From cf545507a7cf0b2f20fed6fc473c6cfefcd4d418 Mon Sep 17 00:00:00 2001 From: Translator Date: Sun, 24 Dec 2023 19:03:32 +0000 Subject: [PATCH] Translated ['pentesting-web/grpc-web-pentest.md'] to pt --- pentesting-web/grpc-web-pentest.md | 155 +++++++++++++++++++++++++++++ 1 file changed, 155 insertions(+) create mode 100644 pentesting-web/grpc-web-pentest.md diff --git a/pentesting-web/grpc-web-pentest.md b/pentesting-web/grpc-web-pentest.md new file mode 100644 index 000000000..8b5a8dcf6 --- /dev/null +++ b/pentesting-web/grpc-web-pentest.md @@ -0,0 +1,155 @@ +# Pentesting gRPC-Web + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥 + +* Você trabalha em uma **empresa de cibersegurança**? Quer ver sua **empresa anunciada no HackTricks**? ou quer ter acesso à **versão mais recente do PEASS ou baixar o HackTricks em PDF**? Confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)! +* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos +* Adquira o [**material oficial do PEASS & HackTricks**](https://peass.creator-spring.com) +* **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo do Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo do telegram**](https://t.me/peass) ou **siga-me** no **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** +* **Compartilhe suas técnicas de hacking enviando PRs para o** [**repositório hacktricks**](https://github.com/carlospolop/hacktricks) **e** [**repositório hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud). + +
+ +## **Manipulando Payloads gRPC-Web** +gRPC-Web usa Content-Type: `application/grpc-web-text` em requisições, que é uma espécie de protobuf em forma codificada em base64, você pode usar a ferramenta [gprc-coder](https://github.com/nxenon/grpc-pentest-suite), e também pode instalar sua [Extensão do Burp Suite](https://github.com/nxenon/grpc-pentest-suite). + +### **Manual com a Ferramenta gGRPC Coder** +1. Primeiro decodifique o payload: +```bash +echo "AAAAABYSC0FtaW4gTmFzaXJpGDY6BVhlbm9u" | python3 grpc-coder.py --decode --type grpc-web-text | protoscope > out.txt +``` +2. Edite o conteúdo do payload decodificado +``` +nano out.txt +2: {"Amin Nasiri Xenon GRPC"} +3: 54 +7: {""} +``` +3. Codifique o novo payload +```bash +protoscope -s out.txt | python3 grpc-coder.py --encode --type grpc-web-text +``` +4. Utilize a saída no interceptador Burp: +``` +AAAAADoSFkFtaW4gTmFzaXJpIFhlbm9uIEdSUEMYNjoePHNjcmlwdD5hbGVydChvcmlnaW4pPC9zY3JpcHQ+ +``` +### **Manual com a Extensão gRPC-Web Coder para Burp Suite** +Você pode usar a Extensão gRPC-Web Coder para Burp Suite no [gRPC-Web Pentest Suite](https://github.com/nxenon/grpc-pentest-suite), o que é mais fácil. Você pode ler as instruções de instalação e uso no repositório. + +## **Analisando Arquivos Javascript gRPC-Web** +Há pelo menos um arquivo Javascript em cada aplicação gRPC-Web. Você pode analisar o arquivo para encontrar novas mensagens, endpoints e serviços. Tente usar a ferramenta [gRPC-Scan](https://github.com/nxenon/grpc-pentest-suite). +1. Baixe o Arquivo Javascript gRPC-Web +2. Escaneie-o com grpc-scan.py: +```bash +python3 grpc-scan.py --file main.js +``` +3. Analise a saída e teste os novos endpoints e novos serviços: +``` +Output: +Found Endpoints: +/grpc.gateway.testing.EchoService/Echo +/grpc.gateway.testing.EchoService/EchoAbort +/grpc.gateway.testing.EchoService/NoOp +/grpc.gateway.testing.EchoService/ServerStreamingEcho +/grpc.gateway.testing.EchoService/ServerStreamingEchoAbort + +Found Messages: + +grpc.gateway.testing.EchoRequest: ++------------+--------------------+--------------+ +| Field Name | Field Type | Field Number | ++============+====================+==============+ +| Message | Proto3StringField | 1 | ++------------+--------------------+--------------+ +| Name | Proto3StringField | 2 | ++------------+--------------------+--------------+ +| Age | Proto3IntField | 3 | ++------------+--------------------+--------------+ +| IsAdmin | Proto3BooleanField | 4 | ++------------+--------------------+--------------+ +| Weight | Proto3FloatField | 5 | ++------------+--------------------+--------------+ +| Test | Proto3StringField | 6 | ++------------+--------------------+--------------+ +| Test2 | Proto3StringField | 7 | ++------------+--------------------+--------------+ +| Test3 | Proto3StringField | 16 | ++------------+--------------------+--------------+ +| Test4 | Proto3StringField | 20 | ++------------+--------------------+--------------+ + +grpc.gateway.testing.EchoResponse: ++--------------+--------------------+--------------+ +| Field Name | Field Type | Field Number | ++==============+====================+==============+ +| Message | Proto3StringField | 1 | ++--------------+--------------------+--------------+ +| Name | Proto3StringField | 2 | ++--------------+--------------------+--------------+ +| Age | Proto3IntField | 3 | ++--------------+--------------------+--------------+ +| IsAdmin | Proto3BooleanField | 4 | ++--------------+--------------------+--------------+ +| Weight | Proto3FloatField | 5 | ++--------------+--------------------+--------------+ +| Test | Proto3StringField | 6 | ++--------------+--------------------+--------------+ +| Test2 | Proto3StringField | 7 | ++--------------+--------------------+--------------+ +| Test3 | Proto3StringField | 16 | ++--------------+--------------------+--------------+ +| Test4 | Proto3StringField | 20 | ++--------------+--------------------+--------------+ +| MessageCount | Proto3IntField | 8 | ++--------------+--------------------+--------------+ + +grpc.gateway.testing.ServerStreamingEchoRequest: ++-----------------+-------------------+--------------+ +| Field Name | Field Type | Field Number | ++=================+===================+==============+ +| Message | Proto3StringField | 1 | ++-----------------+-------------------+--------------+ +| MessageCount | Proto3IntField | 2 | ++-----------------+-------------------+--------------+ +| MessageInterval | Proto3IntField | 3 | ++-----------------+-------------------+--------------+ + +grpc.gateway.testing.ServerStreamingEchoResponse: ++------------+-------------------+--------------+ +| Field Name | Field Type | Field Number | ++============+===================+==============+ +| Message | Proto3StringField | 1 | ++------------+-------------------+--------------+ + +grpc.gateway.testing.ClientStreamingEchoRequest: ++------------+-------------------+--------------+ +| Field Name | Field Type | Field Number | ++============+===================+==============+ +| Message | Proto3StringField | 1 | ++------------+-------------------+--------------+ + +grpc.gateway.testing.ClientStreamingEchoResponse: ++--------------+----------------+--------------+ +| Field Name | Field Type | Field Number | ++==============+================+==============+ +| MessageCount | Proto3IntField | 1 | ++--------------+----------------+--------------+ +``` +## Referências + +* [Artigo Hacking into gRPC-Web por Amin Nasiri](https://infosecwriteups.com/hacking-into-grpc-web-a54053757a45) +* [Suite de Pentest gRPC-Web](https://github.com/nxenon/grpc-pentest-suite) + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥 + +* Você trabalha em uma **empresa de cibersegurança**? Quer ver sua **empresa anunciada no HackTricks**? ou quer ter acesso à **versão mais recente do PEASS ou baixar o HackTricks em PDF**? Confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)! +* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos +* Adquira o [**merchandising oficial do PEASS & HackTricks**](https://peass.creator-spring.com) +* **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo do Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo do telegram**](https://t.me/peass) ou **siga-me** no **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** +* **Compartilhe suas técnicas de hacking enviando PRs para o repositório** [**hacktricks**](https://github.com/carlospolop/hacktricks) **e** [**hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud). + +