diff --git a/AWS Amazon Bucket S3/README.md b/AWS Amazon Bucket S3/README.md index ac02c0b..13d257a 100644 --- a/AWS Amazon Bucket S3/README.md +++ b/AWS Amazon Bucket S3/README.md @@ -111,6 +111,7 @@ Amazon exposes an internal service every EC2 instance can query for instance met http://169.254.169.254/latest/meta-data/ http://169.254.169.254/latest/user-data/ http://169.254.169.254/latest/meta-data/iam/security-credentials/IAM_USER_ROLE_HERE will return the AccessKeyID, SecretAccessKey, and Token +http://169.254.169.254/latest/meta-data/iam/security-credentials/PhotonInstance ``` For example with a proxy : http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws/ diff --git a/PHP serialization/PHP-Serialization-RCE-Exploit.php b/Insecure deserialization/Files/PHP-Serialization-RCE-Exploit.php similarity index 100% rename from PHP serialization/PHP-Serialization-RCE-Exploit.php rename to Insecure deserialization/Files/PHP-Serialization-RCE-Exploit.php diff --git a/Java Deserialization/README.md b/Insecure deserialization/Java.md similarity index 100% rename from Java Deserialization/README.md rename to Insecure deserialization/Java.md diff --git a/PHP serialization/README.md b/Insecure deserialization/PHP.md similarity index 100% rename from PHP serialization/README.md rename to Insecure deserialization/PHP.md diff --git a/Insecure deserialization/README.md b/Insecure deserialization/README.md new file mode 100644 index 0000000..70fc5bd --- /dev/null +++ b/Insecure deserialization/README.md @@ -0,0 +1,22 @@ +# Insecure Deserialization + +> Serialization is the process of turning some object into a data format that can be restored later. People often serialize objects in order to save them to storage, or to send as part of communications. Deserialization is the reverse of that process -- taking data structured from some format, and rebuilding it into an object - OWASP + +Check the following sub-sections, located in other files : + +* [Java deserialization : ysoserial, ...](Java.md) +* [PHP (Object injection) : phpggc, ...](PHP.md) +* [Ruby : universal rce gadget, ...](Ruby.md) + +## Thanks to + +* [Github - ysoserial](https://github.com/frohoff/ysoserial) +* [Java-Deserialization-Cheat-Sheet - GrrrDog](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md) +* [Understanding & practicing java deserialization exploits](https://diablohorn.com/2017/09/09/understanding-practicing-java-deserialization-exploits/) +* [How i found a 1500$ worth Deserialization vulnerability - @D0rkerDevil](https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a) +* [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - 14 Aug 2017, Peter Stöckli](https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html) +* [PHP Object Injection - OWASP](https://www.owasp.org/index.php/PHP_Object_Injection) +* [PHP Object Injection - Thin Ba Shane](http://location-href.com/php-object-injection/) +* [PHP unserialize](http://php.net/manual/en/function.unserialize.php) +* [PHP Generic Gadget - ambionics security](https://www.ambionics.io/blog/php-generic-gadget-chains) +* [RUBY 2.X UNIVERSAL RCE DESERIALIZATION GADGET CHAIN - elttam, Luke Jahnke](https://www.elttam.com.au/blog/ruby-deserialization/) \ No newline at end of file diff --git a/Insecure deserialization/Ruby.md b/Insecure deserialization/Ruby.md new file mode 100644 index 0000000..88b80fb --- /dev/null +++ b/Insecure deserialization/Ruby.md @@ -0,0 +1,7 @@ +# Ruby Deserialization + +TODO + +## Thanks + +- [RUBY 2.X UNIVERSAL RCE DESERIALIZATION GADGET CHAIN - elttam, Luke Jahnke](https://www.elttam.com.au/blog/ruby-deserialization/) \ No newline at end of file diff --git a/Insecured source code management/README.md b/Insecure source code management/README.md similarity index 100% rename from Insecured source code management/README.md rename to Insecure source code management/README.md diff --git a/SSRF injection/README.md b/SSRF injection/README.md index c49084d..9920dea 100644 --- a/SSRF injection/README.md +++ b/SSRF injection/README.md @@ -317,6 +317,7 @@ http://169.254.169.254/latest/user-data http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] http://169.254.169.254/latest/meta-data/ http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME] +http://169.254.169.254/latest/meta-data/iam/security-credentials/PhotonInstance http://169.254.169.254/latest/meta-data/ami-id http://169.254.169.254/latest/meta-data/reservation-id http://169.254.169.254/latest/meta-data/hostname