Web Hacking Arsenal: A Practical Guide to Modern Web Pentesting

Cover....1 Half Title....2 Title....4 Copyright....5 Contents....6 Foreword....22 Preface....26 Acknowledgments....28 About the Author....30 1 Introduction to Web and Browser....32 1.1 Introduction....32 1.2 Introduction to HTTP....32 1.2.1 Properties of HTTP....33 1.2.2 HTTP Communications....33 1.2.3 HTTP Response Codes....35 1.2.4 HTTP Request Methods....36 1.3 Common Vulnerabilities in HTTP Headers....37 1.3.1 User-Agent-Based Spoofing....37 1.3.2 Host Header Injection....37 1.3.3 Cross-Domain Referer Leakage....37 1.4 HTTP 2....38 1.5 Evolution of Modern Web Applications....38 1.5.1 Shift in Architecture....38 1.5.2 Evolution in Technology Stacks....39 1.5.3 LAMP Stack....39 1.5.4 MEAN/MERN Stack....39 1.5.5 Single-Page Applications (SPAs)....39 1.5.6 Use of Cloud Components....40 1.5.7 Serverless Architecture....40 1.6 Understanding Data Encoding....40 1.6.1 URL Encoding....42 1.6.2 Double Encoding....42 1.6.3 HTML Encoding....43 1.6.4 Base64 Encoding....44 1.6.5 Unicode Encoding....45 1.7 Introduction to Browsers....45 1.7.1 User Interface....46 1.7.2 Browser Engine....46 1.7.3 Rendering Engine....47 1.7.4 Networking....47 1.7.5 UI Backend....47 1.7.6 JavaScript Interpreter....47 1.7.7 Data Storage....47 1.8 Core Browser Security Policies and Mechanisms....47 1.8.1 Same-Origin Policy....48 1.8.2 Content Security Policy....50 1.8.3 HTTP Cookies....50 1.8.4 Iframe Sandbox....56 1.8.5 Subresource Integrity Check....56 1.8.6 HTTP Strict Transport Layer Security (HSTS)....57 1.9 Policy Exceptions versus Policy Bypasses....58 1.9.1 SOP Bypass Types....58 1.9.2 SOP Bypass—CVE-2007–0981....58 1.9.3 SOP Bypass—CVE-2011–3246....60 1.10 Site Isolation....60 1.11 Address Bar Spoofing Bugs....61 1.11.1 Address Bar Spoofing—Example 1....62 1.11.2 Address Bar Spoofing—Example 2....62 1.11.3 Bypassing Anti-Phishing Filters Using Spoofing....64 1.12 Extra Mile....66 2 Intelligence Gathering and Enumeration....68 2.1 Introduction....68 2.1.1 Enumerating ASN and IP Blocks....69 2.1.2 Reverse IP Lookup....71 2.2 Reverse IP Lookup with Multi-Threadings....72 2.2.1 Scanning for Open Ports/Services....73 2.3 Scanning Open Ports with Masscan....73 2.4 Detecting HTTP Services by Running Httpx....74 2.4.1 Scanning for Service Versions....74 2.5 Subdomain Enumeration....75 2.5.1 Active Subdomain Enumeration....76 2.6 DNSValidator....76 2.7 ShuffleDNS....77 2.8 Subbrute....78 2.9 Gobuster....79 2.9.1 Subdomain Enumeration Subdomains From Content Security Policy....79 2.9.2 Subdomain Enumeration Using Favicon Hashes....80 2.10 Putting It All Together....82 2.10.1 Passive Enumeration of Subdomains....83 2.10.2 Active + Passive Subdomain Enumeration Using Amass....88 2.10.3 Data Consolidation....92 2.11 Subdomain Takeover....93 2.11.1 Automated Subdomain Takeover Using Subjack....95 2.12 Fingerprint Web Applications....95 2.12.1 Directory Fuzzing....96 2.12.2 Discovering Endpoints Using Passive Enumeration Techniques....97 2.12.3 Enumerating Input Parameters....104 2.13 Mapping the Attack Surface Using Crawling/Spidering....106 2.13.1 Crawling Using Gospider....106 2.14 Automatic Mapping of New Attack Surface....109 2.15 Fingerprinting Web Applications....111 2.15.1 Inspecting HTTP Response Headers....112 2.15.2 Forcing Errors for Exposing Versions....112 2.15.3 Fingerprinting Using WhatWeb/Wappalyzer....112 2.15.4 Wappalyzer Browser Extensions....113 2.16 Detecting Known Vulnerabilities and Exploits....114 2.17 Vulnerability Scanning Using Nuclei....115 2.18 Cloud Enumeration....116 2.18.1 AWS S3 Buckets Enumeration....116 2.18.2 Exploiting Misconfigured AWS S3 Buckets....120 2.18.3 Exploiting Authenticated Users Group Misconfiguration....121 2.19 Extra mile....123 3 Introduction to Server-Side Injection Attacks....124 3.1 Introduction to Server-Side Injection Attacks....124 3.2 Introduction to SQL Injection....124 3.2.1 Classification of SQL Injection....125 3.2.2 SQL Injection Techniques....125 3.2.3 SQLi Data Extraction Using UNION-Based Technique....128 3.3 SQLMap Tip 1....138 3.3.1 SQL Injection to RCE....138 3.4 Retrieving Working Directory....140 3.4.1 Error-Based SQL Injection....141 3.4.2 Boolean SQL Injection....144 3.5 SQLMap Tip 2....148 3.5.1 Time-Based SQL Injection....148 3.5.2 SQLMap Tip....153 3.5.3 Second-Order SQL Injection....153 3.6 SQLMap Tip 3....160 3.6.1 Using Tamper Scripts in SQLMap....160 3.7 Remote Command Execution....164 3.7.1 RCE in Node.js....164 3.7.2 RCE in Flask Application....166 3.8 Server-Side Template Injections (SSTI)....168 3.8.1 Introduction About Templating Engines....168 3.8.2 Identifying Template Injections....170 3.9 Exploiting Template Injections....171 3.9.1 Example # 1 (Python, Jinja2)....172 3.9.2 Example # 2 (Python, Mako)....175 3.10 NoSQL Injection Vulnerabilities....177 3.10.1 MongoDB NoSQL Injection Exploitation....178 3.10.2 NoSQL Injection Real-World Examples....181 3.11 Extra Mile....182 4 Client-Side Injection Attacks....183 4.1 Introduction to XSS....183 4.2 Types of XSS....184 4.3 Reflected XSS....184 4.4 Understanding Context in XSS....185 4.5 XSS Polyglots....187 4.6 Bypassing HTMLSpecialChars....187 4.7 HTMLSpecialChars without Enquotes....188 4.8 Bypassing HTMLSpecialChars with Enquotes....189 4.9 Bypassing HTMLSpecialChars in SVG Context....190 4.10 Stored XSS....191 4.10.1 DOM-Based XSS....193 4.11 Sources and Sinks....194 4.12 Root Cause Analysis....197 4.13 JQuery DOM XSS....199 4.14 JQuery Example #1....200 4.15 JQuery Example #2....200 4.15.1 Client-Side Template Injections....201 4.16 XSS in AngularJS....202 4.17 XSS in ReactJS....204 4.18 XSS via File Upload....204 4.19 XSS Through SVG File....205 4.20 XSS Through MetaData....206 4.20.1 Weaponizing XSS....207 4.21 XSS to Account Takeover....207 4.22 XSS-Based Phishing Attack....209 4.23 XSS Keylogging....211 4.24 Content Security Policy (CSP) Bypass....211 4.25 CSP Bypass: Example #1 Unsafe Inline....212 4.26 CSP Bypass: Example #2—Third-Party Endpoints and “Unsafe-Eval”....213 4.27 CSP Bypass: Example #3—Data URI Allowed....214 4.28 CSP Bypass: Example #4—XSS Through JavaScript File Upload....215 4.29 Exploiting Browser Bugs for XSS....218 4.30 SOP and Document.Domain....218 4.31 DOM Clobbering....220 4.32 ID and Name Attribute....220 4.33 Example 1: Using Anchor Tag to Overwrite Global Variable....221 4.34 Example 2: Breaking Filters with DOM Clobbering....223 4.35 Cookie Property Overriding....224 4.36 Breaking Github Gist Using DOM Clobbering....224 4.37 Mutation-Based XSS (mXSS)....225 4.38 MXSS Mozilla Bleach Clean Function CVE 2020–6802....228 4.39 Behavior of Browser’s HTML Parser....229 4.40 Extra Mile....229 5 Cross-Site Request Forgery Attacks....231 5.1 Introduction to CSRF Vulnerabilities....231 5.1.1 How Does CSRF Work?....231 5.1.2 Constructing CSRF Payload....233 5.1.3 CSRF Payloads without User Interaction....235 5.1.4 Exploiting CSRF Payload in GET Requests....236 5.1.5 CSRF Payload Delivery....237 5.2 Exploiting JSON-Based CSRF....237 5.2.1 Scenario 1: Missing Content-Type Validation and JSON Formatting....237 5.3 Scenario 2: Content-Type Is Not Validated, But JSON Syntax Is Verified....239 5.4 Scenario 3: When Server Is Expecting Application/JSON Content-Type Header....239 5.5 Automating CSRF POC Generation....239 5.5.1 OWASP ZAP POC Generator....240 5.5.2 CSRF POC Generator....240 5.6 Exploiting Multi-Staged CSRF....241 5.7 Exploiting Weak Anti-CSRF Defenses....245 5.7.1 CSRF Defenses—Weak/Predictable Anti-CSRF Tokens....245 5.7.2 CSRF Bypass—Unverified CSRF Tokens....246 5.7.3 CSRF Bypass—Referer/Origin Check....247 5.7.4 Scenario 1: Application Not Properly Validating Referer Header....248 5.7.5 Scenario 2: Weak Regex for Referer/Origin Validation....249 5.7.6 Scenario 3: Subdomain-Based Referer Validation Bypass....249 5.8 Scenario 4: Inconsistent Handling of Referer Headers....250 5.8.1 Circumventing CSRF Defenses via XSS....250 5.9 SameSite Cookies....253 5.9.1 SameSite Strict Bypass....254 5.9.2 SameSite Strict Bypass via Subdomains....255 5.9.3 SameSite Lax....256 5.9.4 SameSite Lax Bypass....256 5.9.5 SameSite None....257 5.10 Extra Mile....257 6 Webapp File System Attack....258 6.1 Introduction....258 6.2 Directory Traversal Attacks....258 6.3 Directory Traversal on Node.js App....260 6.4 Fuzzing Internal Files with FFUF....262 6.4.1 Directory Traversal and Arbitrary File Creation Vulnerability....263 6.5 File Inclusion Vulnerabilities....264 6.5.1 Local File Inclusion to Remote Code Execution....266 6.5.2 LFI to RCE via Apache Log Files....266 6.5.3 LFI to RCE via SSH Auth Log....268 6.5.4 LFI to RCE Using PHP Wrappers and Protocols....269 6.5.5 LFI to RCE via Race Condition....270 6.6 Local File Disclosure....273 6.7 File Upload Attacks....276 6.7.1 PHP Disable Functions....277 6.8 Bypassing File Upload Restrictions....280 6.8.1 Bypassing Client-Side Validation....280 6.8.2 Bypassing Blacklist-Based Filters....281 6.8.3 Apache. htaccess Override....283 6.8.4 MIME-Type Verification Bypass....284 6.8.5 Bypassing Magic Bytes....286 6.8.6 Method 1: Injecting through EXIF Data....286 6.8.7 Method 2: Raw Insertion....288 6.8.8 Vulnerabilities in Image-Parsing Libraries....288 Extra Mile....290 7 Authentication, Authorization, and SSO Attacks....291 7.1 Introduction....291 7.2 Attacks against Authentication....292 7.2.1 Username Enumeration....292 7.2.2 Username Enumeration through Timing Attack....293 7.2.3 Brute Force and Dictionary Attacks....294 7.2.4 Brute Forcing HTTP Basic Authentication....295 7.2.5 Attacking Form-Based Authentication....295 7.3 Attacking Account Lockout Policy....298 7.4 Bypassing Rate-Limiting Mechanism....299 7.4.1 Other Ways to Bypass Rate Limiting....300 7.5 Bypassing CAPTCHA....301 7.5.1 Replay Attack....302 7.6 Dynamic CAPTCHA Generation Bypass Using OCR....307 7.7 Abusing Forgot Password Functionality....310 7.7.1 Predictable Reset Token....310 7.8 Password Reset Link Poisoning via Host Header Injection....313 7.9 Attacking Authorization....315 7.9.1 Lack of Access Control....316 7.9.2 Insecure Direct Object References (IDOR)....318 7.9.3 Web Parameter Tampering....320 7.9.4 Attacking JWT....323 7.10 None Algorithm....328 7.11 Attacking OAuth 2.0....330 7.11.1 OAuth Scenario 1: Stealing OAuth Tokens via Redirect_uri....332 7.11.2 OAuth Scenario 2: Stealing Users’ OAuth Tokens via Bypassing Redirect_uri....335 7.12 Attacking SAML....336 7.12.1 SAML Workflow....337 7.12.2 SAML Scenario 1: Response Tampering....337 7.12.3 SAML Scenario 2: Signature Exclusion Attack....340 7.13 Attacking Multi-Factor Authentication....341 7.13.1 Multi-Factor Authentication Bypasses....342 7.13.2 MFA Bypass Scenario: OTP Bypass....342 7.14 Web Cache Deception....345 7.15 Extra Mile....346 8 Business Logic Flaws....347 8.1 Introduction....347 8.2 Business Logic Flaws....347 8.2.1 Unlimited Wallet Balance Manipulation....348 8.2.2 Transaction Duplication Vulnerability....350 8.2.3 Improper Validation Rule Resulting in Business Logic Flaw....351 8.2.4 Exploiting Top-Up Feature to Steal Customer Balance....352 8.2.5 Lack of Validation Leads to Unlimited Card Limit....353 8.2.6 Unauthorized Manipulation of Cart Items Pre-/Post-Authentication....354 8.2.7 Loan Amount Restriction Bypass....356 8.2.8 Abuse of Feature Leads to Unlimited Wallet Balance....357 8.3 Race Condition Vulnerabilities....358 8.3.1 Race Condition Leading to Manipulation of Votes....359 8.3.2 Creating Multiple Accounts with the Same Details Using Race Condition....362 8.3.3 Exploiting Race Condition in Coupon Code Feature for Duplicate Discounts....363 8.4 Extra Mile....364 9 Exploring XXE, SSRF, and Request Smuggling Techniques....366 9.1 Introduction to XML....366 9.2 XML Structure....367 9.2.1 XML DTD....367 9.2.2 External DTD....368 9.2.3 XML Entities....369 9.3 XXE (XML External Entity)....370 9.3.1 XXE Local File Read....371 9.3.2 Remote Code Execution Using XXE....375 9.3.3 XXE JSON to XML....376 9.3.4 XXE Through File Parsing....377 9.3.5 Reading Local Files via php://....379 9.4 Blind XXE Exploitation Using Out-of-Band (OOB) Channels....380 9.4.1 Parameter Entities....380 9.4.2 OOB XXE via HTTP....381 9.4.3 XXE OOB Using FTP....383 9.4.4 Error-Based Blind XXE....384 9.5 Server-Side Request Forgery (SSRF)....384 9.5.1 SSRF Port Scan....385 9.5.2 File Read with SSRF....387 9.5.3 SSRF in PHP Thumb Application....388 9.5.4 Validation of the Vulnerability....389 9.5.5 SSRF to Remote Code Execution (RCE)....390 9.5.6 Scanning for Open Ports....390 9.5.7 Interacting with Redis and the Gopher Protocol....392 9.5.8 Chaining SSRF with Redis for File Write to Obtain RCE....393 9.5.9 DNS Rebinding in SSRF Attacks....394 9.6 HTTP Request Smuggling/HTTP Desync Attacks....397 9.6.1 CL.TE Technique Leading to Persistent XSS....398 9.6.2 CVE-2019–20372: HTTP Request Smuggling via Error Pages in NGINX....401 Extra Mile....403 10 Attacking Serialization....404 10.1 Introduction to Serialization....404 10.1.1 Concept of Gadget....405 10.2 Insecure Deserialization/PHP Object Injection....405 10.2.1 PHP Magic Functions....407 10.2.2 PHP Object Injection—Example....407 10.2.3 PHP Object Injection in SugarCRM....409 10.2.4 Input Parameters....410 10.2.5 Finding a Magic Function....411 10.3 Insecure Deserialization—DOT NET....414 10.3.1 Deserialization of the Base64-Encoded Payload....417 10.3.2 ASP.NET Viewstate Insecure Deserialization....417 10.3.3 MAC Validation and Encryption....418 10.3.4 Exploiting with YSOSerial....419 10.3.5 Blacklist3r....419 10.4 Decoding VIEWSTATE....419 10.5 Insecure Deserialization—Python....420 10.5.1 Serializing the Data with Pickle.Dumps....420 10.5.2 Deserializing the Bytes with Pickle.Loads....421 10.6 Insecure Deserialization—Java....426 10.6.1 Gadgets Libraries in Java....427 10.6.2 Insecure Deserialization—Example....427 10.6.3 Vulnerable Code....428 10.6.4 Verifying the Vulnerability....428 10.6.5 Generating the URLDNS Payload....428 10.6.6 Obtaining RCE Using Insecure Deserialization....429 10.6.7 Blackbox Review of Java-Based Applications....432 10.6.8 Java Framework and Libraries Indicators....433 10.7 Extra Mile....433 11 Pentesting Web Services and Cloud Services....434 11.1 Introduction....434 11.1.1 Differences between RPC and REST....435 11.1.2 Monolithic versus Distributed Architecture....435 11.2 Introduction to SOAP....436 11.2.1 Interacting with SOAP Services....437 11.2.2 Invoking Hidden Methods in SOAP....437 11.2.3 SOAP Account-Takeover Vulnerability....440 11.2.4 Remote Code Execution (RCE) in SOAP Service....442 11.2.5 Finding Writable Directory....444 11.2.6 Uploading Shell to Achieve RCE....444 11.3 JSON-RPC Vulnerabilities....445 11.4 REST API....447 11.4.1 Request Methods....448 11.4.2 Identifying REST API Endpoints....448 11.4.3 Example 1: Excessive Data Exposure....449 11.4.4 Example 2: Sensitive Data Exposure....450 11.4.5 Example 3: Unauthorized Modification Using Users’ Profile....451 11.5 GraphQL Vulnerabilities....451 11.5.1 Enumerating GraphQL Endpoint....453 11.5.2 GraphQL Introspection....453 11.6 Response....456 11.6.1 Information Disclosure: GraphQL Field Suggestions....457 11.6.2 GraphQL Introspection Query for Mutation....458 11.7 Response....461 11.8 Response....462 11.9 Serverless Applications Vulnerabilities....462 11.9.1 Functions as a Service (FaaS)....463 11.10 Sensitive Information Exposure....464 11.10.1 Serverless Event Injection....465 11.10.2 Analysis of Vulnerable Code....466 11.11 Extra Mile....468 12 Attacking HTML5....469 12.1 Introduction....469 12.2 Cross-Origin Resource Sharing....469 12.2.1 Weak Access Control Using Origin Header....471 12.2.2 CORS Leading to DOM XSS Vulnerability....472 12.2.3 Exploiting OpenRedirects....474 12.3 Web Storage: An Overview....474 12.3.1 Session Storage....474 12.3.2 Local Storage....475 12.3.3 Session/Local Storage API....475 12.3.4 Security Concerns with Web Storage in HTML5....476 12.3.5 Session Hijacking....476 12.3.6 Second-Order DOM XSS Using Local Storage....476 12.4 IndexedDB Vulnerabilities....478 12.4.1 Scenario—A Notes Application....479 12.5 Web Messaging Attacks Scenarios....482 12.5.1 Sender’s Window....482 12.5.2 Receiver’s Window....483 12.5.3 Security Concerns....483 12.5.4 Not Validating Origin in PostMessage API....483 12.5.5 DOM XSS in PostMessage API....484 12.6 WebWorkers Vulnerabilities....487 12.6.1 Interacting with WebWorker....487 12.6.2 WebWorker DOM XSS....488 12.6.3 Distributed Denial of Service Attacks Using WebWorkers....489 12.6.4 Distributed Password Cracking Using WebWorker....491 12.7 WebSockets....492 12.7.1 WebSocket DOM XSS....493 12.7.2 Cross-Site WebSocket Hijacking (CSWH)....494 12.7.3 WebSocket and Unencrypted Connections....497 12.8 UI Redressing Attacks....497 12.9 Extra Mile....502 13 Evading Web Application Firewalls (WAFs)....503 13.1 Introduction to WAF....503 13.1.1 WAF Detection Methods....503 13.1.2 Regular Expressions....504 13.1.3 Bayesian Analysis....504 13.1.4 Machine Learning....504 13.1.5 Understanding WAF Security Models: Whitelisting and Blacklisting....504 13.1.6 Whitelisting-Based Models....504 13.1.7 Blacklisting-Based Models....505 13.1.8 Fingerprinting WAF....506 13.1.9 Cookie Values....507 13.1.10 Citrix Netscaler....507 13.1.11 F5 Big IP ASM....507 13.1.12 Barracuda WAF....508 13.1.13 HTTP Response Codes....508 13.1.14 ModSecurity....508 13.1.15 Sucuri WAF....509 13.1.16 CloudFlare WAF....509 13.1.17 Connection Close....510 13.2 Bypass WAF—Methodology Exemplified at XSS....511 13.2.1 Injecting Harmless HTML....511 13.2.2 Considerations....511 13.2.3 Injecting Script Tag....511 13.2.4 Testing with Attributes and Corresponding Tags....512 13.2.5 Testing with src Attribute....512 13.2.6 Testing with Srcdoc Attribute....513 13.2.7 Testing with Action Attribute....513 13.3 Testing with Formaction Attribute....513 13.3.1 Testing with Data Attribute....514 13.3.2 Testing with href Attribute....514 13.3.3 Testing with Pseudo-Protocols....515 13.3.4 Using HTML Character Entities for Evasion....518 13.3.5 Injecting Event Handlers....519 13.3.6 Injecting a Fictitious Event Handler....520 13.3.7 Injecting Lesser-Known Event Handlers....520 13.3.8 Injecting Location Object....521 13.3.9 Bypass Using Unicode Separators....522 13.3.10 Using SVG-Based Vectors....524 13.3.11 Bypassing WAF’s Blocking Parenthesis....524 13.3.12 Bypassing Keyword-Based Filters....524 13.3.13 Character Escapes....525 13.3.14 Constructing Strings in JavaScript....525 13.3.15 Accessing Properties through Syntactic Notation....526 13.3.16 Bypassing Keyword-Based Filters Using Non-Alphanumeric JS....527 13.3.17 Alternative Execution Sinks....527 13.3.18 Bypassing WAF’s Decoding Entities....529 13.3.19 Case Study: Laravel XSS Filter Bypass....529 13.3.20 Bypassing Recursive Filters through Tag Nesting....531 13.3.21 Bypassing Filters with Case Sensitivity....531 13.3.22 Bypassing Improper Input Escaping....532 13.3.23 Bypassing Using DOM XSS....534 13.3.24 Example for Disallowed Keywords....535 13.3.25 Using Window.Name Property....535 13.4 Setting the Name Property....536 13.5 Example 1: Using the Iframe Tag....536 13.6 Example 2: Window.open Function....536 13.7 Example 3: Anchor Tag....537 13.7.1 Bypassing Blacklisted “Location” Keyword....537 13.7.2 Variations Using Different Browser Properties....538 13.7.3 Bypassing WAF Using HPP....538 13.8 Example with XSS....538 13.9 Example with SQL Injection....539 13.10 Extra Mile....539 14 Report Writing....540 14.1 Introduction....540 14.2 Reporting Audience....540 14.3 Executive Summary....541 14.3.1 Structure of an Executive Summary....541 14.3.2 Executive Summary Fail....543 14.3.3 Recommendations Report....544 14.4 Findings Summary....544 14.4.1 Overall Strengths....545 14.4.2 Overall Weaknesses....546 14.5 Historical Comparison....546 14.6 Narrative of the Report....547 14.7 Risk Assessment....547 14.7.1 CVSS Scoring....548 14.7.2 Limitations of CVSS....550 14.8 Risk Matrix....550 14.8.1 Risk Assessment and Reporting....551 14.9 Methodology....551 14.10 Technical Report....551 14.11 Organizing the Report....555 14.12 Report Writing Tools....556 14.12.1 ChatGPT for Report Writing....556 14.12.2 Prompt 1....556 14.12.3 Prompt 2....557 14.12.4 Prompt 3....558 14.12.5 Prompt 4....559 14.13 Report Writing Tips....560 14.14 Extra Mile....561 Index....562