Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USAPost Views: 50 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.Speaking at Black Hat USA yesterday (August 10), James Kettle unveiled research that opens the new frontier in HTTP request smuggling – browser-powered desync attacks.

The briefing and it’s whitepaper, titled ‘Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling’, builds on Kettle’s previous research into desync attacks.

Traditional desync attacks poison the connection between a front-end and back-end server and are therefore impossible on websites that don’t use a front-end/back-end architecture.

However this new technique causes a desync between the front-end and the browser, allowing an attacker to “craft high-severity exploits without relying on malformed requests that browsers will never send”, Kettle noted.

This can expose a whole new range of websites to server-side request smuggling and enables an attacker to perform client-side variations of these attacks by inducing a victim’s browser to poison its own connection to a vulnerable web server.

Kettle demonstrated how he was able to turn a victim’s web browser into a desync delivery platform, shifting the request smuggling frontier by exposing single-server websites and internal networks.

He was able to combine cross-domain requests with server flaws to poison browser connection pools, install backdoors, and release desync worms – in turn compromising targets including Amazon, Apache, Akamai, Varnish, and multiple web VPNs.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course DiscoveryKettle told attendees at the 25th anniversary of the annual hacking conference that four separate vulnerabilities led to the discovery of browser-powered desync attacks.

The first, involving request validation, leverages a technique in which an attacker can use two requests down the same connection with a valid host header in order to gain access to the host in the second request, because the reverse proxy only validates the first host.

The second, first-request routing, is a closely related flaw which occurs when the front-end uses the first request’s Host header to decide which back-end to route the request to, and then routes all subsequent requests from the same client connection down the same back-end connection.

Kettle also discovered a technique to detect connection-locked request smuggling by using a delay and reading the data early to decide if the front-end is using the Content-Length header.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/819f-article-220810-james-k-1024x576.jpg
James Kettle presents at the annual hacking conference held in Las Vegas
If it is using the Content-Length it will time out, which will signify the difference between connection-locked HTTP/1 request smuggling and harmless HTTP pipelining.

A fourth vulnerability caused a desync known as CL.0/H2.0. Kettle was able to use this to compromise Amazon users’ accounts, enabling him to steal users’ requests and add them to his shopping list. He could capture all their requests, including tokens which could have enabled him to impersonate those users.

Speaking[...]

___________________________
@hacking_Attack
@Hacking_Video

rhub
118. BugBounty
119. Huntr
120. Universocraft
121. Wireclub
122. AminoApps
123. Trakt
124. Giphy
125. Minecraft List
126. SEOClerks
127. Mix
128. Codecademy
129. Bandcamp
130. Poshmark
131. hackster
132. BodyBuilding
133. Mastodon
134. IFTTT
135. Anime Planet
136. Destructoid
137. Gitee
138. Teknik
139. BitChute
140. The Tatto Forum
141. NPM
142. PyPI
143. HackenProof
144. VKontakte
145. about me
146. Dissenter
147. Designspiration
148. Fark
149. mmorpg
150. Pikabu
151. Playstation Network
152. Warrior Forum
153. Pixilart Export ReportThe results can be exported as a PDF Report.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_report_pdf_cover.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_report_pdf_results.png Export ReportWhen possible Blackbird will extract the user’s metadata, bringing data such as name, bio, location and profile picture.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_metadata.png Random UserAgentBlackbird uses a random UserAgent from a list of 1000 UserAgents in each request to prevent blocking. Supersonic speedBlackbird sends async HTTP requests, allowing a lot more speed when discovering user accounts. JSON TemplateBlackbird uses JSON as a template to store and read data.

The data.json file store all sites that blackbird verify. Params* app – Site name
* url
* valid – Python expression that returns True when user exists
* id – Unique numeric ID
* method – HTTP method
* json – JSON body POST (needs to be escaped, use this: https://codebeautify.org/json-escape-unescape)
* {username} – Username place (URL or Body)
* response.status – HTTP response status
* responseContent – Raw response body
* soup – Beautifulsoup parsed response body
* jsonData – JSON response body
* metadada – a list of objects to be scraped ExamplesGET

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/GET-1024x610.png

POST JSON

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/POST-JSON-1024x508.png

GET with Metadata extraction

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/GET-with-Metadata-extraction-919x1024.png DisclaimerThis or previous program is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that the author is not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of these programs its your responsibility.
Clone the repo from here: GitHub Link
Trending: Write up: Find Hidden Info using Google Dorking manually, and Automated using Pagodo https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Offensive-Azure-300x150.png Offensive Security Tool: Offensive-AzureAugust 5, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Pretender-300x150.png Offensive Security Tool: PretenderJuly 29, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/DDoS-Layer7-bheh-300x150.png Offensive Security Tool: DDoS-Layer7-bhehJuly 28, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/GitHacker-300x150.png Offensive Security Tool: GitHackerJuly 22, 2022
Reading Time: 3 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post OSINT Tool[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

___________________________
@hacking_Attack
@Hacking_Video

: Blackbird first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

ALEX2 Orderbook: Testnet with Bug Bounty rewards and more
https://medium.com/@Crypto_Davy_ENG/alex2-orderbook-testnet-with-bug-bounty-rewards-and-more-5f77731c3ba1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Testnet of a decentralized exchange from the ALEX2 project.Continue reading on Medium » (https://medium.com/@Crypto_Davy_ENG/alex2-orderbook-testnet-with-bug-bounty-rewards-and-more-5f77731c3ba1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Amazon Cognito misconfiguration lead to account takeover
https://medium.com/@iknowhatodo/amazon-cognito-misconfiguration-lead-to-account-takeover-20694243ca40?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello reader,
I hope you are doing well. Today I want to talk about one of my findings. It was a public program and the bug is not fixed…Continue reading on Medium » (https://medium.com/@iknowhatodo/amazon-cognito-misconfiguration-lead-to-account-takeover-20694243ca40?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

File Upload Bypass to RCE == $$$$
https://sagarsajeev.medium.com/file-upload-bypass-to-rce-76991b47ad8f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Multiple ways to Bypass a File upload feature and chain it to an RCE.Continue reading on Medium » (https://sagarsajeev.medium.com/file-upload-bypass-to-rce-76991b47ad8f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

File Upload Bypass to RCE == $$$$

Multiple ways to Bypass a File upload feature and chain it to an RCE.Continue reading on Medium »
Read more...

OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents
http://www.kitploit.com/2022/08/offensivevba-code-execution-and-av.html

___________________________
@hacking_Attack
@Hacking_Video

In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away from being complete. If you know any other cool technique or useful template feel free to contribute and create a pull request! Most of the templates in this repo were already published somewhere. I just copy pasted most templates from ms-docs sites, blog posts or from other tools.
Templates in this repo File Description ShellApplication_ShellExecute.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/ShellApplication_ShellExecute.vba) Execute an OS command via ShellApplication object and ShellExecute method ShellApplication_ShellExecute_privileged.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/ShellApplication_ShellExecute_privileged.vba) Execute an privileged OS command via ShellApplication object and ShellExecute method - UAC prompt Shellcode_CreateThread.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Shellcode_CreateThread.vba) Execute shellcode in the current process via Win32 CreateThread Shellcode_EnumChildWindowsCallback.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Shellcode_EnumChildWindowsCallback.vba) Execute shellcode in the current process via EnumChildWindows Win32_CreateProcess.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Win32_CreateProcess.vba) Create a new process for code execution via Win32 CreateProcess function Win32_ShellExecute.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Win32_ShellExecute.vba) Create a new process for code execution via Win32 ShellExecute function WMI_Process_Create.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/WMI_Process_Create.vba) Create a new process via WMI for code execution WMI_Process_Create2.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/WMI_Process_Create2.vba) Another WMI code execution example WscriptShell_Exec.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/WscriptShell_Exec.vba) Execute an OS command via WscriptShell object and Exec method WscriptShell_run.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/WscriptShell_run.vba) Execute an OS command via WscriptShell object and Run method VBA-RunPE (https://github.com/itm4n/VBA-RunPE/tree/master) @itm4n's (https://twitter.com/itm4n) RunPE technique in VBA GadgetToJScript (https://github.com/med0x2e/GadgetToJScript/tree/master) med0x2e's (https://github.com/med0x2e) C# script for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts. PPID_Spoof.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/PPID_Spoof.vba) christophetd's (https://github.com/christophetd) spoofing-office-macro (https://github.com/christophetd/spoofing-office-macro) copy AMSIBypass_AmsiScanBuffer_ordinal.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/AMSIBypass_AmsiScanBuffer_ordinal.vba) rmdavy's (https://github.com/rmdavy) AMSI Bypass to patch AmsiScanBuffer using ordinal values for a signature bypass AMSIBypass_AmsiScanBuffer_Classic.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/AMSIBypass_AmsiScanBuffer_Classic.vba) rasta-mouse's (https://github.com/rasta-mouse) classic AmsiScanBuffer patch AMSIBypass_Heap.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/AMSIBypass_Heap.vba) rmdavy's (https://github.com/rmdavy) HeapsOfFun (https://github.com/rmdavy/HeapsOfFun) repo copy AMSIbypasses.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/AMSIbypasses.vba) outflanknl's (https://github.com/outflanknl)

___________________________
@hacking_Attack
@Hacking_Video

AMSI bypass blog (https://outflank.nl/blog/2019/04/17/bypassing-amsi-for-vba/) COMHijack_DLL_Load.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/COMHijack_DLL_Load.vba) Load DLL via COM Hijacking COM_Process_create.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/COM_Process_create.vba) Create process via COM object Download_Autostart.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Download_Autostart.vba) Download a file from a remote webserver and put it into the StartUp folder Download_Autostart_WinAPI.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Download_Autostart_WinAPI.vba) Download a file from a remote webserver via URLDownloadtoFileA and put it into the StartUp folder Dropper_Autostart.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Dropper_Autostart.vba) Drop batch file into the StartUp folder Registry_Persist_wmi.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Registry_Persist_wmi.vba) Create StartUp registry key (https://www.kitploit.com/search/label/Registry%20Key) for persistence (https://www.kitploit.com/search/label/Persistence) via WMI Registry_Persist_wscript.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Registry_Persist_wscript.vba) Create StartUp registry key for persistence via wscript object ScheduledTask_Create.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/ScheduledTask_Create.vba) Create and start sheduled task for code execution/persistence XMLDOM_Load_XSL_Process_create.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/XMLDOM_Load_XSL_Process_create.vba) Load XSL from a remote webserver to execute code regsvr32_sct_DownloadExecute.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/regsvr32_sct_DownloadExecute.vba) Execute regsvr32 to download a remote webservers SCT file for code execution BlockETW.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/BlockETW.vba) Patch EtwEventWrite in ntdll.dll to block ETW data collection BlockETW_COMPLUS_ETWEnabled_ENV.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/BlockETW_COMPLUS_ETWEnabled_ENV.vba) Block ETW data collection by setting the environment variable COMPLUS_ETWEnabled to 0, credit to @xpn ShellWindows_Process_create.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/ShellWindows_Process_create.vba) ShellWindows Process create to get explorer.exe as parent process AES.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/AES.vba) An example to use AES encryption/decryption in VBA from Here (https://github.com/susam/aes.vbs/blob/a0cb5f9ffbd90b435622f5cfdb84264e1a319bf2/aes.vbs) Dropper_Executable_Autostart.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Dropper_Executable_Autostart.vba) Get executable bytes from VBA and drop into Autostart - no download in this case MarauderDrop.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/MarauderDrop.vba) Drop a COM registered .NET DLL into temp, import the function and execute code - in this case loads a remote C# binary from a webserver to memory and executes it - credit to @Jean_Maes_1994 (https://twitter.com/Jean_Maes_1994) for MaraudersMap (https://github.com/NVISOsecurity/blogposts/tree/master/MaraudersMap) Dropper_Workfolders_lolbas_Execute.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Dropper_Workfolders_lolbas_Execute.vba) Drop an embedded executable into the TEMP directory and execute it using C:\windows\system32\Workfolders.exe as LOLBAS - credit to @YoSignals (https://www.ctus.io/2021/04/12/exploading/) SandBoxEvasion (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/SandBoxEvasion) Some SandBox Evasion templates Evasion Dropper Autostart.vba

___________________________
@hacking_Attack
@Hacking_Video

(https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Evasion_Dropper_Autostart.vba) Drops a file to the Startup directory bypassing file write monitoring via renamed folder operation Evasion MsiInstallProduct.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Evasion%20MsiInstallProduct.vba) Installs a remote MSI package using WindowsInstaller ActiveXObject avoiding spawning suspicious office child process, the msi installation will be executed as a child of the MSIEXEC /V service StealNetNTLMv2.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/StealNetNTLMv2.vba) Steal NetNTLMv2 Hash via share connection - credit to https://book.hacktricks.xyz/windows/ntlm/places-to-steal-ntlm-creds Parse-Outlook.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Parse-Outlook.vba) Parses Outlook for sensitive keywords and file extensions, and exfils them via email - credit to JohnWoodman (https://github.com/JohnWoodman/VBA-Macro-Projects) Reverse-Shell.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Reverse-Shell.vba) Reverse shell written entirely in VBA using Windows API (https://www.kitploit.com/search/label/Windows%20API) calls - credit to JohnWoodman (https://github.com/JohnWoodman/VBA-Macro-Projects) Missing - ToDos File Description Unhooker.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Unhooker.vba) Unhook API's in memory to get rid of hooks Syscalls.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Syscalls.vba) Syscall usage - fresh from disk or Syswhispers like Manymore.vba (https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/Manymore.vba) If you have any more ideas feel free to contribute Obfuscators / Payload generators VBad (https://github.com/Pepitoh/VBad) wePWNise (https://github.com/FSecureLABS/wePWNise) VisualBasicObfuscator (https://github.com/mgeeky/VisualBasicObfuscator/tree/master) - needs some modification (https://www.kitploit.com/search/label/Modification) as it doesn't split up lines and is therefore not usable for office document macros macro_pack (https://github.com/sevagas/macro_pack) shellcode2vbscript.py (https://github.com/DidierStevens/DidierStevensSuite/blob/master/shellcode2vbscript.py) EvilClippy (https://github.com/outflanknl/EvilClippy) OfficePurge (https://github.com/mandiant/OfficePurge) SharpShooter (https://github.com/mdsecactivebreach/SharpShooter) VBS-Obfuscator-in-Python (https://github.com/kkar/VBS-Obfuscator-in-Python) - - needs some modification as it doesn't split up lines and is therefore not usable for office document macros Credits / usefull resources ASR bypass: http://blog.sevagas.com/IMG/pdf/bypass_windows_defender_attack_surface_reduction.pdf Shellcode to VBScript conversion: https://github.com/DidierStevens/DidierStevensSuite/blob/master/shellcode2vbscript.py Bypass AMSI in VBA: https://outflank.nl/blog/2019/04/17/bypassing-amsi-for-vba/ VBA purging: https://www.mandiant.com/resources/purgalicious-vba-macro-obfuscation-with-vba-purging F-Secure VBA Evasion and detection post: https://blog.f-secure.com/dechaining-macros-and-evading-edr/ One more F-Secure blog: https://labs.f-secure.com/archive/dll-tricks-with-vba-to-improve-offensive-macro-capability/

Download OffensiveVBA (https://github.com/S3cur3Th1sSh1t/OffensiveVBA)

___________________________
@hacking_Attack
@Hacking_Video

Forging GraphQL Bombs, the 2022 version of Zip Bombs
https://www.reddit.com/r/Pentesting/comments/wml8ac/forging_graphql_bombs_the_2022_version_of_zip/

Hey Pentesters! Escape.tech (https://escape.tech/)'s security research team recently uncovered a new kind of attack to add to your arsenal. It's called GraphQL Bombs and it is about creating an abnormal amount of work out of a single HTTP request to a GraphQL endpoint. You'll find all the details about this vulnerability and how to prevent it in this article: Forging GraphQL Bombs, the 2022 version of Zip Bombs (escape.tech) (https://blog.escape.tech/forging-graphql-bombs-the-2022-version-of-zip-bombs/) Feel free to ask questions in the replies, we'll be happy to answer submitted by /u/GautierLePire (https://www.reddit.com/user/GautierLePire)
[link] (https://www.reddit.com/r/Pentesting/comments/wml8ac/forging_graphql_bombs_the_2022_version_of_zip/) [comments] (https://www.reddit.com/r/Pentesting/comments/wml8ac/forging_graphql_bombs_the_2022_version_of_zip/)

___________________________
@hacking_Attack
@Hacking_Video

Attempting to exploit CVE-2022-22582
https://www.reddit.com/r/Pentesting/comments/wmlkdc/attempting_to_exploit_cve202222582/

Ok so I'm trying to execute the cve that I referenced on my local mac (version 11.6.1). I've looked at the original PoC at http://www.github.com/poizon-box/CVE-2022-22582. This doesn't produce any errors, but the exploit is supposed to take advantage of symlinks to overwrite priviledged files, anf I don't understand how that's supposed to work. If you couls help me it would be very appreciated. submitted by /u/GuillotineNamedJEff (https://www.reddit.com/user/GuillotineNamedJEff)
[link] (https://www.reddit.com/r/Pentesting/comments/wmlkdc/attempting_to_exploit_cve202222582/) [comments] (https://www.reddit.com/r/Pentesting/comments/wmlkdc/attempting_to_exploit_cve202222582/)

___________________________
@hacking_Attack
@Hacking_Video