Showing posts with label Webapps. Show all posts
Showing posts with label Webapps. Show all posts

Oct 4, 2017

Parameth - brute discover GET and POST

Often when you are busting a directory for common files, you can identify scripts (for example test.php) that look like they need to be passed an unknown parameter. This hopefully can help find them.
brute discover GET and POST
The -off flag allows you to specify an offset (helps with dynamic pages) so for example, if you were getting alternating response sizes of 4444 and 4448, set the offset to 5 and it will only show the stuff outside the norm

Adding new params from source

The following regexes might be useful to parse $_GET or $_POST parameters from source:
$> grep -rioP '$_POST[\s*["']\s*\w+\s*["']\s*]' PHPSOURCE | grep -oP '$_POST[\s*["']\s*\w+\s*["']\s*]' | sed -e "s/$_POST[\s*["']//g" -e "s/\s*['"]\s*]//g" | sort -u > /tmp/outfile.txt
$> grep -rioP '$_GET[\s*["']\s*\w+\s*["']\s*]' PHPSOURCE | grep -oP '$_GET[\s*["']\s*\w+\s*["']\s*]' | sed -e "s/$_GET[\s*["']//g" -e "s/\s*['"]\s*]//g" | sort -u > /tmp/outfile.txt

Sep 14, 2017

Spaghetti - Web Application Security Scanner

Web Application Security Scanner
Spaghetti is a web application security scanner tool. It is designed to find various default and insecure files, configurations and misconfigurations. Spaghetti is built on python2.7 and can run on any platform which has a Python environment.
Spaghetti

Installation

$ git clone https://github.com/m4ll0k/Spaghetti.git
$ cd Spaghetti 
$ pip install -r requirements.txt
$ python spaghetti.py --help

Features

  • Fingerprints
  • Server
  • Web Frameworks (CakePHP,CherryPy,Django,...)
  • Web Application Firewall (Waf) (Cloudflare,AWS,Barracuda,...)
  • Content Management System (CMS) (Drupal,Joomla,Wordpress,Magento)
  • Operating System (Linux,Unix,Windows,...)
  • Language (PHP,Ruby,Python,ASP,...)

Dicovery:

  • Apache
  • Apache (mod_userdir)
  • Apache (mod_status)
  • Apache multiviews
  • Apache xss
  • Broken Auth./Session Management
  • Admin Panel
  • Backdoors
  • Backup Directory
  • Backup File
  • Common Directory
  • Common File
  • Log File
  • Disclosure
  • Emails
  • IP
  • Injection
  • HTML
  • SQL
  • LDAP
  • XPath
  • XSS
  • RFI
  • PHP Code
  • Other
  • Allow Methods
  • HTML Object
  • Multiple Index
  • Robots Paths
  • Cookie Security
  • Vulns
  • ShellShock
  • Struts-Shock

Usage:

python spaghetti.py --url target.com --scan 0 --random-agent --verbose
python spaghetti.py --url target.com --scan 1 --random-agent --verbose

Sep 12, 2017

WebFundamentals - Best practices for modern web development

Web Fundamentals on DevSite

new WebFundamentals! An effort to showcase best practices and tools for modern Web Development.
WebFundamentals
WebFundamentals

What's changed?

  • We're now using the DevSite infrastructure
  • New style guide
  • New widgets allow inline JavaScript, common links, related guide and more
  • Jekyll has been eliminated, instead pages are rendered at request time
  • Front-matter has been eliminated from the markdown, but files now require a simple set of tags

What stays the same?

Cloning the repo

If you have a high-bandwidth connection, I recommend starting with a fresh clone of the repo.
https://github.com/j00tesiD/WebFundamentals.git

Getting set up

The new DevSite infrastructure simplifies the dependencies a lot. Ensure you have a recent version of Node and the AppEngine SDK for Python already installed.

Run npm install (needed for the build process)

Build the auto-generated files

Some files (contributors includes, some pages for updates, showcases, etc) are automatically generated. The first time you clone the repo and run npm install, this is done for you. However, when you add a case study, update, etc., you'll need to re-build those files using:

npm run build

Update the code labs

To update the Code Labs, you'll need the claat tool, and access to the original Doc files. This will likely only work for Googlers.
  • Download the claat tool and place it in your tools directory.
  • Run tools/update-codelabs.sh
  • Check the latest changes into GitHub

Start the development server

Run npm start

Test your changes before submitting a PR

Please run your changes through npm test before submitting a PR. The test looks for things that may cause issues with DevSite and tries to keep our content consistent. It's part of the deployment process, so PRs will fail if there are any errors! To run:
npm test

Aug 31, 2017

Building a Blog With Next.js and Styled-Components

Next.js is an awesome new framework for building universal React applications. In simple terms, that means you can use React to render templates on the server, as well front-end components the way you’re most likely used to. The advantages of this are numerous (shared components, faster rendering, great tooling), but getting it all to work properly is generally a pain.

Next.js makes this process easy, and with the release of V3 I thought I’d whip up a blog to learn and demonstrate how it works. In this tutorial we’ll be using the following:
  • next (3.X)
  • styled-components (phenomenal css-in-js solution)
  • next-routes (middleware for expressive routes in next)
  • express (for serving our pages, although you can also do static exports)
I’d highly recommend you follow along with the github repo here https://github.com/timberio/next-go/, as some components are left out for the sake of brevity.
Building a Blog With Next.js and styled-components

1. Getting Started

Getting set up is simple, you can follow along in the docs but the gist of it is to install next, react, and react-dom, add a simple build script and create your index file.
yarn add next@beta react react-dom --save
Add the following scripts to your package.json
{
  "scripts": {
    "dev": "next",
    "build": "next build",
    "start": "next start"
  }
}
Then create an index.js file inside of a pages folder in the root
// ./pages/index.js

export default () => (
  <div>Welcome to next.js!</div>
)
Then you can just run yarn dev and you should be up and running on localhost:3000. Hot reloading is baked in by default, which you can peek at if you inspect the .next folder in your root directory.

2. Adding Some Style

Next up we’ll configure styled-components to style our blog.
First run
yarn add styled-components.
Then create a custom _document.js file in the root with the following:
https://gist.github.com/a8711187724db5ac96b4c4e391f245a5
The custom _document.js allows us to override the default page layout and inject our own styles and markup surrouding our react app.

3. Creating a Layout

Now let’s create a main layout which all of our blog views will use, put the following in layouts/Main.js:
/* layouts/Main.js */

import Head from 'next/head'
import Wrapper from './Wrapper'
import Nav from 'components/Nav'
import Footer from 'components/Footer'

export default ({ children, title = 'This is the default title' }) => (
  <Wrapper>
    <Head>
      <title>{ title }</title>
    </Head>
    <header>
      <Nav />
    </header>

    <main>
      { children }
    </main>

    <Footer>
      Footer
    </Footer>
  </Wrapper>
)
We’ll use this layout to wrap our pages, which can override the <Head> tags and render content into the { children } block.

4. Rendering Posts

Now that we have our layout set up, let’s modify our index.js page to take advantage of it, and also render some posts.
Update pages/index.js with the following:
import React from 'react'
import Layout from 'layouts/Main';
import { getPosts } from 'api/posts'
import { Link } from 'routes'

import Post from 'components/Post'

const IndexPage = ({ posts }) => (
  <Layout>
    <ul>
      {posts.map(p => (
        <Post key={p.title} post={p} />
      ))}
    </ul>
  </Layout>
)

IndexPage.getInitialProps = async ({ req }) => {
  const res = await getPosts()
  const json = await res.json()
  return { posts: json }
}

export default IndexPage
The key here is the getInitialProps on our IndexPage component, which fetches all of the required data needed for this page to render. When this page is accessed directly at localhost:3000, Next will take care of fetching the data before the page is rendered. If we're navigating to this page from another one, no additional page reloads will happen, Next's clientside routing will take over and fetch the data for us before rendering the component thanks to the Link component. You can even add the prefetch property to tell Next to prefetch that page for blazing fast page loads.
Now we’ll use some sample json and place the api in api/posts/index.js:
undefined
And add our Post component in components/Post/index.js:
import React from 'react'
import { Link } from 'routes'
import Wrapper from './Wrapper'

const PostItem = ({ post }) => (
  <Wrapper>
    <Link route='post' params={{ slug: post.title }}>
      <a>
        <h3>{post.title}</h3>
        <p>{post.body}</p>
      </a>
    </Link>
  </Wrapper>
)

export default PostItem
When you reload the page you should see a list of posts getting rendered by our index page like so (you can see the styles in the github repo https://github.com/timberio/next-go/).

5. Post Pages

Now that we have a list of posts, lets add a route to view each individual post. Create a new page in pages/Post.js like so:
import React from 'react'
import Link from 'next/link'
import styled from 'styled-components'
import Layout from 'layouts/Main';
import { getPost } from 'api/posts'

const PostPage = ({ post }) => (
  <Layout>
   <h1>{post.title}</h1>
   <p>{post.body}</p>
  </Layout>
)

PostPage.getInitialProps = async ({ query }) => {
  const res = await getPost(query.slug)
  const json = await res.json()
  return { post: json[0] }
}

export default PostPage
This page is reponsible for fetching and rendering individual posts, so let’s add a route to show it. We’ll be using next-routes for some nice expressive route definitions, so simply run:
yarn add next-routes
and add a routes.js folder in the root with the following:
const nextRoutes = require('next-routes')
const routes = module.exports = nextRoutes()

routes.add('index', '/')
routes.add('post', '/blog/:slug')
Then make sure to add this middleware in ./server.js
const express = require('express')
const next = require('next')
const routes = require('./routes')

const dev = process.env.NODE_ENV !== 'production'
const app = next({ dev })
const handle = app.getRequestHandler()
const handler = routes.getRequestHandler(app)

app.prepare()
.then(() => {
  const server = express()
  server.use(handler)

  server.get('*', (req, res) => {
    return handle(req, res)
  })

  server.listen(3000, (err) => {
    if (err) throw err
    console.log('> Ready on http://localhost:3000')
  })
})
Now our <Link route='post' params={{ slug: post.title }}> components in pages/index.js will map to this page with the proper params and if you click on one you should see something like this:
That’s it! You can easily sub in your own endpoints in api/posts/index.js to fetch from your API or CMS of choice.
You can see a working demo at https://next-go.now.sh/ and view the code at https://github.com/timberio/next-go. You can also learn more about Next at https://learnnextjs.com/.
published at https://timber.io/blog/building-a-blog-with-next-jshttps://medium.com/styled-components/building-a-blog-with-next-js-359cf1236574

Aug 28, 2017

Exploit: WordPress Plugin Easy Modal 2.0.17 - SQL Injection

WordPress Easy Modal Plugin - Multiple Security Vulnerabilities
Advisory ID: DC-2017-01-007
Advisory Title: WordPress Easy Modal Plugin Multiple
WordPress Plugin Easy Modal 2017
Easy Modal.

Vulnerabilities

  • Software: WordPress Easy Modal plugin
  • Language: PHP
  • Version: 2.0.17 and below
  • Vendor Status: Vendor contacted, update released
  • Release Date: 2017/08/07
  • Risk: Medium 

1. General Overview

During the security audit of Easy Modal plugin for WordPress CMS, multiple vulnerabilities were discovered using DefenseCode ThunderScan application source code security analysis platform.

2. Software Overview

According to the plugin developers, Easy Modal is the #1 WordPress Popup Plugin. It's advertised as "Make glorious & powerful popups and market your content like never before - all in minutes!".
According to wordpress.org, it has more than 20,000 active installs.
Homepage:
http://wordpress.org/extend/plugins/easy-modal/
https://easy-modal.com

3. Vulnerability Description

During the security analysis, ThunderScan discovered SQL injection vulnerabilities in Easy Modal WordPress plugin.

The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plugin settings page. Users that do
not have full administrative privileges could abuse the database access the vulnerability provides to either escalate their privileges or obtain and modify database contents they were not supposed to be
able to.

The nonce token is required as the URL parameter. Token value is not unique for each request, nor per each URL, so if the attacker manages to obtain a valid token value, the module could be exposed to attack vectors such as Cross Site request forgery (CSRF).

3.1. SQL injection

  • Function: $wpdb->query()
  • Variables: $_GET['id'], $_GET['ids'], $_GET['modal']
  • Sample URL:
  • http://vulnerablesite.com/wp-admin/admin.php?page=easy-modal&action=dele
  • te&id%5B0%5D=4%20AND%20SLEEP(5)&easy-modal_nonce=xxx
  • File: easy-modal\classes\controller\admin\modals.php

3.2. SQL injection

  • Function: $wpdb->query()
  • Variables: $_GET['id'], $_GET['ids'], $_GET['modal']
  • Sample URL:
  • http://vulnerablesite.com/wp-admin/admin.php?easy-modal_nonce=xxx&_wp_ht
  • tp_referer=%2Fvulnerablesite.com%2Fwp-admin%2Fadmin.php%3Fpage%3Deasy-mo
  • dal%26status%3Dtrash&page=easy-modal&action=untrash&paged=1&id[]=2)%20AN
  • D%20SLEEP(10)--%20ZpVQ&action2=-1
  • File: easy-modal\classes\controller\admin\modals.php

4. Credits

by Neven Biruski. | DB

Exploit: Schools Alert Management - SQL injection login bypass

SQL injection login bypass
Schools Alert Management.
Schools Alert Management - SQL injection login bypass, an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular school.

Proof of Concept: http://localhost/schoolalert/demo_school_name/schools_login.php  [ set username and password ] to >>  admin' or 1=1 - you must choose the check box as management

Exploit Author: Ali BawazeEer
Dork: N/A
Date: 28.08.2017
Vendor Homepage: http://www.phpscriptsmall.com/product/schools-alert-management-system/
Version: 2.01
Category: Webapps
Tested on: Win / Mozila Firefox

 

AdBlock Detected!

Like this blog? Keep us running by whitelisting this blog in your ad blocker.

This is how to whitelisting this blog in your ad blocker.

Thank you!

×