Security Research & Engineering Practice

Technical articles migrated from Yuque.

[SOC] Traffic Protection Effectiveness: How to Verify Whether Your Internal Network IDS Is Working Properly

::::info http://www.testmyids.com/ :::: To determine whether an internal network intrusion detection system (IDS) is running properly and effectively detecting potential threats in network traffic, you can take a hands-on approach to verify its functionality. A well-known resource frequently used for this kind of testing is http://www.testmyids.com/ This website is designed for security professionals, aiming to help them assess whether their IDS can accurately identify and raise alerts on potentially malicious activity or non-compliant network requests. ...

Stable Packet Capture: Intercepting Traffic from Various Devices via a Transparent Proxy (mitmproxy Usage)

Tutorial reference https://blog.csdn.net/zhuxian1277/article/details/111875951 Use Case mitmproxy is a powerful man-in-the-middle proxy tool that lets you intercept, view, and modify traffic between clients and servers. Its transparent proxy mode makes mitmproxy extremely useful in specific scenarios, especially when network traffic needs to be analyzed or tested without changing any settings on the target device. No proxy configuration needed: Unlike Burp Suite, mitmproxy in transparent mode does not require manually setting an HTTP or HTTPS proxy on the target machine. This means the end user or test subject will not notice the proxy’s presence, reducing the chance of human intervention. Certificate installation: Although no proxy configuration is required in transparent mode, to intercept and decrypt HTTPS traffic you still need to install mitmproxy’s root certificate on the target machine. This is similar to Burp Suite, since both must handle the SSL/TLS handshake to view encrypted traffic. Via MitmWeb, you can view captured packets locally; in terms of usage it is not much different from Burp. ...

The Form Is a Honeypot, the PDF Is the Real Target: Bypassing Websites That Pretend You Need to Register

Some things, once you know them, you will never be “fooled” by them a second time. cheat on me? I remember the first time I tried to download a whitepaper from a security vendor’s website, and a form popped up: “Please fill in your name, phone number, email, and company name before downloading.” I did as asked, even going so far as to use a throwaway email address. ...

[SOC] Defending Against Apereo CAS Deserialization Attacks with Suricata

1. Attack Characteristics of the Vulnerability The root cause of this vulnerability is the deserialization of untrusted user input, which involves a hardcoded key. An attacker can leverage deserialization gadgets already present on the target machine to perform malicious operations. The traffic characteristics of normal versus malicious requests are described below. A normal login request. Request execution length: 1121 Response Status code: 200 Response length: 7287 Malicious exploitation - no response echo Request ...

[CVE-2022-36804] Bitbucket Pre-auth RCE Vulnerability

Critical severity command injection vulnerability - CVE-2022-36804 Official advisory: https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html Let’s diff 8.3.0 vs 8.3.1, and get familiar with the workflow of diffing jar packages in IDEA along the way: https://product-downloads.atlassian.com/software/stash/downloads/atlassian-bitbucket-8.3.0-x64.bin https://product-downloads.atlassian.com/software/stash/downloads/atlassian-bitbucket-8.3.1-x64.bin Analyzing the patch, two suspicious spots were found: patch#1 found bitbucket/atlassian-bitbucket-8.3.0-x64/app/WEB-INF/lib/nuprocess-2.0.2-atlassian-3.jar!/com/zaxxer/nuprocess/NuProcessBuilder.class the patch#1 is like: this.ensureNoNullCharacters(commands); A new method ensureNoNullCharacters was added command.indexOf(0): checks whether the command contains the \u0000 character If it does, an exception is thrown directly: Commands may not contain null characters — you can add this hint value in your PoC private void ensureNoNullCharacters(List<String> commands) { Iterator var2 = commands.iterator(); String command; do { if (!var2.hasNext()) { return; } command = (String)var2.next(); } while(command.indexOf(0) < 0); throw new IllegalArgumentException("Commands may not contain null characters"); } The full patch is below: ...

HackTheBox: Tenet Notes

Tenet 10.10.10.223 https://app.hackthebox.com/machines/Tenet/ export ip=10.10.10.223 && export url=http://10.10.10.223:80 && echo ok Information Gathering Nmap: Nmap scan report for 10.10.10.223 Host is up (1.1s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 cc:ca:43:d4:4c:e7:4e:bf:26:f4:27:ea:b8:75:a8:f8 (RSA) | 256 85:f3:ac:ba:1a:6a:03:59:e2:7e:86:47:e7:3e:3c:00 (ECDSA) |_ 256 e7:e9:9a:dd:c3:4a:2f:7a:e1:e0:5d:a2:b0:ca:44:a8 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.29 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Directory scanning: ...

A Look at AutoBinding Vulnerabilities in Spring MVC

0x01 BackGround Spring MVC, the Spring Web model-view-controller (MVC) framework Software frameworks sometimes allow developers to automatically bind HTTP request parameters into objects, making it easier for developers to build with the framework. Updates to the framework or business implementation can introduce new parameters that, in turn, affect variables or object parameters in the program code that were not meant to be set. Ruby on Rails, NodeJS, and Spring MVC all have this feature, and it frequently leads to vulnerabilities (it can be understood as property injection), ...

pwnhub: Internal CTF [Unboxing Together - So_That_Login] Writeup

The Challenge Itself There was no response echo at all, so I first tried FUZZing with ffuf and Burp: ./ffuf -w /opt/dic/SecLists/Fuzzing/SQLi/Generic-BlindSQLi.fuzzdb.txt -u http://121.40.89.206:8088/index.php -d "username=FUZZ&passwd=" Throughout the whole process there were only two kinds of responses (both 200): 1) When a forbidden keyword is detected: Returns alert('No,way! hacker!'); Content-Length: 42 2) When the input is substituted into the SQL query: Returns the homepage content Content-Length: 2175 Here is the SQL fuzzing dictionary as well: https://github.com/H4lo/dictionary/blob/master/sql_fuzz.txt ...

CVE-2021-41714: Tipask PostAuth LFR

1.Intro Tipask: Tipask is an open source PHP Question&Answer system developed based on the Laravel framework that is easy to extend and has strong load capacity and stability. Tipask < 3.5.9, which fails to validate the path parameters entered by the user when downloading attachments, a registered user can download arbitrary files on the Tipask server, such as .env, /etc/passwd, laravel.log and so on, causing information leakage. This vulnerability is CREDITED to the following entity: Qi'An Xin Technology Group, Network Security Department, Product-Security Team (1)Vendor Official Site: https://www.tipask.com/ ...

pwnhub: [Mid-Autumn Festival] BabyExec writeup

My first submission to pwnhub — I hope to join this excellent community of ours! 1. Prologue: A True MD5 Collision The challenge: <?php error_reporting(0); highlight_file(__FILE__); if ((string)$_GET['x'] !== (string)$_GET['y'] && md5($_GET['x']) === md5($_GET['y'])) { if(!isset($_GET['shell'])){ echo "Attack me!"; } else { $shell = $_GET['shell']; if(!preg_match("/[a-zA-Z0-9_$@]+/",$shell)){ eval($shell); } else { die('No,No,No! Keep it up......'); } } } else { die("No, way!"); } ?> The MD5 check: Without relying on weak typing, make md5(x) and md5(y) equal while x and y differ — a classic, well-worn topic. ...