few days before noticed ablog postfor exploiting Facebook chat and reading all the chats of users so that made me to interested to know about the issues, and basically it was misconfiguredCORSconfiguration wherenull originis allowed with credentials true, it was not something heard for the 1st time,@albinowaxfrom theportswiggerexplained it very well in hisblog post, so after reading that messenger blog post I went to test for the same issue for some targets where I allowed to test it.
but before that here are some tips aboutCORSwhere it can be exploitable from the attacker’s point of view:
POORLY IMPLEMENTED, BEST CASE FOR ATTACK:
Access-Control-Allow-Origin: https://attacker.com
Access-Control-Allow-Credentials: true
POORLY IMPLEMENTED, EXPLOITABLE:
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true
BAD IMPLEMENTATION BUT NOT EXPLOITABLE:
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
or just
Access-Control-Allow-Origin: *
even this is not good from the development point of view but due to its own rules of CORS ifAccess-Control-Allow-Originset to*we don’t get benefitAccess-Control-Allow-Credentials: truemeansno cookie accessof the victim.
When you can’t exploit even if above misconfigurations are present:
Presence of any custom header in the request which is getting used to authenticate the user.
Presence of any unique/authentication/key in the request URI
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code.
Lets say , we visit a signup page of a website and we entered email and password and click on signup . But before clicking sign up , I am capturing request in the Burp Suite . So when i captured the request , I changed email to some long string , like if email is "davinder@gmail.com" , i changed that to "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa@gmail.com" or even more in size
If i am able to proceed further without any restriction and or boundation, that this vulnerability exists.
Another example of code
Steps to resolve:
Restrict size limit on input parameter.
Impact
Category:Availability: Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop. Access control (instruction processing): Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program’s implicit security policy. Other: When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Portswigger.net will give you detailed video for burp setup , But to hunt bugs on Android , Below are some important steps in order to unpin Apps for testing . To do so you need to install below apps
1. Dowload genymotion - This is Your Andoid Emulater
2. Download super su v2.46 or latest
3. Download xposed installer apk
4. download xposed sdk
5. Download ssl unpinning
first root your android fone
than download xposed apk in that fone
than install xposed sdk (Note sdk version must be same as your fone apk version)
than ssl unpinning
After all steps , Restart android phone.
After Restarting the phone , Open SSL pinning App, Select the app you want to test and click on upin.
After that capture the requests on the Burp and have fun.
This is something when we are able to sign up on any web application using a long 100000 characters password which may lead website becoming unavailable or unresponsive.
When you supply a long password , Generally what happens applications are implementing password hashing algorithms , So when we supply long password than server will get busy doing that and website becomes unavailable or unresponsive . When a long password is sent, the password hashing process will result in CPU and memory exhaustion.
Prevention
Normally all sites have a password minimum to maximum length like 72 words limit or 48 limit to prevent Denial Of Service attack.
The password hashing implementation must be fixed to limit the maximum length of accepted passwords.
A rate limiting is used to check if the user session has to be limited based on the information in the session
cache. If user make too many requests within a given time ,
HTTP-Servers has to respond with status code
429: Too Many Requests.
Description:-
I have identified that when Forgetting Password for account , the
request has no rate limit which then can be used to loop through one
request. Which can be annoying to the root users sending mass password
to one email.
Steps To Reproduce The Issue
Go to Forget Password page
Enter the mail where you want to receive the link
Capture that request in BURP.
Send this to Intruder and set parameter at"Accept-Language: en-US,en;q=0.5"
Now go to payload and select number from 1 to 100.
Click on start attack.
If you will receive 100 mails with this , than this is a bug which have to be reported.
Solution -
I Will Recommend to Add A ReCaptcha & Sort Of Something Which
Requires Manual Human Interaction To Proceed Like You Can Add Captcha
Like 2+2=___ so that it cannot be brute forced and you also can have a
limit at the backend for particular number upto 5 times a day user can
request Forget Password Email or Link something like that will prevent
you from someone exploiting this vulnerability
Impact
If You Are Using Any Email Service Software API Or Some Tool Which
Costs You For Your Email This Type Of Attack Can Result You In Financial
Lose And It Can Also Slow Down Your Services It Can Take Bulk Of
Storage In Sent Mail Although If Users Are Affected By This
Vulnerability They Can Stop Using Your Services Which Can Lead To
Business Risk
Redirect means allowing a website to forward the request for the resources to another URL/endpoint. Let’s assume that you make a request to davindertutorials.com and davindertutorials.com can redirect you to another website(new-davindertutorials.com), so you’ll end up at new-davindertutorials.com even though the original request was made for davindertutorials.com. This is called “redirection”. There are different types of redirects in HTTP, check em out below.
Now Lets understand this vulnerability:
Open redirect is basically what the name says, Openly allow Redirects to any website.
URL redirection vulnerabilities found when user redirect to some other url , mainly the attacker url in unsafe way.
An attacker can construct a URL within the application that causes a redirection to an external domain. This behavior is well known for doing phishing attacks against users of the application.
Redirection Status Code - 3xx
300 Multiple Choices
301 Moved Permanently
302 Found
303 See Other
304 Not Modified
305 Use Proxy
307 Temporary Redirect
308 Permanent Redirect
The redirection can happen on the server-side or the client side.
Server-Side: Request to redirect is sent to the server, then the server notifies the browser to redirect to the url specified via the response.
Client-Side: Browser is notified to redirect to the url specified directly without the intervention of the server.
Why is this an issue?
Think about it for a moment, what if davindertutorials.com, a TRUSTED website allows you to redirect to any other website. Then a malicious user can simply redirect davindertutorials.com to attacker.com, and people fall for it all the time believing that it’s trusted, but infact, it’s not. So allowing redirects to any website without a stop in the middle or without a proper notification for the user is Bad.
Explanation
Let’s say there’s a “well known” website - https://example.com/. And let’s assume that there’s a link like
This link is to a sigup page, once you signup, you get redirected to https://example.com/login which is specified in the HTTP GET Parameter redirectUrl.
What happens if we change the example.com/login to attacker.com?
By visiting this url, if we get redirected to attacker.com after the signup, this means we have an open redirect vulnerablility. This is a classic open redirect vulnerability.
Why does this happen?
This happens due to insufficient redirection checks in the back-end, which means the server is not properly checking if the redirect URL is in their whitelist or not.
Here are some examples of vulnerable code
HTML Meta tags can refresh the site with the given url as it’s content and also you can specify the refresh delay time.
How to find them?
Visit every endpoint of the target to find these “redirect” parameters.
View your proxy history, you might find something. Make sure to use filters.
Bruteforcing helps too.
You might uncover many endpoints by reading javascript code.
Google is your friend, example query: inurl:redirectUrl=http site:target.com
Understand and analyze where the redirection is needed in the target application like redirecting to dashboard after login or something like that.
Some tricks to find this bugs
Test for basic modification of the url like target.com/?redirect_url=https://attacker.com.
Try with double forward slashes target.com//attacker.com.
Try target.com/@attacker.com. In this case the interpretation will be like, the target.com is the username and attacker.com will be the domain.
Test for javascript Protocol javascript:confirm(1).
Try target.com/?image_url=attacker.com/.jpg if there’s an image resource being loaded.
Try IP address instead of the domain name.
You can go further in terms of representing the IP in decimal, hex or octal.
You can also try target.com/?redirect_url=target.com.attacker.com to bypass weak regex implementations.
Chinese seperator 。 as the dot - https://attacker%E3%80%82com.
Test for String reverser unicode(“\u202e”) target.com@%E2%80%AE@attacker.com.
No slashes https:attacker.com.
Back slashes http:/\/\attacker.com or https:/\attacker.com.
Different domain redirect_url=.jp resulting in redirection of target.com.jp which is not the same as target.com.
Try some unicode(including emojis) madness t𝐀rget.com or 𝐀ttacker.com(‘𝐀’ is “\uD835\uDC00”).
Exploitation
Phishing
Assume that the target is example.com. It has a password recovery page at example.com/forgot-password. You enter the email and you click on Forgot Password button, and it’ll send you an email with a password reset link, and this link might look like
Posts
