Hacking Articles Tips Tricks Videos Tutorials

5 mistakes to avoid on the bug bounty program

Improve your testing accuracy and get the most out of your findingsContinue reading on Medium »
Read more...

9 views08:36

9 views09:23

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Ermir : An Evil Java RMI Registry

Ermir is an Evil/Rogue RMI Registry, it exploits unsecure deserialization on any Java code calling standard RMI methods on it (list()/lookup()/bind()/rebind()/unbind()). Requirements* Ruby v3 or newer. InstallationInstall Ermir from rubygems.org:
$ gem install ermir
or clone the repo and build the gem:
$ git clone https://github.com/hakivvi/ermir.git
$ rake install UsageErmir is a cli gem, it comes with 2 cli files ermirand gadgetmarshal, ermiris the actual gem and the latter is just a pretty interface to GadgetMarshaller.java file which rewrites the gadgets of Ysoserial to match MarshalInputStreamrequirements, the output should be then piped into ermiror a file, in case of custom gadgets use MarshalOutputStreaminstead of ObjectOutputStreamto write your serialized object to the output stream. ermirusage:
➜ ~ ermir
Ermir by @hakivvi * https://github.com/hakivvi/ermir.
Info:
Ermir is a Rogue/Evil RMI Registry which exploits unsecure Java deserialization on any Java code calling standard RMI methods on it.
Usage: ermir [options]
-l, --listen bind the RMI Registry to this ip and port (default: 0.0.0.0:1099).
-f, --file path to file containing the gadget to be deserialized.
-p, --pipe read the serialized gadget from the standard input stream.
-v, --version print Ermir version.
-h, --help print options help.
Example:
$ gadgetmarshal /path/to/ysoserial.jar Groovy1 calc.exe | ermir --listen 127.0.0.1:1099 --pipe gadgetmarshalusage:
➜ ~ gadgetmarshal
Usage: gadgetmarshal /path/to/ysoserial.jar Gadget1 cmd (optional)/path/to/output/file How does it work?java.rmi.registry.Registryoffers 5 methods: list(), lookup(), bind(), rebind(), unbind():

* public Remote lookup(String name): lookup() searches for a bound object in the registry by its name, the registry returns a Remoteobject which references the remote object that was looked up, the returned object is read using MarshalInputStream.readObject()which is just another layer on top of ObjectInputStream, basically it excpects after each class/proxy descriptor (TC_CLASSDESC/TC_PROXYCLASSDESC) an URL that will be used to load this class or proxy class. this is the same wild bug that was fixed in jdk7u21. (Ermir does not specify this URL as only old Java version are vulnerable, instead it just write null). as Ysoserial gadgets are being serialized using ObjectOutputStream, Ermir uses gadgetmarshal-a wrapper around GadgetMarshaller.java– to serialize the specified gagdet to match MarshalInputStreamrequirements.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdaOHO1_sEgsxh-KFwFL69Z18F-43bHQl9NJJI8ujN_su2HYCrZ0b0Xb7DgyUzY481Bx-X_sYOdSwkYAHgrryYAWAVFyBMmWzOYMByT7KKAcVc-IHfeZ4zNzhVNPLlHQVHRUJhLrTutg_VMc-6_UI-HTIrmawAhz8pvRnDMCwxRBuX7gnp1s74PXTJ/s1115/Ermir.png public String[] list(): list() asks the registry for all the bound objects names, while Stringtype cannot be subsitued with a malicious gadget as it is not like any ordinary object and it is not read using readObject()but rather readUTF(), however as list()returns String[]which is an actual object and it is read using readObject(), Ermir sends the gadget instead of this String[]type.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-3L2H3V6ljJokLR_PQweExmHLi9tXuQo81g3_BY0TR9HJJb6gDhYC1hpUCrlJ59MIb4U-95c0FdL2hlakFGrRJYC2LnHye7xxpcA9pWyVPSHZXAL6RQxVkfSZLyfjXzIpCAqMBFx_Ty5lNt6DN8tglZ_Pzmgs6i1TIl0AnYCd[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Ermir : An Evil Java RMI Registry 2022!!!Kalilinuxtutorials

Ermir is an Evil/Rogue RMI Registry, it exploits unsecure deserialization on any Java code calling standard RMI methods on it (list()/lookup()/bind()/rebind()/unbind()). Requirements Installation Install Ermir from rubygems.org: $ gem install ermir or clone…

9 viewsedited 09:23

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Ermir : An Evil Java RMI Registry Ermir is an Evil/Rogue RMI Registry, it exploits unsecure deserialization on any Java code calling standard RMI methods on it (list()/lookup()/bind()/rebind()/unbind()). Requirements* Ruby v3 or newer.…

oVtyoXTfsJg9hRaM/s1157/Ermir1.png public void bind(java.lang.String $param_String_1, java.rmi.Remote $param_Remote_2): bind() binds an object to a name on the registry, in bind() case the return type is voidand there is nothing being returned, however if the registry specifies in the RMI return data packet that this return is an execptional return, the client/server client will call readObject()despite the return type is void, this is how the regitry sends exceptions to its client (usually java.lang.ClassNotFoundException), once again Ermir will deliver the serialized gadget instead of a legitimate Exception object.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSk7ltF-m8gtRaEyaxLwXXRODcgH3_YSS5CtmfdKk84Ip6bwb_gy5HemBjKGhzkO_FszGU6TwarkczIcOADmClWwQuiUvjq7otglmSbHWt7FnoUQW7BTZx1ywyIsSBuFKPh7vSUgp99CV8JMrgYvvfZCA_v4V-IvWQIXMY8zf4v4TsylhGrx_-ai0Q/s883/Ermir2.png
* public void rebind(java.lang.String $param_String_1, java.rmi.Remote $param_Remote_2): rebind() replaces the binding of the passed name with the supplied remote reference, also returns void, Ermir returns an exception just like bind().
* public void unbind(java.lang.String $param_String_1): unbind() unbinds a remote object by name in the RMI registry, this one also returns void. PoChttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSm1mRjvlfqNCdssr-4sz0e2skXUqbXsVeiNlxS2FN46PjmvELD3nFnUd_mLX53UiHzkJx8k4KVoiXk3litK0OvR3RqcOZRQ3KYNxlJTAvBzJzFU5lJUDf84OwXk20TeYn9IP3RY-MwCJSy9SnUzIxWB3PK2k6f7JFdnJ60LJ-UVIuqE6AfErQMvmE/s1920/Ermir4.gif Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 09:23

Hacking Articles Tips Tricks Videos Tutorials

Sleep SQL injection on Name Parameter While Updating Profile
https://medium.com/@umeryousuf26/sleep-sql-injection-on-name-parameter-while-updating-profile-2bbac9f47336?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Sleep SQL injection on Name Parameter While Updating Profile

Hi everyone, I am an Independent Cyber Security Researcher and a Bug Bounty Hunter from Pakistan.

10 viewsedited 09:30

Hacking Articles Tips Tricks Videos Tutorials

10 views09:30

Hacking Articles Tips Tricks Videos Tutorials

Hi everyone, I am an Independent Cyber Security Researcher and a Bug Bounty Hunter from Pakistan.Continue reading on Medium » (https://medium.com/@umeryousuf26/sleep-sql-injection-on-name-parameter-while-updating-profile-2bbac9f47336?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Sleep SQL injection on Name Parameter While Updating Profile

Hi everyone, I am an Independent Cyber Security Researcher and a Bug Bounty Hunter from Pakistan.

9 viewsedited 09:30

Hacking Articles Tips Tricks Videos Tutorials

Sleep SQL injection on Name Parameter While Updating Profile

Hi everyone, I am an Independent Cyber Security Researcher and a Bug Bounty Hunter from Pakistan.Continue reading on Medium »
Read more...

6 views10:06

Hacking Articles Tips Tricks Videos Tutorials

6 views10:27

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
How to Secure Database From Hackers

https://cdn-images-1.medium.com/max/1280/1*VEdmGrNe7_LrnQPaHPfoPg.jpeg
Lack of security is one of the biggest threats to your data security. A hacker can steal your data, or worse if you don’t have a secure…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

How to Secure Database From Hackers

Lack of security is one of the biggest threats to your data security. A hacker can steal your data, or worse if you don’t have a secure…

6 viewsedited 10:27

Hacking Articles Tips Tricks Videos Tutorials

6 views10:27