.md +++ b/pentesting-web/hacking-jwt-json-web-tokens.md @@ -70,7 +70,7 @@ Check if the token lasts more than 24h... maybe it never expires. If there is a [**See this page.**](../generic-methodologies-and-resources/brute-force.md#jwt) -### Modify the algorithm to None (CVE-2015-9235) +### Modify the algorithm to None Set the algorithm used as "None" and remove the signature part. diff --git a/todo/online-platforms-with-api.md b/todo/online-platforms-with-api.md index 67fcb7e7a..04b333848 100644 --- a/todo/online-platforms-with-api.md +++ b/todo/online-platforms-with-api.md @@ -1,4 +1,4 @@ - +# Online Platforms with API
@@ -9,132 +9,135 @@ Other ways to support HackTricks: * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) -* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.** +* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
- -# [ProjectHoneypot](https://www.projecthoneypot.org/) +## [ProjectHoneypot](https://www.projecthoneypot.org/) You can ask if an IP is related to suspicious/malicious activities. Completely free. -# [**BotScout**](http://botscout.com/api.htm) +## [**BotScout**](http://botscout.com/api.htm) Check if the IP address is related to a bot that register accounts. It can also check usernames and emails. Initially free. -# [Hunter](https://hunter.io/) +## [Hunter](https://hunter.io/) -Find and verify emails. -Some free API requests free, for more you need to pay. +Find and verify emails.\ +Some free API requests free, for more you need to pay.\ Commercial? -# [AlientVault](https://otx.alienvault.com/api) +## [AlientVault](https://otx.alienvault.com/api) Find Malicious activities related to IPs and Domains. Free. -# [Clearbit](https://dashboard.clearbit.com/) +## [Clearbit](https://dashboard.clearbit.com/) -Find related personal data to a email \(profiles on other platforms\), domain \(basic company info ,mails and people working\) and companies \(get company info from mail\). -You need to pay to access all the possibilities. +Find related personal data to a email (profiles on other platforms), domain (basic company info ,mails and people working) and companies (get company info from mail).\ +You need to pay to access all the possibilities.\ Commercial? -# [BuiltWith](https://builtwith.com/) +## [BuiltWith](https://builtwith.com/) -Technologies used by webs. Expensive... +Technologies used by webs. Expensive...\ Commercial? -# [Fraudguard](https://fraudguard.io/) +## [Fraudguard](https://fraudguard.io/) -Check if a host \(domain or IP\) is related with suspicious/malicious activities. Have some free API access. +Check if a host (domain or IP) is related with suspicious/malicious activities. Have some free API access.\ Commercial? -# [FortiGuard](https://fortiguard.com/) +## [FortiGuard](https://fortiguard.com/) -Check if a host \(domain or IP\) is related with suspicious/malicious activities. Have some free API access. +Check if a host (domain or IP) is related with suspicious/malicious activities. Have some free API access. -# [SpamCop](https://www.spamcop.net/) +## [SpamCop](https://www.spamcop.net/) Indicates if host is related to spam activity. Have some free API access. -# [mywot](https://www.mywot.com/) +## [mywot](https://www.mywot.com/) Based on opinions and other metrics get if a domain is related with suspicious/malicious information. -# [ipinfo](https://ipinfo.io/) +## [ipinfo](https://ipinfo.io/) Obtains basic info from an IP address. You can test up to 100K/month. -# [securitytrails](https://securitytrails.com/app/account) +## [securitytrails](https://securitytrails.com/app/account) -This platform give information about domains and IP addresses like domains inside an IP or inside a domain server, domains owned by an email \(find related domains\), IP history of domains \(find the host behind CloudFlare\), all domains using a nameserver.... +This platform give information about domains and IP addresses like domains inside an IP or inside a domain server, domains owned by an email (find related domains), IP history of domains (find the host behind CloudFlare), all domains using a nameserver....\ You have some free access. -# [fullcontact](https://www.fullcontact.com/) +## [fullcontact](https://www.fullcontact.com/) Allows to search by email, domain or company name and retrieve "personal" information related. It can also verify emails. There is some free access. -# [RiskIQ](https://www.spiderfoot.net/documentation/) +## [RiskIQ](https://www.spiderfoot.net/documentation/) A lot of information from domains and IPs even in the free/community version. -# [\_IntelligenceX](https://intelx.io/) +## [\_IntelligenceX](https://intelx.io/) Search Domains, IPs and emails and get info from dumps. Have some free access. -# [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) +## [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) Search by IP and gather information related to suspicions activities. There is some free access. -# [Greynoise](https://viz.greynoise.io/) +## [Greynoise](https://viz.greynoise.io/) Search by IP or IP range and get information about IPs scanning the Internet. 15 days free access. -# [Shodan](https://www.shodan.io/) +## [Shodan](https://www.shodan.io/) Get scan information of an IP address. Have some free api access. -# [Censys](https://censys.io/) +## [Censys](https://censys.io/) Very similar to shodan -# [buckets.grayhatwarfare.com](https://buckets.grayhatwarfare.com/) +## [buckets.grayhatwarfare.com](https://buckets.grayhatwarfare.com/) Find open S3 buckets searching by keyword. -# [Dehashed](https://www.dehashed.com/data) +## [Dehashed](https://www.dehashed.com/data) -Find leaked credentials of emails and even domains +Find leaked credentials of emails and even domains\ Commercial? -# [psbdmp](https://psbdmp.ws/) +## [psbdmp](https://psbdmp.ws/) Search pastebins where a email appeared. Commercial? -# [emailrep.io](https://emailrep.io/key) +## [emailrep.io](https://emailrep.io/key) Get reputation of a mail. Commercial? -# [ghostproject](https://ghostproject.fr/) +## [ghostproject](https://ghostproject.fr/) Get passwords from leaked emails. Commercial? -# [Binaryedge](https://www.binaryedge.io/) +## [Binaryedge](https://www.binaryedge.io/) Obtain interesting info from IPs -# [haveibeenpwned](https://haveibeenpwned.com/) +## [haveibeenpwned](https://haveibeenpwned.com/) Search by domain and email and get if it was pwned and passwords. Commercial? -[https://dnsdumpster.com/](https://dnsdumpster.com/)\(in a commercial tool?\) +### [IP2Location.io](https://www.ip2location.io/) -[https://www.netcraft.com/](https://www.netcraft.com/) \(in a commercial tool?\) - -[https://www.nmmapper.com/sys/tools/subdomainfinder/](https://www.nmmapper.com/) \(in a commercial tool?\) +It detects IP geolocation, data center, ASN and even VPN information. It offers free 30K queries per month. +[https://dnsdumpster.com/](https://dnsdumpster.com/)(in a commercial tool?) + +[https://www.netcraft.com/](https://www.netcraft.com/) (in a commercial tool?) + +[https://www.nmmapper.com/sys/tools/subdomainfinder/](https://www.nmmapper.com/) (in a commercial tool?) +
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)! @@ -144,9 +147,7 @@ Other ways to support HackTricks: * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) -* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.** +* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
- -