Hacking Articles|Raj Chandel's Blog
Burp Suite for Pentester: Repeater

Today, in this article, we’ll focus on the Repeater and its options featured by the Burp Suite Professional Version, which will help any Pentester to send the request inside the burp and observe its Response in real-time without disturbing the request captured from the browser. Table of Content· Introduction· Renaming the Tabs· Request Method· Request History· URL as Request· URL Encode· Following Redirection· Search· Reopening Closed Tab· Views· Exporting Repeater Data· ConclusionEven the users that are just beginning to use the Burp Suite are likely to be familiar with the functions of the Repeater. However, let’s go over them to recall the functionality of the Repeater. It is a tool that is designed to allow the user or attacker to change or resend particular HTTP requests and understand and analyze the response generated by it. Here in the demonstration below, we have captured an HTTP request from the browser. This request is captured inside the Intercept sub-tab inside the Proxy tab. By Right Clicking on the captured request, a drop-down menu appears. This menu contains an option that says “Send to Repeater”. Clicking this option will send the request to the repeater. You can also use the shortcut Ctrl and R to send any request to the repeater.Renaming the TabsDuring any assessment, the Repeater tends to get cluttered with multiple tabs with numbers as shown in the image below. Since each time, a request is being sent to the Repeater, the tab gets incremented by one. This can get confusing to catch up after a while of working on a project. Request MethodNext, we will discuss the ability of the Repeater to change the Request Method type. These are the HTTP methods such as the GET, POST, PUT, OPTIONS, etc. Some web pages are configured to work with multiple methods. Suppose, you want to request a page with input fields, to request that form, we need to use the GET methods, and to submit the data from the fields to the server, you will require the [...]

___________________________
@hacking_Attack
@Hacking_Video

POST methods.  This can be managed with just an option present in the right-click menu by the name of “Change request method”. In the demonstration provided below, we have a GET request.Request HistoryWhen using any Web Browser, we have the Forward and Backwards buttons on the browser. These help us to navigate to the Previous or Next Page. The repeater has the Back (<)) buttons as well. These can help where we get a 301 Response for our request. This means that we can follow the Redirection. Using the Forward (>) button we can choose to move to the next request and its subsequent response. However, in case you are using the repeater to test different parameters and their effects on the response, then you can go back to any response that might be working as per your requirement. The Request history can be viewed by clicking the Drop-Down button next to the Backward (<)URL as RequestIn a Penetration testing environment, there are situations where it is required to test the response of a particular URL without actually capturing the request. Or there can be a scenario where you were able to get a particular finding but you don’t have the request in the response. So, you will have to go to the HTTP History and locate that particular request and send it to the repeater. This process can be shortened by just using the URL. Here, we are copying the URL from our Web Browser. URL EncodeWeb servers don’t deal with the spaces and certain symbols easily. Hence, the space and certain symbols such as the & are encoded in URL Encode format. Developers program the websites to encode the data Client side before generating the request and then send it to the web server. Now, when making changes to the request inside the Repeater, you forget to provide the proper encoding the request may behave in an unpredicted way. Also, some filters are placed to find certain symbols such as < > [...]

___________________________
@hacking_Attack
@Hacking_Video

but the URL may Encode equivalent of those are not filtered and that filter can be bypassed by just encoding them. In the demonstration below, we have a request inside the Repeater and we right-click on the request and choose the URL-encode as you type option. This will encode our text to URL Encode format as we type without any effort from our end.Following RedirectionRedirection is an important part of any web application. This can help the user navigate the web pages in a way that the developer intended. It can also help the developer to integrate multiple different web applications into a single website. Web Browsers follow the redirection by default and it poses a problem to a penetration tester because while testing certain scenarios such as Open Redirection or Web Cache Poisoning, the penetration tester needs to toggle and observe the redirection response from the application. The Repeater has an option that can help with this or similar situations. It provides the user with an option to either never to follow redirections or follow the redirection for the on-site redirection or follow the redirection for In-scope domains only or to just Always Follow the Redirection. This provides the user to configure the Repeater as per their requirement that is based on the build of the application.SearchIn both sections i.e., Request and Response of the Repeater, we have a search bar at the bottom. Since the response would contain all the HTML code to create the webpage, it tends to be very lengthy and it can be very difficult to look for any particular keyword in the code. This is a problem when we are trying to see if any parameters that we passed were reflected in the response or not. The Search is configured to automatically move to the first keyword it finds and the Left and Right arrow keys can be used to toggle between the different occurrences of the keyword. Some settings can be toggled while using the Search. We can check the box to make the search Case Sensitive or we can use a Regex value to search for a general type of occurrence. At last, the Auto-scroll can be triggered each time any change be made to the Search bar. This can also help look for particular keywords quickly.Reopening Closed TabIf you have been using Burp for some time now, you might have accidentally closed the Repeater Tab that you don’t want to close. You are not alone and it is not your fault. The Close (X) is placed in such a way that it is very possible to close the tab without any intention to do so. After numerous requests to the PortSwigger, They made this option where you can Right Click on[...]

___________________________
@hacking_Attack
@Hacking_Video

the location where all the tabs lie and Choose The Reopen Closed Tab option to open any tab that you closed accidentally.ViewsMultiple views are provided to view the Request and the Response sections in the Burp Suite. This pretty much sums based on the user’s preference. The three options that are provided are the classic Side by Side Panels as shown in the image below.Exporting Repeater DataAs we know that documentation is a vital part of any engagement. As we send multiple requests to form the repeater and with each request, we tend to make some changes to the request. So, to keep a track of it outside of Burp, we have the feature that allows us to save the history of all the requests sent.  After working with multiple requests, we right-click on the request and choose the “Save entire history” option from the drop-down menu. ConclusionThe repeater is one of the basic tools of the BurpSuite. However, through extensive research and developments, a lot of hidden features are added to the tool. It has reached a point where many of these features can ease the life of any Pentester. ___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Burp Suite for Pentester: Repeater

Today, in this article, we’ll focus on the Repeater and its options featured by the Burp Suite Professional Version, which will help any Pentester to send the request inside the burp and observe its Response in real-time without disturbing the request captured from the browser. Table of Content Introduction Renaming

The post Burp Suite for Pentester: Repeater appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Can OWASP be considered as a network pentesting methodology!!!
https://www.reddit.com/r/Pentesting/comments/p3l3o7/can_owasp_be_considered_as_a_network_pentesting/

<!-- SC_OFF -->Hi there, I am doing research about network pentesting methodologies, and I mentioned OWASP as one of the methodologies that can be applied to network pentesting because I found that Internet-based penetration test is a type of network pentesting and it's applied in the deployment of an e-application so I assumed that OWASP can partially be one of network pentesting methodologies since it's dedicated for a web app. I am actually new in the field so I am a little bit confused. I'll appreciate any help. <!-- SC_ON --> submitted by /u/Shylamo (https://www.reddit.com/user/Shylamo)
[link] (https://www.reddit.com/r/Pentesting/comments/p3l3o7/can_owasp_be_considered_as_a_network_pentesting/) [comments] (https://www.reddit.com/r/Pentesting/comments/p3l3o7/can_owasp_be_considered_as_a_network_pentesting/)

hacking: security in practice
Anyone know how to spam SMG 360?

Anyone know how to have surveys go in so they receive a lot of positive ones. Trying to help a friend out.

submitted by /u/shawnmendess
[link] [comments]

jwtXploiter - A Tool To Test Security Of Json Web Token

A tool to test security of JSON Web Tokens. Test a JWT against all known CVEs; Tamper with the token payload: changes claims and subclaims values. Exploit known vulnerable header claims (kid, jku, x5u) Verify a token Retrieve the public key of your target's ssl connection and try to use it in a key confusion attack with one option only All JWAs supported Generates a JWK and insert it in the token header And much, much more!Wiki Read the wiki! wiki Installation N.B. Cloning the repository should be avoided except for development purposes! N.B. Deb package has to be considered beta With rpm: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter-1.2.1-1.noarch.rpmsudo rpm --install jwtxploiter-1.2.1-1.noarch.rpm or, if previous version is installed on your machine sudo rpm --upgrade jwtxploiter-1.2.1-1.noarch.rpm With pip: sudo pip install jwtxploiter With deb: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter_1.2.1-1_all.debsudo dpkg -i jwtxploiter_1.2.1-1_all.deb Cloing the repo: git clone https://github.com/DontPanicO/jwtXploiter.git./install.sh N.B. python3-pip package is required to install dependencies, be sure to have it installed. Who this tool is written for? Web Application Penetration Tester / Bug Bounty Hunters This tool has been written with the aim of become a key part of pentesters toolkit. Devs who need to test the secuirty of JWTs used in their applications CTF Players Not For Students Since this tool automates lot of stuff, without force the user to know what's happening under the hood, it won't help you to understand the vulnerabilities it exploits. To Know For attacks that generates a jwks file, you could find it in the current working directory. Remeber to deletes such files in order to avoid conflicts. For jku/x5u injection that needs to merge two urls (the server vulnerable url and your one), the HERE keyword is required. For redirect attacks the keyword should replace the redirect url, e.g. http://app.com/foo?redirect=bar&some=thing --> http://app.com/foo?redirect=HERE&some=thing For jku/x5u injections via HTTP header injection attacks, the HERE keyword sould be appended to the vulnerable parameter, without replacing its value, e.g. http://app.com/foo?param=value --> http://app.com/foo?param=valueHERE Also, in such cases, be sure to pass the server url and your one as comma separated values. '/.well-known/jwks.json' is automatically appended to your url in jku/x5u attacks. So make sure to place the jwks file under this path on your server. If you don't want that happen, use the --manual option, but this option is compatible only with --jku-basic and --x5u-basic so, you will need to manually craft the url and pass it to those options, even for attacks that exploit Open Redirect or HTTP header injection. Look at the wiki for a detailed documentation. Download jwtXploiter
Read more...

KitPloit - PenTest Tools!
jwtXploiter - A Tool To Test Security Of Json Web Token

https://1.bp.blogspot.com/-vVZWi21UEPg/YRIRLVR7hHI/AAAAAAAAptA/vNcIKhL3VPo8xxG94bshOO2va9h5n7pBwCNcBGAsYHQ/w640-h466/jwt-crack.png A tool to test security of JSON Web Tokens. Test a JWT against all known CVEs;

* Tamper with the token payload: changes claims and subclaims values.
* Exploit known vulnerable header claims (kid, jku, x5u)
* Verify a token
* Retrieve the public key of your target's ssl connection and try to use it in a key confusion attack with one option only
* All JWAs supported
* Generates a JWK and insert it in the token header
* And much, much more! Wiki* Read the wiki! wiki InstallationN.B. Cloning the repository should be avoided except for development purposes! N.B. Deb package has to be considered beta

*
With rpm: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter-1.2.1-1.noarch.rpm
sudo rpm --install jwtxploiter-1.2.1-1.noarch.rpmor, if previous version is installed on your machine sudo rpm --upgrade jwtxploiter-1.2.1-1.noarch.rpm*
With pip: sudo pip install jwtxploiter*
With deb: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter_1.2.1-1_all.deb
sudo dpkg -i jwtxploiter_1.2.1-1_all.deb*
Cloing the repo: git clone https://github.com/DontPanicO/jwtXploiter.git
./install.shN.B. python3-pip package is required to install dependencies, be sure to have it installed. Who this tool is written for?*
Web Application Penetration Tester / Bug Bounty Hunters

* This tool has been written with the aim of become a key part of pentesters toolkit.

*
Devs who need to test the secuirty of JWTs used in their applications

*
CTF Players

*
Not For Students

* Since this tool automates lot of stuff, without force the user to know what's happening under the hood, it won't help you to understand the vulnerabilities it exploits. To Know*
For attacks that generates a jwks file, you could find it in the current working directory. Remeber to deletes such files in order to avoid conflicts.

*
For jku/x5u injection that needs to merge two urls (the server vulnerable url and your one), the HERE keyword is required.

*
For redirect attacks the keyword should replace the redirect url, e.g.

* http://app.com/foo?redirect=bar&some=thing --> http://app.com/foo?redirect=HERE&some=thing

*
For jku/x5u injections via HTTP header injection attacks, the HERE keyword sould be appended to the vulnerable parameter, without replacing its value, e.g.

* http://app.com/foo?param=value --> http://app.com/foo?param=valueHERE

*
Also, in such cases, be sure to pass the server url and your one as comma separated values.

*
'/.well-known/jwks.json' is automatically appended to your url in jku/x5u attacks. So make sure to place the jwks file under this path on your server.

*
If you don't want that happen, use the --manual option, but this option is compatible only with --jku-basic and --x5u-basic so, you will need to manually craft the url and pass it to those options, even for attacks that exploit Open Redirect or HTTP header injection.

*
Look at the wiki for a detailed documentation. Download jwtXploiter

Hacking on Medium
Crypto Heist

https://cdn-images-1.medium.com/max/800/0*MmwnehV1a4-UF73m.png
Crypto has been the most popular financial instrument in the past few years, especially during the COVID-19 pandemic.

Continue reading on invstr »

Hacking on Medium
Space challenge PWN — HTB

https://cdn-images-1.medium.com/max/753/1*Cw_jxP7_DUWRj_Ie_t6n3g.jpeg
Walkthrough includes— Buffer overflow, ROP, and shell coding.

Continue reading on Medium »

Hacking on Medium
Taking Over Employee Accounts by Managers with Zero Employee Interaction

https://cdn-images-1.medium.com/max/1564/1*44fj4eIWUAn1IhEeGJC18g.png
Hello,

Continue reading on Medium »

Taking Over Employee Accounts by Managers with Zero Employee Interaction

Hello,Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
Microsoft Warns: Another Unpatched PrintNightmare Zero-Day

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-DayPost Views: 141
Reading Time: 1 Minute
One day after dropping its scheduled August Patch Tuesday update, Microsoft issued a warning about yet another unpatched privilege escalation/remote code-execution (RCE) vulnerability in the Windows Print Spooler.
The zero-day bug, tracked as CVE-2021-36958, carries a CVSS vulnerability-severity scale rating of 7.3, meaning that it’s rated as “important.” Microsoft said that it allows for a local attack vector requiring user interaction, but that the attack complexity is low, with few privileges required.

“A remote code-execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,” the computing giant explained in its Wednesday advisory. “An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights.”

The CERT Coordination Center actually flagged the issue in mid-July, when it warned that a working exploit was available. That proof-of-concept (PoC), issued by Benjamin Delpy, comes complete with a video.
So apparently @offenseindepth reported this to Microsoft before your public PoC on July 17?
And Microsoft is only just now publishing an out-of-band bulletin on it on August 11?
https://s.w.org/images/core/emoji/13.1.0/72x72/1f914.png pic.twitter.com/8eDHD7tg7A

— Will Dormann (@wdormann) August 11, 2021
See Also: Auth Bypass Bug Exploited, Affecting Millions of Routers On Thursday, CERT/CC issued more details on the issue, explaining that it arises from an oversight in signature requirements around the “Point and Print” capability, which allows users without administrative privileges to install printer drivers that execute with SYSTEM privileges via the Print Spooler service.

While Microsoft requires that printers installable via Point are either signed by a WHQL release signature or by a trusted certificate, Windows printer drivers can specify queue-specific files that are associated with the use of the device, which leaves a loophole for malicious actors.

“For example, a shared printer can specify a CopyFiles directive for arbitrary files,” according to the CERT/CC advisory. “These files, which may be copied over alongside the digital-signature-enforced printer driver files, are not covered by any signature requirement. Furthermore, these files can be used to overwrite any of the signature-verified files that were placed on a system during printer driver install. This can allow for local privilege escalation to SYSTEM on a vulnerable system.”
See Also: Offensive Security Tool: Mimikatz Microsoft credited Victor Mata of FusionX at Accenture Security with originally reporting the issue, which Mata said occurred back in December 2020:
Hey guys, I reported the vulnerability in Dec'20 but haven't disclosed details at MSRC's request. It looks like they acknowledged it today due to the recent events with print spooler.

— Victor Mata (@offenseindepth) August 11, 2021
So far, Microsoft hasn’t seen any attacks in the wild using the bug, but it noted that exploitation is “more likely.” With a working exploit in circulation, that seems a fair assessment. Print Spooler-Palooza and the PrintNightmareDelpy characterized this latest zero-day as being part of the string of Print Spooler bugs collectively known as PrintNightmare.

The bad dream started in early[...]