Burp-Suite-Certified-Practitioner-Exam-Study - Burp Suite Certified Practitioner Exam Study

项目说明

Burp Suite Certified Practitioner Exam Study

>This is my study notes with over a 110 PortSwigger Academy Labs.
>I used these labs to pass the Burp Suite Certified Practitioner Exam 2023.
>My BSCP qualification.
>For more informaion go to PortSwigger Academy to get latest learning materials.

----

SCANNING - Enumeration
Focus Scanning
Scan non-standard entities

FOOTHOLD - Stage 1
Content Discovery
DOM-XSS
XSS Cross Site Scripting
Web Cache Poison
Host Headers
HTTP Request Smuggling
Brute force
Authentication

PRI ESCALATION - Stage 2
CSRF - Account Takeover
Password Reset
SQLi - SQL Injection
JWT - JSON Web Tokens
Prototype pollution
API Testing
Access Control
GraphQL API Endpoints
CORS - Cross-origin resource sharing

DATA EXFILTRATION - Stage 3
XXE - XML entities & Injections
SSRF - Server side request forgery
SSTI - Server side template injection
SSPP - 服务端 Side Prototype Pollution
LFI - File path tra
File Uploads
Deserialization
OS Command Injection

APPENDIX
Python Scripts
Payloads
Word lists
Focus target scanning
Approach
Extra Training Content

My Burp Tips

>I can recommend doing as many as possible Mystery lab challenge to test your skills and decrease the time it takes you to *identify* the , before taking the exam.
>I also found this PortSwigger advice on Retaking your exam very informative.
>Watch CryptoCat - Burp Suite Certified Professional (BSCP) Review + Tips/Tricks for fresh view of the BSCP exam in 2024.

----

<br><br><a href=" target="_blank"><img src=" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
>Thanks for the supported *coffee*, \o/

My Burp Suite Certified Practitioner certificate.

----

Scanning

>Enumeration of the Web Applications start with initial and directed scanning in time limited engagement.

Focus Scanning
Scan non-standard entities

Focus Scanning

>Due to the tight time limit during engagements or exam, scan defined insertion points for specific requests.

!scan-defined-insertion-points

>Scanner detected XML injection on storeId parameter and this lead to reading the secret Carlos file.

>Out of band XInclude request, need hosted DTD to read local file.

PortSwigger Lab: Disco quickly with targeted scanning

Scanning non-standard data structures

>Scanning non-standard data structures using Burp feature to scan selected insertion point for select text in response or requests.

!scan-selected-insertion-point

>Identify the through Burp scanner issue results.
>In this case, using the identified XSS, Steal the admin user's cookies by crafting the payload in the *identified* insertion point.

>Url encode key characters.

!admin-cookie-stealer

>Use the admin user's cookie to access the admin panel by replacing it in the current browser session.

PortSwigger Lab: Scanning non-standard data structures

-----

Foothold

Content Discovery

>Enumeration of target start with fuzzing web directories and files. Either use the Burp engagement tools, content discovery option to find hidden paths and files or use FFUF to enumerate web directories and files. Looking at robots.txt or sitemap.xml that can reveal content.

>Burp engagement 工具, content discovery using my compiled word list burp-labs-wordlist as custom file list.

!content-discovery.png

>Examine the git repo branches on local downloaded copy, using git-cola tool. Then select Undo last commit and extract admin password from the diff window.

!git-cola

PortSwigger Lab: Information disclosure in control history

>Always open source code to look for any de comments that reveal hidden files or paths. Below example lead to symphony token deserialization.

!DEV code debug comment deserial

-----

DOM-Based XSS

DOM XSS Indicators
DOM XSS Identified with DOM Invader
DOM XSS AngularJS
DOM XSS document.write in select
DOM XSS JSON.parse web messages
DOM XSS AddE Ja URL
DOM XSS AddE Ads Message
DOM XSS E Cookie Stealer
DOM XSS Last Cookie

Identify DOM-XSS

>DOM-based XSS arise when Ja takes data from an attacker-controllable 源码, such as the URL, and passes 代码 to a sink that supports dynamic 代码 execution.
>Test which characters enable the escaping out of the source code injection point, by using the fuzzer string below.

>Review the source code to *identify* the sources , sinks or methods that may lead to exploit, list of samples:

* document.write()
* window.location
* document.cookie
* eval()
* document.domain
* WebSocket()
* element.src
* postMessage()
* setRequestHeader()
* FileReader.readAsText()
* ExecuteSql()
* sessionStorage.setItem()
* document.e()
* JSON.parse
* ng-app
* URLSearchParams
* replace()
* innerHTML
* location.search
* addE
* sanitizeKey()

Dom Invader

>Using Dom Invader plug-in and set the canary to value, such as domxss, it will detect DOM-XSS sinks that can be exploit.

!DOM Invader

AngularJS

>AngularJS expression below can be injected into the search function when angle brackets and double quotes HTML-encoded. The is *identified* by noticing the search string is enclosed in an ng-app directive and /js/angular 1-7-7.js script included. Review the HTML 代码 to *identify* the ng-app directi AngularJS that this is the root element of the AngularJS application.

!domxss-on-constructor.png

>PortSwigger lab payload below:

>Cookie stealer payload using on.constructor that can be placed in iframe, hosted on an exploit 服务端, resulting in the session cookie being send to Burp Collaborator.
>PortSwigger cheat sheet for cross site scripting reference)

>Note: The session cookie property must not have the HttpOnly secure flag set in order for XSS to succeed.

!domxss-on-constructor.png

PortSwigger Lab: DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded

z3nsh3ll give an amazingly detail understanding on the constructor in this lab on YouTube

Doc Write Location search

>The target is to DOM-XSS in the stock check function. source code reveal is the sink used with allowing us to add storeId query parameter with a value containing the Ja payload inside a statement.

!DOM-XSS doc write inside select

>Perform a test using below payload to *identify* the injection into the modified GET request, using "> to escape.

!get-dom-xss.png

>DOM XSS cookie stealer payload in a document.write sink using source location.search inside a <select> element. This can be send to 服务端 in <iframe>. To test the cookie stealer payload I again on my browser in console added a test POC cookie to test sending it to Collaborator.

!dom-xss

PortSwigger Lab: DOM XSS in document.write sink using 源码 location.search inside a select element

DOM XSS JSON.parse web messages

>Target use web messaging and parses the message as JSON.
>Exploiting the by constructing an HTML page on the exploit 服务端,
>that exploits DOM XSS .

#### Requirements to steal cookie using this method: same-origin execution and non-HttpOnly cookies

>Rabbit hole: The CORS policy No Access-Control-Allow-Originheader block access for Collaborator from able to access to fetch and cookie need insecure flags, look out *Neo* the Matrix.

>The Ja 代码 on the target using event listener that listens for a web message.
>This event listener expects a string that is parsed using JSON.parse().

>Identify the JSON.parse() in page code:

!JSON_parse_web_messages.png

>In the Ja below, *identify* the event listener expects a type property
>and that the load-channel case of the switch statement changes the img src attribute.

>*Identify* web messages on target that is using postmessage() with DOM Invader.

>To exploit the above source code,
>inject Ja into the JSON data to change "load-channel" field data
>and perform cookie stealer document.cookie.

>Host an iframe on the exploit 服务端 html body, and send it to the ,
>resulting in the stealing of their cookie.
>*IF* the site CORS policy is poorly configured, then if the session cookie flags are insecurely set, the session cookie could be stolen and send to the Burp collaboration 服务端.

!JSON_parse_web_messages_Exploit_ser.png

>At the end of the iframe onload is a "*", this is to indicate the target is any.

>Set an unsecured test cookie in browser using browser DE console to use during tests for POC XSS
>cookie stealer payloads.

!JSON_parse_web_messages_Exploit_ser.png

PortSwigger Lab: DOM XSS using web messages and JSON.parse

>DOM Invader used to identify and Testing for DOM XSS using web messages

!DOM Invader identify web messages

>Replay the post message using DOM Invader after altering the JSON data.

!DOM Invader resend web messages

PortSwigger: Identify DOM XSS using PortSwigger DOM Invader

DOM XSS AddE Ja URL

>Re the page source code we *identify* the call for a web message but there is an if condition checking if the string contains .

!source-code-web-message-url.png

>The exploit ser payload below includes the string, and is successful in bypassing the if condition check.

!DOM-XSS AddE Ja URL

PortSwigger Lab: DOM XSS using web messages and a Ja URL

DOM XSS AddE Ads Message

>In the source code we *identify* the call using and an element id being referenced.

!Source code web message ads

>The function enclose the collaborator target inside back ticks, and when the iframe loads on the browser, the postMessage() method sends a web message to their home page.

>Replacing the Burp Lab payload with in the above 代码 allow attacker to steal the session cookie.

!AddE Ads Message

PortSwigger Lab: DOM XSS using web messages

Reflected DOM XSS

>In the Search function a Reflected DOM-XSS is *identified* using DOM Invader as being inside an eval() function.

!DOM Invader reflected dom-xss identify

>*Identify* that the search Ja source code on the target, the string is reflected in a JSON response called search-results.
From the Site Map, open the searchResults.js file and notice that the JSON response is used with an eval() function call.

!Reflected DOM-XSS source-code

>Testing \"-alert(1)}// payload we successfully escape the eval(). The attacker then craft an exploit phishing link to the with a cookie stealing payload hosted on exploit 服务端.
>Abo that the backslash \\ is not sanitized, and the JSON data is then send to eval(). Backslash is not escaped correctly and when the JSON response attempts to escape the opening double-quotes character, it adds a second backslash. The resulting double-backslash causes the escaping to be effectively cancelled out.

>In the abo every character is URL encoded and used as the search parameter value. This target do not have an exploit 服务端, so I hosted my own python3 -m http.server 80 web service and save the index.html file that contain the location target URL between <script> tags.

!Reflected DOM-XSS JSON cookie stealer

>In the image above, I create insecure POC cookie value in my browser before simulating a user clicking on link, same as Burp Exploit 服务端, that is the same as the Deli to function.

PortSwigger Lab: Reflected DOM XSS

DOM-XSS Last Cookie

>*Identify* the cookie is set to the last URL under the product page.
>In the source code we identify the injection script tags where is set.

!DOM-XSS last cookie code

>Testing the escape out of of the script string for the value of document.location using .
>Note that document.location value cannot be URL encoded.

>On exploit 服务端 add the following iframe to the body:

!DOM_based_cookie_manipulation.png

Once the cookie is updated the Exploit 服务端 log captures their secret cookie value.

>With the great help from *ShehmeerAbidRajput* I updated this lab with his provided cookie stealer payload.

PortSwigger Lab: DOM-based cookie manipulation

-----

XSS Resources

>XSS Resources pages to lookup payloads for tags and events.

+ Cross-site scripting (XSS) cheat sheet
+ PayloadsAllTheThings (XSS)
+ HackTheBox CPTS Study notes on XSS

>CSP E 工具 to check if content security policy is in place to mitigate XSS attacks. Example is if the base-uri is missing, this will allow attacker to use the alternati method described at Upgrade stored self-XSS.

+ CSP E

>When input field maximum length is at only 23 character in length then use this resource for Tiny XSS Payloads.

+ Tiny XSS Payloads

>Set a unsecured test cookie in browser using browser DE console to use during tests for POC XSS cookie stealer payloads.

Identify allowed Tags

>Basic XSS Payloads to *identify* application security filter controls for handling data received in HTTP request.

>Submitting the abo may gi message, *"Tag is not allowed"* due to Web Application Firewall (WAF) blocking injections.
>Then *identify* allowed tags using PortSwigger Academy Methodology.

>URL and Base64 online encoders and decoders

+ URL Decode and Encode
+ BASE64 Decode and Encode

>This lab gi Methodology to *identify* allowed HTML tags and events for crafting POC XSS.

>Host iframe 代码 on exploit 服务端 and deli link to .

PortSwigger Lab: Reflected XSS into HTML context with most tags and attributes blocked

>In below sample the tag Body and event onresize is the only allowed, pro an injection to perform XSS.

>This example show the Body and event onpopstate is not blocked.

PortSwigger Cheat-sheet XSS Example: onpopstate event

>Below Ja is hosted on exploit 服务端 and then deliver to .
>The code is an iframe doing onload and the search parameter is to onpopstate.

Bypass Blocked Tags

>Application controls gi, *"Tag is not allowed"* when inserting basic XSS payloads, but discover S allowed using abo. This payload steal my own session cookie as POC.

>Place the abo on exploit 服务端 and insert URL with search value into an before deli to in below 代码 block.

!s XSS

PortSwigger Lab: Reflected XSS with some S allowed

XSS Assign protocol

>Lab to test XSS into HTML context with nothing encoded in search function. Using this lab to test the Assignable protocol with location exploit *identified* by PortSwigger XSS research. In the payload is the representing the ASCII newline character.

!XSS protocol location

PortSwigger Lab: Reflected XSS into HTML context with nothing encoded

Custom Tags not Blocked

>Application respond with message *"Tag is not allowed"* when attempting to insert XSS payloads, but if we create a custom tag it is bypassed.

*Identify* if abo tag is not block in search function, by observing the response. Create below payload to steal session cookie out-of-band.

>Note: The custom tag with the ID , which contains an onfocus event handler that triggers the function. The HASH # character at the end of the URL focuses on this element as soon as the page is loaded, causing the payload to be called. Host the payload script on the exploit 服务端 in tags, and send to . Below is the same payload but URL-encoded format.

!Custom XSS tag

PortSwigger Lab: Reflected XSS into HTML context with all tags blocked except custom ones

z3nsh3ll - explaining custom tags for XSS attacks

OnHashChange

>Below iframe uses HASH # character at end of the URL to trigger the OnHashChange XSS cookie stealer.

>Note if the cookie is secure with HttpOnly flag set enabled, the cookie cannot be stolen using XSS.

>PortSwigger Lab payload perform print.

>Note: *Identify* the jquery 1.8.2 included in the source code with the CSS selector action a the hashchange.

!Hashchange

PortSwigger Lab: DOM XSS in jQuery selector sink using a hashchange event

Crypto-Cat: DOM XSS in jQuery selector sink using a hashchange event

Reflected String XSS

>Submitting a search string and re the source code of the search result page, the Ja string is *identified* to reflect the search string tracker.gif in the source code with a named searchTerms.

!Ja string with single quote and backslash escaped

>Using a payload and observe that a single quote gets backslash-escaped, pre breaking out of the string.

>Changing the payload to a cookie stealer that deliver the session token to Burp Collaborator.

!collaborator get cookies

>When placing this payload in iframe, the target application do not allow it to be embedded and gi: refused to connect.

PortSwigger Lab: Reflected XSS into a Ja string with single quote and backslash escaped

>In BSCP exam host the below payload on exploit ser <script> tags, and the search query below before it is URL encoded.

>Exploit Ser search term reflected that is send to to obtain their session cookie.

>The application ga message Tag is not allowed, and this is bypassed using this </ScRiPt >.

Reflected String Extra Escape

>See in source code the named , and when submitting payload , see the single quote is backslash escaped, and then send a payload and *identify* that the backslash is not escaped.

>Using a single backslash, single quote and semicolon we escape out of the Ja string , then using back ticks to enclose the path, allow for the cookie stealer to bypass application protection.

>With help from Trevor I made this into cookie stealer payload, using back ticks. Thanks Trevor, here is his Youtube walk through XSS Ja String Angle Brackets Double Quotes Encoded Single

!fail-escape

PortSwigger Lab: Reflected XSS into a Ja string with angle brackets and double quotes HTML-encoded and single quotes escaped

AngularJS Sandbox Escape

>Expert PortSwigger Lab exercise using AngularJS 1.4.4 and 1.x has reached end of life and is no longer maintained.
>This lab uses AngularJS in an unusual way where the $eval function is not a and you will be unable to use any strings in AngularJS.
>Objecti a cross-site scripting attack that escapes the sandbox and executes the payload without using the $eval function.

z3nsh3ll - YouTube Video give a great explanation of this Reflected XSS with AngularJS Sandbox Escape Without Strings

>*Identify* the angular.module in Ja source code:

!angularJS-sandbox-escape-identify.png

>The key value search is injected into the Ja created dynamically.
>No obvious security issue present here. However, the security of this 代码 depends on how this controller and the extracted are used in the back-end.

>The $parse method e the AngularJS expression $scope.query.

>Using the & to add second key value pair to test payload dynamic 代码 generated.

!angularJS-sandbox-escape-add-2nd-key pair

>Changing the second added key value name to expression to determine if e, /?search=key1value&7*7=payload and math result is 49.

!angularJS-sandbox-escape-2nd-key pair-eval

>Constructing a payload fails when using alert() as the second key name in how angularJS compile the 代码 through the parser.

>AngulaJS sandbox - See PortSwigger 客户端-Side template injection documents

>PortSwigger CheatSheet Reference Sandbox 1.4.4 escape)

>Collaborator payload *cookie stealer*:

>The ASCII decimal for each character in the abo string, separated by commas. Each number represents the ASCII decimal value of the corresponding character in the payload string.

>Python script to convert any payload to ASCIII decimal :

!python-script-ascii_con.png

>Cookie Stealer Payload in ASCII decimal value AngularJS expression run through sandbox, from the PortSwigger solution steps:

1. The exploit uses toString() to create a string without using quotes.
2. Then gets the String prototype and o the charAt function for every string.
3. This breaks the AngularJS sandbox. allow an array passed to the orderBy filter.
4. Set the argument for the filter by again using toString() to create a string and the String constructor property.
5. Finally, use the fromCharCode method generate our payload by con character codes into the payload example x=alert(1).
6. The charAt function has been o, AngularJS will allow this 代码 to escape the Sandbox.

!angularJS-sandbox-escape-cookie-stealer

>PortSwigger Expert Lab: Reflected XSS with AngularJS sandbox escape without strings

XSS Template Literal

>Ja template literal is *identified* by the back ticks used to contain the string. On the target code we *identify* the search string is reflected inside a template literal string.

!xss template literal

>Thanks to *Adrián Gyurácz*, for pro awesome bypass where I failed to get a working cookie stealer bypass all filters for this lab.

>*Adrián Gyurácz* found the following research article from Portswigger that lead to the solution: bypassing-character-blocklists-with-unicode-o

#### Pi from above, his payload:

>As the original lab session cookie has protection flags, he created a test dummy cookie for proof of concept:

!Adrián Gyurácz

>after sending the payload in the search function, I got a cookie stealer hit:

!Adrián Gyurácz

>I hope others find his research helpful, and including it in my guide Tx.

PortSwigger Lab: Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

----

`XSS via JSON into EVAL`

>This PortSwigger Practice Exam APP is performing search function and the DOM Invader *identify* the sink in an eval() function. The search results are placed into JSON content type.

!Dom Invader E

>Test escape out of the JSON data and inject test payload "-prompt(321)-" into the JSON content.

!json-injection-escape.png

>Attempting to get our own session cookie value with payload of "-alert(document.cookie)-" and filter message is returned stating "Potentially dangerous search term".

>WAF is pre dangerous search filters and tags, then we bypass WAF filters using Ja global .

secjuice: Bypass XSS filters using Ja global

>Below is the main cookie stealer payload before BASE 64 encoding it.

>Next is encode payload using Base64 encoded value of the abo stealer payload.

>Test payload on our own session cookie in Search function.

>Unpacking abo assembly stages:

+ Using the eval() method e or executes an argument. + Using atob() or btoa() is function used for encoding to and from base64 format strings. + If eval() being blocked then Alternatives: + setTimeout("code") + setInterval("code) + setImmediate("code") + Function("code")()

>This image shows Burp Collaborator receiving the my cookie value as proof of concept before setting up payload to Deli to .

!Burp collaborator receiving request with base64 cookie value from our POC.

>URL Encode all characters in this payload and use as the value of the /?SearchTerm= parameter.

>Hosting the IFRAME on exploit server, give a error message refused to connect to target. Instead host the payload on exploit ser <script> tags.

!(Deli xss to steal cookie.

>NOTE: Deli to few times if the active user do not send HTTP request to collaborator. Replace the current cookie value with the stolen cookie to impersonate the active user and move on to Stage 2 of the Practice Exam.

PortSwigger Practice Exam - Stage 1 - Foothold

`Stored XSS`

>Stored XSS can also be Blind XSS. >If alert payload do not trigger, see NahamSec blind xss video payload for to click, example:<s=import('//EXPLOIT.net/blind_xss')>>If stored input is redirecting that click on the links, it send request to exploit server. >Use the following sample code to *identify* stored XSS.

>Below log entries show the requests made to the exploit server, and from the logs we can *identify* that /img and /video of the above tags were allowed on the application and made requests when accessed.

!Identify-stored-xss

>Cross site Scripting saved in Blog post comment. This Cookie Stealer payload then send the session cookie to the exploit server logs.

>Product and Store lookup

#### Stored XSS Blog Post

>Stored XSS Blog post cookie stealer sending document cookie to exploit server.

>Below target has a stored XSS in the blog comments function. Steal a user session cookie that views the comments after they are posted, and then use their cookie to do impersonation.

!Stored XSS Blog post

>Fetch API Ja Cookie Stealer payload in Blog post comment.

>IPPSEC YouTube using the HackTheBox Bookworm, showing payload.js Ja code how he using fetch and learning Ja.

PortSwigger Lab: Exploiting cross-site scripting to steal cookies

#### Upgrade stored self-XSS

>Blog comment with Stored self-XSS, upgrading the payload to steal information from DOM. The function edit content reflect the input in the <script>tag. The CSRF token for the write comment is same as the edit content functions. Below payload use write comment function to make the create a blog entry on their on blog with our malicious content. >Thea character is added to escape the # hash character from the initial application source code. >The belowsource code in the blog entry is full exploit to steal info.

>This target is exploited by constructing an HTML injection that clobbers a named share_button, see source code below and uses HTML code above. The content is reflected on the page, then using this reflection enable page redirection to /edit page with the use of the meta http-equiv tag to refresh page after 1 second result in redirection.

!clobbering ja

>Deli, by Sending url that reference the above blog entry to the will trigger XSS as them.

intigriti - Self-XSS upgrade - Solution to December 22 XSS Challenge

>Alternati using HTML injection in the Edit Content blog entry page, *identified* using XSS Resources CSP check.

>Host JS file on Exploit server as static/js/bootstrap.bundle.min.js, with content:

>The modified PortSwigger lab payload assign the document.location function to the defaultAvatar next time page is loaded, because site uses DOMPurify that allows the use of cid: protocol that do not URLencode double quotes.

PortSwigger Lab: Exploiting DOM clobbering to enable XSS

`Stored DOM XSS`

>In the Ja source code, included script resources/js/loadCommentsWith.js we *identify* the html.replace() function inside the custom loadComments function. Testing payloads we see the function only replaces the first occurrence of <>.

!stored dom-xss code replace

>Abo is stored and any user the comment blog will result in their session cookie being stolen and send to collaborator.

!stored DOM-XSS json comments

>PortSwigger Lab payload: <><img src=1 onerror=alert()>.

PortSwigger Lab: Stored DOM XSS

-----

`Web Cache Poison`

Unkeyed header Unkeyed Utm_content Cloaking utm_content Poison ambiguous request Cache Poison multiple headers

`Unkeyed header`

>Target use tracking.js Ja, >and is to or header redirecting path, >allowing the stealing of cookie by poisoning cache.

>*Identify* the web cache headers in response and the tracking.js script in the page source code. >Exploit the by hosting Ja and injecting the header to poison the cache of the target to redirect a .

!Tracking source code review

!tracking.js

>Hosting on the exploit server, injecting the header in request, and poison the cache until hits poison cache.

!exploit host tracking.js

>Body send session cookie to collaboration service.

>Keep Poisoning the web cache of target by resending request with header.

!x-cache-hit.png

PortSwigger Lab: Web cache poisoning with an unkeyed header

>Youtube video showing above lab payload on exploit ser to steal cookie when hits a cached entry on back-end server. The payload is the abo.

YouTube: Web cache poisoning with unkeyed header - cookie stealer

Param Miner Extension to identify web cache

`Unkeyed utm_content`

>Target is to web cache poisoning because it excludes a certain parameter from the cache key. Param Miner's "Guess GET parameters" feature will *identify* the parameter as utm_content.

!Cache query reflected

>Abo is cached and the target cookie send to Burp collaborator.

!cache-collaborator.png

PortSwigger Lab: Web cache poisoning via an unkeyed query parameter

`Cloaking utm_content`

>Param Miner extension doing a Bulk scan > Rails parameter cloaking scan will *identify* the automatically. Manually it can be identified by adding ; to append another parameter to utm_content, the cache treats this as a single parameter. This means that the extra parameter is also excluded from the cache key. >Thesource code for /js/geolocate.js?callback=setCountryCookie is called on every page and execute callback function.

>The callback parameter is keyed, and thus cannot poison cache for user, but by combine duplicate parameter with utm_content it then excluded and cache can be poisoned.

!utm_content cache cloaking

>Cache Cloaking Cookie Capturing payload below, keep poising cache until hits stored cache.

>Below is Url Decoded payload.

PortSwigger Lab: Parameter cloaking

`Poison ambiguous request`

>Adding a second Host header with an exploit server, this *identify* a ambiguous cache and routing your request. Notice that the exploit server in second Host header is reflected in an absolute URL used to import a script from .

>On the exploit server set a file as same path target calls to , this will contain the payload. Place the Ja payload code below to perform a cookie stealer.

!Ambiguous Hosts

PortSwigger Lab: Web cache poisoning requests

`Cache Poison multiple headers`

>Identify that cache hit headers in responses, >then test if the target support or headers. >These headers can allow for the stealing of session cookie.

>Identify if adding the two Forwarded headers to the GET request, result in a change to the location response header. This *identify* positi of the cache with multiple headers.

!x-forwarded-scheme not https

>On the exploit ser the file path to >and then update the poison request header. >Place the payload on exploit server body.

>Remove the cache buster, and then poison the cache until the is redirected to the exploit ser tracking.js to steal session cookie.

PortSwigger Lab: Web cache poisoning with multiple headers

`Duplicate Parameter Fat Poison`

>Identify that the application is to duplicate parameter poisoning, by adding a second parameter with same name and different value the response reflected the injected value.

!countrycode source code

>The function that is called in the response by passing in a duplicate callback parameter is reflected. Notice in response the cache key is still derived from the original callback parameter in the GET request line.

!fat-get-request

>Not able to make cookie stealer payload working......

PortSwigger Lab: Web cache poisoning via a fat GET request

-----

`Host Headers`

Spoof IP Address HOST Connection State Host Routing based SSRF SSRF Host request parsing

`Spoof IP Address`

>*Identify* that altered HOST headers are supported, >which allows you to spoof your IP address and bypass the IP-based brute-force protection >or redirection attacks to do *password reset* poisoning.

>Include the below X- headers and change the username parameter on the password reset request to Carlosbefore sending the request. >In the BSCP exam if you used this exploit then it means you have not used a that require user interaction and allow you to use an interaction to gain access to stage 3 as admin by using exploit serverDeli to function.

>Tips & Notes from *fullfox*:

* When spoofing host header on password reset using Host: or X-Forwarded-Host:, if you receive the error Invalid hostname, try using the following hostname: xxx.oastify.com?TARGET.net legit target URL without a slash.

>Check the exploit server log to obtain the reset link to the username.

!Exploit Server Logs capture the forgot password reset token

PortSwigger Lab: Password reset poisoning

`HOST Connection State`

>Target is to routing-based SSRF via the Host header, but connection state of the first request. Sending grouped request in sequence using single connection and setting the connection header to keep-alive, bypass host header and enable SSRF exploit of local server.

>Next request is the second tab in group sequence of requests.

>Observe that the second request has successfully accessed the admin panel.

!single connection

PortSwigger Lab: Host bypass state attack

-----

`HTTP Request Smuggling`

>Architecture with front-end and back-end server, and front-end or back-end does not support chunked encoding (HEX) or content-length (Decimal). Bypass security controls to retrieve the 's request and use the user's cookies to access their account.

TE.CL dualchunk - Transfer-encoding obfuscated TE.CL multiCase - Admin blocked CL.TE multiCase - Admin blocked CL.TE multiCase - Content-Length Cookie Stealer CL.TE multiCase - User-Agent Cookie Stealer HTTP/2 smuggling - CRLF injection Cookie Stealer HTTP/2 TE - Admin Cookie Stealer

`TE.CL dualchunk - Transfer-encoding obfuscated`

>If Duplicate header names are allowed, and the is detected as dualchunk, then add an additional header with name and value = Transfer-encoding: cow. Use obfuscation techniques with second TE.

>Some servers that do support the Transfer-Encoding header can be induced not to process it if the header is obfuscation in some way.

>On Repeater menu ensure that the "Update Content-Length" option is unchecked.

!GPost Obfuscating the TE header

>Note: You need to include the trailing sequence \r\n\r\n following the final 0.

PortSwigger Lab: HTTP request smuggling, obfuscating the Transfer-Encoding (TE) header

>Wonder how often this scenario occur that hacker is able to steal user request via HTTP Sync ?

`TE.CL multiCase - Admin blocked`

>When attempting to access /admin portal URL path, we get the filter message, Path /admin is blocked. The HTTP Request Smuggler scanner *identify* the as TE.CL multiCase (delayed response). Note: because back-end ser't support chunked encoding, turn off Update Content-Length in Repeater menu.

>After disable auto content length update, changing to HTTP/1.1, then send below request twice, adding the second header Content-Length: 15prevent the HOST header conflicting with first request. >Note: need to include the trailing sequence\r\n\r\n130\o/131\r\n on line above ZERO, as part of length. The initial POST request content-length is manually set.

!te.cl.multicase-smuggle.png

>When sending the /admin/delete?username=carlos133x=alert(1)134 and learning Ja.

PortSwigger Lab: Exploiting cross-site scripting to steal cookies

#### Upgrade stored self-XSS

>Blog comment with Stored self-XSS, upgrading the payload to steal information from DOM. The function edit content reflect the input in the 135/admin portal URL path, we get the filter message, Path /admin is blocked. The HTTP Request Smuggler scanner *identify* the as CL.TE multiCase (delayed response).

>To access the admin panel, send below request twice, adding the second header prevent the HOST header conflicting with first request.

>On the second time the request is send the admin portal is returned in response.

!cl.te multicase admin blocked

PortSwigger Lab: Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE

`CL.TE multiCase - Content-Length`

>Large Content-Length to capture requests. Sending a POST request with smuggled request but the content length is longer than the real length and when browse their cookie session value is posted to blob comment. Increased the comment-post request's Content-Length to 798, then smuggle POST request to the back-end server.

!Exploiting HTTP request smuggling with content-length value

>No new line at end of the smuggled POST request above^^.

>View the blog post to see if there's a comment containing a user's request. Note that once the user browses the target website, then only will the attack be successful. Copy the user's Cookie header from the blog post comment, and use the cookie to access 's account.

!Exploiting HTTP request smuggling to capture other users' requests

PortSwigger Lab: Exploiting HTTP request smuggling to capture other users' requests

`CL.TE multiCase - User-Agent Cookie Stealer`

>*Identify* the UserAgent value is stored in the GET request loading the blog comment form, and stored in User-Agent hidden value. Exploiting HTTP request smuggling to deli XSS using User-Agent value that is then placed in a smuggled request.

>Basic Cross Site Scripting Payload escaping out of HTML document.

>COOKIE STEALER Payload.

>Smuggle this XSS request to the back-end server, so that it exploits the next . Place the XSS cookie stealer in User-Agent header.

!HTTP request smuggling to deli XSS and steal cookie

>Check the PortSwigger Collaborator Request received from browsing target.

!Collaborator capture XSS Request from browsing target

PortSwigger Lab: Exploiting HTTP request smuggling to deli XSS

`HTTP/2 smuggling via CRLF injection`

>Target is to request smuggling because the front-end server downgrades HTTP/2 requests and fails to adequately sanitize incoming headers. Exploitation is by use of an HTTP/2-exclusi smuggling to steal a session cookie and gain access to user's account.

>*Identify* possible when Target reflect previous and recent search history based on cookie, by removing cookie it is noticed that your search history is reset, confirming that it's tied to your session cookie.

!recent searches

>Expand the Inspector's Request Attributes section and change the protocol to HTTP/2, then append arbitrary header with value , follow with the sequence , then followed by the , by pressing shift+ENTER.

!http2-inspector

>Note: enable the Allow HTTP/2 ALPN o option and change the body of HTTP/2 request to below POST request.

!http2 smuggle via crlf inject

PortSwigger Lab: HTTP/2 request smuggling via CRLF injection

Youtube demo HTTP/2 request smuggling via CRLF injection

`HTTP/2 TE desync v10a h2path`

>Target is to request smuggling because the front-end ser HTTP/2 requests even if they have an ambiguous length. Steal the session cookie, of the admin the target. The Burp extension, HTTP Request Smuggler will *identify* the as HTTP/2 TE desync v10a (H2.TE) .

!HTTP/2 TE desync v10a h2path

>Note: Switch to HTTP/2 in the inspector request attributes and Enable the Allow HTTP/2 ALPN o option in repeat menu.

>Note: Paths in both POST and GET requests points to non-existent endpoints. This help to *identify* when not getting a 404 response, the response is from user captured request. Remember to terminate the smuggled request properly by including the sequence after the Host header.

!302 Response once stolen admin cookie request captured

>Copy stolen session cookie value into new http/2 GET request to the admin panel.

!admin-panel-access

PortSwigger Lab: Response queue poisoning via H2.TE request smuggling

-----

`Brute Force`

Stay-Logged-in Stay-logged-in Offline Crack Brute Force Protected Login Subtly Invalid Login

`Stay-Logged-in`

>Login option with a stay-logged-in check-box result in Cookie value containing the password of the user logged in and is to brute-forcing.

!stay-logged-in

>The exploit steps below plus the Intruder Payload processing rules in order and including the GREP option in sequence before starting the attack.

1. Logout as current user. 2. Send the most recent GET /my-account request to Burp Intruder. 3. Select the cookie: as injection position. 4. Hash: 5. Add prefix: 6. Encode: 7. Add GREP under settings tab, to check for the string in the response indicating successfully logged in attack.

!brute

PortSwigger Lab: Brute-forcing a stay-logged-in cookie

`Stay-logged-in Offline Crack`

>The blog application comment function is to stored XSS, use the below payload in blog comment to send the session cookie of Carlos to the exploit server.

>Base64 decode the cookie value and use an online MD5 hash crack station database.

!stay-logged-in Offline

PortSwigger Lab: Offline password cracking

`Brute Force Protected Login`

>*Identified* brute force protection on login when back-end enforce 30 minute ban, resulting in IP blocked after too many invalid login attempts. Testing header result in bypass of brute force protection. Observing the response time with long invalid password, mean we can use Pitchfork technique to *identify* first valid usernames with random long password and then rerun intruder with Pitchfork, set each payload position attack iterates through all sets simultaneously.

Burp Lab Username, Password and directory fuzzing Word lists

>Payload position 1 on IP address for and position 2 on username with a long password to see the response time delay in attack columns window.

!Intruder Pitchfork

>Repeat above Pitchfork intruder attack on the password field and then *identify* valid password from the status column with 302 result.

PortSwigger Lab: Username enumeration timing

`Subtly Invalid Login`

>*Identify* that the login page & password reset is not protected by brute force attack, and no IP block or time-out enforced for invalid username or password.

>Tip for the BSCP Exam, there is sometimes another user with weak password that can be brute forced. Carlos is not always the account to target to give a foothold access in stage 1.

!Subtly invalid login

>Notice on the Intruder attack column for the GREP value, the one response message for a failed username attack do not contain full stop period at the end. Repeat the attack with this *identified* username, and Sniper attack the password field to *identify* response for valid login.

!Refresh Password

>In the BSCP exam *lookout* for other messages returned that are different and disclose valid accounts on the application and allow the brute force *identified* of account passwords, such as example on the refresh password reset function.

>Once valid username identified from different response message, the perform brute force using Burp Intruder on the password.

PortSwigger Lab: Username enumeration different responses

>Another scenario to identify valid username on the WEB APP is to provide list of usernames on login and one invalid password value. In the Intruder attack results one response will contain message Incorrect password. >Intruder attack injection position,username=§in§&password=SomeStupidLongCrazyWrongSecretPassword123456789.

PortSwigger Lab: Username enumeration responses

-----

`Authentication`

Account Registration Auth Token bypass Macro

`Account Registration`

>Business logic flaw in the account registration feature allow for gaining foothold as target user role access. Content Discovery find the path , message state the Admin interface is only a if logged in as a DontWannaCry user.

!Register length flaw

>Creating email with more that 200 character before the symbol is then truncated to 255 characters. This *identify* the in the account registration page logic flaw. In the email below the at the end of is character 255 exactly.

!Inconsistent-handling-exceptional-input

PortSwigger Lab: Inconsistent handling of exceptional input

`Auth Token bypass Macro`

>If the authentication login is protected against brute force by using random token that is used on every login POST, a Burp Macro can be used to bypass protection.

>Create Burp Macro 1. Open Proxy settings and select sessions under Project choices. 2. Scroll down to , and add new macro. 3. Select request from the list to use for the value to be used. 4. click and add custom parameter location to extract. 5. Click OK to return to Sessions under Project choices. 6. Add a Session handling rule, and the editor dialogue opens. 7. In the dialogue, go to the "Scope" tab. 8. Under scope for the session handling rule editor, check Target, Intruder, and Repeater. 9. Still under "URL Scope", select . 10. Close Settings.

!How To Create a Macro in Burp Suite Professional

PortSwigger Lab: Infinite money logic flaw - show how to create Burp Macro

-----

`Pri Escalation`

`CSRF Account Takeover`

OAuth Referer CSRF Referer Header Present LastSearchTerm CSRF duplicated in cookie CSRF Token Present Is Logged In CSRF No Defences SameSite Strict bypass SameSite Lax bypass

>Cross-Site Request Forgery allows an attacker to force users to perform actions that they did not intend to perform. This can enable attacker to change email address and use password reset to take over the account.

`OAuth`

>oAuth linking exploit ser iframe, then deliver to , forcing user to update code linked.

!csrf

>Intercepted the GET /oauth-linking?code=[...]. send to repeat to save code. Drop the request. Important to ensure that the code is not used and, remains valid. Save on exploit server an iframe in which the attribute points to the URL you just copied.

PortSwigger Lab: Forced OAuth profile linking

`Referer CSRF`

>*Identify* the change email function is to CSRF by observing when the Referer header value is changed the response gi, Invalid referer header, and the email change is accepted when the referrer value contains the expected target domain somewhere in the value.

!identify csrf referer header check

>Adding original domain of target and append history.pushState('', '', '/?TARGET.net'); to the Referer header in the form of a query string, allow the change email to update.

>Note: Unlike the normal Referer header spelling, the word "referrer" must be spelled correctly in the above head section of the exploit server.

!Referer csrf

>Create a CSRF proof of concept exploit and host it on the exploit server. Edit the Ja so that the third argument of the history.pushState() function includes a query string with target URL.

>When abo payload is delivered to , the CSRF POC payload changes the email to , because the Referer header contained target in value. In *BSCP* exam take not of your ser address to use in account takeover.

PortSwigger Lab: CSRF with broken Referer

`Referer Header Present`

>In the update email request when changing the referer header the response indicate Invalid referer header, *identifying* CSRF . Using the <meta name="referrer" content="no-referrer"> as part of the exploit server CSRF PoC this control can be bypassed. This instruct the exploit server to Deli to without referer header.

>This is interacti and in BSCP exam if the stage 1 exploit was non interactive then this can be used to obtain administrator interaction by her clicking on the link to change their password. Note to check the source code of the change email page for any additional form id .

!csrf referer present

PortSwigger Lab: CSRF where Referer depends on header being present

`LastSearchTerm`

>*Identify* the CSRF where token not tied to non-session cookie, by changing the csrfkey cookie and seeing the result that the request is rejected. Observe the LastSearchTerm cookie value containing the user supplied input from the search parameter.

!identify-csrf-non-session-tied.png

>Search function has no CSRF protection, create below payload that injects new line characters to set new cookie value in response, and use this to inject cookies into the user's browser.

>Generate CSRF POC, Enable the option to include an auto-submit script and click Regenerate. Remove the auto-submit script code block and add following instead, and place script code below body header. The onerror of the IMG SRC tag will instead submit the CSRF POC.

>During BSCP Exam set the email change value to that of the exploit server ** email address. Then you can change the administrator password with the reset function.

!csrf set cookie poc

>In the below CSRF PoC code, the hidden csrf value is the one generated by the change email function and the csrfkey value in the img src is the value of the , obtained by logging on as provided credentials. not sure in exam but real world this is test to be performed.

PortSwigger Lab: CSRF where token is tied to non-session cookie

`CSRF duplicated in cookie`

>In the target we *identify* that the CSRF key token is duplicated in the cookie value. Another *indicator* is the cookie contain the value searched. By giving search value that contain we can inject an end of line and new line characters to create new CSRF cookie and value.

!set cookie csrf fake

>In the exploit code tag we set cookie for csrf to fake.

!csrf duplicated cookie

PortSwigger Lab: CSRF where token is duplicated in cookie

`CSRF Token Present`

>Changing the value of the parameter result in change email request being rejected. Deleting the CSRF token allow the change email to be accepted, and this *identify* that the of token being present is .

>CSRF PoC Payload hosted on exploit server:

!csrf present fail

PortSwigger Lab: CSRF where token depends on token being present

`Is Logged In`

>If cookie with the isloggedin name is *identified*, then a refresh of admin password POST request could be exploited. >Change username parameter to administrator while logged in as low pri user. >CSRF token is not tied to user session.

!CSRF privesc

`CSRF No Defences`

>Target with no defences against email change function, can allow the pri escalation to admin role. In the exam changing the email to the email address on the exploit server can allow the attacker to change the password of the admin user, resulting in pri escalation. >In the exam there is only *one* active user, and if the previous stage was completed using an attack that did not require the in of the active user clicking on a link by performing poison cache or performing phishing attack by means ofDeliver to function, then CSRF change exploit can be used.

!csrf-change-email.png

PortSwigger Lab: CSRF with no defences

`SameSite Strict bypass`

>In the live chat function, we notice the GET /chat HTTP/2 request do not use any unpredictable tokens, this can *identify* possible cross-site WebSocket hijacking (CSWSH) if possible to bypass SameSite cookie restriction.

>Host on exploit server POC payload to *identify* CSWSH .

>The SameSite=Strict is set for session cookies and this prevent the browser from including these cookies in XSS cross-site requests. We *Identify* the header Access-Control-Allow-Origin in additional requests to script and images to a subdomain at cms-. >Browsing to this CDN subdomain atcms- and then *identify* that random user name input is reflected, confirmed this to be a reflected XSS .

cms reflected xss samesite bypass

>Bypass the SameSite restrictions, by URL encode the entire script below and using it as the input to the CDN subdomain at cms- username login, hosted on exploit server.

>Host the following on exploit server and deliver to , once the collaborator receive the chat history with their password, result in account takeover.

>The chat history contain password for the .

!chat-history.png

PortSwigger Lab: SameSite Strict bypass domain

`SameSite Lax bypass`

>Observe if you visit /social-login, this automatically initiates the full OAuth flow. If you still have a logged-in session with the OAuth server, this all happens without any interaction., and in proxy history, notice that every time you complete the OAuth flow, the target site sets a new session cookie even if you were already logged in.

>Bypass the popup blocker, to induce the to click on the page and only opens the popup once the has clicked, with the following Ja. The exploit Ja code first refreshes the 's session by forcing their browser to visit /social-login, then submits the email change request after a short pause. Deliver the exploit to the .

PortSwigger Lab: SameSite Lax bypass refresh

-----

`Password Reset`

Refresh Password broken logic Current Password Time-Sensiti Tokenz

`Refresh Password broken logic`

>If the application Refresh Password feature is flawed, this can be exploited to identify valid accounts or obtain password reset token. This can lead to identifying valid users accounts or pri escalation.

>This is the type of that do not require active user on application to interact with the exploit, and without any user clicking on link or interaction. Take note of that do not require active user on application for the BSCP exam, as this mean in the next stage of the exam it is possible to use for example other interacti links send to .

>*Identify* in the source code for the /forgot-password page the username is a hidden field.

!Password reset hidden username

>Exploit the post request by deleting the parameter in both the URL and request body. Change the username parameter to .

!Temp-forgot-password-token

PortSwigger Lab: Password reset broken logic

`Current Password`

>*Identify* the Change password do not need the parameter to set a new password, and the user whom password will be changed is based on POST parameter >In the PortSwigger labs they provide you the credentials for , and this simulate in the exam stage 1 achieved low level user access. In exam this password reset is example of how it is possible without interaction from active user to pri escalate your access to admin.

>Intercept the request as the token is single random use value, set , and remo.

!Change password without current

PortSwigger Lab: Weak isolation on dual-use endpoint

`Time-Sensiti Tokenz`

>The target site uses time stamps to generate a hash password reset token URL.

>By sending parallel force password reset requests for two different users at the same time, >will result in duplicate matching tokens because the same timestamp used by backend to generate the reset tokenz.

>Our own user carlos receive the reset token url in their email and then edit the name in the url to match administrator target user.

!portswigger_race_condition_force-forgot-password-tokenz.png

>PortSwigger Lab: Exploiting time-sensiti

>Reference: API Uni and PortSwigger Labs study notes

----

`SQL Injection`

Blind Time Delay Blind SQLi Blind SQLi no indication Blind SQLi Conditional Response Oracle SQLMAP Non-Oracle Manual SQLi error-based SQLi HackTheBox CPTS SQLi Fundamentals

>Error based or Blind SQL injection , allow SQL queries in an application to be used to extract data or login credentials from the database. SQLMAP is used to fast track the exploit and retrieve the sensiti.

>*Identify* SQLi, by adding a double (") or single quote (') to web parameters or tracking cookies, if this break the SQL syntax resulting in error message response, then positive SQL injection *identified*. If no error or conditional message observed test blind Time delays payloads.

SQL Injection cheat sheet examples

!Identify the input parameter to SQL injection

`Blind Time Delay`

>Blind SQL injection with time delays is tricky to *identify*, fuzzing in educated guessing as OffSec also taught me in OSCP. The below payload will perform conditional case to delay the response by 10 seconds if positive SQL injection *identified*.

>Identify SQLi . In Burp Practice exam Stage 2 the advance search filters are to PostgreSQL. I found SQLMAP tricky to identify and exploit the practice exam in advance search. Manual exploit of the SQL injection time delay in Practice Exam here.

>URL encoded PostgreSQL payload.

>Determine how many characters are in the password of the administrator user. To do this, increment the number after >1 conditional check.

!blind-time-delay SQLi

>Using CLUSTER Bomb attack to re-run the attack for each permutation of the character positions in the password, and to determine character value.

>Using CLUSTER bomb attack type with two payload, first for the length of the password 1..20 and then second using characters a..z and numbers 0..9 . Add the Response Received column to the intruder attack results to sort by and observe the 10 seconds or more delay as positi.

!blind CLUSTER bomb SQLi

PortSwigger Lab: Blind SQL injection with time delays and information retrieval

#### Practice Exam PostgreSQL TimeDelay

>In the Burp Practice exam stage 2 the SQL injection is escaped not using single quote ' but using a semicolon ; and then URL encoding it as %3B.

!practice exam stage-2 time delay sqli

>With a Intruder CLUSTER bomb attack the password can be extracted in one single attack with two payload positions in the below payload.

>Stage 3 of the Burp Practice exam admin portal require exploitation of an insecure deserialization cookie value.

`Blind SQLi`

>Target is to Out of band data exfiltration using Blind SQL exploitation query. In this case the trackingID cookie. Below is combination of SQL injection and XXE payload to exploit the and send administrator password as DNS request to the collaborator service.

!Blind SQL injection with out-of-band data exfil

PortSwigger Lab: Blind SQL injection with out-of-band data exfiltration

>The SQL payload above can also be used to extract the Administrator password for the this PortSwigger Lab: Blind SQL injection with conditional errors challenge.

`Blind SQLi no indication`

>Placing a single quote at end of the cookie or search parameter /search_ad?searchTerm=' may gi 500 Internal Ser. Make an educated guess, by using below blind SQLi payload and combine with basic XXE technique, this then makes a call to collaboration server but no data is ex-filtrated.

!SQLi XXE

>Additional SQLi payload with XML for reference with the SQL concatenation operator to concatenate two expressions that e two character data types or to numeric data type and do some obfuscating.

OAST - Out-of-band Application Security Testing

PortSwigger Lab: Blind SQL injection with out-of-band interaction

`Blind SQLi Conditional Response`

>This blind SQL injection is *identified* by a small message difference in the responses. When sending a valid true SQL query the response contain string in response. Invalid false SQL query statement do not contain the response conditional message.

>False SQL statement to *identify* conditional message not in response.

>Determine how many characters are in the password of the administrator user. To do this, change the SQL statement value to and in intruder Settings tab, at the "Grep - Match" section. Clear any existing entries in the list, and then add the value to *identify* true condition.

>Next step is to test the character at each position to determine its value. This in a much larger number of requests.

!sqli conditional response

>Alternative use a CLUSTER Bomb attack and setting two payload positions, first one for the character position with a payload of numbers and the second position, using alpha and number characters, this will iterate through each permutation of payload combinations.

!CLUSTER bomb

PortSwigger Lab: Blind SQL injection with conditional responses

`Oracle`

>Identified SQL injection by adding a single quote to the end of the category parameter value and observing response of 500 Internal Ser.

>Retrieve the list of tables in the Oracle database:

>Oracle payload to retrieve the details of the columns in the table.

>Oracle payload to retrieve the usernames and passwords from Users_XXX table.

PortSwigger Lab: SQL injection attack, listing the database contents on Oracle

`SQLMAP`

>In the PortSwigger Practice Exam APP we *identify* SQLi on the advance search function by adding a single quote and the response result in HTTP/2 500 Internal Ser.

>Here is my HackTheBox CPTS study notes on SQLMAP examples to bypass primiti WAF mechanisms. SQLMAP Essentials - Cases

>After doing some testing with SQLMAP 1.7.2#stable and 1.6, I found that both are able to exploit the PortSwigger Practice exam. Walkthrough from bmdyy doing the Practice Exam using SQLMAP for reference of the parameters used.

PortSwigger Forum thread - SQLMAP

>I took the practice exam and was able to exploit SQLi using below payload.

!SQLMAP used to dump data from tables

>This is also a good start with SQLMAP to *identify* and extract data from a sensiti based time delay SQL injection in advance search filters on the exam.

!sqlmap 1.7.2 stable

SQLMAP Help usage

>SQLMAP DBS to get databases.

>Use SQLMAP dump tables identified from public database.

>ContinueUse SQLMAP E Technique to get the users content.

`Non-Oracle Manual SQLi`

>SQL injection UNION attack, determining the number of columns returned by the query.

>Determined there is two columns returned. Finding a column containing , to be used for reflecting information extracted.

>Next *identifying* a list of tables in the database.

>OPTIONAL: Retrieve data from other tables, use code below payload to retrieve the contents of the table.

>Retrieve the names of the columns in the *users* table.

>Final step is to the dump data from the username and passwords columns.

>EXTRA: If you only have one column to extract text data, then concatenate multiple in a single reflected output field using SQL syntax characters from the database.

!manual-sqli.png

PortSwigger Lab: SQL injection attack, listing the database contents on non-Oracle databases

`error-based SQLi`

>Adding a single quote to the end of the TrackingId cookie value, we can *identify* and confirm the SQL Injection based on the message in the response.

!identify-.png

>The two payloads administrator record is the first record, and then to retrieve the password for the Administrator account from the user table in the database, from the columns username and password.

>Due to the cookie value length limit the payload is shortened by using limit 1, and the actual cookie value replace with just a letter x. SQL Injection used the CAST function.

!SQL Injection CAST function

PortSwigger Lab: error-based SQL injection

-----

`JWT`

JWT bypass via JWK JWT Weak secret JWT kid header JWT arbitrary jku header

>JSON web tokens (JWTs) use to send cryptographically signed JSON data, and most commonly used to send information ("claims") about users as part of authentication, session handling, and access control.

`JWT bypass via JWK`

>The burp scanner *identify* in server as, JWT self-signed JWK header supported. Possible to exploit it through failed check of the provided key source. >jwk (JSON Web Key) - Provides an embedded JSON object representing the key.

>Authentication bypass Exploit steps via jwk header injection:

1. New RSA Key 2. In request JWT payload, change the value of the sub claim to administrator 3. Select Attack, then select Embedded JWK with newly generated RSA key 4. Observe a parameter now contain our public key, sending request result in access to admin portal

!jwk header

PortSwigger Lab: JWT authentication bypass via jwk header injection

`JWT Weak secret`

>Brute force weak JWT signing key using hashcat.

>Hashcat result provide the secret, to be used to generate a forged signing key.

PortSwigger JWT authentication bypass via weak signing key

`JWT kid header`

>JWT-based mechanism for handling sessions. In order to the signature, the server uses the kidparameter in JWT header to fetch the relevant key from its file system. >Generate a new Symmetric Key and replace k property with the base64 null byte AA==, to be used when signing the JWT. >kid (Key ID) - Provides an ID that servers can use to identify the correct key in cases where there are multiple keys to choose from.

>JWS

>Payload

!jwt

PortSwigger Lab: JWT authentication bypass via kid header path tra

`JWT arbitrary jku header`

>Burp scanner identified stating the application appears to trust the jkuheader of the JWT found in the manual insertion point. It fetched a public key from an arbitrary URL provided in this header and attempted to use it to the signature. >jku (JSON Web Key Set URL) - Provides a URL from which servers can fetch keys containing the correct key.

>Exploit steps to Upload a malicious JWK Set, then Modify and sign the JWT:

1. Generate New RSA Key pair automatically, and ignore the size. 2. On the exploit server body create empty JWK { "keys": [ ] } . 3. Copy Public Key as JWK from the new RSA key pair generate in previous step, in between the exploit body square brackets [ paste ] . 4. Copy kid value of generate RSA key into the/admin request JWT header kidvalue. 5. Set new parameter to the value of the exploit server URL. 6. Change JWT payload value of the claim toadministrator. 7. On the/admin request in repeat, at bottom of the JSON Web Token tab, click Sign. 8. On Sign option, then select theRSA signing keythat was generated in the previous steps. 9. Send request, and gain access to admin portal.

!jwt-jku-header-setup.png

>The exploit ser the JWK public key content.

!jwt-jku-header-exploit-server.png

PortSwigger Lab: JWT authentication bypass via jku header injection

-----

`ProtoType Pollution`

>Attacker add arbitrary properties to global Ja object prototypes, which is inherited by user-defined objects that lead to client-side DOM XSS or ser code execution.

Client-Side Proto Ser Proto Dom Invader Enable Prototype Pollution

`Client-Side Proto`

>A target is to DOM XSS side prototype pollution. DOM Invader will *identify* the gadget and using a hosted payload to performing phishing directed at the and steal their cookie.

>Exploit server Body section, host an exploit that will na the to a malicious URL.

!Proto pollution

>Abo show the Deliver to phishing request being send.

PortSwigger Lab: Client-side prototype pollution in third-party libraries

!Proto pollution

`Ser Proto`

>To *identify* Proto pollution, insert the follow into a JSON post request when updating a user profile information authenticated as low pri role. >See instruction video by Tre about PrivEsc prototype pollution.

!identify __proto__

>Observe the property and resend the POST update account with the payload below to elevate our access role to Administrator.

PortSwigger Lab: Pri escalation prototype pollution

-----

`API Testing`

Exploiting a mass assignment API Reset Password Parameter Pollution

`Exploiting a mass assignment`

>API performing GET request and directly after a POST request and in the POST request notice additional JSON parameters in the body of response, indicate hidden parameter fields. >Add hidden fields such as{"admin":true} can elevate access to higher pri users or gain sensiti about user.

>In below lab exercise the ecommerce site have a discount parameter and adding it with value of 100 allow for the product to be free on checkout.

!Mass assignment hidden parameter

>Pri escalation using API endpoints hidden parameters in POST or PATCH HTTP verb request.

PortSwigger Lab: Exploiting a mass assignment

`API Reset Password Parameter Pollution`

>Notice the reset password API function uses parameter in POST body for username. To *identify* aditional hidden parameters for the API function insert random parameter to obser message leaking information of positi. >URL encode the random parameter and add it to current POST body parameters:

#### URL Encode Character Table

* %3F - ?*%3E - >*%3D - =*%3C - <*%3B - ;*%2C- ',' *%28 - (*%29 - )*%27 - '*%26 - &delimiter between different parameters *%25 - %*%24 - $*%23 - #fragment identifier *%22 - "*%2F - /*%27 - back tick

>Based on the response there is possible second parameter named field and re the Ja source code there is reset_token parameter.

!api-code-re

>Adding the additional parameter field with reset_token in the POST request, leak the seniti to reset password token.

!api-resetpassword-leak-token

Browsing to the target URL and adding the stolen reset token, and change the administrator or carlos user password to gain access.

PortSwigger Lab: Exploiting ser parameter pollution in a query string

----

`Access Control`

JSON roleid PrivEsc Original URL Drop Select a role Trace to Admin HTB requested I remove my write-up for CPTS Skills assessments - IDOR

`PrivEsc JSON RoleId`

>Access control to the admin interface is based on user roles, and this can lead to pri escalation or access control (IDOR) security .

>Capture current logged in user email change email submission request and send to Intruder, then add "roleid":§32§ into the JSON body of the request, and fuzz the possible roleid value for administrator access role.

>The Hitchhiker's Guide to the Galaxy answer was 42

!Intruder Payload set to identify Admin role ID

>Attacker *identify* the possible role ID of administrator role and then send this request with updated roleId to pri escalate the current logged in user to the access role of administrator.

!Attack identify Admin role ID

PortSwigger Lab: User role can be modified in user profile

>See API Mass assignment lab exercises to alter JSON by inserting additional fields in JSON POST data.

`Drop Select a role`

>Escalation to administrator is sometimes controlled by a role selector GET request, by dropping the Please select a role GET request before it is presented to the user, the default role of admin is selected by back-end and access is granted to the admin portal.

!Select a role

PortSwigger Lab: Authentication bypass state machine

`Original URL`

>Admin portal only accessible from internal. *Identify* if access control can be bypassed using header X-Original-URL, obser response to /admin endpoint requests depending on header value.

!x-original-url

PortSwigger Lab: URL-based access control can be circum

`Trace to Admin`

>Unable to reach /admin portal, but when changing the GET request to TRACE /admin this response contain an X-Custom-IP-Authorization: header. >Use the *identified* header to by access control to the admin authentication.

!trace info

PortSwigger Lab: Authentication bypass disclosure

-----

`GraphQL API`

Identify GraphQL API GraphQL Reveal Credentials GraphQL Brute Force GraphQL attack paths

`Identify GraphQL API`

>To *identify* if there is hidden GraphQL API endpoint send an invalid GET request endpoint and obser Not Found, but when sending /api the response is Query not present.

!graphql API identify

>Enumeration of the GraphQL API endpoint require testing with a uni query. >Modify GET request with query as a URL parameter/api?query=query{__typename}.

>The below response the *identity* of GraphQL endpoint:

>Check introspection, with new request URL-encoded introspection query as a query parameter.

!graphql-api-introspection-query.png

>Bypass introspection protection matching the regex filters, and modify the query to include a %0a newline character after __schema and resend.

>Save the introspection response to file as graphql.json, and remove HTTP headers from the sa file leaving only body.

>On the InQL Scanner tab, load the file graphql.jsonand enter to scan API endpoint. >Expand scan results for the schema and find thegetUserquery. >In Repeater, copy and paste the getUser query as parameter and send it to the API endpoint discovered but first URL encode all characters.

>Test alternative user IDs until the API confirms carlos user ID as 3.

!graphql-api-getuser-sensiti.png

>This give you sensiti for a user on the system such as login token, login password information, etc.

PortSwigger Lab: Finding a hidden GraphQL endpoint

`GraphQL Reveal Creds`

>Intercept the login POST request to the target. *Identify* the GraphQL mutation contain the username and password.

!graphql-identify

>Copy the URL of the /graphql/v1 POST request and past into the *InQL Scanner* tab to scan API.

!graphql-scanner.png

>There is a getUser query that returns a user's username and password. This query fetches the relevant user information via a direct reference to an id number.

>Modify a request by replacing the inQL tab query value to the below discovered getuserquery from scanner. >In the POST JSON body remove theoperationName property and value.

!graphql-modify-request.png

>Log in to the site as the administrator, and gain access to the Admin panel.

PortSwigger Lab: Accidental exposure of private GraphQL fields

`GraphQL Brute Force`

>The login API is protected by rate limiter to protect against brute force attacks. >Sending too many incorrect login attempts to the API, rate limit protection response message response is *identified*.

>Using the following PortSwigger Ja to generate a list of login combination with password wordlist as part of brute force attack that bypass rate limiting protection.

!graphql-brute-list.png

>Using the output from the abo, and place it in the InQL tab of the login POST request POST /graphql/v1 HTTP/2, removing the operationName POST body parameter and value, before sending single request containing all possible passwords in the GraphQL query.

!graphql-brute-force-InQL.png

>Response from the single POST request is one value marked true and the client login token return in response.

>Replace the cookie in browser to impersonate Carlos user session.

PortSwigger Lab: Bypassing GraphQL brute force protections

`GraphQL`

>Using GraphQL to find attack paths, sensiti, types, objects and data.

>Run Introspection query and copy response body to file introspection.json>Host local GraphQL on Kali Linux:

>See code for the server.js in repo files.

>Browse to GraphQL instance

!GraphQL

-----

`CORS`

Trusted insecure protocols Null origin trusted

`Trusted insecure protocols`

>*Identify* in the source code the account details are requested with AJAX request and it contains the user session cookie in the response.

!cors-ajax-request.png

>Test if the application CORS configuration will allow access to sub-domains using below test header. If response include the Access-Control-Allow-Origin header with the origin reflect it is to CORS.

>The target call subdomain to retrie , and the productid parameter is to cross-site scripting (XSS).

!Subdomain cors xss

>Place code in the exploit server body and Deli to to steal the AJAX session token and API key. In the BSCP exam use the CORS to steal JSON data that also include the administrator session token, and can be used to escalate pri.

PortSwigger Lab: CORS with trusted insecure protocols

`Null origin trusted`

>Identify the CORS insecure configuration by checking the AJAX response if it contains the Access-Control-Allow-Credentials, then add header Origin: null. If the null origin is reflected in the Access-Control-Allow-Origin header it is .

>Payload that may work in BSCP exam to obtain the administrator account API and session cookie data. Host on exploit server.

!CORS-NULL trusted

PortSwigger Lab: CORS with trusted null origin

-----

`Data Exfiltration`

`XXE Injections`

XXE Identify XXE Xinclude file read XXE DTD Blind Out-of-band XXE DTD Blind Error messages XXE SQLi inside XML + Hack XXE perform SSRF XXE with S HackTheBox XML External Entity Injection - Private Github

>File upload or user import function on web target use XML file format. This can be to XML external entity (XXE) injection.

`Identify XML`

>Possible to find XXE attack surface in requests that do not contain any XML.

>To *Identify* XXE in not so obvious parameters or requests, require adding the below and URL encode the & ampersand symbol to see the response.

>Below the ser with indication that XML Entities are not allowed for security reasons.

!Identify XML Injections

`Xinclude file read`

>Webapp Check Stock feature use ser XML document that is server side parsed inside XML document, and request is not constructed of the entire XML document, it is not possible to use a hosted DTD file. Injecting an XInclude statement to retrieve the contents of file instead.

!XInclude to retrie

>URL encode the XXE payload before sending.

PortSwigger Lab: Exploiting XInclude to retrie

`DTD Blind Out-of-band`

>On the exploit ser the hosted file name to as the exploit file with Document Type Definition (DTD) extension, containing the following payload. The is the Unicode hex character code for percent sign . Parameter entities are referenced using the percent character instead of the usual ampersand.

!Exploit.DTD file hosted

>Modify the file upload XML body of the request before sending to the target server.

!Exploiting blind XXE to exfiltrate data using a malicious exploit DTD file

PortSwigger Lab: Exploiting blind XXE to exfiltrate data using a malicious external DTD

>Rabbit hole: The submit feedback and screenshot upload on feedback is not to be followed by *Neo* down the Matrix.

`Identify Existing DTD Files`

>Reference list of existing DTD fileS on servers GoSecure dtd-finder dtd_files.txt

The following XML payload in POST body can be used to identify existing DTD files on target server:

>Use Burp Intruder with abo wordlists to find valid DTD files that can be repurposed to *Exploiting XXE to retrieve data exfil by repurposing a local DTD*

!xml_identify_existing_dtd_files.png

`DTD Blind Error messages`

>Trigger XML parsing errors in such a way that the error messages contain sensitive data. >If the out of band to Collaborator payload above do not work test if the target will call a file with invalid reference >and return response in an error message.

>Hosted on exploit server the file and body contents to path.

>On the stock check XML post request insert the payload between definition and first element.

!DTD Exploit invalid error

PortSwigger Lab: Exploiting blind XXE to retrieve data messages

>Rabbit hole: The submit feedback and screenshot upload on feedback is for *Neo* to follow *Trinity* in the Matrix.

`SQL + XML + Hack`

>The combination of are *identified* in a XML Post body and inserting mathematical expression such as 7x7 into field and observing the e value. Using this type of XML and SQL injection with WAF filter bypass may allow extract of sensitive data. >Hack Online tool

!identify-math-e

>WAF detect attack when appending SQL query such as a UNION SELECT statement to the original store ID. Web application firewall (WAF) will block requests that contain obvious signs of a SQL injection attack.

>Bypass the WAF, Use Burp extension Hack to obfuscate the SQL Injection payload in the XML post body.

!Web application firewall (WAF) bypass require obfuscate of malicious query with Hack

>Webapp return one column, thus need to concatenate the returned usernames and passwords columns from the users table.

!SQL injection with filter bypass via XML encoding obfuscation

>Below is sample SQLi payloads to read local file, or output to another folder on target.

PortSwigger Lab: SQL injection with filter bypass via XML encoding

-----

`SSRF - Server Side Request Forgery`

SSRF blacklist filter SSRF GET URL + HOST Header SSRF inside XXE SSRF HOST Routing-based SSRF inside HTML-to-PDF SSRF Open Redirection SSRF Consecuti State

>Ser request forgery is a web security that allows an attacker to cause the ser application to make requests to an unintended malicious exploit location URL.

>SSRF attack cause the server to make a connection to internal services within the organization, or force the server to connect to arbitrary external systems, potentially leaking sensitive data. Burp scanner may detect SSRF issue as an, External service interaction (HTTP).

>SSRF Sample payloads.

>Alternative IP representation of : 1. 2130706433 2. 0 3. 127.1

`SSRF blacklist filter`

>*Identify* the SSRF in the stockAPI parameter, and bypass the block by changing the URL target localhost and admin endpoint to: .

>Double URL encode characters in URL to Obfuscate the a to %2561, resulting in the bypass of the blacklist filter.

!ssrf obfuscated

PortSwigger Lab: SSRF with blacklist-based input filter

`Absolute GET URL + HOST SSRF`

>*Identify* SSRF flawed request parsing by changing the HOST header to Collaborator server and pro an absolute URL in the GET request line and observe the response from the Collaborator server.

!identify ssrf flawed request parsing host header

>Use the Host header to target 192.168.0.141 or , and notice the response give 302 status admin interface found. Append /admin to the absolute URL in the request line and send the request. Observe SSRF response.

!ssrf

PortSwigger Lab: SSRF request parsing

`SSRF redirect_uris`

>In this Server Side Request a Redirect to URI is exploited. >POST request to register data to the client application with redirect URL endpoint in JSON body. Provide a redirect_uris array containing an arbitrary white-list of callback URIs. Observe the redirect_uri.

!ssrf_redirect_uris.png

PortSwigger Lab: SSRF dynamic client registration

`XXE + SSRF`

>Exploiting XXE to perform SSRF attacks using stock check function that obtains sensitive data.

!xxe-ssrf-localhost.png

PortSwigger Lab: Exploiting XXE to perform SSRF attacks

`HOST Routing-based SSRF`

>*Identify* routing-based SSRF by altering the host header on request and observe the response. Routing-based SSRF via the Host header allow insecure access to a localhost Intranet.

!Routing-based SSRF

>Note: Once access gained to the internal ser portal, the response indicate the form requires a POST request and CSRF token, so we convert the GET request to POST as below.

PortSwigger Lab: Routing-based SSRF

`HTML to PDF`

>Identify a PDF download function and the source code uses to create html on download. This HTML-to-PDF framework is to SSRF attack. Partial source code for Ja on the target .

>Note: The <div> tag defines a di or a section in an HTML document. The <div> tag is used as a container for HTML elements - which is then styled with CSS. z3nsh3ll explain HTML DI and SPAN different ways to style the elements.

>Identify file download HTML-to-PDF convert function on target is .

>Libraries used to convert HTML files to PDF documents are to ser request forgery (SSRF).

PortSwigger Research SSRF

>Sample code below can be injected on implementation of HTML to PDF con such as to read local file, resulting in SSRF to Local File Read Exploit in Hassan's blog.

>Thehackerish showing wkHTMLtoPDF exploitation using root-me.org - Gemini-Pentest-v1 CTF lab in the video Pentest SSRF Ep4 by editing the name of the admin profile with HTML content it is then generated server side by including remote or local files.

!root-me ctf Gemini pentest v1

>JSON POST request body containing the HTMLtoPDF formatted payload to read local file.

!root-me ctf wkhtmltopdf 0.12.4

>Above the display name is injected with payload and on export the HTML-to-PDF con perform SSRF.

>The PDF creator: wkhtmltopdf 0.12.5 is known for SSRF , and in HackTricks - Server Side XSS - Dynamic PDF there is cross site scripting and server side exploits documented.

`SSRF Open Redirection`

>The target make GET request to the *next product* on the e-commerce site, using a path parameter. On the stockAPI POST request the value provided in body data is the partial path to internal system. See product page source code below.

!ssrf-open-redirection-code.png

>The *identification* of this is by testing paths and observing the input path specified is reflected in the response Location header.

!SSRF Open Redirect Location reflect

>In this lab they state the admin interface is at but in exam use the .

>On the POST stock request, replace the StockAPI value with the partial path, not the absolute URL, from the GET request URL as the value of the parameter.

>URL-encode payload

!SSRF Open Redirect

PortSwigger Lab: SSRF with filter bypass via open redirection

-----

`SSTI - Server Side Template Injection`

SSTI Identified Tornado Django Freemarker ERB Handlebars

>Use the web framework nati syntax to inject a malicious payload into a {{input}}, which is then executed ser. Submitting invalid syntax will often result in error message that lead to *identifying* the template framework. Use PortSwigger template decision tree to aid in *identification*.

`SSTI Identified`

>SSTI can be *identified* using the tool SSTImap. The limitations of this tool is that the template expression results are sometimes only e by another GET request or calling another function in the application, as the output is not directly reflected or echoed into the response where the template expression was posted. >Alternative way to *identify* the template framework is to induce error message by injecting malformed user supplied payloads.

Tib3rius gi SSTI explanation on this PortSwigger Web Academy labs tutorial

>POST request with the data param to test and send payload using SSTImap tool.

!SSTImap Tool

>SSTI payloads to manually *identify* .

`Tornado`

>*Identification* of tornado template framework after testing injection with .

!Identify SSTI

>Tornado Template can be *identified* using a payload that breakout of current expression and e 7*7.

>The preferred name functionality in the user account profile page is altered and on blog post comment the output displayed.

!Tornado Template

>Data extracted from the output response when reloading the blog comment pre saved by a logged in user after changing their preferred display name.

!ssti tornado results

Lab: Basic ser template injection code context

`Django`

>Django Template uses tag to display debugging information.

!Django template

PortSwigger Lab: Ser template injection with information disclosure objects

`Freemarker`

>Freemarker Template Content-Manager (C0nt3ntM4n4g3r)

!Freemarker template

PortSwigger Lab: Ser template injection using documentation

`ERB`

>Embedded Ruby (ERB) template syntax >Identify ERB template in aGET /?message=Unfortunately%20this%20product%20is%20out%20of%20stock HTTP/2 request that then reflects the message value in the response, Unfortunately this product is out of stock.

>ERB Template documentation reveals that you can list all directories and then read arbitrary files as follows:

!ERB template

PortSwigger Lab: Basic ser template injection

`Handlebars`

>Handlebars Template can be identified by injecting below set of characters and not encoding them into the GET /?message=Unfortunately this product is out of stock parameter. SSTIMAP was not able to identify this handlebars SSTI .

Use fuzzer payload to produce error message that *identify* handlebars template engine.

!identified-ssti-handlebars.png

>URL encoding the payload, it is not required to remo breaks or spaces. The payload will send the contents of /home/carlos/secret to Burp Collaborator.

!Handlebars template

PortSwigger Lab: Ser template injection in an unknown language

PortSwigger Research SSTI

>Note: *Identify* the Update forgot email template message under the admin_panel at the path /update_forgot_email.

-----

`SSPP - Server Side Prototype Pollution`

>The application run Node.js and the Express framework. It is to ser prototype pollution (SSPP) because it unsafely merges user-controllable input into a ser Ja object.

>SSPP Exploit steps:

1. Find a prototype pollution source that you can use to add arbitrary properties to the global Object.prototype. 2. Identify a gadget that you can use to inject and execute arbitrary system commands. 3. Trigger remote execution of a command that deletes the file /home/carlos/morale.txt.

>*Identify* prototype pollution

>Test for remote code execution (RCE) by performing DNS request from back-end.

Inject exploit in to read or delete user sensitive data. After injection, trigger new spawned node child processes, by using admin panel maintenance jobs button. This will action on Carlos secret file.

!SSPP JSON injection

PortSwigger Lab: Remote code execution prototype pollution

-----

`File Path Tra`

HackTheBox CPTS File Inclusion LFI Attacks Admin Portal Files Path Tra Authz

`LFI attacks`

>Rana Khalil Directory tra training demo show the attacks that allow the malicious actor to read file on the server. >*Identify* web parameters such asfilename= that are requesting files from target.

1. Application blocks tra sequences but treats the supplied filename as being relative to a absolute path and can be exploit with absolute path to target file payload. 2. Images on target is loaded using parameter, and is defending against tra attacks by stripping path tra. Exploit using payloads. 3. Superfluous URL-encoded payload can bypass application security controls. 4. Leading the beginning of the filename referenced with the original path and then appending payload at end bypasses the protection. 5. Using a null byte character at end plus an image extension to fool APP controls that an image is requested, this payload succeed. 6. Double URL encode file path tra, as example this../../../../../../../../../../etc/hostname will be URL double encoded as, %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fhostname. 7. Windows OS accept both../ and ..\ for directory tra syntax, and as example retrieving loadImage?filename=..\..\..\windows\win.inion windows target to *identify* valid path tra. 8. PHP Wrapper, expect & filter pose that allow tra bypass to result in remote code execution (RCE) critical. Using PHP filter chain generator to get your RCE without uploading a file if you control entirely the parameter passed to a require or an include in PHP! See Tib3rius YouTube demo 9...%2f is also basic dot dot Forward Slash file path tra obfuscation technique payload ..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd

>Corresponding PortSwigger Directory tra labs.

1. PortSwigger Lab: File path tra, tra sequences blocked with absolute path bypass 2. PortSwigger Lab: File path tra, tra sequences stripped non-recursively 3. PortSwigger Lab: File path tra, tra sequences stripped with superfluous URL-decode 4. PortSwigger Lab: File path tra, of start of path 5. PortSwigger Lab: File path tra, of file extension with null byte bypass

!file-path-tra.png

>BSCP Exam challenge *identified*, after obtaining admin session access, you can read /etc/passwd and /etc/hostname but as soon using same bypass file path tra technique, the home/carlos/secret gi 403 Forbidden.

`Admin Portal Files`

>On the admin portal *identify* that the images are loaded using imagefile= parameter. Test if to directory tra. The imagefile parameter is to directory tra path attacks, enabling read access to arbitrary files on the server.

>Note: Add the fuzzing path tra payload from drop-down list option, *Add from list ...*. Then set processing rule on the provided payload to replace the FILE place holder with reg-ex for each of the attacks.

!payloads for path traverse

>Burp Intruder provides a predefined payload list, as example "Fuzzing - path tra".

PortSwigger Academy File-path-tra

403bypasser

`Path Tra Authz`

>Adding Headers in request with value 127.0.0.1 or localhost can also help in bypassing restrictions.

HackTricks Bypass 403 Forbidden paths

-----

`File Uploads`

Bypass Upload Controls XXE via S upload Remote File Inclusion XSS S Race Condition Web shell upload Exploit-Notes: File Upload Attack references

`Bypass Upload Controls`

>A image upload function or avatar logo upload, can by exploited and security controls bypassed to upload content to extract sensitive data or execute code server side.

>*Identify* any type of file upload function.

!Identify file upload

>The PHP source code of the exploit.php file below will read the /home/carlos/secret sensiti.

>File upload bypass techniques:

1. Upload the file name and include obfuscated path tra ..%2fexploit.php and retrieve the content GET /files/a/..%2fexploit.php. 2. Upload a file named,exploit.php%00.jpg with trailing null byte character and get the file execution at /files/a/exploit.php. 3. Create polygot using valid image file, by running the command in bash terminal:exiftool -Comment="<?php echo 'START ' . file_get_contents('/home/carlos/secret') . ' END'; ?>" ./stickman.png -o polyglot2023.php. Once polygot is uploaded, view the extracted data by issuing a GET request to the uploaded path /files/a/polyglot.php , and search the response content for the phrase STARTto obtain the sensitive data. 4. Upload two different files. First upload.htaccess with Content-Type: text/plain, and the file data value set to AddType application/x-httpd-php .l33t. This will allow the upload and execute of second file upload named, exploit.l33t with extension l33t. 5. MIME typeimage/jpeg or image/png is only allowed. Bypass the filter by specifying Content-Type to value of image/jpeg and then uploading exploit.phpfile. 6. If target allow Remote File Include (RFI), upload from remote URL, then host and exploit file with the following GIF magic bytes:GIF89a; <?php echo file_get_contents('/home/carlos/secret'); ?>. The file name on exploit ser read image.php%00.gif. 7. Double file extension bypass filterexploit.csv.php.

>Matching file upload labs:

1. PortSwigger Lab: Web shell upload via path tra 2. PortSwigger Lab: Web shell upload file extension 3. PortSwigger Lab: Remote code execution web shell upload 4. PortSwigger Lab: Web shell upload blacklist bypass 5. PortSwigger Lab: Web shell upload restriction bypass

!File upload stages

>This intigriti walkthrough great explanation of file upload lab.

`XXE via S upload`

>*Identify* image upload on the blog post function that accept svg images, and observe that the a already on blog source code is svg extensions.

>The content of the image.svg file uploaded:

!xxe s file

PortSwigger Lab: Exploiting XXE file upload

`Remote File Inclusion`

>RFI function on target allow the upload of image from remote HTTPS URL source and perform to checks, the source URL must be and the file extension is checked, but the MIME content type or file content is maybe not . Incorrect RFI result in response message, File must be either a jpg or png.

>Methods to bypass extension :

1. Extension with capitalization, such as . 2. Double extension, such as or 3. Extension with a delimiter, such as . Other examples, or 4. Empty filename, 5. Try to cut allowed extension with more than the maximum filename length.

>Below scenario could be exploited using SSRF or RFI. Did not solve this challenge.....

!RFI function

>I am missing some key info and need to *identify* PortSwigger research about RFI.

>But the method below works for sure. It is taken from DingyShark's git ()

1. To exploit this , paste php payload in body section of your exploit server and name it shell.php:

2. To bypass filters and provoke RFI, use the next payload:

`XSS S`

>Uploading of SVG file that contains Ja that performs cross site scripting attack.

`Race Condition Web shell upload`

>Image upload function *identified* on profile page.

>White box penetration test scenario, the *source code* that introduces this race condition is supplied by the client for the target:

>The uploaded file is moved to an accessible folder, where it is checked for . Malicious files are only removed once the virus check is complete.

>PHP Payload to read the secret data <?php echo file_get_contents('/home/carlos/secret'); ?>

>Right-click on the failed upload POST /my-account/avatarrequest that was used to submit the PHP Payload file upload and select *Extensions > Turbo Intruder > Send to turbo intruder.* >The Turbo Intruder window opens. Copy and paste the following race condition inducing script template into Turbo Intruder's Python editor:

!race-condition-turbo-intruder

>Race script template into Turbo Intruder's Python editor:

>results list, notice that some of the GET requests received a 200 response containing Carlos's secret. !race-condition-read-secret.png

PortSwigger Lab: Web shell upload via race condition

`WebShell JSP File Upload`

>Target strutted.htb HackTheBox Lab machine restricted file upload only allows image files.

>Enumaration of a downloaded ZIP source code backup, identify C >File upload logic in Apache Struts is flawed. >Attacker can manipulate file upload to enable paths tra and be used to perform Remote Code Execution. >C issue affects Apache Struts from 2.0.0 before 6.4.0.

>The attack path is to emb a malicious JSP file into the contents of an image. >The OGNL parameter abuse to change the name of the file to a JSP file which will let us trigger payloads. >We grab this payload from a similar disclosure, and copy the shell.jsp contents below the image header in our POST request.

>Source of Ja webshell.JSP

>target only accepts a single valid image file since it performs MIME checks:

!C part1

>By OGNL injection, rewrite file to code shell.jsp and place in rout of web application.

!C part 2

>RCE Execution achived

-----

`Deserialization`

CustomTemplate PHP Burp Deserialization Scanner YsoSerial SHA1 HMAC Symfony

`CustomTemplate PHP`

>Reading page source code and noticing comment mentioning , this *identify* possible PHP framework and the Burp scanner *identify* serialized session cookie object after we logged in with stolen credentials.

!info-disclose

>Re PHP source code by adding tilde *~* character at end of GET request , we notice the destruct method.

!comments-in-source-code

>Original Decoded cookie

>Make new PHP serial CustomTemplate object with the lock_file_path attribute set to /home/carlos/morale.txt. Make sure to use the correct data type labels and length indicators. The 's' indicate string and the length.

!modify-serial-cookie

PortSwigger Lab: Arbitrary object injection in PHP

`Burp Deserialization Scanner`

>Intercept the admin panel page in the Burp Practice Exam, and *identify* the serial value of the cookie named admin-prefs. This challenge is from the PortSwigger Practice Exam APP.

!Admin prefs serial cookie

>Use below payload in the Deserialization scanner exploiting Java jar ysoserial command, to obtain remote code execution (RCE) when payload de-serialized on target.

>Image below is from the Practice exam, I have some issues with my setup as the old of java is needed when running ysoserial in bash terminal, and the Burp Suite Pro app need sudo to save the config of the extension.

!ysoserial rce

>Burp Deserialization Scanner configuration when running burp as sudo, leaving the java path to java and the ysoserial path to . My scanner detect the ja in the burp issue list but not when i run it manual???

!Deserialization scanner config setup

`YsoSerial`

>Below is ysoserial command line execution to generate base64 encoded serialized cookie object containing payload.

>IMPORTANT: If you get error message when executing saying something in lines of *java.lang.IllegalAccessError: class ysoserial.payloads.util.Gadgets*, the switch to alternative Java on Linux with following commands.

!Switch Ja

>Now execute to generate base64 payload, using Ja 11. Replace session cookie with generated base64 payload and URL encode only the key characters before sending request.

!ysoserial Command

PortSwigger Lab: Exploiting Ja with Apache Commons

`SHA1 HMAC Symfony`

>*Identify* that the cookie contains a Base64-encoded token, signed with a SHA-1 HMAC hash. On the home page we discover a de comment to debug info for , re the digital signature to sign new token. Sending invalid cookie session value the error reveals, Symfony : 4.3.6.

>Note: In BSCP exam not going to run this as it delete the file, but in exam read source code to *identify* the PHP function and extract content out-of-band using .

>Exploit steps to perform a PHP deserialization with a pre-built gadget chain.

1. Request the file to find the leaked information about the website. 2. Generate a Base64-encoded serialized object that exploits an RCE gadget chain in Symfony . 3. Construct a valid cookie containing this malicious object and sign it correctly using the secret key you obtained.

4. Execute the php code in terminal, to obtain signed cookie.

!Symfony phpggc gadget deserial

>Replace cookie value and send request to get remote code execution (RCE) when cookie is deserialised server side. Ignore the ser , check the collaborator if data was received.

PortSwigger Lab: Exploiting PHP deserialization with a pre-built gadget chain

-----

`OS Command Injection`

+ Feedback + Output redirection

`Feedback`

>Use following command separation characters to *identify* Operating System Command injection .

>The target application submit feedback function require email value, and *identifying* blind OS command injection by appending bash command, we then can observe a request made to Collaborator.

>The below payload use DNS exfiltration and the Burp Collaborator DNS service.

>In this YouTube video Leet Cipher show how to use DNS rebinding with blind command injection to exfiltration the contents of passwd from the target by first uploading bash script that Base64 and then Base58 encode the passwd file content, to strip special character not able to ex-filtrate with DNS label restrictions.

!OS command injection

leetCipher Github scripts for Blind OS DNS exfiltrate

>PortSwigger Lab payload perform a DNS lookup using nslookup as a Burp Collaborator subdomain.

PortSwigger Lab: Blind OS command injection with out-of-band data exfiltration

`Output redirection`

>If OS command injection *identified*, and filter in place pre complex command injection, attempt to redirect output to writable folder. *Identify* a path tra that allow reading of files only in current WEB APP.

>*Identify* the working directory using pwd command output redirected, and appending to output.txt file every bash command stdout.

>Use working directory discovered using above pwd command to redirect output and read content.

!os CMD path tra lfi

>Get output file content.

PortSwigger Lab: Blind OS command injection with output redirection

>Sample Command Injection Basic Payloads:

>Tip from *fullfox*:

* If you can inject in an XML file and you can't find a way to perform an XXE, think about OS command injection using $() or backticks.

-----

`Appendix`

>This section contain additional information to solving the PortSwigger labs and approaching the BSCP exam, such as the Youtube content creators, Burp speed scanning technique, python scripts and Obfuscation techniques to bypass filters.

Obfuscation Python Scripts Focus Scanning Approach YouTube & Extra Training Content Convert epoch time to milliseconds from human readable may be in exam

`Obfuscation`

>Obfuscation is the action of making something obscure, unclear, or unintelligible.

>URL and Base64 online encoders and decoders.

+ URL Decode and Encode + BASE64 Decode and Encode

>URL replacing the period character with encoded value of .

>Double-encode the injecting payload.

>HTML encode one or more of the characters. In video by z3nsh3ll: Payload obfuscation with HTML encoding he explain post analysis of the lab Stored XSS into onclick event.

>XML encode for bypassing WAFs

>Multiple encodings together

>SQL CHAR

>Unicode escape sequence, Hex Code (0022) Converts to decimal 34 which maps directly to ASCII character code 34 standard double quote "

>Unicode escape sequence payload: cmd.exe

>Right-to-Left O: \u202E

Obfuscating attacks using encodings

-----

`Python Scripts`

>Python script to *identify* in the exam and provide indicators of exploits.

Python Script to *identify* possible in headers, cookies or the response body

Lab Automated Python Scripts

Automate the solving of the labs using python scripts

`Approach`

>Tips from Daniel Redfern is best I have come access explaining fundamental mechanics in BSCP exam, especially Tip 7, only one active user per application and if you reach stage 2 and you did not use interacti in stage 1 that required the Deliver to function of the exploit server, then use an interacti on stage 2 to reach admin user role.

>Hacking-Notes created a awesome website with an interacti to help people during BSCP exams. >Track phases of attacks checklist: >

>When stuck in BSCP exam, reference the below Micah blog tip 5 table of category to stages for ways to progress through the stages.

!Micah

`Identified`

>The image below is my view of possible *identified* and exploitation to reach the next BSCP exam stage and progress through the exam challenges. >I ha solve the challenges in green using the PortSwigger Academy Labs, but we never stop learning......

<a href=" target="_blank"><img src=" alt="Passed BSCP Exam Stages" style="height: 230px !important;width: 810px !important;" ></a>

`Extra Training Content`

>Some great links to YouTube content creators training material and links to study stuff.

My YouTube BSCP Study Playlist


Using Burp and Postman, Brad Schiff explain Cookies, Sessions, JSON Web Tokens (JWT) - thanks!  
Youtube Information Security content creators channels (*in no particular order*):  
1. z3nsh3ll  
2. TJCHacking  
3. intigriti  
4. Seven Seas Security  
5. Rana Khalil  
6. Tib3rius  
7. John Hammond  
8. TraceTheCode  
9. The Cyber Mentor  
10. Sabyasachi Paul  
11. bmdyy  
12. CyberSecurityTV  
13. nu11 security  
14. PortSwigger  
15. IppSec  
16. Daniel Redfern  
17. Li  
18. JSONSEC  
19. thehackerish  
20. Da  
21. LearnWebCode Brad Schiff  
Footnote  
>Perse: is Persistence in doing something despite difficulty or delay in achieving success.  
>The OSCP certification taught me to [#TryHarder]() and gave me the foundation penetration testing skills.  
>The BSCP exam gave me the next level of web application security analyst knowledge.  
>I hope my notes offer other Information Security Students some guidance and walkthrough tips.  
Burp Exam Results

>The Burp Suite Certified Practitioner exam is a challenging practical examination designed to demonstrate your web security testing knowledge and Burp Suite Professional skills. >My tip when preparing, is to understand the academy labs. Extra work is required as the labs do not always provide the identification of the step. >In my study notes I document the lab guides from the official PortSwigger academy to make sure I know how to identify the , use it in different scenarios and make payloads that show the impact when exploiting the . As example crafting a XSS cookie stealer payload instead of just calling theprint` function.
>The BSCP qualification on my resume demonstrate a deep knowledge of the latest classes and how to exploit Web Applications, proving my hacking ability to employers and the community.

项目信息

开发语言：Python

Star 数：1486

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Burp Suite Certified Practitioner Exam Study展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	Burp-Suite-Certified-Practitioner-Exam-Study - Burp Suite Certified Practitioner Exam Study
所属分类	黑客技术
发布作者	admin
发布时间	2026-10-05 22:12:54
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	334
讨论数量	0
主题状态	正常讨论中