mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 22:52:06 +00:00
92 lines
6.3 KiB
Markdown
92 lines
6.3 KiB
Markdown
# UUID Insecurities
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Basic Information
|
|
|
|
Universally Unique Identifiers (UUIDs) ni **nambari za bit 128 zinazotumika kutambulisha habari kwa kipekee** katika mifumo ya kompyuta. UUIDs ni muhimu katika programu ambapo vitambulisho vya kipekee vinahitajika bila uratibu wa kati. Zinatumika mara nyingi kama funguo za hifadhidata na zinaweza kurejelea vipengele mbalimbali kama hati na vikao.
|
|
|
|
UUIDs zimeundwa kuwa za kipekee na **ngumu kukisia**. Zimejengwa kwa muundo maalum, zimegawanywa katika vikundi vitano vinavyowakilishwa kama tarakimu 32 za hexadecimal. Kuna matoleo tofauti ya UUIDs, kila moja ikihudumia madhumuni tofauti:
|
|
|
|
* **UUID v1** ni ya msingi wa wakati, ikijumuisha alama ya wakati, mfuatano wa saa, na kitambulisho cha node (anwani ya MAC), lakini inaweza kuonyesha habari za mfumo.
|
|
* **UUID v2** ni sawa na v1 lakini inajumuisha marekebisho kwa maeneo ya ndani (siyo maarufu sana).
|
|
* **UUID v3 na v5** zinaunda UUIDs kwa kutumia thamani za hash kutoka kwa namespace na jina, ambapo v3 inatumia MD5 na v5 inatumia SHA-1.
|
|
* **UUID v4** inaundwa karibu kabisa kwa bahati nasibu, ikitoa kiwango cha juu cha kutotambulika lakini ikiwa na hatari kidogo ya nakala.
|
|
|
|
{% hint style="success" %}
|
|
Kumbuka kwamba toleo na subversion ya UUID kawaida huonekana katika nafasi ile ile ndani ya UUID. Kwa mfano katika:\
|
|
12345678 - abcd - 1a56 - a539 - 103755193864\
|
|
xxxxxxxx - xxxx - Mxxx - Nxxx - xxxxxxxxxxxx
|
|
|
|
* **Nafasi ya M** Inaonyesha **toleo** la UUID. Katika mfano hapo juu, ni UUID v**1**.
|
|
* **Nafasi ya N** Inaonyesha aina ya UUID.
|
|
{% endhint %}
|
|
|
|
## Sandwich attack
|
|
|
|
"Sandwich Attack" ni aina maalum ya shambulio ambayo **inatumia utabiri wa uzalishaji wa UUID v1 katika programu za wavuti**, hasa katika vipengele kama vile upya wa nywila. UUID v1 inaundwa kwa msingi wa wakati, mfuatano wa saa, na anwani ya MAC ya node, ambayo inaweza kufanya iwe rahisi kukisia ikiwa mshambuliaji anaweza kupata baadhi ya UUIDs hizi zilizozalishwa karibu kwa wakati.
|
|
|
|
### Example
|
|
|
|
Fikiria programu ya wavuti inayotumia UUID v1 kwa ajili ya kuunda viungo vya upya wa nywila. Hapa kuna jinsi mshambuliaji anaweza kutumia hii kupata ufikiaji usioidhinishwa:
|
|
|
|
1. **Mipangilio ya Awali**:
|
|
|
|
* Mshambuliaji ana udhibiti wa akaunti mbili za barua pepe: \`attacker1@acme.com\` na \`attacker2@acme.com\`.
|
|
* Akaunti ya barua pepe ya lengo ni \`victim@acme.com\`.
|
|
|
|
2. **Utendaji**:
|
|
|
|
* Mshambuliaji anasababisha upya wa nywila kwa akaunti yake ya kwanza (\`attacker1@acme.com\`) na kupokea kiungo cha upya wa nywila chenye UUID, sema \`99874128-7592-11e9-8201-bb2f15014a14\`.
|
|
* Mara moja baada ya hapo, mshambuliaji anasababisha upya wa nywila kwa akaunti ya mwathirika (\`victim@acme.com\`) na kisha haraka kwa akaunti ya pili inayodhibitiwa na mshambuliaji (\`attacker2@acme.com\`).
|
|
* Mshambuliaji anapata kiungo cha upya kwa akaunti ya pili chenye UUID, sema \`998796b4-7592-11e9-8201-bb2f15014a14\`.
|
|
|
|
3. **Uchambuzi**:
|
|
|
|
* Mshambuliaji sasa ana UUID mbili zilizozalishwa karibu kwa wakati (\`99874128\` na \`998796b4\`). Kwa kuzingatia asili ya mfuatano ya UUIDs za msingi wa wakati, UUID kwa akaunti ya mwathirika itakuwa na uwezekano wa kuwa kati ya hizi mbili.
|
|
|
|
4. **Shambulio la Brute Force:**
|
|
|
|
* Mshambuliaji anatumia zana kuunda UUIDs kati ya hizi mbili na kujaribu kila UUID iliyozalishwa kwa kujaribu kufikia kiungo cha upya wa nywila (mfano, \`https://www.acme.com/reset/\<generated-UUID>\`).
|
|
* Ikiwa programu ya wavuti haipunguzi vizuri kiwango au kuzuia majaribio kama haya, mshambuliaji anaweza haraka kujaribu UUID zote zinazowezekana katika anuwai hiyo.
|
|
|
|
5. **Ufikiaji Uliopatikana:**
|
|
|
|
* Mara tu UUID sahihi kwa kiungo cha upya wa nywila ya mwathirika inapogundulika, mshambuliaji anaweza kuunda upya nywila ya mwathirika na kupata ufikiaji usioidhinishwa kwa akaunti yao.
|
|
|
|
### Tools
|
|
|
|
* Unaweza kufanya shambulio la sandwich kiotomatiki kwa kutumia zana: [**https://github.com/Lupin-Holmes/sandwich**](https://github.com/Lupin-Holmes/sandwich)
|
|
* Unaweza kugundua aina hizi za UUIDs katika Burp Suite kwa kutumia nyongeza [**UUID Detector**](https://portswigger.net/bappstore/65f32f209a72480ea5f1a0dac4f38248).
|
|
|
|
## References
|
|
|
|
* [https://versprite.com/blog/universally-unique-identifiers/](https://versprite.com/blog/universally-unique-identifiers/)
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|