# Uingizaji wa Uingizaji wa Upande wa Seva/Upande wa Kuingiza
Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa nahtARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!
Njia nyingine za kusaidia HackTricks:
* Ikiwa unataka kuona **kampuni yako inatangazwa katika HackTricks** au **kupakua HackTricks katika PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
## Taarifa Msingi za Uingizaji wa Upande wa Seva
**(Maelezo yaliyochukuliwa kutoka [nyaraka za Apache](https://httpd.apache.org/docs/current/howto/ssi.html))**
SSI (Uingizaji wa Upande wa Seva) ni maagizo ambayo **hupachikwa kwenye kurasa za HTML, na kuhesabiwa kwenye seva** wakati kurasa zinahudumiwa. Inakuwezesha **kuongeza maudhui yanayozalishwa kwa kudumu** kwenye ukurasa wa HTML uliopo, bila kuhudumia ukurasa mzima kupitia programu ya CGI, au teknolojia nyingine ya kudumu.\
Kwa mfano, unaweza kuweka agizo kwenye ukurasa wa HTML uliopo, kama vile:
``
Na, wakati ukurasa unahudumiwa, kipande hiki kitahesabiwa na kubadilishwa na thamani yake:
`Jumanne, 15-Jan-2013 19:28:54 EST`
Uamuzi wa lini kutumia SSI, na lini kuwa na ukurasa wako uliotengenezwa kabisa na programu fulani, kawaida ni suala la sehemu ngapi ya ukurasa ni ya kudumu, na sehemu ngapi inahitaji kuhesabiwa upya kila wakati ukurasa unahudumiwa. SSI ni njia nzuri ya kuongeza vipande vidogo vya habari, kama vile wakati wa sasa - kama inavyoonyeshwa hapo juu. Lakini ikiwa sehemu kubwa ya ukurasa wako inazalishwa wakati unahudumiwa, unahitaji kutafuta suluhisho lingine.
Unaweza kudhani uwepo wa SSI ikiwa programu ya wavuti inatumia faili zenye viendelezi \*\* `.shtml`, `.shtm` au `.stm`\*\*, lakini sio kila wakati.
Udhihirisho wa kawaida wa SSI una muundo ufuatao:
```
```
### Angalia
To check for Server-Side Inclusion (SSI) and Edge-Side Inclusion (ESI) Injection vulnerabilities, you can follow these steps:
1. **Identify the target**: Determine the target website or application that you want to test for SSI or ESI Injection vulnerabilities.
2. **Inspect the source code**: Analyze the source code of the target application to identify any potential SSI or ESI injection points. Look for server-side scripting languages like PHP, ASP, or JSP, as they are commonly used for SSI or ESI.
3. **Test for SSI Injection**: Inject SSI directives into user-controllable input fields, such as URL parameters or form inputs, to see if they are processed by the server. Use SSI directives like `` to include external files or execute commands.
4. **Test for ESI Injection**: Inject ESI directives into user-controllable input fields, such as URL parameters or form inputs, to see if they are processed by the server. Use ESI directives like `` to include external content or execute commands.
5. **Observe the response**: Analyze the server's response to determine if the injected SSI or ESI directives are executed or if any error messages or unusual behavior occurs.
6. **Exploit the vulnerability**: If the SSI or ESI injection is successful, try to exploit the vulnerability further by including sensitive files, executing commands, or accessing restricted areas of the application.
7. **Report and mitigate**: Document your findings and report them to the appropriate parties. Provide recommendations on how to mitigate the SSI or ESI Injection vulnerabilities, such as input validation and output encoding.
By following these steps, you can effectively test for and exploit Server-Side Inclusion and Edge-Side Inclusion Injection vulnerabilities in web applications.
```javascript
// Document name
// Date
// File inclusion
// Including files (same directory)
// CGI Program results
// Including virtual files (same directory)
// Modification date of a file
// Command exec
// Command exec
// Reverse shell
// Print all variables
// Setting variables
```
## Kuingizwa kwa Upande wa Edge
Kuna tatizo la **kukusanya habari au programu za kibinafsi** kama sehemu ya yaliyomo inaweza **kubadilika** kwa wakati ujao yaliyomo inapopatikana tena. Hii ndio **ESI** inatumika, kuonyesha kutumia vitambulisho vya ESI **yaliyomo ya kibinafsi inayohitaji kuzalishwa** kabla ya kutuma toleo la hifadhi.\
Ikiwa **mshambuliaji** anaweza **kuingiza kialamishi cha ESI** ndani ya yaliyomo ya hifadhi, basi, anaweza kuweza **kuingiza yaliyomo yoyote** kwenye hati kabla haijatumwa kwa watumiaji.
### Uchunguzi wa ESI
**Kichwa** kinachofuata katika jibu kutoka kwa seva kina maana kuwa seva inatumia ESI:
```
Surrogate-Control: content="ESI/1.0"
```
Ikiwa huwezi kupata kichwa hiki, server **inaweza kutumia ESI hata hivyo**.\
Pia inawezekana kutumia **njia ya kudhuru kipofu** kwa kuwa ombi linapaswa kuwasili kwenye server ya mshambuliaji:
```javascript
// Basic detection
hello
// If previous is reflected as "hello", it's vulnerable
// Blind detection
// XSS Exploitation Example
// Cookie Stealer (bypass httpOnly flag)
// Introduce private local files (Not LFI per se)
// Valid for Akamai, sends debug information in the response
```
### Uchunguzi wa ESI
[GoSecure iliumba](https://www.gosecure.net/blog/2018/04/03/beyond-xss-edge-side-include-injection/) jedwali ili kuelewa mashambulizi yanayowezekana ambayo tunaweza kujaribu dhidi ya programu tofauti zinazoweza kusaidia ESI, kulingana na kazi inayoungwa mkono:
* **Includes**: Inasaidia agizo la ``
* **Vars**: Inasaidia agizo la ``. Inatumika kwa kuzunguka Filters za XSS
* **Cookie**: Vidakuzi vya hati vinapatikana kwa injini ya ESI
* **Upstream Headers Inahitajika**: Programu mbadala hazitaprocess taarifa za ESI isipokuwa programu ya juu inatoa vichwa vya habari
* **Host Allowlist**: Katika kesi hii, ESI inajumuisha inawezekana tu kutoka kwa seva zilizoruhusiwa, ikifanya SSRF, kwa mfano, iwezekane tu dhidi ya seva hizo
| **Programu** | **Includes** | **Vars** | **Cookies** | **Upstream Headers Inahitajika** | **Host Whitelist** |
| :--------------------------: | :----------: | :------: | :---------: | :---------------------------: | :----------------: |
| Squid3 | Ndiyo | Ndiyo | Ndiyo | Ndiyo | Hapana |
| Varnish Cache | Ndiyo | Hapana | Hapana | Ndiyo | Ndiyo |
| Fastly | Ndiyo | Hapana | Hapana | Hapana | Ndiyo |
| Akamai ESI Test Server (ETS) | Ndiyo | Ndiyo | Ndiyo | Hapana | Hapana |
| NodeJS esi | Ndiyo | Ndiyo | Ndiyo | Hapana | Hapana |
| NodeJS nodesi | Ndiyo | Hapana | Hapana | Hapana | Hiari |
#### XSS
Agizo la ESI lifuatalo litapakia faili yoyote ndani ya jibu la seva
```xml
```
#### Pita ulinzi wa XSS ya mteja
##### Description:
Some web applications implement client-side XSS protection mechanisms to prevent the execution of malicious scripts in the browser. These protections are usually implemented using Content Security Policy (CSP) headers or JavaScript libraries like DOMPurify.
However, it is possible to bypass these client-side XSS protections by finding and exploiting vulnerabilities in the server-side code. This can be done by injecting malicious code that will be executed on the server and then reflected back to the client.
##### Exploitation:
To bypass client XSS protection, you can try the following techniques:
1. Server-Side Inclusion (SSI) Injection: If the web application uses Server-Side Includes (SSI) to dynamically include content, you can try injecting malicious code into the included file. This code will be executed on the server and then reflected back to the client, bypassing the client-side XSS protection.
2. Edge-Side Includes (ESI) Injection: If the web application uses Edge-Side Includes (ESI) to include content from different sources, you can try injecting malicious code into the included content. This code will be executed on the server and then reflected back to the client, bypassing the client-side XSS protection.
##### Prevention:
To prevent bypassing client XSS protection, you should:
- Implement server-side input validation and sanitization to prevent injection attacks.
- Use a web application firewall (WAF) to detect and block malicious requests.
- Regularly update and patch the server-side code to fix any vulnerabilities that could be exploited.
- Educate developers about secure coding practices and the risks associated with XSS attacks.
```xml
x=>alert(/Chrome%20XSS%20filter%20bypass/);>
Use to bypass WAFs:
ipt>alert(1)ript>
error=alert(1)>
```
#### Pora Kuki
* Pora kuki kwa mbali
```xml
```
* Chukua kuki ya HTTP\_ONLY kwa kutumia XSS kwa kuirudisha katika jibu:
```bash
# This will reflect the cookies in the response
# Reflect XSS (you can put '">