Skip to content

Latest commit

 

History

History
399 lines (270 loc) · 20.6 KB

README.md

File metadata and controls

399 lines (270 loc) · 20.6 KB

Web App Vulnerabilities

Broken Authentication

{% content-ref url="broken-authentication.md" %} broken-authentication.md {% endcontent-ref %}

Broken Links

Broken Links

Browser Attacks

Browser Attacks

__

Business logic flaws

{% content-ref url="business-logic-flaws.md" %} business-logic-flaws.md {% endcontent-ref %}

Bypass Methodology

Bypass Methodology

Clickjacking

{% content-ref url="clickjacking.md" %} clickjacking.md {% endcontent-ref %}

Command Injection

{% content-ref url="command-injection.md" %} command-injection.md {% endcontent-ref %}

CORS Attacks

CORS MIsconfig
CORS Bypass

Cross Site Leaks

CSRF - Cross Site Request Forgery

{% content-ref url="csrf.md" %} csrf.md {% endcontent-ref %}

Carriage Return and Line Feed Injection

CRLF Injection

Client Side Template Injection

Client Side Template Injection Scanner - ACSTIS helps you to scan certain web applications for AngularJS Client-Side Template Injection (sometimes referred to as CSTI, sandbox escape or sandbox bypass). It supports scanning a single request but also crawling the entire web application for the AngularJS CSTI vulnerability.

CSV Injection

Dependancy Confusion

Deserialization Attacks

{% content-ref url="deserialization.md" %} deserialization.md {% endcontent-ref %}

Directory Transversal

Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files.

Basics
  • Simple attack
    • Linux system - ../../../etc/passwd
    • Windows system ..\..\..\windows\win.ini
  • Absolute path from filesystem without traversal sequences
    • filename=/etc/passwd
  • Nested Traversal Sequences
    • ....// or ....\/ will revert when stripped
    • ....//....//....//etc/passwd
  • Non standard encoding
    • You might be able to use various non-standard encodings, such as ..%c0%af or ..%252f, to bypass the input filter.
    • ..%252f..%252f..%252fetc/passwd
  • Valid start of path/base folder
    • filename=/var/www/images/../../../etc/passwd
  • File extension null byte bypass
    • If an application requires that the user-supplied filename must end with an expected file extension, such as .png, then it might be possible to use a null byte to effectively terminate the file path before the required extension.
    • filename=../../../etc/passwd%00.png
  • dotdotpwn - DotDotPwn is a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc.
Resources

{% embed url="https://youtu.be/kkSzmhJD73s" %}

File Inclusion Vulnerabilities

File inclusion vulnerabilities allow an attacker to include a file into the applications running code. **** In order to actually exploit a file inclusion vulnerability, we must be able to not only execute code, but also to write our shell payload somewhere.

{% tabs %} {% tab title="Identification" %}

{% tab title="Tools" %}

  • LFISuite - LFI Suite is a totally automatic tool able to scan and exploit Local File Inclusion vulnerabilities using many different methods of attack
  • Liffy - Local File Inclusion Exploitation tool.
  • Kadimus - Kadimus is a tool to check for and exploit LFI vulnerabilities, with a focus on PHP systems.
  • fimap - Fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps. {% endtab %}

{% tab title="Reference" %}

File Upload

File Upload

HTML Injection

HTTP Host Header Attacks

{% content-ref url="http-host-header-attacks.md" %} http-host-header-attacks.md {% endcontent-ref %}

HTTP Request Smuggling

{% content-ref url="http-request-smuggling.md" %} http-request-smuggling.md {% endcontent-ref %}

Input Fuzzing

Input Fuzzing
  • Wfuzz - Powerful Web application content fuzzer.
  • FuzzDb - FuzzDB was created to increase the likelihood of finding application security vulnerabilities through dynamic application security testing.
  • ffuf - A super fast web fuzzer written in Go.
  • QsFuzz - Qsfuzz (Query String Fuzz) allows you to build your own rules to fuzz query strings and easily identify vulnerabilities.
  • AFLplusplus - The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

Insecure Direct Object Reference

{% content-ref url="insecure-direct-object-reference.md" %} insecure-direct-object-reference.md {% endcontent-ref %}

LDAP Injection

LDAP Injection

Open Redirect Vulnerabilities

Open Redirect Vulnerabilities

Prototype Pollution

  • ppfuzz - A fast tool to scan client-side prototype pollution vulnerability written in Rust.

Security Misconfigurations

Security misconfigurations include:
• Poorly configured permissions on cloud services, like S3 buckets
• Having unnecessary features enabled, like services, pages, accounts or privileges
• Default accounts with unchanged passwords
• Error messages that are overly detailed and allow an attacker to find out more about the system
• Not using HTTP security headers, or revealing too much detail in the Server: HTTP header

Sidejacking

  • hamster-sidejack - Hamster is tool or “sidejacking”. It acts as a proxy server that replaces your cookies with session cookies stolen from somebody else, allowing you to hijack their sessions.

SQL Injection

{% content-ref url="sql-injection/" %} sql-injection {% endcontent-ref %}

SSRF: Server Side Request Forgery

SSRF

SSTI: Server Side Template Injection

SSTI 
<figure><img src="../../.gitbook/assets/image (8).png" alt=""><figcaption></figcaption></figure>

__

X-Path Injection

Web Cache Poisoning

{% content-ref url="web-cache-poisoning.md" %} web-cache-poisoning.md {% endcontent-ref %}

Web Man-In-The-Middle

  • Evilginx2 - Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
  • MITM Proxy - Mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols.

Web Sockets

{% content-ref url="web-sockets.md" %} web-sockets.md {% endcontent-ref %}

XXE - XML External Entity Attacks

{% content-ref url="xxe-xml-external-entity-attacks.md" %} xxe-xml-external-entity-attacks.md {% endcontent-ref %}

XSS - Cross Site Scripting

{% content-ref url="owasp-7-xss-cross-site-scripting.md" %} owasp-7-xss-cross-site-scripting.md {% endcontent-ref %}