diff --git a/README.md b/README.md index 3af4d1c..d97662d 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,84 @@ S.No. | Topic **17** | [Vulnerable Code Snippet - 5](/resources/vulnerable-code-5.md) **18** | [Vulnerable Code Snippet - 6](/resources/vulnerable-code-6.md) **19** | [Vulnerable Code Snippet - 7](/resources/vulnerable-code-7.md) - +**20** | [Vulnerable Code Snippet - 8](/resources/vulnerable-code-8.md) +**21** | [Vulnerable Code Snippet - 9](/resources/vulnerable-code-9.md) +**22** | [Vulnerable Code Snippet - 10](/resources/vulnerable-code-10.md) +**23** | [Vulnerable Code Snippet - 11](/resources/vulnerable-code-11.md) +**24** | [Vulnerable Code Snippet - 12](/resources/vulnerable-code-12.md) +**25** | [Vulnerable Code Snippet - 13](/resources/vulnerable-code-13.md) +**26** | [Vulnerable Code Snippet - 14](/resources/vulnerable-code-14.md) +**27** | [Vulnerable Code Snippet - 15](/resources/vulnerable-code-15.md) +**28** | [Vulnerable Code Snippet - 16](/resources/vulnerable-code-16.md) +**29** | [Vulnerable Code Snippet - 17](/resources/vulnerable-code-17.md) +**30** | [Vulnerable Code Snippet - 18](/resources/vulnerable-code-18.md) +**31** | [Vulnerable Code Snippet - 19](/resources/vulnerable-code-19.md) +**32** | [Account Takeover Methodology](/resources/account-takeovers-methodology.md) +**33** | [Vulnerable Code Snippet - 20](/resources/vulnerable-code-20.md) +**34** | [Vulnerable Code Snippet - 21](/resources/vulnerable-code-21.md) +**35** | [Vulnerable Code Snippet - 22](/resources/vulnerable-code-22.md) +**36** | [Vulnerable Code Snippet - 23](/resources/vulnerable-code-23.md) +**37** | [Vulnerable Code Snippet - 24](/resources/vulnerable-code-24.md) +**38** | [Vulnerable Code Snippet - 25](/resources/vulnerable-code-25.md) +**39** | [Vulnerable Code Snippet - 26](/resources/vulnerable-code-26.md) +**40** | [Vulnerable Code Snippet - 27](/resources/vulnerable-code-27.md) +**41** | [Vulnerable Code Snippet - 28](/resources/vulnerable-code-28.md) +**42** | [Vulnerable Code Snippet - 29](/resources/vulnerable-code-29.md) +**43** | [Vulnerable Code Snippet - 30](/resources/vulnerable-code-30.md) +**44** | [Vulnerable Code Snippet - 31](/resources/vulnerable-code-31.md) +**45** | [Vulnerable Code Snippet - 32](/resources/vulnerable-code-32.md) +**46** | [Vulnerable Code Snippet - 33](/resources/vulnerable-code-33.md) +**47** | [Vulnerable Code Snippet - 34](/resources/vulnerable-code-34.md) +**48** | [Vulnerable Code Snippet - 35](/resources/vulnerable-code-35.md) +**49** | [Vulnerable Code Snippet - 36](/resources/vulnerable-code-36.md) +**50** | [Vulnerable Code Snippet - 37](/resources/vulnerable-code-37.md) +**51** | [Vulnerable Code Snippet - 38](/resources/vulnerable-code-38.md) +**52** | [Vulnerable Code Snippet - 39](/resources/vulnerable-code-39.md) +**53** | [Vulnerable Code Snippet - 40](/resources/vulnerable-code-40.md) +**54** | [Vulnerable Code Snippet - 41](/resources/vulnerable-code-41.md) +**55** | [Vulnerable Code Snippet - 42](/resources/vulnerable-code-42.md) +**56** | [Vulnerable Code Snippet - 43](/resources/vulnerable-code-43.md) +**57** | [Vulnerable Code Snippet - 44](/resources/vulnerable-code-44.md) +**58** | [Vulnerable Code Snippet - 45](/resources/vulnerable-code-45.md) +**59** | [Ruby ERB SSTI](/resources/ruby-erb-ssti.md) +**60** | [Introduction to CWE](/resources/intro-to-cwe.md) +**61** | [CWE-787: Out-of-bounds Write](/resources/cwe-787.md) +**62** | [Vulnerable Code Snippet - 46](/resources/vulnerable-code-46.md) +**63** | [CWE-20: Improper Input Validation](/resources/cwe-20.md) +**64** | [Vulnerabilities in Cookie Based Authentication](/resources/vulnerabilities-in-cookies.md) +**65** | [How do I get Started in Cyber Security? — My Perspective & Learning Path!](/resources/getting-into-cybersecurity.md) +**66** | [Scope Based Recon Methodology: Exploring Tactics for Smart Recon](/resources/scope-based-recon.md) +**67** | [MFA Bypass Techniques](/resources/mfa-bypass.md) +**68** | [Vulnerable Code Snippet - 47](/resources/vulnerable-code-47.md) +**69** | [Vulnerable Code Snippet - 48](/resources/vulnerable-code-48.md) +**70** | [Vulnerable Code Snippet - 49](/resources/vulnerable-code-49.md) +**71** | [Vulnerable Code Snippet - 50](/resources/vulnerable-code-50.md) +**72** | [Vulnerable Code Snippet - 51](/resources/vulnerable-code-51.md) +**73** | [Vulnerable Code Snippet - 52](/resources/vulnerable-code-52.md) +**74** | [Vulnerable Code Snippet - 53](/resources/vulnerable-code-53.md) +**75** | [Vulnerable Code Snippet - 54](/resources/vulnerable-code-54.md) +**76** | [Vulnerable Code Snippet - 55](/resources/vulnerable-code-55.md) +**77** | [Vulnerable Code Snippet - 56](/resources/vulnerable-code-56.md) +**78** | [Vulnerable Code Snippet - 57](/resources/vulnerable-code-57.md) +**79** | [Vulnerable Code Snippet - 58](/resources/vulnerable-code-58.md) +**80** | [Vulnerable Code Snippet - 59](/resources/vulnerable-code-59.md) +**81** | [Vulnerable Code Snippet - 60](/resources/vulnerable-code-60.md) +**82** | [Vulnerable Code Snippet - 61](/resources/vulnerable-code-61.md) +**83** | [Vulnerable Code Snippet - 62](/resources/vulnerable-code-62.md) +**84** | [Vulnerable Code Snippet - 63](/resources/vulnerable-code-63.md) +**85** | [Vulnerable Code Snippet - 64](/resources/vulnerable-code-64.md) +**86** | [Vulnerable Code Snippet - 65](/resources/vulnerable-code-65.md) +**87** | [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](/resources/cwe-200.md) +**88** | [CWE-732: Incorrect Permission Assignment for Critical Resource](/resources/cwe-732.md) +**89** | [CWE-522: Insufficiently Protected Credentials](/resources/cwe-522.md) +**90** | [CWE-918: Server-Side Request Forgery (SSRF)](/resources/cwe-918) +**91** | [CWE-611: Improper Restriction of XML External Entity Reference](/resources/cwe-611.md) +**92** | [CWE-476: NULL Pointer Dereference](/resources/cwe-476.md) +**93** | [CWE-276: Incorrect Default Permissions](/resources/cwe-276.md) +**94** | [CWE-862: Missing Authorization](/resources/cwe-862.md) +**95** | [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer](/resources/cwe-119.md) +**96** | [CWE-798: Use of Hard-coded Credentials](/resources/cwe-798.md) +**97** | [CWE-287: Improper Authentication](/resources/cwe-287.md) # SecurityExplained NewsLetter @@ -48,11 +125,45 @@ S.No. | Topic **1** | [Issue-1](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-newsletter-315740) **2** | [Issue-2](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-2-969744) **3** | [Issue-3](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-3-979380) +**4** | [Issue-4](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-4-990787) +**5** | [Issue-5](https://t.co/MIS3cFYYtj) +**6** | [Issue-6](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-6-1014382) +**7** | [Issue-7](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-7-1026847) +**8** | [Issue-8](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-8-1038241) +**9** | [Issue-9](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-9-1049767) +**10** | [Issue-10](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-10-1061802) +**11** | [Issue-11](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-11-1073189) +**12** | [Issue-12](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-12-1084203) +**13** | [Issue-13](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-13-1095142) +**14** | [Issue-14](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-14-1106987) +# AskMeAnything -# Guest Resources +___ +S.No. | Topic +--- | --- +**1** | [AMA-1: AMA with Harsh Bothra](https://twitter.com/harshbothra_/status/1497233820336418816) +**2** | [AMA-2: AMA with Six2dez](https://twitter.com/harshbothra_/status/1499731408868179972) +**3** | [AMA-3: AMA with Brumens](https://twitter.com/harshbothra_/status/1511327809733480451) +# Threads ___ S.No. | Topic --- | --- -**1** | [<>](/guest-resources/<>.md) +**1** | [7 Hacking Books you must read](https://twitter.com/harshbothra_/status/1499346357227642886) +**2** | [4 Subdomain Enumeration Tools you must have in your Arsenal 💻](https://twitter.com/harshbothra_/status/1500101328978079744) +**3** | [6 Burp Extensions to Check for Access Control & Privilege Escalation Issues](https://twitter.com/harshbothra_/status/1500848764948389889) +**4** | [5 Powerful Web Fuzzing & Content Discovery Tools You Must Know](https://twitter.com/harshbothra_/status/1501928368521945090) +**5** | [17 Search Engines every Security Professional Must Know](https://twitter.com/harshbothra_/status/1503332626580471808) +**6** | [7 Cyber Security Conferences Channel You Must Follow](https://twitter.com/harshbothra_/status/1505869341748723714) +**7** | [9 Free Practice Labs to Master Cross-Site Scripting](https://twitter.com/harshbothra_/status/1508406052663934979) +**8** | [11 MindMaps I have created that you may find useful!](https://twitter.com/harshbothra_/status/1509168580071329792) +**9** | [14 Payload Repositories to find all the required Payloads & Attack Vectors](https://twitter.com/harshbothra_/status/1509870706347032579) + +# MindMaps +S.No. | Topic +--- | --- +**1** | [Account Takeover Techniques](https://www.xmind.net/m/M3WEqG/) +**2** | [CWE TOP 10 (2021)](https://www.xmind.net/m/icrqti) + + diff --git a/media/code-10.jpg b/media/code-10.jpg new file mode 100644 index 0000000..0cb4f86 Binary files /dev/null and b/media/code-10.jpg differ diff --git a/media/code-11.jpg b/media/code-11.jpg new file mode 100644 index 0000000..6edeff1 Binary files /dev/null and b/media/code-11.jpg differ diff --git a/media/code-12.jpg b/media/code-12.jpg new file mode 100644 index 0000000..7c585f7 Binary files /dev/null and b/media/code-12.jpg differ diff --git a/media/code-13.jpg b/media/code-13.jpg new file mode 100644 index 0000000..1c8f036 Binary files /dev/null and b/media/code-13.jpg differ diff --git a/media/code-14.jpg b/media/code-14.jpg new file mode 100644 index 0000000..c1313a9 Binary files /dev/null and b/media/code-14.jpg differ diff --git a/media/code-15.jpg b/media/code-15.jpg new file mode 100644 index 0000000..2fe9b1b Binary files /dev/null and b/media/code-15.jpg differ diff --git a/media/code-16.jpg b/media/code-16.jpg new file mode 100644 index 0000000..80486a8 Binary files /dev/null and b/media/code-16.jpg differ diff --git a/media/code-17.jpg b/media/code-17.jpg new file mode 100644 index 0000000..6c3e6e5 Binary files /dev/null and b/media/code-17.jpg differ diff --git a/media/code-18.jpg b/media/code-18.jpg new file mode 100644 index 0000000..ae931ea Binary files /dev/null and b/media/code-18.jpg differ diff --git a/media/code-19.jpg b/media/code-19.jpg new file mode 100644 index 0000000..5fe8957 Binary files /dev/null and b/media/code-19.jpg differ diff --git a/media/code-20.jpg b/media/code-20.jpg new file mode 100644 index 0000000..e92f208 Binary files /dev/null and b/media/code-20.jpg differ diff --git a/media/code-21.jpg b/media/code-21.jpg new file mode 100644 index 0000000..dc477e5 Binary files /dev/null and b/media/code-21.jpg differ diff --git a/media/code-22.jpg b/media/code-22.jpg new file mode 100644 index 0000000..b89ce59 Binary files /dev/null and b/media/code-22.jpg differ diff --git a/media/code-23.jpg b/media/code-23.jpg new file mode 100644 index 0000000..e48ef1f Binary files /dev/null and b/media/code-23.jpg differ diff --git a/media/code-24.jpg b/media/code-24.jpg new file mode 100644 index 0000000..6077423 Binary files /dev/null and b/media/code-24.jpg differ diff --git a/media/code-25.jpg b/media/code-25.jpg new file mode 100644 index 0000000..eae7482 Binary files /dev/null and b/media/code-25.jpg differ diff --git a/media/code-26.jpg b/media/code-26.jpg new file mode 100644 index 0000000..79ae429 Binary files /dev/null and b/media/code-26.jpg differ diff --git a/media/code-27.jpg b/media/code-27.jpg new file mode 100644 index 0000000..7709036 Binary files /dev/null and b/media/code-27.jpg differ diff --git a/media/code-28.jpg b/media/code-28.jpg new file mode 100644 index 0000000..dae4acc Binary files /dev/null and b/media/code-28.jpg differ diff --git a/media/code-29.jpg b/media/code-29.jpg new file mode 100644 index 0000000..8cb5ca8 Binary files /dev/null and b/media/code-29.jpg differ diff --git a/media/code-30.jpg b/media/code-30.jpg new file mode 100644 index 0000000..c4f0f1d Binary files /dev/null and b/media/code-30.jpg differ diff --git a/media/code-31.jpg b/media/code-31.jpg new file mode 100644 index 0000000..d46f5c7 Binary files /dev/null and b/media/code-31.jpg differ diff --git a/media/code-32.jpg b/media/code-32.jpg new file mode 100644 index 0000000..9467c2a Binary files /dev/null and b/media/code-32.jpg differ diff --git a/media/code-33.jpg b/media/code-33.jpg new file mode 100644 index 0000000..37bca84 Binary files /dev/null and b/media/code-33.jpg differ diff --git a/media/code-34.jpg b/media/code-34.jpg new file mode 100644 index 0000000..fee722c Binary files /dev/null and b/media/code-34.jpg differ diff --git a/media/code-35.jpg b/media/code-35.jpg new file mode 100644 index 0000000..c04c7e9 Binary files /dev/null and b/media/code-35.jpg differ diff --git a/media/code-36.jpg b/media/code-36.jpg new file mode 100644 index 0000000..e13f2ed Binary files /dev/null and b/media/code-36.jpg differ diff --git a/media/code-37.jpg b/media/code-37.jpg new file mode 100644 index 0000000..bdcaa43 Binary files /dev/null and b/media/code-37.jpg differ diff --git a/media/code-38.jpg b/media/code-38.jpg new file mode 100644 index 0000000..d80390f Binary files /dev/null and b/media/code-38.jpg differ diff --git a/media/code-39.jpg b/media/code-39.jpg new file mode 100644 index 0000000..e48ef1f Binary files /dev/null and b/media/code-39.jpg differ diff --git a/media/code-40.jpg b/media/code-40.jpg new file mode 100644 index 0000000..9fd7521 Binary files /dev/null and b/media/code-40.jpg differ diff --git a/media/code-41.jpg b/media/code-41.jpg new file mode 100644 index 0000000..5fe90f3 Binary files /dev/null and b/media/code-41.jpg differ diff --git a/media/code-42.jpg b/media/code-42.jpg new file mode 100644 index 0000000..6b2a8b0 Binary files /dev/null and b/media/code-42.jpg differ diff --git a/media/code-43.jpg b/media/code-43.jpg new file mode 100644 index 0000000..273349a Binary files /dev/null and b/media/code-43.jpg differ diff --git a/media/code-44.jpg b/media/code-44.jpg new file mode 100644 index 0000000..4deb851 Binary files /dev/null and b/media/code-44.jpg differ diff --git a/media/code-45.jpg b/media/code-45.jpg new file mode 100644 index 0000000..12baa51 Binary files /dev/null and b/media/code-45.jpg differ diff --git a/media/code-46.jpg b/media/code-46.jpg new file mode 100644 index 0000000..8da62ac Binary files /dev/null and b/media/code-46.jpg differ diff --git a/media/code-47.jpg b/media/code-47.jpg new file mode 100644 index 0000000..f33b7ad Binary files /dev/null and b/media/code-47.jpg differ diff --git a/media/code-48.jpg b/media/code-48.jpg new file mode 100644 index 0000000..1dd0721 Binary files /dev/null and b/media/code-48.jpg differ diff --git a/media/code-49.png b/media/code-49.png new file mode 100644 index 0000000..801ade1 Binary files /dev/null and b/media/code-49.png differ diff --git a/media/code-50.png b/media/code-50.png new file mode 100644 index 0000000..3071b56 Binary files /dev/null and b/media/code-50.png differ diff --git a/media/code-51.png b/media/code-51.png new file mode 100644 index 0000000..97aa38e Binary files /dev/null and b/media/code-51.png differ diff --git a/media/code-52.png b/media/code-52.png new file mode 100644 index 0000000..cb696fb Binary files /dev/null and b/media/code-52.png differ diff --git a/media/code-53.png b/media/code-53.png new file mode 100644 index 0000000..9baae05 Binary files /dev/null and b/media/code-53.png differ diff --git a/media/code-54.png b/media/code-54.png new file mode 100644 index 0000000..46591b6 Binary files /dev/null and b/media/code-54.png differ diff --git a/media/code-55.png b/media/code-55.png new file mode 100644 index 0000000..d563214 Binary files /dev/null and b/media/code-55.png differ diff --git a/media/code-56.png b/media/code-56.png new file mode 100644 index 0000000..1eca76d Binary files /dev/null and b/media/code-56.png differ diff --git a/media/code-57.png b/media/code-57.png new file mode 100644 index 0000000..9fde832 Binary files /dev/null and b/media/code-57.png differ diff --git a/media/code-58.png b/media/code-58.png new file mode 100644 index 0000000..6ebdf4f Binary files /dev/null and b/media/code-58.png differ diff --git a/media/code-59.png b/media/code-59.png new file mode 100644 index 0000000..6ef6c9a Binary files /dev/null and b/media/code-59.png differ diff --git a/media/code-60.png b/media/code-60.png new file mode 100644 index 0000000..ff8df46 Binary files /dev/null and b/media/code-60.png differ diff --git a/media/code-61.png b/media/code-61.png new file mode 100644 index 0000000..5d6e765 Binary files /dev/null and b/media/code-61.png differ diff --git a/media/code-62.png b/media/code-62.png new file mode 100644 index 0000000..488685b Binary files /dev/null and b/media/code-62.png differ diff --git a/media/code-63.png b/media/code-63.png new file mode 100644 index 0000000..c785143 Binary files /dev/null and b/media/code-63.png differ diff --git a/media/code-64.png b/media/code-64.png new file mode 100644 index 0000000..9677563 Binary files /dev/null and b/media/code-64.png differ diff --git a/media/code-65.png b/media/code-65.png new file mode 100644 index 0000000..6df0358 Binary files /dev/null and b/media/code-65.png differ diff --git a/media/code-8.jpg b/media/code-8.jpg new file mode 100644 index 0000000..38ffec1 Binary files /dev/null and b/media/code-8.jpg differ diff --git a/media/code-9.jpg b/media/code-9.jpg new file mode 100644 index 0000000..58aa8da Binary files /dev/null and b/media/code-9.jpg differ diff --git a/resources/account-takeovers-methodology.md b/resources/account-takeovers-methodology.md new file mode 100644 index 0000000..3753a59 --- /dev/null +++ b/resources/account-takeovers-methodology.md @@ -0,0 +1,80 @@ +### SecurityExplained S-32: My Methodology on Performing Account Takoevers + +``` +An account takeover usually refers to gaining persistent access to the victim user's account and performing all the authentication actions as a victim would be able to do. The severity of account takeover issues is usually considered between High to Critical. However, it also depends upon the complexity and likelihood of the attack. + +In general, the account takeover is not a "vulnerability class" itself but an impact result of a vulnerability. For example, the application was vulnerable to CSRF, and the attacker was able to perform specific actions that led to "Account Takeover". + +Below is my methodology for testing different scenarios of Account Takeover: + +1. Account Takeover by CSRF +- If your target application is vulnerable to CSRF on functionalities such as "Email/Phone" Change, you can attempt to perform account takeover using it. +a. Perform CSRF to Update Attacker Email/Phone in Victim Account +b. Perform Password Reset using Attacker Email/Phone set in Victim Account +c. Account Takeover Successful. + +2. Account Takeover by IDOR (Post Authentication) +- If your target application is vulnerable to IDOR on functionalities such as "Email/Phone" Change, you can attempt to perform account takeover using it. +a. Perform IDOR to Update Attacker Email/Phone in Victim Account +b. Perform Password Reset using Attacker Email/Phone set in Victim Account +c. Account Takeover Successful. + +3. Account Takeover by IDOR in Password Reset +- If the application sends `user identifier` in the password reset functionality. Then, one can perform an account takeover. Multiple methods depend upon the functionality. One of the standard methods is: + +a. Trigger Password Reset Request +b. Open the Password Reset Link and Change the `user identifier` to `victim user`. +c. Attempt to perform Password Reset. +d. If the password reset is successful, account takeover is achieved. + +4. Account Takeover by Password Reset Poisoning +- If the application is vulnerable to host header injection, an attacker can attempt to perform a password reset poisoning attack by adding an attacker-controlled host to the password reset link and completing takeover in simple steps: + +a. Capture the Password Reset Request and Change the Host header value to "attacker-controlled" host. +b. Forward the request and check the email for the password reset link. +c. If the password reset link contains the "attacker-controlled" hostname and the victim clicks on the link, it will be logged on the attacker server. +d. Attacker can use the token and perform account takeover by resetting the password. + +5. Account Takeover by Broken Cryptography +- If the password reset token/link generated by the application is not cryptographically strong, an attacker may attempt to find a way to forge a valid reset token. There are no specific ways to execute these attacks, but the main goal is to identify how the token is generated. +a. Check for the Token Randomness +b. Check for standard cryptographic methods in use +c. Try to identify if any known token generation library is used by the application. + +6. Account Takeover by OAuth Misconfiguration +- If the application uses OAuth, there are multiple ways to perform account takeover if the OAuth is misconfigured. Some of the attacks are performing account takeover using CSRF in OAuth, SSO Restriction Bypass, etc. + +Example: +- https://hackerone.com/reports/314808 +- https://hackerone.com/reports/541701 + +7. Pre-Authentication Account Takeover +- I have shared an in-depth blog on performing Pre-Authentication Account Takeover that can be found at: https://hbothra22.medium.com/attacking-social-logins-pre-authentication-account-takeover-790248cfdc3 + +8. Account Takeover due to Improper Rate-Limitation Checks +- If the application doesn't implement proper rate-limitation, it is possible to bypass the authentication in the application that utilizes Phone/Email OTP based login (Assuming OTP is 4 digit & has a long expiry). +a. Initiate a login request and send an OTP. +b. Input Wrong OTP and Fuzz the OTP parameter. +c. Once the valid OTP is received, you will get the proper access token which can be used to login into the user account. +- This issue is also seen in the application having no password policy where an attacker can brute-force the password field. + +9. Account Takeover due to Weak Security Policies +- Due to the weak security policies, an attacker may find a way to bypass the authentication & authorization and attempt to gain initial non-persistent access to the victim account. Once you have initial access, you can attempt to get privileged access depending upon the application use-case & offered functionalities. + +10. Account Takeover by Utilizing Sensitive Data Exposure +- Always check for the sensitive data exposure in different components for interesting information such as "Access Tokens", "Session Tokens", and "Credentials". Sometimes, the access tokens are fresh and not expired that can be used to perform session hijacking and gain non-persistent access to the user account. +- Also, search for the endpoints that might reveal sensitive information such as password hashes, session variables, etc. I haven't encountered these in the production application but always a good practice to test these. + +11. Account Takeover by Cross-Site Scripting +- If you have cross-site scripting, there are ways to steal a user's session cookies & gain a non-persistent account takeover. However, in a situation where you can hijack admin sessions and create more admin accounts or reset the password for any users, you can perform a persistent account takeover. + +- Even if you cannot hijack a session, if there's a way to create an account using an admin account controlled by JS, you can use XSS to trigger it and create a user account. (Experienced this in a CTF situation) + +12. Misc. Methods + - Response Manipulation + - Status Code Manipulation + - Parameter Pollution + - Token Forging +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1488504894294466561?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/attacks-with-mass-assign.md b/resources/attacks-with-mass-assign.md index 55b7ab2..5031933 100644 --- a/resources/attacks-with-mass-assign.md +++ b/resources/attacks-with-mass-assign.md @@ -1,23 +1,25 @@ -### SecurityExplained S-5: Bypassing Privileges & Other Restrictions with Mass Assignment Attacks. +### SecurityExplained S-5: Bypassing Privileges & Other Restrictions with Mass Assignment Attacks. ``` As per OWASP's defination: Software frameworks sometime allow developers to automatically bind HTTP request parameters into program code variables or objects to make using that framework easier on developers. This can sometimes cause harm. Attackers can sometimes use this methodology to create new parameters that the developer never intended which in turn creates or overwrites new variable or objects in program code that was not intended. This is called a Mass Assignment vulnerability. -There are multiple attacks that can be executed by exploiting this vulnerability such as escalating privileges, bypassing business logic, manipulating payloads and bypassing client-side checks. +There are multiple attacks that can be executed by exploiting this vulnerability such as escalating privileges, bypassing business logic, manipulating payloads and bypassing client-side checks. Testing for testing issue is quite easy, one of the quick example is to check for "Interesting Parameter" in the response that are original not a part of the request, add the parameter in the request with an attacker controlled value and perform the action. If the parameter is getting manipulated, the vulnerability exists. [My testing methodology] 1. Suppose a multi-privilege application has profile change functionality. -2. With a non-admin account profile change request looks like this: `POST /myprofile ... ... username=harsh&email=h@h.com` -3. The response contains an additional parameter such as `isAdmin=False` that is not part of the original request from `Step-2`. +2. With a non-admin account profile change request looks like this: `POST /myprofile ... ... username=harsh&email=h@h.com` +3. The response contains an additional parameter such as `isAdmin=False` that is not part of the original request from `Step-2`. 4. Now, simply add this `isAdmin` parameter to the request in `Step-2` with the value `True` and forward the request. Ex: `POST /myprofile ... ... username=harsh&email=h@h.com&isAdmin=True` 5. If the response reflects value of `isAdmin` as `True`, it implies that the application doesn't perform proper checks and the vulnerability exists. -6. To confirm, check if the user is updated to Admin User by performing the actions possible with an admin user. +6. To confirm, check if the user is updated to Admin User by performing the actions possible with an admin user. -- Similarly, this technique can be used to bypass multiple restrictions such as two-factor authentication, abuse business logic and other things. It is always a good idea to include the response parameters in the request and perform some checks. +- Similarly, this technique can be used to bypass multiple restrictions such as two-factor authentication, abuse business logic and other things. It is always a good idea to include the response parameters in the request and perform some checks. OWASP CheatSheet series contains interesting information on this attack: https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1478739664093675526?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/bypassing-filters-visual-spoofing.md b/resources/bypassing-filters-visual-spoofing.md index c160a9c..cb6553e 100644 --- a/resources/bypassing-filters-visual-spoofing.md +++ b/resources/bypassing-filters-visual-spoofing.md @@ -1,28 +1,28 @@ -### SecurityExplained S-8: Bypassing Filters(and more) with Visual Spoofing +### SecurityExplained S-8: Bypassing Filters(and more) with Visual Spoofing ``` -Visual Spoofing attacks utilizes the characters from different languages that are visually similar. For example: These all letters [AΑ А ᗅ ᗋ ᴀ Ａ] looks like 'A' of english, visually, however, the computer program processes these characters with their exact meanings. +Visual Spoofing attacks utilizes the characters from different languages that are visually similar. For example: These all letters [AΑ А ᗅ ᗋ ᴀ Ａ] looks like 'A' of english, visually, however, the computer program processes these characters with their exact meanings. -This is where it became an interesting tool to abuse the filters and regular expression based checks & bypass them. +This is where it became an interesting tool to abuse the filters and regular expression based checks & bypass them. -There are multiple attack scenarios using Visual Spoofing/Homographic Attacks: +There are multiple attack scenarios using Visual Spoofing/Homographic Attacks: -1. Abusing the Filters & Bypassing Them +1. Abusing the Filters & Bypassing Them -- One can attempt to bypass filters for any attack category such as cross-site scripting and may have a successful execution. +- One can attempt to bypass filters for any attack category such as cross-site scripting and may have a successful execution. -Ex: For example: <> tags are filters, you can try ‹› instead. (Looks visually similar but are different). +Ex: For example: <> tags are filters, you can try ‹› instead. (Looks visually similar but are different). 2. Domain Spoofing -- Highly reliable while performing a social engineering attack. The phishing emails, websites, etc looks legit and genuine. +- Highly reliable while performing a social engineering attack. The phishing emails, websites, etc looks legit and genuine. -3. Business Logic Abuse -- One can attempt to perform business logic abuse, break the parsing logics and even attempt to perform account takeovers. +3. Business Logic Abuse +- One can attempt to perform business logic abuse, break the parsing logics and even attempt to perform account takeovers. -4. IDN Homograph Attacks +4. IDN Homograph Attacks 5. And other endless misc. things one can think of (Being creative is always a plus) @@ -31,4 +31,6 @@ Homoglyph Attack Generator: https://www.irongeek.com/homoglyph-attack-generator. Interesting Resources: https://websec.github.io/unicode-security-guide/visual-spoofing/ -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1479813683114958852?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/bypassing-ios-biometrics.md b/resources/bypassing-ios-biometrics.md index 2ca2273..d482e06 100644 --- a/resources/bypassing-ios-biometrics.md +++ b/resources/bypassing-ios-biometrics.md @@ -1,21 +1,23 @@ -### SecurityExplained S-6: Bypassing Biometrics in iOS with Objection +### SecurityExplained S-6: Bypassing Biometrics in iOS with Objection ``` -Many applications provide a functionality to enable touch/face ID as an added layer of protection to the application. However, if the attack have "physical access" to the device, it is possible to bypass this restriction and gain access to the application. There are multiple methods to bypass the checks, however, one of the simplest method is to use "Objection". +Many applications provide a functionality to enable touch/face ID as an added layer of protection to the application. However, if the attack have "physical access" to the device, it is possible to bypass this restriction and gain access to the application. There are multiple methods to bypass the checks, however, one of the simplest method is to use "Objection". -Before, performing the attack ensure that the device has frida up and running. Also, the objection must be installed on the attacker system. +Before, performing the attack ensure that the device has frida up and running. Also, the objection must be installed on the attacker system. -# How to perform the attack: +# How to perform the attack: 1. Run the following command: objection --gadget -2. In the objection run following command: ios ui biometrics_bypass -3. Now, give the wrong "biometric", the application says it is wrong, now simply click on "Cancel" to observe that the biometrics are bypassed. +2. In the objection run following command: ios ui biometrics_bypass +3. Now, give the wrong "biometric", the application says it is wrong, now simply click on "Cancel" to observe that the biometrics are bypassed. -# How this works: +# How this works: -- LAContext is a class that is responsible for the local authentication. In this, there is a evaluatePolicy method that is responsible to present a dialog and authenticate the user. When the command mentioned in the "Step-2" is executed, objection creates a hook on "-[LAContext evaluatePolicy:localizedReason:reply:]" and manipulates the boolean value from "False" to "True". +- LAContext is a class that is responsible for the local authentication. In this, there is a evaluatePolicy method that is responsible to present a dialog and authenticate the user. When the command mentioned in the "Step-2" is executed, objection creates a hook on "-[LAContext evaluatePolicy:localizedReason:reply:]" and manipulates the boolean value from "False" to "True". A detailed explanation can be found here: https://github.com/sensepost/objection/wiki/Understanding-the-iOS-Biometrics-Bypass -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1479127074132529155?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/custom-wordlist-for-contentdiscovery.md b/resources/custom-wordlist-for-contentdiscovery.md index df070e1..210248c 100644 --- a/resources/custom-wordlist-for-contentdiscovery.md +++ b/resources/custom-wordlist-for-contentdiscovery.md @@ -21,4 +21,6 @@ Let's see how "CWFF (Custom Wordlist For Fuzzing)" tool works in action: 2. Now, simply run the tool: "python3 cwff.py " and it will start scraping. 3. Results will be stored on a directory with the supplied domain name for later access. 4. There are multiple flags and options available that can be found in the help documents: "python3 cwff.py --help" -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1477971761907978241?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/cwe-119.md b/resources/cwe-119.md new file mode 100644 index 0000000..d2ea73c --- /dev/null +++ b/resources/cwe-119.md @@ -0,0 +1,25 @@ +## SecurityExplained S-95 + +## CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer +Although the software operates on a memory buffer, it can read from or write to memory locations outside of the buffer's intended border. + +Buffer errors are frequent in software that uses a memory buffer to execute actions. An attacker may be able to read or write data outside the intended buffer due to a lack of or incorrect validation of input data. Memory corruption is a term used to describe this flaw. +Specific languages support direct memory addressing, but they don't always check that the addresses are valid for the referred buffer. As a result, read and write operations on memory regions associated with another buffer, variables, data structures, and so on may be done. + + +### Potential Impact: + +An attacker who has complete control over the user input can read or write to any memory location. As a result, it's possible to extract potentially sensitive data from memory and create memory corruption, crash the application, or even run arbitrary code on the target machine. + +Use a language that prevents this vulnerability from occurring or provides constructs that make it easy to avoid this weakness. + +Buffer overflows are not a problem in many languages that do their memory management, such as Java and Perl. Other languages often provide overflow protection, such as Ada and C#, but the programmer can remove it. + +Run or create the software using features or extensions that automatically provide a buffer overflow mitigation or elimination technique. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/119.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1511207010242494465) diff --git a/resources/cwe-20.md b/resources/cwe-20.md new file mode 100644 index 0000000..7fb4fb3 --- /dev/null +++ b/resources/cwe-20.md @@ -0,0 +1,45 @@ +## SecurityExplained S-63 + +### CWE-787: Improper Input Validation + +The product/program does not validate or validate poorly or input that can disrupt a program's control flow or data flow. When software fails to properly validate input, an attacker can construct it in a way that the rest of the application does not expect. As a result, components of the system may receive unwanted input, resulting in a change in control flow or even arbitrary code execution. The flaw appears during the Architecture and Design, as well as the implementation stages. + +#### It allows to: +- Cause the Program to Stop +- Set Arbitrary Command Execution +- Cause Excessive Expenditure of Resources +- Read and Compromise Personal Information + +#### Input validation can be applied to: +1. Raw Data - Strings, Numbers, Parameters, File Contents, etc. +2. Metadata - Information about the raw data, such as headers or size + + +#### Upon entering the code, many properties of raw data or metadata may need to be checked, such as: +- Size, length, frequency, price, rate, number of operations, duration, and so on (all defined quantities). +- Incorporate symbolic keys or other items into hash tables, associative arrays, etc. +- Individual data items, raw data and metadata, references, and so on must all be consistent. +- Implied or derived quantities, such as the real file size rather than defined file size. +- More complicated data structures like indices, offsets, or placements. + +It's important to keep in mind that "input validation" might have a variety of meanings depending upon whether you ask or whatever classification scheme you use. When referring or mapping to this CWE entry, take caution. + +#### Possible Attacks ++ SQL Injection ++ Cross-Site Scripting (XSS) ++ Command Injection ++ Arbitrary Code Execution ++ Application-Level DOS Attack ++ and other similar attacks + +#### Mitigations + +1. Use a framework like Struts or the OWASP ESAPI Validation API to validate input. It's important to remember that adopting a framework doesn't solve all input validation issues; be aware of any flaws in the framework itself. +2. Parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application are all potential areas where untrusted inputs can enter your software. Keep in mind that API calls can be used to obtain such inputs + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/20.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1499723526948855808) diff --git a/resources/cwe-200.md b/resources/cwe-200.md new file mode 100644 index 0000000..27f5660 --- /dev/null +++ b/resources/cwe-200.md @@ -0,0 +1,33 @@ +## SecurityExplained S-87 + +### CWE Top 25: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor + +The product makes sensitive information available to someone who isn't explicitly permitted to access it. + +CWE-200 arises when confidential information (e.g., application systems and network information, user-supplied data such as names email addresses) is made available to individuals who are not authorized to see it. + +This flaw could be the outcome of various issues involving the disclosure of sensitive information. +When the following conditions exist, the information is considered sensitive: +It is sensitive within the product's operations (e.g., information with restricted access, private messages, etc.) +It includes information about the product, its environment, or connected systems that the application is not supposed to reveal. +The application relies on sensitive information-containing resources (e.g., databases) and inadvertently reveals how an unauthorized person could access such resources. + + +# Example: +This code tries to connect to a database and prints any errors it encounters. +Example Language: Java + +If an error occurs, the reported message reveals the location of the script's configuration file. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the attacker can read the file, they will access the database's credentials. + +# Mitigations: +The fundamental strategy for protecting sensitive data is to use secure storage and access techniques. However, information assets must first be identified to identify what should be secured and how it should be protected. +Divide the system into "safe" zones where clear trust lines can be drawn. Allowing sensitive data to leave the trust boundary is not a good idea, and always be cautious when interacting with a division outside of the secure zone. +Never keep/store log files with world-readable permissions; +Architects and designers should utilize the principle of least privilege to determine whether privileges should be used and when they should be discarded. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/200.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1508300855090372613) diff --git a/resources/cwe-276.md b/resources/cwe-276.md new file mode 100644 index 0000000..2713509 --- /dev/null +++ b/resources/cwe-276.md @@ -0,0 +1,33 @@ +## SecurityExplained S-93 + +### CWE-276: Incorrect Default Permissions +Installed file permissions are specified to allow anyone to edit those files during installation. + +During the installation process, the software may apply unwanted permissions to directories, files, or other objects, which is called this flaw. As a result, a malicious user may be able to override security requirements that were not intended. + +Access control lists (ACLs) differentiate access privileges for distinct users and groups in most current operating systems. +A principal (e.g., a process or a threat acting on behalf of a user) works on objects in modern operating systems. Access to these objects (e.g., files, directories, registry keys, etc.) is critical for security measures employed in many operating systems, and permissions enforced on essential components of the operating system can influence system behaviour. + +### Potential Impact: +This flaw is usually exploitable only locally. A malicious individual could obtain access to sensitive data, tamper with sensitive data, or wholly compromise the susceptible system. + +In Linux, any local user with world-writable access on a setuid/setgid executable can insert malicious content into it and execute arbitrary code with the file's owner's privileges. + +Any application that can be writable by an unauthorized user is a security risk. This is because it can be exploited to elevate privileges on the system, such as if a malicious and unprivileged user updated it before being executed by a privileged one. + + +### Mitigations: +According to the architecture, only users who genuinely require those operations should have access to and modify file attributes. + +Users and groups should appropriately manage ownership of files and folders. For example, allowing unwanted groups access to protected information is never good. + +During installation, keep note of software's permissions for directories, files, and registry keys. + +Never allow apps to give executable files world-readable permissions, especially in the system PATH environment variable or any other default search path, such as Windows, Windows/system32 directories, etc. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/276.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1510488017076596743) diff --git a/resources/cwe-287.md b/resources/cwe-287.md new file mode 100644 index 0000000..183b082 --- /dev/null +++ b/resources/cwe-287.md @@ -0,0 +1,45 @@ +## SecurityExplained S-97 + +## CWE-287: Improper Authentication + +When an actor claims to have a particular identity, the program either does not prove or does not sufficiently verify that claim. +Improper Authentication is a vulnerability that describes the ineffective techniques for verifying a user's identity. + +This flaw could be exploited by multiuser systems and apps that use multiple permission levels. + +This flaw happens when an application incorrectly verifies a user's identity. An attacker can access certain rights within the application or expose sensitive information if software wrongly checks user login information or permits the use of different forms of malicious credentials collection (e.g. brute force, spoofing). + +### Example: + +The "id" argument in the HTTP GET request is used by software to assign privileges within the application. For example, if the option is set to "user," the application will allow you to view the data; if it is set to "admin," you will be able to update the data on the page. + + +http://vulnerable.com/index.php?view=1&id=user +http://vulnerable.com/index.php?view=1&id=admin + +An attacker who sets the "group" option to "admin" will be allowed to change the website. + +The previous example is simply a demonstration of how the flaw works. However, in real-world circumstances, poor Authentication can be caused by various factors, including software misconfiguration, human error, etc. + + + +### Potential Impact: + +This flaw can expose resources or functionality to unauthorized individuals, exposing sensitive information or allowing attackers to run arbitrary code. + +An attacker can take advantage of this flaw via various methods, including brute-force attacks, session fixation, and Man-in-the-Middle (MitM) attacks. + + +### Mitigations: +Tools and techniques that involve manual (human) analysis, such as penetration testing, threat modelling, and interactive tools that allow the tester to record and change an active session, can be used to discover this flaw. +Use an authentication framework or library such as the OWASP ESAPI Authentication feature. + +Robust authentication procedures, including anti-brute force and session protection mechanisms, are recommended to protect the application against this flaw. + + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/287.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1511954434007310336) diff --git a/resources/cwe-476.md b/resources/cwe-476.md new file mode 100644 index 0000000..4ebbd3c --- /dev/null +++ b/resources/cwe-476.md @@ -0,0 +1,37 @@ +## SecurityExplained S-92 + +### CWE-476: NULL Pointer Dereference + +When an application dereferences a pointer that it considers valid but is NULL, it usually crashes or exits. + +Several faults, including race situations and simple programming blunders, can cause NULL pointer to dereference concerns. In C/C++ languages, NULL pointer dereferences mistakes are widespread. A pointer is a data type in programming languages that refers to a memory location. The pointer is considered dereferenced once it has gotten the value of the location. When an application dereferences a pointer that should be a valid address but returns NULL, this is known as the NULL pointer dereference vulnerability. + +This type of vulnerability could affect software written in C/C++, Assembly, or any other language that uses pointers. + +The programmer assumes that the system has a property named "cmd" specified at all times. When an attacker takes control of the application's environment and removes "cmd," the software throws a NULL pointer exception when trying to invoke the trim() method. + + +### Potential Impact: + +In most cases, NULL pointer dereferences errors cause the application to crash, but in some cases, code execution is possible. This flaw can result in a denial of service attack against the entire system or be exploited to take complete control over it, depending on the application's privileges. + +When the null is equivalent to the 0x0 memory address and the secret code has access, it can write or read memory, leading to the code execution. + +Unless exception handling (on some systems) is available and implemented, NULL pointer differences usually result in the process of failing. Even when exception handling is utilized, returning software to a safe operation can be pretty challenging. + + +### Mitigations: + +Before utilizing a value, check the function's return value outputs to ensure it isn't NULL. + +Nearly all NULL pointer dereferences can be avoided if all pointers that could be updated are sanity-checked before usage. + +Validate input to variables and data stores that may accept input from a third party. + +Use automated static analysis techniques to look for this type of flaw. Several recent methods employ data flow analysis to reduce the number of false positives. ( This isn't a perfect solution because it's impossible to achieve 100% accuracy and coverage) + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/476.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509461251277012997) diff --git a/resources/cwe-522.md b/resources/cwe-522.md new file mode 100644 index 0000000..0e5875c --- /dev/null +++ b/resources/cwe-522.md @@ -0,0 +1,28 @@ +## SecurityExplained S-89 + +### CWE-522: Insufficiently Protected Credentials + +The product transfers or saves authentication credentials, but it does so improperly that it can be intercepted or retrieved by unauthorized individuals. + +This flaw relates to an architectural security approach that has been misdesigned. Another form of credential attack uses flaws in how passwords are encoded, saved, and handled by a web application, network, or software system. + +Risky development practices, such as storing passwords in insecure locations, storing credentials in plaintext, storing user passwords using poor or reproducible cryptographic techniques, or using hard-coded credentials, generate vulnerabilities that can be exploited to recover clients' credentials which can then be used to attack applications and other apps the user logs into. + +### Potential Impact: +An attacker could access user accounts and sensitive data stored within them. + +### Mitigation: + +To secure the credentials, use an appropriate security mechanism. + +Creating a firm password policy in your organization, such as prohibiting the use of passwords found in recent data breaches or well-known weak passwords, or encouraging the use of long, randomly generated passwords in conjunction with password managers, to improve security. + +• To protect the credentials, make proper use of cryptography. +• To secure credentials, follow industry best practices (e.g. LDAP, Keystore, etc.) + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/522.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509113963195219968) diff --git a/resources/cwe-611.md b/resources/cwe-611.md new file mode 100644 index 0000000..1d4f2b7 --- /dev/null +++ b/resources/cwe-611.md @@ -0,0 +1,43 @@ +## SecurityExplained S-91 + +### CWE-611: Improper Restriction of XML External Entity Reference + +Improper Restriction of XML External Entity Reference, or XXE, refers to a situation in which an XML parser is incorrectly set, allowing an attacker to connect directly with local or external files. + +When an application executes an XML document that contains entities pointing to external URIs, CWE-611 vulnerabilities can occur. These URIs resolve to assets outside the application's control, resulting in potentially dangerous execution of activities prescribed by the external assets. + + +An issue in parsing an XML file containing XML entities with URIs that potentially refer to documents beyond the intended place is the source of the flaw. If the program fails to check the path to documents before including them, the attacker can consist of any file from a local or remote system and have it displayed by the application. + +XML uses a tree-like structure of tags and data to store and convey data. A document type definition (DTD) can be found in an XML document, and its declarations describe the document's structure, data values, rights, and so on. The DTD might be embedded in the document or referenced from another location. You can specify "XML entities" in DTDs, which refer to values in the document in the same way that variables are used in programming languages. + +The XXE attack is based on the ability of the XML language to declare arbitrary entities using an external Data Type Definition (DTD) and the ability to read and execute files. + +### Potential Impact: + +The impact can range from local / remote file inclusion to remote command execution and entire system compromise, depending on the application's implementation and architecture. + +This vulnerability can also be exploited to execute internal network port scans on the affected machine or servers. + +The attacker may be able to access arbitrary files on the system if a malicious DTD is included and a default entity resolver is enabled. + +The DTD can include any HTTP request that the server can handle. Therefore, other attacks could be launched due to the server's trust connection with other entities. + +### Mitigations: + +This vulnerability is frequently introduced to the program during the architecture and design phase. Therefore, it is nearly impossible to mitigate this vulnerability without modifying the application source code in most circumstances. + +External entity expansion can be disabled in many XML parsers and validators. + +Allowing application functionality that parses XML documents should be avoided. + +Implement server-side input validation, filtering, or sanitization that is positive allowlisting to prohibit malicious data from entering XML documents or headers. + +Configure the XML parser so that no DTD declarations are validated or processed. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/611.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509795203900608513) diff --git a/resources/cwe-732.md b/resources/cwe-732.md new file mode 100644 index 0000000..e0819bf --- /dev/null +++ b/resources/cwe-732.md @@ -0,0 +1,35 @@ +## SecurityExplained S-88 + +### CWE-732: Incorrect Permission Assignment for Critical Resource + +The product defines permissions for a security-critical resource so that unwanted actors can read or modify it. +When a resource's permissions are set to allow access to a broader range of actors than is required, sensitive information may be exposed, or undesired parties may modify the resource. This is very risky when the resource is tied to program configuration, execution, or sensitive user data. + +This flaw arises due to the deployment of an architectural security strategy. The developer may make assumptions about the product's operating environment, such as that the software runs on a single-user system or is only available to trusted administrators. Permissions become a concern when the software is run in a different environment. +When the user starts the program, the developer may establish loose permissions to reduce difficulties, then add documentation saying that permissions should be tightened. However, because system administrators and users do not always read the documentation, insecure permissions may be kept unaltered. + + +# Example: +This code creates a new user's home directory and makes that user directory's owner. If the user does not have permission to own the new directory, the directory is removed. + + +The directory is created with the default permissions 0777 because the optional "mode" argument is absent from the call to mkdir(). Setting the new user as the directory's administrator does not modify the directory's permissions, which are still set to the default. Any user can read and write to the directory by default, allowing an exploit on the user's files. + +# Potential Impact: + +An attacker may be able to delete or damage essential data in the related resource, such as entries from a database, by destroying or corrupting it. +An attacker could exploit this vulnerability to read private information from the connected resource, such as credentials or configuration information stored in a file. +To obtain privileges, an attacker may change crucial attributes of the related resource, such as replacing a world-writable executable with Malware. + + +# Mitigations: +Check to verify whether a critical resource, such as a configuration file, has insecure permissions (such as being editable by any regular user) and generate an error or even quits the software if there is a chance an unauthorized person has updated the resource. + +Run the code in a "jail" or similar sandbox environment where strict limits separate the process and the operating system. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/732.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1508761138208514055) diff --git a/resources/cwe-787.md b/resources/cwe-787.md new file mode 100644 index 0000000..efd8d83 --- /dev/null +++ b/resources/cwe-787.md @@ -0,0 +1,39 @@ +## SecurityExplained S-61 + +### CWE-787: Out-of-bounds Write + +The Out-of-bounds Write is a software security vulnerability that occuers when the data is written beyond the boundaries (i.e. past the end, before the beginning) of the intended buffer. This weakness is also listed in the CWE TOP 25 (2021). This has been give the CWE ID as CWE-787 + +- This vulnerability could result into buffer overflows, memory corruption, crash of the software or even a code execution. As per the cwe.mitre.org, The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results. + +- An alternate term of this weakness is Memory Corruption. CWE website defines memory corruption as, The generic term "memory corruption" is often used to describe the consequences of writing to memory outside the bounds of a buffer, or to memory that is invalid, when the root cause is something other than a sequential copy of excessive data from a fixed starting location. This may include issues such as incorrect pointer arithmetic, accessing invalid pointers due to incomplete initialization or memory release, etc. + +- This weakness is usually introduced while the implementation phase of the software. This type of attacks are majorly observed in softwares based on C and C++ programming languages. + + +# Example Code + +- The following is an example of code that may result in a buffer underwrite, if find() returns a negative value to indicate that ch is not found in srcBuf: + +``` +(bad code) +Example Language: C +int main() { +... +strncpy(destBuf, &srcBuf[find(srcBuf, ch)], 1024); +... +} + +``` + +- If the index to srcBuf is somehow under user control, this is an arbitrary write-what-where condition. + + +- This vulnerability can be detected using the manual and automated static as well as dynamic analysis using fuzzing techniques. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/787.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1477258377252065281?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/cwe-798.md b/resources/cwe-798.md new file mode 100644 index 0000000..d81bafa --- /dev/null +++ b/resources/cwe-798.md @@ -0,0 +1,31 @@ +## SecurityExplained S-96 + +## CWE-798: Use of Hard-coded Credentials +Hard-coded credentials, such as a password or cryptographic key, are included in the software, which it uses for inbound authentication, outbound communication with external components, and internal data encryption. +The flaw exists due to hardcoded passwords, cryptographic keys, tokens, and other authentication credentials that cannot be modified in code. + +Hard-coded credentials usually leave a significant gap in the security system, allowing an attacker to bypass the software administrator's authentication. The system administrator may have a hard time detecting this flaw. Even if it is found, fixing it can be challenging. Thus the administrator may be forced to disable the product altogether. + +The following are the two primary variations: +Inbound: A default administrator account is generated in the Inbound variation, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each product installation. It usually is impossible for system administrators to change or disable it without directly editing the programme or updating the software. Anyone with knowledge of the password can access the product if it is ever found or released (a typical occurrence on the Internet). +Finally, massive attacks like supply-chain attacks will be possible because all programme installations will use the same password, even if they are from different businesses. + +2. Outbound: Front-end systems that authenticate with a back-end service are considered outbound. The back-end service may require a fixed password that can be easily obtained. Those back-end credentials could be hard-coded into the front-end software by the coder. Any user of that programme could extract the password. +Client-side systems with hard-coded passwords are considerably more dangerous because extracting a password from a binary is usually highly straightforward. + +This problem can affect any software with a management interface or scripting capability. + + +## Mitigations: + +If your application has hardcoded credentials that allow unauthorised remote access, you must immediately take action. It is recommended to block access to the impacted URLs or scripts in applications where source code updates are difficult or impossible to make (e.g. credentials are kept in an a.dll file in an ASP.NET application). +Store passwords, keys, and other credentials outside of the code in a password-protected, encrypted configuration file or database secured from all outsiders, even other local users on the same machine, for outbound authentication. + +For inbound authentication, deploy a "first login" option that requires the user to submit a unique, strong password or key rather than hard-coding a default username and password, key, or other authentication credentials for first-time logins. +It's also necessary to set up your Web Application Firewall (WAF) to restrict access to a website if the application receives hardcoded credentials via a request parameter. + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/798.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1511592046468902913) diff --git a/resources/cwe-862.md b/resources/cwe-862.md new file mode 100644 index 0000000..ec0a59c --- /dev/null +++ b/resources/cwe-862.md @@ -0,0 +1,33 @@ +## SecurityExplained S-94 + +## CWE-862: Missing Authorization +When an actor tries to access a resource or conduct an action, the software does not complete an authorization check. + +Authorization evaluates whether a user with a given identity can access a shared resource based on the user's privileges and any rights or other access-control criteria that apply to the asset. +Users can access data or conduct actions that they shouldn't be able to do if access control measures aren't in place. This can result in various issues, including data leakage, denial of service, and arbitrary code execution. + +This flaw arises from a neglected security approach during the architecture and design process. Authorization defects may occur when a single-user application is switched to a multi-user environment. +A developer may create authorization flaws because of a lack of awareness of the underlying technologies. For example, a developer might believe that attackers won't be able to change particular inputs like headers or cookies. + + +### Potential Impact: + +An attacker could read sensitive data by reading it straight from an unrestricted data store or by using improperly protected privileged functionality. + +An attacker may be able to gain access to, edit, or delete data for which they are not allowed. This can be pretty harmless (for example, seeing an admin console landing page but not being able to see any data) or extremely dangerous (for example (e.g. complete visibility into user data). + +### Mitigations: + +Separate the software into four sections: anonymous, regular, privileged, and administrative. You may reduce the attack surface by mapping roles to data and functions adequately. + +Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. + +Use a well-tested library or framework to prevent this flaw from arising or provide constructs that make it easy to avoid. Consider employing authorization frameworks like the JAAS Authorization Framework, for example. + +Confirm that the business logic carries out access control checks. These tests may differ from access control checks performed on more general resources such as files, connections, processes, RAM, and database records. + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/862.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1510835305019895808) diff --git a/resources/cwe-918.md b/resources/cwe-918.md new file mode 100644 index 0000000..bdc4a55 --- /dev/null +++ b/resources/cwe-918.md @@ -0,0 +1,41 @@ +## SecurityExplained S-90 + +### CWE-918: Server-Side Request Forgery (SSRF) +The web server receives a URL or similar request from an upstream component and obtains its contents, but it does not check that the request is routed to the correct destination. + +Malicious parties can use CWE-918, also known as server-side request forgeries (SSRF), to trick a server into making requests to obtain access to internal infrastructure, sensitive data, etc. + +The use of URLs helps identify the attack surface for SSRF. Although sanitization and allow lists are two more effective techniques available, they can be challenging to manage. + +Server-Side Request Forgery (SSRF) is an attack in which an attacker uses a web application's ability to make unauthorized requests to internal or external services. + +For example, if the program contains functionality that sends requests to other servers and the attacker can tamper with it, your web server can be turned into a proxy. As a result, an attacker can reach systems that are otherwise behind a firewall or access private resources on the local host itself, depending on the web server's settings. + +A malicious attacker can use this vulnerability to force a server-side application to send HTTP requests to their chosen domain. + +### Potential Impact: + +A typical example is information disclosure via a port scan of internal hosts and returned service banners enumerated. In certain circumstances, a detailed error message will be sent to indicate the port's status; in others, a time-based approach will be required. + +If a hosting provider hosts the application, it can reveal instance metadata, such as public SSH keys, credentials, and private IP address blocks. + +In rare situations, the vulnerability can be leveraged to access the contents of local files on the webserver. This is accomplished by employing a different handler: 'file:/'. An attacker may be able to view web application source code, configuration files, and other sensitive data. + +### Mitigations: + +Keep an allowlist of DNS or IP addresses that the web application is allowed to visit. + +If a denylist is required, ensure that all user input is thoroughly validated and that no private IP addresses are allowed. + +Avoid delivering raw responses from the server-side to the client-side by sanitizing all user input used in URLs and other requests. + +To restrict all superfluous traffic, use firewall policies or network access control rules. + +Assure that only HTTP(S) protocols can be used, and if different handlers are required, ensure that a robust allowlist is employed. It's also essential to avoid HTTP redirection. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/918.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509461251277012997) diff --git a/resources/feroxbuster-explained.md b/resources/feroxbuster-explained.md index c70092f..b19a77d 100644 --- a/resources/feroxbuster-explained.md +++ b/resources/feroxbuster-explained.md @@ -23,4 +23,5 @@ Feel free to ask questions related to "How do I perform Content Discovery", etc. ``` -#### Twitter Handle: @harshbothra_ \ No newline at end of file +#### Twitter Handle: @harshbothra_ +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1477541501311676417?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/getting-into-cybersecurity.md b/resources/getting-into-cybersecurity.md new file mode 100644 index 0000000..3d6bdce --- /dev/null +++ b/resources/getting-into-cybersecurity.md @@ -0,0 +1,3 @@ +## SecurityExplained S-65: How do I get Started in Cyber Security? — My Perspective & Learning Path! + +Blog: https://hbothra22.medium.com/how-do-i-get-started-in-cyber-security-my-perspective-learning-path-b53065189ba5 \ No newline at end of file diff --git a/resources/htmli-to-cloud-ssrf.md b/resources/htmli-to-cloud-ssrf.md index c3eccf9..fe5b38e 100644 --- a/resources/htmli-to-cloud-ssrf.md +++ b/resources/htmli-to-cloud-ssrf.md @@ -1,16 +1,18 @@ -### SecurityExplained S-4: Escalating HTML Injection to Cloud Metadata SSRF +### SecurityExplained S-4: Escalating HTML Injection to Cloud Metadata SSRF ``` -If you have found an HTML Injection vulnerability that allows you to load -2. If the iframe is loaded successfully and the interaction is received on the Collaborator, next step is to check for Metadata SSRF. -3. Now, perform the attack with the following payload (Specific to AWS): -4. If the loaded iframe contains "security credentials", you can perform further enumeration. -5. Also, if the application is rendering the HTML code in the "PDF", this attack is still possible, so worth trying. +2. If the iframe is loaded successfully and the interaction is received on the Collaborator, next step is to check for Metadata SSRF. +3. Now, perform the attack with the following payload (Specific to AWS): +4. If the loaded iframe contains "security credentials", you can perform further enumeration. +5. Also, if the application is rendering the HTML code in the "PDF", this attack is still possible, so worth trying. Here is the list of Metadata endpoints for different cloud service providers: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md#ssrf-url-for-cloud-instances -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1478394407095353346?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/intro-to-cwe.md b/resources/intro-to-cwe.md new file mode 100644 index 0000000..bd9f0ce --- /dev/null +++ b/resources/intro-to-cwe.md @@ -0,0 +1,48 @@ +## SecurityExplained S-60: + +### Introduction to CWE + +According to the official description, the CWE™ (Common Weakness Enumeration) is a community-developed list of software and hardware weakness types. + +It serves as a common language, a measuring stick for security tools, and as a line for weakness identification, mitigation, and prevention efforts. The list includes more than 924 Common Weakness in Software & Hardware. + +**There are multiple options available to look for a CWE such as:** +- By Software Development +- By Hardware Design +- By Research Concepts +- External Mappings such as (CWE TOP 25, OWASP TOP 10, Software Fault Pattern Cluster and more) + + +**The CWE TOP 25 is a list of top 25 most dangerous software weakness observed. These Weakness includes:** + +- Out-of-bounds Write +- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +- Out-of-bounds Read +- Improper Input Validation +- Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') +- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +- Use After Free +- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +- Cross-Site Request Forgery (CSRF) +- Unrestricted Upload of File with Dangerous Type +- Missing Authentication for Critical Function +- Integer Overflow or Wraparound +- Deserialization of Untrusted Data +- Improper Authentication +- NULL Pointer Dereference +- Use of Hard-coded Credentials +- Improper Restriction of Operations within the Bounds of a Memory Buffer +- Missing Authorization +- Incorrect Default Permissions +- Exposure of Sensitive Information to an Unauthorized Actor +- Insufficiently Protected Credentials +- Incorrect Permission Assignment for Critical Resource +- Improper Restriction of XML External Entity Reference +- Server-Side Request Forgery (SSRF) +- Improper Neutralization of Special Elements used in a Command ('Command Injection') + + + +MindMap Link: https://www.xmind.net/m/icrqti + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1477258377252065281?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/mfa-bypass.md b/resources/mfa-bypass.md new file mode 100644 index 0000000..939b96e --- /dev/null +++ b/resources/mfa-bypass.md @@ -0,0 +1,3 @@ +## SecurityExplained S-67: MFA Bypass Techniques + +Blog: https://hbothra22.medium.com/bypassing-the-protections-mfa-bypass-techniques-for-the-win-8ef6215de6ab \ No newline at end of file diff --git a/resources/path-traversal-file-upload.md b/resources/path-traversal-file-upload.md index dedf435..6126f37 100644 --- a/resources/path-traversal-file-upload.md +++ b/resources/path-traversal-file-upload.md @@ -1,15 +1,17 @@ -### SecurityExplained S-9: Path Traversal via File Upload +### SecurityExplained S-9: Path Traversal via File Upload ``` -File upload is a very interesting functionality and there are multiple attacks that are possible such as code execution, cross-site scripting and one of the functionality is "File Overwrite using Path Traversal" +File upload is a very interesting functionality and there are multiple attacks that are possible such as code execution, cross-site scripting and one of the functionality is "File Overwrite using Path Traversal" -Whenever you find a file upload functionality that stores the files on the backend instead of just processing the data for one time use, you may try following steps: +Whenever you find a file upload functionality that stores the files on the backend instead of just processing the data for one time use, you may try following steps: 1. Capture a file upload request. 2. In the filename parameter, change filename to "../../filename" and forward the request. -3. See, if the file is getting stored outside the expected directory, if 'yes', it is an issue. -4. Now, attempt to overwrite a system file and check if it is possible to overwrite the system file. +3. See, if the file is getting stored outside the expected directory, if 'yes', it is an issue. +4. Now, attempt to overwrite a system file and check if it is possible to overwrite the system file. Note: It is not recommended to overwrite a critical system file on the production system, make sure you take necessary permissions from the client before you perform such escalations. -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1480200369732931584?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/premium-feature-testing-methodology.md b/resources/premium-feature-testing-methodology - Copy.md similarity index 77% rename from resources/premium-feature-testing-methodology.md rename to resources/premium-feature-testing-methodology - Copy.md index 20c5a4b..99c1208 100644 --- a/resources/premium-feature-testing-methodology.md +++ b/resources/premium-feature-testing-methodology - Copy.md @@ -1,14 +1,14 @@ ### SecurityExplained S-7: My Methodology to Test Premium Features ``` -Premium Features are not widely tested by crowd due to the involvement of a purchase factor. However, the person who often invest some amount to purchase premium account & perform testing for premium feature abuse is less likely to go disappointed. +Premium Features are not widely tested by crowd due to the involvement of a purchase factor. However, the person who often invest some amount to purchase premium account & perform testing for premium feature abuse is less likely to go disappointed. -Below is my methodology to test for the Premium features: +Below is my methodology to test for the Premium features: [Without Purchase] 1. Fuzzing the API endpoints for find out the endpoints that are accessible to premium users. -2. Comparing the difference in the freemium vs premium accounts and creating a threat map of functionalities available in the premium account to make sure if it's really worth an investment. -3. Next, Checking the profile update functionality and if there is any "Response Parameters" such as "isSubscribed", trying to use mass assignment attack to gain premium features for free using the "Freemium Account". +2. Comparing the difference in the freemium vs premium accounts and creating a threat map of functionalities available in the premium account to make sure if it's really worth an investment. +3. Next, Checking the profile update functionality and if there is any "Response Parameters" such as "isSubscribed", trying to use mass assignment attack to gain premium features for free using the "Freemium Account". 4. Checking for the trial membership & trying to abuse the business logic to always re-issue the trial membership once finished (typically a 7 day membership is offered). 5. Performing enumeration/recon to find some API documents that may involve the API calls accessible to premium user. 6. Some applications use true-false request/response values to validate if a user is having access to premium features or not. Try using Burp's Match & Replace to see if you can replace these values whenever you browse the app & access the premium features. @@ -17,8 +17,10 @@ Below is my methodology to test for the Premium features: 1. Pay for a premium feature and cancel your subscription. If you get a refund but the feature is still usable, it's a monetary impact issue. 2. Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not. 3. Generating a site-map with the premium user and comparing it with the freemium user to find new endpoints. -4. Checking for privilege escalation attacks between these two users manually as well as using extensions such as Autorize. -5. Checking for payment gateway flows and payment tampering. +4. Checking for privilege escalation attacks between these two users manually as well as using extensions such as Autorize. +5. Checking for payment gateway flows and payment tampering. -Feel free to add more techniques if you know some! -``` \ No newline at end of file +Feel free to add more techniques if you know some! +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1479451102408065033?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/ruby-erb-ssti.md b/resources/ruby-erb-ssti.md new file mode 100644 index 0000000..6136ffc --- /dev/null +++ b/resources/ruby-erb-ssti.md @@ -0,0 +1,28 @@ +### SecurityExplained S-59: Ruby ERB SSTI + +``` +Server-Side Template Injection (SSTI) vulnerabilities occurs when an user-supplied data is inserted into a template and insecurely evaluated as an expression by the template engine. This may allow an attacker to trick the template engine into evaluation an expression that could allow an attacker to execute system commands or gain a remote shell. + +To look for template injection vulnerability, it is essential to enumerate and know if the template engine is in use. If the application uses template engine, the next thing is to know what language based template injection is used and what all classes and methods are accessible that could be chained together to perform the desired action. + +# Looking for Template Injection in Ruby ERB: + +1. Let's assume the target application is running Ruby and a specific input field/functionality looks like using a template engine. +2. Now, try a simple payload like: <%=7*7%> +3. If the output is "49", it is confirmed that the application makes use of Ruby ERB Template Engine. + + +After confirming the template engine as Ruby ERB, one can try for following payloads for actions such as local file read or command execution: + +<%= system('cat /etc/passwd') %> +<%= `ls /` %> +<%= IO.popen('ls /').readlines() %> +<% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%> +<% require 'open4' %><% @a,@b,@c,@d=Open4.popen4('whoami') %><%= @c.readline()%> + + +A detailed write up on Ruby ERB Template Injection by TrustedSec: https://www.trustedsec.com/blog/rubyerb-template-injection/ + +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1498324305872318464) diff --git a/resources/rustscan-portscanner.md b/resources/rustscan-portscanner.md index 3e626ae..d8df10e 100644 --- a/resources/rustscan-portscanner.md +++ b/resources/rustscan-portscanner.md @@ -1,11 +1,11 @@ -### SecurityExplained S-11: RustScan - The Modern Port Scanner +### SecurityExplained S-11: RustScan - The Modern Port Scanner ``` -- RustScan is a port scanner written using Rust programming. The tool utilizes adaptive learning model to improvise itself over the time, i.e. more you use the tool, better it becomes. +- RustScan is a port scanner written using Rust programming. The tool utilizes adaptive learning model to improvise itself over the time, i.e. more you use the tool, better it becomes. # Tool Repo: https://github.com/RustScan/RustScan/ -- It is mentioned on the official repo that this tool can do following: +- It is mentioned on the official repo that this tool can do following: - Scans all 65k ports in 3 seconds. - Full scripting engine support. Automatically pipe results into Nmap, or use our scripts (or write your own) to do whatever you want. - Adaptive learning. RustScan improves the more you use it. No bloated machine learning here, just basic maths. @@ -18,4 +18,6 @@ There are two main points that makes this tool my new preffered choice for the P Installation Guide: https://github.com/RustScan/RustScan/wiki/Installation-Guide -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1480905854433988611?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/scope-based-recon.md b/resources/scope-based-recon.md new file mode 100644 index 0000000..ff4d678 --- /dev/null +++ b/resources/scope-based-recon.md @@ -0,0 +1,3 @@ +## SecurityExplained S-66: Scope Based Recon Methodology: Exploring Tactics for Smart Recon + +Blog: https://hbothra22.medium.com/scope-based-recon-smart-recon-tactics-7e72d590eae5 \ No newline at end of file diff --git a/resources/vulnerabilities-in-cookies.md b/resources/vulnerabilities-in-cookies.md new file mode 100644 index 0000000..fca66ac --- /dev/null +++ b/resources/vulnerabilities-in-cookies.md @@ -0,0 +1,3 @@ +## SecurityExplained S-64: Vulnerabilities in Cookie Based Authentication + +Blog: https://hbothra22.medium.com/got-cookies-cookie-based-authentication-vulnerabilities-in-wild-55fa7c374be0 diff --git a/resources/vulnerable-code-1.md b/resources/vulnerable-code-1.md index ed133e3..18af4d9 100644 --- a/resources/vulnerable-code-1.md +++ b/resources/vulnerable-code-1.md @@ -1,12 +1,31 @@ ### SecurityExplained S-12: Vulnerable Code Snippet - 1 - -#### Vulnerable Code: +#### Vulnerable Code: ![Vulnerable Code](../media/code-1.png) +#### Solution: -#### Solution: The above code is vulnerable to cross-site scripting attacks due to improper filtration! The encoding is missing a single quote (') and it is possible to execute an XSS with payloads such as: '+alert(1)+'. -##### Code Credits: OWASP Secure Coding Dojo \ No newline at end of file +This is example of JSP code, <% %> tags are used in Java Servlet Pages to dynamically generate servlets using Java syntax. Here, escapeHtml4 is being used from StringEscapeUtils library whose main purpose is quite obvious from its name i.e to escape characters given in a string as input. + +As mentioned [here]() in the official documentation of StringEscapeUtils, the escapeHtml4 does not supports the encoding of apostrophe (') character. + +Hence, entering the payload ` '+alert+'` will result in XSS pop up as apostrophes go unescaped by the function. + +The resulting javascript code looks something like this after replacing our payload + +`document.cookie = 'search='+alert(1)+''; ` + +Hence the alert(1) executes, you can verify it by running this piece of code in your browser's console. + +One way to fix this is to manually encode apostrophe by using `replace` with function + +``` +String searchTxt = StringEscapeUtils.escapeHtml4(request.getParameter("search")).replace("'","'"); +``` + +##### Code Credits: OWASP Secure Coding Dojo + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1481257258734727171?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-10.md b/resources/vulnerable-code-10.md new file mode 100644 index 0000000..4741268 --- /dev/null +++ b/resources/vulnerable-code-10.md @@ -0,0 +1,13 @@ +### SecurityExplained S-22: Vulnerable Code Snippet - 10 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-10.jpg) + +#### Solution: + +The code is vulnerable to authentication bypass vulnerability. An attacker can impersonate and login as any user as at the line-10 the code doesn't validate the JWT signature. + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1484947412443545602?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-11.md b/resources/vulnerable-code-11.md new file mode 100644 index 0000000..37aed58 --- /dev/null +++ b/resources/vulnerable-code-11.md @@ -0,0 +1,13 @@ +### SecurityExplained S-23: Vulnerable Code Snippet - 11 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-11.jpg) + +#### Solution: + +This answer is by SonarSource: There are two ways to serialize classes in PHP, both with O: and C:. The second encoding mode is not supported by the blocklist, and arbitrary objects could then be deserialized! It's not enough to get RCE, but it's a good start. + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1485315700998938625?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-12.md b/resources/vulnerable-code-12.md new file mode 100644 index 0000000..fd9e76c --- /dev/null +++ b/resources/vulnerable-code-12.md @@ -0,0 +1,13 @@ +### SecurityExplained S-24: Vulnerable Code Snippet - 12 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-12.jpg) + +#### Solution: + +The code is vulnerable to prototype pollution that could even lead to remote code execution. The statement in line 12 uses a dangerous pattern that allows for Prototype Pollution. When type is set to **proto**, then id and content can specify a key and value that will be set on Object.prototype. + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1485639304861069313?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-13.md b/resources/vulnerable-code-13.md new file mode 100644 index 0000000..ac5437d --- /dev/null +++ b/resources/vulnerable-code-13.md @@ -0,0 +1,13 @@ +### SecurityExplained S-25: Vulnerable Code Snippet - 13 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-13.jpg) + +#### Solution: + +The code is vulnerable remote code execution vulnerability via Path Traversal. Payload like this works: ?dir=

.

.

/

.

.

/

.

./user/profile.png + +##### Code Credits: Octagon Networks + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1486000043165634562?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-14.md b/resources/vulnerable-code-14.md new file mode 100644 index 0000000..221f1c8 --- /dev/null +++ b/resources/vulnerable-code-14.md @@ -0,0 +1,13 @@ +### SecurityExplained S-26: Vulnerable Code Snippet - 14 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-14.jpg) + +#### Solution: + +The code is vulnerable to code execution due to use of array_map() function. An attacker can perform attack like: array.php?map=phpinfo, that execute phpinfo() in it. + +##### Code Credits: Octagon Networks + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1486375951084961792?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-15.md b/resources/vulnerable-code-15.md new file mode 100644 index 0000000..0db9563 --- /dev/null +++ b/resources/vulnerable-code-15.md @@ -0,0 +1,13 @@ +### SecurityExplained S-27: Vulnerable Code Snippet - 15 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-15.jpg) + +#### Solution: + +As per SonarSource, There is a ToCToU (Time of Check - Time of Use) bug: if the file does not exist at the time of the checks, they will be skipped. Attackers could create a symlink at /tmp/logs.txt right before the call to fopen(), and write to an unintended destination! It's very common to find file checks vulnerable to such ToCToU bugs. The best ways to avoid it is to perform these operations in folders with restrictive permissions and prefer file descriptors to paths (fstat, etc). + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1486753867047997442?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-16.md b/resources/vulnerable-code-16.md new file mode 100644 index 0000000..0d85aeb --- /dev/null +++ b/resources/vulnerable-code-16.md @@ -0,0 +1,15 @@ +### SecurityExplained S-28: Vulnerable Code Snippet - 16 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-16.jpg) + +#### Solution: + +The code is vulnerable to XXE attack because the use of the `LIBXML_NOENT` enables the external entity loading in php8. + +Similar Issue: https://blog.sonarsource.com/wordpress-xxe-security-vulnerability + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1487080467861889030?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-17.md b/resources/vulnerable-code-17.md new file mode 100644 index 0000000..7f67475 --- /dev/null +++ b/resources/vulnerable-code-17.md @@ -0,0 +1,13 @@ +### SecurityExplained S-29: Vulnerable Code Snippet - 17 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-17.jpg) + +#### Solution: + +As per @SonarSource, isPrivileged() will always return true because casting an int to an int-based enum never throws an exception, even if there is no enum member corresponding to that number. To make the check correct, it has to return PrivRoles.IsDefined((PrivRoles) role). + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1487434398186508294?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-18.md b/resources/vulnerable-code-18.md new file mode 100644 index 0000000..d865e0c --- /dev/null +++ b/resources/vulnerable-code-18.md @@ -0,0 +1,20 @@ +### SecurityExplained S-30: Vulnerable Code Snippet - 18 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-18.jpg) + +#### Solution: + +As per SonarSource, At line 9, the email is transformed to uppercase before its use in the SQL query. On Unicode characters, this process has the unintended effect that two distinct code points may result in the same one. + +It can be used to send the password reset token to another email and takeover accounts: + +foo@mix.com -> FOO@MIX.com +foo@mıhttp://x.com -> FOO@MIX.com + +Interesting Blog: https://t.co/UxdZJQxzc1 + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1487850861770731520?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-19.md b/resources/vulnerable-code-19.md new file mode 100644 index 0000000..6bac9d0 --- /dev/null +++ b/resources/vulnerable-code-19.md @@ -0,0 +1,13 @@ +### SecurityExplained S-31: Vulnerable Code Snippet - 19 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-19.jpg) + +#### Solution: + +As per @SonarSource, The regex at line 7 is correct in itself as it checks for the right characters. The bug lies in the g flag; it makes the regex object retain the last match index and will continue after that index when .test() is called again. Attackers could still use quotes, and perform the SQL injection, by sending their request two times in a row: the second regex check will start after the quote. + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1488191330493014018?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-2.md b/resources/vulnerable-code-2.md index 8711cfb..55f88b1 100644 --- a/resources/vulnerable-code-2.md +++ b/resources/vulnerable-code-2.md @@ -1,16 +1,16 @@ ### SecurityExplained S-13: Vulnerable Code Snippet - 2 - -#### Vulnerable Code: +#### Vulnerable Code: ![Vulnerable Code](../media/code-2.jpg) +#### Solution: -#### Solution: -The above code is vulnerable to cross-site scripting attack as it can be observed that on the line 15, a handler for message events is registered which writes the event's data in the DOM on the line 13. -It is possible to embed this page and send an event with an XSS payload to execute a successful attack. +The above code is vulnerable to cross-site scripting attack as it can be observed that on the line 15, a handler for message events is registered which writes the event's data in the DOM on the line 13. +It is possible to embed this page and send an event with an XSS payload to execute a successful attack. Similar Bug: https://blog.sonarsource.com/ghost-admin-takeover +##### Code Credits: SonarSource -##### Code Credits: SonarSource \ No newline at end of file +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1481606121991598081?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-20.md b/resources/vulnerable-code-20.md new file mode 100644 index 0000000..5d47c52 --- /dev/null +++ b/resources/vulnerable-code-20.md @@ -0,0 +1,13 @@ +### SecurityExplained S-33: Vulnerable Code Snippet - 20 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-20.jpg) + +#### Solution: + +As per @SonarSource, The problem lies with the server reading 16 bytes on line 13 into its buffer without making sure that the string is null-terminated (the last byte of the buffer is null). Sending 16 non-null bytes to the server will return them and the adjacent buffer containing sensitive data! + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1488907363184566275?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-21.md b/resources/vulnerable-code-21.md new file mode 100644 index 0000000..2cfaa5d --- /dev/null +++ b/resources/vulnerable-code-21.md @@ -0,0 +1,13 @@ +### SecurityExplained S-34: Vulnerable Code Snippet - 21 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-21.jpg) + +#### Solution: + +As per @SonarSource, This risk of DNS rebinding is always easy to overlook: Dns.GetHostEntry() does a first DNS query, validates the result against the allow-list, and then WebRequest does a second DNS query. Both DNS queries can have a different response, and unintended servers could be reached that way. Always work with the value you first validated! + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1489280271640055809?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-22.md b/resources/vulnerable-code-22.md new file mode 100644 index 0000000..074c473 --- /dev/null +++ b/resources/vulnerable-code-22.md @@ -0,0 +1,15 @@ +### SecurityExplained S-35: Vulnerable Code Snippet - 22 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-22.jpg) + +#### Solution: + +As per @SonarSource, Arbitrary arguments can be added to the tar command, e.g. by creating a file named “-I touch shell” in /opt/webapp. The -I argument allows executing an arbitrary command, here “touch shell”. --checkpoint-action works too. + +Twitter Thread: https://twitter.com/harshbothra_/status/1489630710025830400 + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1489630648159846400?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-23.md b/resources/vulnerable-code-23.md new file mode 100644 index 0000000..3148614 --- /dev/null +++ b/resources/vulnerable-code-23.md @@ -0,0 +1,12 @@ +### SecurityExplained S-36: Vulnerable Code Snippet - 23 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-23.jpg) + + +#### Solution: +The code utilizes XPath queries and due to lack of sanitization on line-14, it is possible to perform XPATH injection. + +Twitter Thread: https://twitter.com/harshbothra_/status/1489896229970792449 +##### Code Credits: SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-24.md b/resources/vulnerable-code-24.md new file mode 100644 index 0000000..059aa1c --- /dev/null +++ b/resources/vulnerable-code-24.md @@ -0,0 +1,14 @@ +### SecurityExplained S-37: Vulnerable Code Snippet - 24 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-24.jpg) + + +#### Solution: + +The above code is vulnerable to Local File Inclusion (LFI) due to improper sanitization on receiving user input on line-11 and line-12. An attacker may attempt to submit a malicious payload and gain access to internal files. + +Twitter Thread: https://twitter.com/harshbothra_/status/1490320844962377728 + +##### Code Credits: @ChetanyaKunndra \ No newline at end of file diff --git a/resources/vulnerable-code-25.md b/resources/vulnerable-code-25.md new file mode 100644 index 0000000..10a0fad --- /dev/null +++ b/resources/vulnerable-code-25.md @@ -0,0 +1,20 @@ +### SecurityExplained S-38: Vulnerable Code Snippet - 25 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-25.jpg) + + +#### Solution: + +The above code is vulnerable to Remote Code Execution. The code implements a black-list based filter on line-15 which can be bypassed if the payload meets the following requirements: +* Is inside a quote to not take advantage of the bash CLI [Ex: "$(whoami)" ] +* Do not use any of the blacklist chars inside the $(...). +* Execute a system command of any kind that is proven to execute. + +It is recommended to use a whitelist instead and also not use system cmd calls to make a task instead use a built-in function and create an own function that does the same without using os.system(ls). + + +Twitter Thread: https://twitter.com/harshbothra_/status/1490513142375333889 + +##### Code Credits: @Brumens2 diff --git a/resources/vulnerable-code-26.md b/resources/vulnerable-code-26.md new file mode 100644 index 0000000..04ee091 --- /dev/null +++ b/resources/vulnerable-code-26.md @@ -0,0 +1,16 @@ +### SecurityExplained S-39: Vulnerable Code Snippet - 26 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-26.jpg) + + +#### Solution: + +This code demonstrates a basic SQL Injection vulnerability. As observed in the code, there is no sanitization performed & the user-controlled input is directly supplied. Looking at Line-19, it can be clearly seen as an SQLi issue. + + +Twitter Thread: https://twitter.com/harshbothra_/status/1490792057597616128 + +##### Code Credits: @ChetanyaKunndra + \ No newline at end of file diff --git a/resources/vulnerable-code-27.md b/resources/vulnerable-code-27.md new file mode 100644 index 0000000..7c3fa6d --- /dev/null +++ b/resources/vulnerable-code-27.md @@ -0,0 +1,22 @@ +### SecurityExplained S-40: Vulnerable Code Snippet - 27 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-27.jpg) + + +#### Solution: + +This code is vulnerable to Cross-Site Scripting (XSS) attack. Example Payload: \"onload=alert(1)// + +This payload works because the "replace()" function in PHP do not properly replace the user input. The first replacement works fine replace('\"', '') but when it later replace('\\', '\\\\'), the issue occurs. The issue is that the replacement for '"' is first and coverted to '\"'. When the other replace statement is called it sees '\"' and replace the '\' with a duel backslash '\\' but this in fact destroys the filter itself. + +Example: +value = "\\"" + + + +Twitter Thread: https://twitter.com/harshbothra_/status/1491160060076376065 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-28.md b/resources/vulnerable-code-28.md new file mode 100644 index 0000000..7a4b8ea --- /dev/null +++ b/resources/vulnerable-code-28.md @@ -0,0 +1,18 @@ +### SecurityExplained S-41: Vulnerable Code Snippet - 28 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-28.jpg) + + +#### Solution: + + +@Brumens2 explained that this code is vulnerable to Insecure Direct Object Reference. The issue is that the if statement do check with "==" and not "&&" on line-17. This means if irrespective of "true" or "false" condition, it will grant the permission. + + + +Twitter Thread: https://twitter.com/harshbothra_/status/1491644512204394498 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-29.md b/resources/vulnerable-code-29.md new file mode 100644 index 0000000..fc1a3c4 --- /dev/null +++ b/resources/vulnerable-code-29.md @@ -0,0 +1,18 @@ +### SecurityExplained S-42: Vulnerable Code Snippet - 29 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-29.jpg) + + +#### Solution: + + +This code is vulnerable to cross-site scripting (XSS) as an attacker can perform successful attack by supplying malicious payload in the user_comment parameter. With some interesting response from the community, it looks like the code is also vulnerable to IDOR. + + + +Twitter Thread: https://twitter.com/harshbothra_/status/1491972760343621632 + +##### Code Credits: @ChetanyaKunndra + \ No newline at end of file diff --git a/resources/vulnerable-code-3.md b/resources/vulnerable-code-3.md index 7d5758c..dad54cd 100644 --- a/resources/vulnerable-code-3.md +++ b/resources/vulnerable-code-3.md @@ -1,17 +1,17 @@ ### SecurityExplained S-15: Vulnerable Code Snippet - 3 - -#### Vulnerable Code: +#### Vulnerable Code: ![Vulnerable Code](../media/code-3.jpg) +#### Solution: -#### Solution: - -The issue lies in the line 11 due to the use of "os.path.join()" and the issue here is an attacker can read arbitrary files by supplying malicious paylod through img variable. +The issue lies in line 11 due to the use of "os.path.join()" and the issue here is an attacker can read arbitrary files by supplying malicious payload through img variable. As per the documentation, when the values passed in "os.path.join()" & one of the paths to concatenate is absolute, previous values will be ignored. -Hence, here the string passed in "os.path.join(harsh,/etc/passwd)" return as "/etc/passwd" resulting into accessing the sensitive file. +Hence, here the string passed in "os.path.join(harsh,/etc/passwd)" return as "/etc/passwd" resulting into accessing the sensitive file. + +##### Code Credits: SonarSource -##### Code Credits: SonarSource \ No newline at end of file +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1482316119101030411?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-30.md b/resources/vulnerable-code-30.md new file mode 100644 index 0000000..cfb285f --- /dev/null +++ b/resources/vulnerable-code-30.md @@ -0,0 +1,19 @@ +### SecurityExplained S-43: Vulnerable Code Snippet - 30 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-30.jpg) + + +#### Solution: + + +This code is vulnerable to SSTI and as a result, an attacker may attempt to gain RCE. The code uses "user input" to search in its store. However, it does not filter the return value of the template render. + +Ex Payload: {{10-6}} => 4 + + +Twitter Thread: https://twitter.com/harshbothra_/status/1492332636756398083 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-31.md b/resources/vulnerable-code-31.md new file mode 100644 index 0000000..419250e --- /dev/null +++ b/resources/vulnerable-code-31.md @@ -0,0 +1,17 @@ +### SecurityExplained S-44: Vulnerable Code Snippet - 31 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-31.jpg) + + +#### Solution: + +This code connects to the backend database & its purpose is to change the username inside the profile page. It first checks the username "id" by user input and runs a SQL statement to extract the current username for that user. The issue is that user input is not filtered. If you infect the "id" when it's reading the user input. It does not convert the "id" variable into an (int) type or filters it. This makes it possible to get access to the database fully by executing a SQL Injection. + +Example Payload: sleep(1): Will sleep "x" row that is in the table. At "line 24". + +Twitter Thread: https://twitter.com/harshbothra_/status/1492657271662206976 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-32.md b/resources/vulnerable-code-32.md new file mode 100644 index 0000000..0da1143 --- /dev/null +++ b/resources/vulnerable-code-32.md @@ -0,0 +1,15 @@ +### SecurityExplained S-45: Vulnerable Code Snippet - 32 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-32.jpg) + + +#### Solution: + +This code is vulnerable to open redirection attack as the function "get_success_url" on line-27 doesn't properly implement the checks and the "Next" parameter is not using any whitelists. This may result into a redirection issue. + +Twitter Thread: https://twitter.com/harshbothra_/status/1493042310589947906 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-33.md b/resources/vulnerable-code-33.md new file mode 100644 index 0000000..f450072 --- /dev/null +++ b/resources/vulnerable-code-33.md @@ -0,0 +1,15 @@ +### SecurityExplained S-46: Vulnerable Code Snippet - 33 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-33.jpg) + + +#### Solution: + +This code is vulnerable to RCE via SSTI due to improper filtration. Additionally, the replace() function is case sensitive and the filters can be bypassed by case juggling to execute an XSS attack as well. + +Twitter Thread: https://twitter.com/harshbothra_/status/1493412245404938241 + +##### Code Credits: @0xryuk + \ No newline at end of file diff --git a/resources/vulnerable-code-34.md b/resources/vulnerable-code-34.md new file mode 100644 index 0000000..0cb7473 --- /dev/null +++ b/resources/vulnerable-code-34.md @@ -0,0 +1,15 @@ +### SecurityExplained S-47: Vulnerable Code Snippet - 34 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-34.jpg) + + +#### Solution: + +This code is vulnerable IDOR as the user_id and record_id are not properly protected by the authorization verification and as a result an attacker who can guess/know these two parameters can access other user's information. + +Twitter Thread: https://twitter.com/harshbothra_/status/1493789734392373253 + +##### Code Credits: @ChetanyaKunndra + \ No newline at end of file diff --git a/resources/vulnerable-code-35.md b/resources/vulnerable-code-35.md new file mode 100644 index 0000000..e43b8ba --- /dev/null +++ b/resources/vulnerable-code-35.md @@ -0,0 +1,16 @@ +### SecurityExplained S-48: Vulnerable Code Snippet - 35 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-35.jpg) + + +#### Solution: + +The code is vulnerable to XSS and LFI. The focus of this code is that the filename can be used as a payload to execute JavaScript and perform an XSS attack. +When filtering a function always remember that it's more than one bug that can be exploited in it. For example this is highly vulnerable to LFI but it's also vulnerable to XSS. + +Twitter Thread: https://twitter.com/harshbothra_/status/1494127206552985605 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-36.md b/resources/vulnerable-code-36.md new file mode 100644 index 0000000..35f9698 --- /dev/null +++ b/resources/vulnerable-code-36.md @@ -0,0 +1,14 @@ +### SecurityExplained S-49: Vulnerable Code Snippet - 36 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-36.jpg) + + +#### Solution: + +This code is vulnerable to Server-Side Request Forgery due to improper filtration in the "connName". An attacker can abuse it perform the attack successfully. + +Twitter Thread: https://twitter.com/harshbothra_/status/1494127206552985605 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-37.md b/resources/vulnerable-code-37.md new file mode 100644 index 0000000..ac3e9a5 --- /dev/null +++ b/resources/vulnerable-code-37.md @@ -0,0 +1,14 @@ +### SecurityExplained S-50: Vulnerable Code Snippet - 37 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-37.jpg) + + +#### Solution: + +This code is vulnerable to Host Header Injection as the code takes the value of HOST in the password reset link from request itself. This may allow an attacker to inject arbitrary host in the password reset link and get hold of the valid reset token to perform a successful password reset attack. + +Twitter Thread: https://twitter.com/harshbothra_/status/1494777872929542144 + +##### Code Credits: @Brumens2 \ No newline at end of file diff --git a/resources/vulnerable-code-38.md b/resources/vulnerable-code-38.md new file mode 100644 index 0000000..cfa068e --- /dev/null +++ b/resources/vulnerable-code-38.md @@ -0,0 +1,14 @@ +### SecurityExplained S-51: Vulnerable Code Snippet - 38 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-38.jpg) + + +#### Solution: + +The code is vulnerable to DOM-based XSS and allows execution of XSS using "s" parameter using payloads like: x'onmouseover=alert(1)// + +Twitter Thread: https://twitter.com/harshbothra_/status/1495224184611524608 + +##### Code Credits: @Brumens2 \ No newline at end of file diff --git a/resources/vulnerable-code-39.md b/resources/vulnerable-code-39.md new file mode 100644 index 0000000..4457599 --- /dev/null +++ b/resources/vulnerable-code-39.md @@ -0,0 +1,14 @@ +### SecurityExplained S-52: Vulnerable Code Snippet - 39 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-39.jpg) + + +#### Solution: + +This code is vulnerable to XPATH Injection. 🥷 + +Twitter Thread: https://twitter.com/harshbothra_/status/1495542532784246784 + +##### Code Credits: @SonarSources \ No newline at end of file diff --git a/resources/vulnerable-code-4.md b/resources/vulnerable-code-4.md index dd6c5b4..19b6cd1 100644 --- a/resources/vulnerable-code-4.md +++ b/resources/vulnerable-code-4.md @@ -1,12 +1,13 @@ ### SecurityExplained S-16: Vulnerable Code Snippet - 4 -#### Vulnerable Code: +#### Vulnerable Code: ![Vulnerable Code](../media/code-4.jpg) - -#### Solution: +#### Solution: The issue in this code snippet is the use of Blacklist (Denylist) instead of using a Whitelist (Allowlist). An attacker can bypass this protection in multiple ways and upload a malicious file on the server. -##### Code Credits: SonarSource \ No newline at end of file +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1482740498683285506?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-40.md b/resources/vulnerable-code-40.md new file mode 100644 index 0000000..ca0ff85 --- /dev/null +++ b/resources/vulnerable-code-40.md @@ -0,0 +1,14 @@ +### SecurityExplained S-53: Vulnerable Code Snippet - 40 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-40.jpg) + + +#### Solution: + +This code is vulnerable to Local File Inclusion as the backslash character can be used in a path traversal attack (..\) to disclose arbitrary files from the (Windows) host. + +Twitter Thread: https://twitter.com/harshbothra_/status/1495950722000580608 + +##### Code Credits: @SonarSources \ No newline at end of file diff --git a/resources/vulnerable-code-41.md b/resources/vulnerable-code-41.md new file mode 100644 index 0000000..096fd27 --- /dev/null +++ b/resources/vulnerable-code-41.md @@ -0,0 +1,14 @@ +### SecurityExplained S-54: Vulnerable Code Snippet - 41 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-41.jpg) + + +#### Solution: + +This code is vulnerable to CORS misconfiguration as can be observed on line-14. User-provided data, such as URL parameters, POST data payloads, or cookies, should always be considered untrusted and tainted. Applications constructing HTTP response headers based on tainted data could allow attackers to change security sensitive headers like Cross-Origin Resource Sharing headers. + +Twitter Thread: https://twitter.com/harshbothra_/status/1496326447954341891 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-42.md b/resources/vulnerable-code-42.md new file mode 100644 index 0000000..9d0f0fb --- /dev/null +++ b/resources/vulnerable-code-42.md @@ -0,0 +1,17 @@ +### SecurityExplained S-55: Vulnerable Code Snippet - 42 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-42.jpg) + + +#### Solution: + +This code is vulnerable to multiple security vulnerabilities: +1. The token generation algorithm is SHA-1 which is known to collision attacks and is not a best practice to use it. +2. There is a possibility of account takeover based on the actual implementation as an attacker may attempt to inject emails to get it routed to attacker email along with victim email. +3. This also looks vulnerable to Host Header Injection attack. + +Twitter Thread: https://twitter.com/harshbothra_/status/1496668703181651972 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-43.md b/resources/vulnerable-code-43.md new file mode 100644 index 0000000..f6a1895 --- /dev/null +++ b/resources/vulnerable-code-43.md @@ -0,0 +1,14 @@ +### SecurityExplained S-56: Vulnerable Code Snippet - 43 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-43.jpg) + + +#### Solution: + +This code is vulnerable to Command Injection as an attacker can inject malicious shell commands into the name of an uploaded file by using characters such as ";" or "`" to start a new command. + +Twitter Thread: https://twitter.com/harshbothra_/status/1496993342378242063 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-44.md b/resources/vulnerable-code-44.md new file mode 100644 index 0000000..feee118 --- /dev/null +++ b/resources/vulnerable-code-44.md @@ -0,0 +1,15 @@ +### SecurityExplained S-57: Vulnerable Code Snippet - 44 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-44.jpg) + + +#### Solution: + +As per @SonarSource, there is an XSS issue but maybe not as expected. Razor takes care of output encoding for ViewData in line 4. However, ViewData also overwrites the static content in ViewBag & there is an XSS in line 2. +Read More: https://sonarcloud.io/project/issues?id=SonarSourceResearch_2020_calendar_22&open=AXY4_4rsU9JBkqHd22a1&resolved=false&types=VULNERABILITY + +Twitter Thread: https://twitter.com/harshbothra_/status/1497431227451777027 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-45.md b/resources/vulnerable-code-45.md new file mode 100644 index 0000000..5f358ca --- /dev/null +++ b/resources/vulnerable-code-45.md @@ -0,0 +1,14 @@ +### SecurityExplained S-58: Vulnerable Code Snippet - 45 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-45.jpg) + + +#### Solution: + +This code is vulnerable to Path Traversal Attack. More information could be found here: https://sonarcloud.io/summary/overall?id=SonarSourceResearch_2020_calendar_15 + +Twitter Thread: https://twitter.com/harshbothra_/status/1497776001018859523 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-46.md b/resources/vulnerable-code-46.md new file mode 100644 index 0000000..e03b600 --- /dev/null +++ b/resources/vulnerable-code-46.md @@ -0,0 +1,15 @@ +### SecurityExplained S-62: Vulnerable Code Snippet - 46 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-46.jpg) + + +#### Solution: + +The code is vulnerable to File Upload Bypass attacks. Due to a lack of whitelist utilization, it is possible to bypass the extension check and upload a malicious files. + +Twitter Thread: https://twitter.com/harshbothra_/status/1499322445265661956 + +##### Code Credits: @0xRyuk + \ No newline at end of file diff --git a/resources/vulnerable-code-47.md b/resources/vulnerable-code-47.md new file mode 100644 index 0000000..a6db44f --- /dev/null +++ b/resources/vulnerable-code-47.md @@ -0,0 +1,19 @@ +### SecurityExplained S-68: Vulnerable Code Snippet - 47 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-47.jpg) + + +#### Solution: + +The code takes input into a fwrite() and gives it the function include() which use "stream_get_meta_data" to read headers and metadata for later use. The '$input' is inserted into fwrite() without any filter. +This makes it possible to infect a new "" tag and execute php code. + +Exploit Payload: + + +Twitter Thread: https://twitter.com/harshbothra_/status/1501384795623882758 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-48.md b/resources/vulnerable-code-48.md new file mode 100644 index 0000000..9355746 --- /dev/null +++ b/resources/vulnerable-code-48.md @@ -0,0 +1,18 @@ +### SecurityExplained S-69: Vulnerable Code Snippet - 48 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-48.jpg) + + +#### Solution: + +The code checks if the username is "admin" should be the only user that is allowed to add new comments. The code does use the function "strtolower()". + +This means if a user registers a new account with the username as "ADMIN" that do not have the privileges. The user is still able to add a new comment +and the filter is bypassed. + +Twitter Thread: https://twitter.com/harshbothra_/status/1501738369990070275 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-49.md b/resources/vulnerable-code-49.md new file mode 100644 index 0000000..d9a8948 --- /dev/null +++ b/resources/vulnerable-code-49.md @@ -0,0 +1,19 @@ +### SecurityExplained S-70: Vulnerable Code Snippet - 49 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-49.png) + + +#### Solution: + +This code is vulnerable to LDAP Injection. User-provided data such as URL parameters should always be considered as untrusted and tainted. Constructing LDAP names or search filters directly from tainted data enables attackers to inject specially crafted values that changes the initial meaning of the name or filter itself. Successful LDAP injections attacks can read, modify or delete sensitive information from the directory service. + +Within LDAP names, the special characters ' ', '#', '"', '+', ',', ';', '<', '>', '\' and null must be escaped according to RFC 4514, for example by replacing them with the backslash character '\' followed by the two hex digits corresponding to the ASCII code of the character to be escaped. Similarly, LDAP search filters must escape a different set of special characters (including but not limited to '*', '(', ')', '\' and null) according to RFC 4515. + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-2078 + +Twitter Thread: https://twitter.com/harshbothra_/status/1502115860084785152 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-5.md b/resources/vulnerable-code-5.md index dd6c5b4..f58a3be 100644 --- a/resources/vulnerable-code-5.md +++ b/resources/vulnerable-code-5.md @@ -1,12 +1,13 @@ -### SecurityExplained S-16: Vulnerable Code Snippet - 4 +### SecurityExplained S-17: Vulnerable Code Snippet - 5 -#### Vulnerable Code: +#### Vulnerable Code: -![Vulnerable Code](../media/code-4.jpg) +![Vulnerable Code](../media/code-5.jpg) +#### Solution: -#### Solution: +The issue in this code snippet is that the files are stored without any extension. The Apache does not attach a Content-Type header in the response. Modern browsers will interpret these files as HTML which may lead to an attack such as Stored Cross-Site Scripting. -The issue in this code snippet is the use of Blacklist (Denylist) instead of using a Whitelist (Allowlist). An attacker can bypass this protection in multiple ways and upload a malicious file on the server. +##### Code Credits: SonarSource -##### Code Credits: SonarSource \ No newline at end of file +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1483124633373409281?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-50.md b/resources/vulnerable-code-50.md new file mode 100644 index 0000000..979b882 --- /dev/null +++ b/resources/vulnerable-code-50.md @@ -0,0 +1,17 @@ +### SecurityExplained S-71: Vulnerable Code Snippet - 50 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-50.png) + + +#### Solution: + +This is vulnerable to Cross-Site Scripting as there is no input sanitization on the $name. + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-5131 + +Twitter Thread: https://twitter.com/harshbothra_/status/1502463146203631616 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-51.md b/resources/vulnerable-code-51.md new file mode 100644 index 0000000..63392f5 --- /dev/null +++ b/resources/vulnerable-code-51.md @@ -0,0 +1,20 @@ +### SecurityExplained S-72: Vulnerable Code Snippet - 51 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-51.png) + + +#### Solution: + +This code is vulnerable to SQL Injection attacks. +User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing SQL queries directly from tainted data enables attackers to inject specially crafted values that change the initial meaning of the query itself. Successful database query injection attacks can read, modify, or delete sensitive information from the database and sometimes even shut it down or execute arbitrary operating system commands. The solution is to use prepared statements and to bind variables to SQL query parameters with dedicated methods like bindParam, which ensures that user-provided data will be properly escaped. + +Another solution is to validate every parameter used to build the query. This can be achieved by transforming string values to primitive types or by validating them against a white list of accepted values. + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-3649 + +Twitter Thread: https://twitter.com/harshbothra_/status/1502806574368129024 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-52.md b/resources/vulnerable-code-52.md new file mode 100644 index 0000000..4567da2 --- /dev/null +++ b/resources/vulnerable-code-52.md @@ -0,0 +1,18 @@ +### SecurityExplained S-73: Vulnerable Code Snippet - 52 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-52.png) + + +#### Solution: + +This code is vulnerable to XPATH Injection. User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing XPath expressions directly from tainted data enables attackers to inject specially crafted values that changes the initial meaning of the expression itself. Successful XPath injection attacks can read sensitive information from XML documents. + + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-2091 + +Twitter Thread: https://twitter.com/harshbothra_/status/1503112764985815043 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-53.md b/resources/vulnerable-code-53.md new file mode 100644 index 0000000..4ae91dd --- /dev/null +++ b/resources/vulnerable-code-53.md @@ -0,0 +1,19 @@ +### SecurityExplained S-74: Vulnerable Code Snippet - 53 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-53.png) + + +#### Solution: + +This code is vulnerable to Session Fixation Attacks. Session fixation attacks occur when an attacker can force a legitimate user to use a session ID that he knows. + +To avoid fixation attacks, it’s a good practice to generate a new session each time a user authenticates and delete/invalidate the existing session (the one possibly known by the attacker). + +Reference: https://t.co/gdwErw0aml + +Twitter Thread: https://twitter.com/harshbothra_/status/1503559120841949186 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-54.md b/resources/vulnerable-code-54.md new file mode 100644 index 0000000..d443f67 --- /dev/null +++ b/resources/vulnerable-code-54.md @@ -0,0 +1,23 @@ +### SecurityExplained S-75: Vulnerable Code Snippet - 54 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-54.png) + + +#### Solution: + +This code is vulnerable to ZipSlip Attack. + +File names of the entries in a zip archive should be considered untrusted, tainted and should be validated before being used for file system operations. Indeed, file names can contain specially crafted values, such as '../', that change the initial path and, when accessed, resolve to a path on the filesystem where the user should normally not have access. + +A successful attack might give an attacker the ability to read, modify, or delete sensitive information from the file system and sometimes even execute arbitrary operating system commands. This special case of path injection vulnerabilities is called "zip slip". + +The mitigation strategy should be based on the whitelisting of allowed paths or characters. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-6096 + +Twitter Thread: https://twitter.com/harshbothra_/status/1503912699104702464 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-55.md b/resources/vulnerable-code-55.md new file mode 100644 index 0000000..48cd1f9 --- /dev/null +++ b/resources/vulnerable-code-55.md @@ -0,0 +1,25 @@ +### SecurityExplained S-76: Vulnerable Code Snippet - 55 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-55.png) + + +#### Solution: + +This code is vulnerable to NoSQL Injection Attack. + +User-provided data such as URL parameters and POST body-content should always be considered untrusted and tainted. + +Applications that perform NoSQL operations based on tainted data can be exploited similarly to regular SQL injection bugs. Depending on the code, the same risks exist as with SQL injections: The attacker aims to access sensitive information or compromise data integrity. Attacks may involve the injection of query operators, JavaScript code, or string operations. + +This problem can be mitigated by using an Object Document Mapper (ODM) library or by validating user-supplied data based on its size or allowed characters. + +Since Javascript allows different types of HTTP parameters, the problem could be mitigated by ensuring that the type of the input is a String or by sanitizing the user-provided data. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-5147 + +Twitter Thread: https://twitter.com/harshbothra_/status/1504305286869241857 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-56.md b/resources/vulnerable-code-56.md new file mode 100644 index 0000000..7278b7d --- /dev/null +++ b/resources/vulnerable-code-56.md @@ -0,0 +1,21 @@ +### SecurityExplained S-77: Vulnerable Code Snippet - 56 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-56.png) + + +#### Solution: + +This code is vulnerable to SQL Injection Attack. + +User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing SQL queries directly from tainted data enables attackers to inject specially crafted values that change the initial meaning of the query itself. Successful database query injection attacks can read, modify, or delete sensitive information from the database and sometimes even shut it down or execute arbitrary operating system commands. + +Typically, the solution is to use prepared statements and to bind variables to SQL query parameters with dedicated methods like setParameter, which ensures that user-provided data will be properly escaped. Another solution is to validate every parameter used to build the query. This can be achieved by transforming string values to primitive types or by validating them against a white list of accepted values. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-3649 + +Twitter Thread: https://twitter.com/harshbothra_/status/1504637477297934337 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-57.md b/resources/vulnerable-code-57.md new file mode 100644 index 0000000..b08a179 --- /dev/null +++ b/resources/vulnerable-code-57.md @@ -0,0 +1,23 @@ +### SecurityExplained S-78: Vulnerable Code Snippet - 57 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-57.png) + + +#### Solution: + +This code is vulnerable to Unrestricted File Upload Attack. + +These minimum restrictions should be applied when handling file uploads: + +the file upload folder to restrict untrusted files to a specific folder. +the file extension of the uploaded file to prevent remote code execution. +Also the size of the uploaded file should be limited to prevent denial of service attacks. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-2598 + +Twitter Thread: https://twitter.com/harshbothra_/status/1504999863632637959 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-58.md b/resources/vulnerable-code-58.md new file mode 100644 index 0000000..36998af --- /dev/null +++ b/resources/vulnerable-code-58.md @@ -0,0 +1,23 @@ +### SecurityExplained S-79: Vulnerable Code Snippet - 58 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-58.png) + + +#### Solution: + +This code is vulnerable to Open Redirection Attack. + +These minimum restrictions should be applied when handling file uploads: + +the file upload folder to restrict untrusted files to a specific folder. +the file extension of the uploaded file to prevent remote code execution. +Also the size of the uploaded file should be limited to prevent denial of service attacks. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-5146 + +Twitter Thread: https://twitter.com/harshbothra_/status/1505392450499584003 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-59.md b/resources/vulnerable-code-59.md new file mode 100644 index 0000000..40a0f7e --- /dev/null +++ b/resources/vulnerable-code-59.md @@ -0,0 +1,21 @@ +### SecurityExplained S-80: Vulnerable Code Snippet - 59 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-59.png) + + +#### Solution: + +This code is vulnerable to Session Fixation Attack. + +User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing cookies directly from tainted data enables attackers to set the session identifier to a known value, allowing the attacker to share the session with the victim. Successful attacks might result in unauthorized access to sensitive information, for example if the session identifier is not regenerated when the victim authenticates. + +Typically, the solution to prevent this type of attack is to restrict the cookies that can be influenced with an allow-list. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-6287 + +Twitter Thread: https://twitter.com/harshbothra_/status/1505733449285468165 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-6.md b/resources/vulnerable-code-6.md index 7653fc2..f304c7d 100644 --- a/resources/vulnerable-code-6.md +++ b/resources/vulnerable-code-6.md @@ -1,12 +1,13 @@ ### SecurityExplained S-18: Vulnerable Code Snippet - 6 -#### Vulnerable Code: +#### Vulnerable Code: ![Vulnerable Code](../media/code-6.jpg) - -#### Solution: +#### Solution: The code is vulnerable to SSRF attack. The issue in this code snippet is that the Java's URI.resolve() will return its parameter if it is an absolute URL, which can be abused to perform SSRF. By using http:/example.com# as artifact the final URL will start with http:/example.com#, which the OkHttp library will accept when making the request. -##### Code Credits: SonarSource \ No newline at end of file +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1483501885235417090?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-60.md b/resources/vulnerable-code-60.md new file mode 100644 index 0000000..80c6387 --- /dev/null +++ b/resources/vulnerable-code-60.md @@ -0,0 +1,21 @@ +### SecurityExplained S-81: Vulnerable Code Snippet - 60 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-60.png) + + +#### Solution: + +This code is vulnerable to Remote Code Execution. + +Applications that execute code dynamically should neutralize any externally-provided values used to construct the code. Failure to do so could allow an attacker to execute arbitrary code. This could enable a wide range of serious attacks like accessing/modifying sensitive information or gain full system access. + +The mitigation strategy should be based on whitelisting of allowed values or casting to safe types. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5334 + +Twitter Thread: https://mobile.twitter.com/harshbothra_/status/1506095330395258885 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-61.md b/resources/vulnerable-code-61.md new file mode 100644 index 0000000..9dd052a --- /dev/null +++ b/resources/vulnerable-code-61.md @@ -0,0 +1,21 @@ +### SecurityExplained S-82: Vulnerable Code Snippet - 61 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-61.png) + + +#### Solution: + +This code is vulnerable to Remote Code Execution. + +Applications that execute code dynamically should neutralize any externally-provided values used to construct the code. Failure to do so could allow an attacker to execute arbitrary code. This could enable a wide range of serious attacks like accessing/modifying sensitive information or gain full system access. + +The mitigation strategy should be based on whitelisting of allowed values or casting to safe types. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5334 + +Twitter Thread: https://twitter.com/harshbothra_/status/1506472817621045249 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-62.md b/resources/vulnerable-code-62.md new file mode 100644 index 0000000..768006c --- /dev/null +++ b/resources/vulnerable-code-62.md @@ -0,0 +1,21 @@ +### SecurityExplained S-83: Vulnerable Code Snippet - 62 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-62.png) + + +#### Solution: + +This code is vulnerable to LDAP Injection. + +User-provided data such as URL parameters should always be considered as untrusted and tainted. Constructing LDAP names or search filters directly from tainted data enables attackers to inject specially crafted values that changes the initial meaning of the name or filter itself. Successful LDAP injections attacks can read, modify or delete sensitive information from the directory service. + +Within LDAP names, the special characters ' ', '#', '"', '+', ',', ';', '<', '>', '\' and null must be escaped according to RFC 4514, for example by replacing them with the backslash character '\' followed by the two hex digits corresponding to the ASCII code of the character to be escaped. Similarly, LDAP search filters must escape a different set of special characters (including but not limited to '*', '(', ')', '\' and null) according to RFC 4515. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2078 + +Twitter Thread: https://twitter.com/harshbothra_/status/1506850305970901000 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-63.md b/resources/vulnerable-code-63.md new file mode 100644 index 0000000..9a7d31e --- /dev/null +++ b/resources/vulnerable-code-63.md @@ -0,0 +1,23 @@ +### SecurityExplained S-84: Vulnerable Code Snippet - 63 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-63.png) + + +#### Solution: + +This code is vulnerable to Path Injection Attack. + +User-provided data, such as URL parameters, POST data payloads, or cookies, should always be considered untrusted and tainted. Constructing file system paths directly from tainted data could enable an attacker to inject specially crafted values, such as '../', that change the initial path and, when accessed, resolve to a path on the filesystem where the user should normally not have access. + +A successful attack might give an attacker the ability to read, modify, or delete sensitive information from the file system and sometimes even execute arbitrary operating system commands. This is often referred to as a "path traversal" or "directory traversal" attack. + +The mitigation strategy should be based on the whitelisting of allowed paths or characters. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2078 + +Twitter Thread: https://twitter.com/harshbothra_/status/1507167395315548171 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-64.md b/resources/vulnerable-code-64.md new file mode 100644 index 0000000..d39e9c7 --- /dev/null +++ b/resources/vulnerable-code-64.md @@ -0,0 +1,31 @@ +### SecurityExplained S-85: Vulnerable Code Snippet - 64 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-64.png) + + +#### Solution: + +This code is vulnerable to Insecure Deserialization Attack. + +User-provided data such as URL parameters, POST data payloads or cookies should always be considered untrusted and tainted. Deserialization based on data supplied by the user could result in two types of attacks: + +Remote code execution attacks, where the structure of the serialized data is changed to modify the behavior of the object being unserialized. +Parameter tampering attacks, where data is modified to escalate privileges or change for example quantity or price of products. +The best way to protect against deserialization attacks is probably to challenge the use of the deserialization mechanism in the application. They are cases were the use of deserialization mechanism was not justified and created breaches (CVE-2017-9785). + +If the use of deserialization mechanisms is valid in your context, the problem could be mitigated in any of the following ways: +- Instead of using a native data interchange format, use a safe, standard format such as untyped JSON or structured data approaches such as Google Protocol Buffers. + +- To ensure integrity is not compromised, add a digital signature (HMAC) to the serialized data that is validated before deserialization (this is only valid if the client doesn’t need to modify the serialized data) + +- As a last resort, restrict deserialization to be possible only to specific, whitelisted classes. + + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5135 + +Twitter Thread: https://twitter.com/harshbothra_/status/1507544881308188674 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-65.md b/resources/vulnerable-code-65.md new file mode 100644 index 0000000..311a628 --- /dev/null +++ b/resources/vulnerable-code-65.md @@ -0,0 +1,24 @@ +### SecurityExplained S-86: Vulnerable Code Snippet - 65 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-65.png) + + +#### Solution: + +This code is vulnerable to NoSQL Injection Attack. + +User-provided data such as URL parameters and POST body-content should always be considered untrusted and tainted. + +Applications that perform NoSQL operations based on tainted data can be exploited similarly to regular SQL injection bugs. Depending on the code, the same risks exist as with SQL injections: The attacker aims to access sensitive information or compromise data integrity. Attacks may involve the injection of query operators, JavaScript code, or string operations. + +This problem can be mitigated by using an Object Document Mapper (ODM) library or by validating user-supplied data based on its size or allowed characters. + + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5147 + +Twitter Thread: https://twitter.com/harshbothra_/status/1507857619532144646 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-7.md b/resources/vulnerable-code-7.md index 78622d0..e37eb42 100644 --- a/resources/vulnerable-code-7.md +++ b/resources/vulnerable-code-7.md @@ -1,14 +1,15 @@ ### SecurityExplained S-19: Vulnerable Code Snippet - 7 -#### Vulnerable Code: +#### Vulnerable Code: -![Vulnerable Code](../media/code-6.jpg) +![Vulnerable Code](../media/code-7.jpg) - -#### Solution: +#### Solution: The code is vulnerable to Remote Code Execution via SQL Injection. As per SonarSource, addslashes() is not enough to protect against SQL injections because the interpolated value is not surrounded by quotes. This value is later used in the external shell call without proper escaping. A payload like 1--$(id>foo) is enough to gain RCE! -##### Code Credits: SonarSource \ No newline at end of file +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1483835811896655877?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-8.md b/resources/vulnerable-code-8.md new file mode 100644 index 0000000..e8b9331 --- /dev/null +++ b/resources/vulnerable-code-8.md @@ -0,0 +1,13 @@ +### SecurityExplained S-20: Vulnerable Code Snippet - 8 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-8.jpg) + +#### Solution: + +The code is vulnerable to path traversal attack. There is a sanitization against this attack but the protection is not sufficient and can be bypassed with the payloads such as ".\./.\.shell.jsp". + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1484208541707927554?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/vulnerable-code-9.md b/resources/vulnerable-code-9.md new file mode 100644 index 0000000..3ecdb6d --- /dev/null +++ b/resources/vulnerable-code-9.md @@ -0,0 +1,15 @@ +### SecurityExplained S-21: Vulnerable Code Snippet - 9 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-9.jpg) + +#### Solution: + +The code is vulnerable to Remote Code Execution by uploading a malicious file named as `img-converter.exe` that will then be executed instead of the one installed on the system. + +As per Sonar Source, When executing commands by name (e.g. `img-converter`) on Windows, the OS looks for the executable in the current directory first and only after that in the PATH. This applies here because the command is executed in the directory where the file is copied to. + +##### Code Credits: SonarSource + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1484590293483945984?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/web-pentesting-methodology.md b/resources/web-pentesting-methodology.md index 3676435..9b7f05e 100644 --- a/resources/web-pentesting-methodology.md +++ b/resources/web-pentesting-methodology.md @@ -1,24 +1,27 @@ -### SecurityExplained S-1: My Penetration Testing Methodology [Web] - ``` -The below threat contain an overview of my penetration testing methodology on the web application targets: +## SecurityExplained S-1: +### My Penetration Testing Methodology [Web] + +The below threat contain an overview of my penetration testing methodology on the web application targets: -1. Initially, before starting with the engagement, I start with "Scoping", where I go through the details shared by the client to understand the scope and see if the testing is feasible as per the given timeline. During this phase, I check if the application is accessible and credentials (if required) are working correctly. If anything from "Step-1" is blocking, I reach out to the concerned person and request unblocking the blocker items. -2. Next, I start browsing the application while letting the traffic flow through Burp Suite to populate the "Target" menu. The main idea is to understand core business logic, map out interesting functionalities and build an overall attack surface. I also take notes if required. -3. In parallel to Step-2, I run "Recon" activities depending on the scope size. However, some bare minimums are to run "Port Scan, Directory Fuzzing, Historical URL Scan, Nuclei/Template Based Fuzzing, GitHub Scanning", and some other tools as required. I also perform quick OSINT to check for the information & data leakage related to my target. -4. Further, I start preparing a threat map containing hypothetical test cases of "What an attacker can do to exploit this application?". For example, if an application has three user roles, I would check for the privilege escalation on "Three Different Levels"(Vertical) as well as privilege escalation on "Same Level" (Horizontal). -5. Lastly and most importantly, I start the manual penetration testing on the application. I include the test cases derived from "Step-4" in my manual testing. Now, breaking down the manual penetration testing approach a bit further: - a. I mainly rely upon "Burp Suite, Developer Tools and Skills" during the manual assessment. - b. I use the "Advance Scope" option in the Burp Suite to remove unnecessary noise and help be in the correct scope while running "Active/Passive" Scanner or Scans originating from Burp Extensions. - c. I use "Autorize" to perform checks related to "Privilege Escalation & IDOR". - d. I check most of the "GET" endpoints that return data using an unauthenticated user to check for "Lack of Authorization Checks". - e. I use "Burp Match & Replace" to check for injection attacks. I define specific stings which are further replaced to the Payloads by Burp Proxy's Match & Replace rules. It makes overall testing relatively easy. - f. I spend more time on functionalities such as "File Upload" because such functionalities themselves have a huge attack surface. - g. Similarly, I use "Burp Extensions" as per the "application". So, for example, If the application uses "SSO", then only I enable the extensions related to "SSO", such as "SAML Raider", and others. - h. I keep logs of the testing using "Logger++". Taking logs helps a lot. +1. Initially, before starting with the engagement, I start with *Scoping*, where I go through the details shared by the client to understand the scope and see if the testing is feasible as per the given timeline. During this phase, I check if the application is accessible and credentials (if required) are working correctly. If anything from **Step-1** is blocking, I reach out to the concerned person and request unblocking the blocker items. +2. Next, I start browsing the application while letting the traffic flow through Burp Suite to populate the *Targe* menu. The main idea is to understand core business logic, map out interesting functionalities and build an overall attack surface. I also take notes if required. +3. In parallel to **Step-2**, I run *Recon* activities depending on the scope size. However, some bare minimums are to run *Port Scan*, *Directory Fuzzing*, *Historical URL Scan*, *Nuclei/Template Based Fuzzing*, *GitHub Scanning*, and some other tools as required. I also perform quick OSINT to check for the information & data leakage related to my target. +4. Further, I start preparing a threat map containing hypothetical test cases of "What an attacker can do to exploit this application?". For example, if an application has three user roles, I would check for the privilege escalation on "Three Different Levels"(Vertical) as well as privilege escalation on "Same Level" (Horizontal). +5. Lastly and most importantly, I start the manual penetration testing on the application. I include the test cases derived from **Step-4** in my manual testing. Now, breaking down the manual penetration testing approach a bit further: + + I mainly rely upon *Burp Suite*, *Developer Tools* and *Skills* during the manual assessment. + + I use the *Advance Scope* option in the Burp Suite to remove unnecessary noise and help be in the correct scope while running *Active/Passive* Scanner or Scans originating from *Burp Extensions*. + + I use [Autorize](https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f) to perform checks related to *Privilege Escalation* & *IDOR*. + + I check most of the *GET* endpoints that return data using an unauthenticated user to check for Lack of Authorization Checks. + + I use *Burp Match & Replace* to check for injection attacks. I define specific stings which are further replaced to the Payloads by Burp Proxy's Match & Replace rules. It makes overall testing relatively easy. + + I spend more time on functionalities such as *File Upload* because such functionalities themselves have a huge attack surface. + + Similarly, I use *Burp Extensions* as per the application. So, for example, If the application uses *SSO*, then only I enable the extensions related to *SSO*, such as *SAML Raider*, and others. + + I keep logs of the testing using [Logger++](https://portswigger.net/bappstore/470b7057b86f41c396a97903377f3d81). Taking logs helps a lot. -I use this basic testing methodology while testing a web application. However, I will attempt to cover a lot more in the "Manual Testing" shortly through some Blogs. +I use this basic testing methodology while testing a web application. However, I will attempt to cover a lot more in the *Manual Testing* shortly through some Blogs. Feel free to ask if you have any questions on "How do I Test specific things", etc. on my Twitter handle @harshbothra_ -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1477258377252065281?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/xxe-in-json.md b/resources/xxe-in-json.md index 4212516..cafd4e9 100644 --- a/resources/xxe-in-json.md +++ b/resources/xxe-in-json.md @@ -1,18 +1,20 @@ ### SecurityExplained S-14: Exploiting XXE in JSON Endpoints ``` -XXE a.k.a XML External Entities is a vulnerability that is usally found in endpoints that process XML data. This attack happens when a misconfigured or weekly configured XML parser processed the external entity reference from a XML Input. +XXE a.k.a XML External Entities is a vulnerability that is usally found in endpoints that process XML data. This attack happens when a misconfigured or weekly configured XML parser processed the external entity reference from a XML Input. -However, if an application is using JSON as content-type in request processing, in a usual assumption, we often do not check for the XXE attack but in certain scenarios, it might be possible that the application supports XML parsing along with JSON but that is not visible via request structure. Hence, we should always check for XXE in JSON endpoints. +However, if an application is using JSON as content-type in request processing, in a usual assumption, we often do not check for the XXE attack but in certain scenarios, it might be possible that the application supports XML parsing along with JSON but that is not visible via request structure. Hence, we should always check for XXE in JSON endpoints. # To perform XXE in JSON Endpoints, One can try below steps: -1. Capture a JSON request with Burp Suite. -2. Convert the content-type to XML using "Content-Type Convertor" Burp Extension. -3. Process the Request and if request is processed successfully, it means that the XML parsing is supported. +1. Capture a JSON request with Burp Suite. +2. Convert the content-type to XML using "Content-Type Convertor" Burp Extension. +3. Process the Request and if request is processed successfully, it means that the XML parsing is supported. 4. Now, attempt to exploit XXE Interesting Read: https://www.netspi.com/blog/technical/web-application-penetration-testing/playing-content-type-xxe-json-endpoints/ More About XXE: https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1481974615409041414?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ) diff --git a/resources/zip-slip-file-upload.md b/resources/zip-slip-file-upload.md index 396448d..9535eca 100644 --- a/resources/zip-slip-file-upload.md +++ b/resources/zip-slip-file-upload.md @@ -1,23 +1,25 @@ -### SecurityExplained S-10: Attacking Zip Upload Functionality with ZipSlip Attack +### SecurityExplained S-10: Attacking Zip Upload Functionality with ZipSlip Attack ``` -As mentioned in the last SecurityExplained post, file upload is a big attack vector & one of my favourite functionality to perform attack on. When an application allows uploading zip, stores it on the back and to process the content, tried to unzip it, it is an interesting attack vector for "Zip Slip" Attack. +As mentioned in the last SecurityExplained post, file upload is a big attack vector & one of my favourite functionality to perform attack on. When an application allows uploading zip, stores it on the back and to process the content, tried to unzip it, it is an interesting attack vector for "Zip Slip" Attack. -Let's understand what is a ZipSlip Attack: +Let's understand what is a ZipSlip Attack: -As per the synk.io's: Zip Slip is a widespread arbitrary file overwrite critical vulnerability, which typically results in remote command execution. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.sh). The Zip Slip vulnerability can affect numerous archive formats, including tar, jar, war, cpio, apk, rar and 7z. +As per the synk.io's: Zip Slip is a widespread arbitrary file overwrite critical vulnerability, which typically results in remote command execution. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.sh). The Zip Slip vulnerability can affect numerous archive formats, including tar, jar, war, cpio, apk, rar and 7z. -# How to Exploit? +# How to Exploit? - Using the following tool, create a malicious zip file: https://github.com/ptoomey3/evilarc - Upload the malicious zip file using the zip upload functionality -- If accepted and uploaded successfully, try to check for the endpoints that reflects the results of the uploaded file or try to check for any unintended behavior from the server/application for further exploitation. +- If accepted and uploaded successfully, try to check for the endpoints that reflects the results of the uploaded file or try to check for any unintended behavior from the server/application for further exploitation. -# Interesting Research Read: +# Interesting Research Read: - https://snyk.io/research/zip-slip-vulnerability - https://github.com/snyk/zip-slip-vulnerability -``` \ No newline at end of file +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1480567796098420737?s=20&t=DGEwqEwXwFbWH0VXkOKVsQ)