TODO: Need to pull web notes out of the OS Agnostic section (and then rename that to something better!)
Hack Responsibly.
Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.
Web site "flyover" surveillance: Aquatone "is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface" - from the author (see link). Visual dirbuster?
Crawl web pages for keywords - useful for password/vhost enumeration lists
Common checks
IP conversion
Injecting IPs when '.' is disallowed: convert the standard "dotted decimal" format to decimal, or hex value using -ip2dh. The sending or receiving computer will usually automatically convert it to a format that it can use. This is a great way to bypass WAF, IDS, or other tools that filter on IPs.
If you like this content and would like to see more, please consider buying me a coffee!
# Add something like 127.0.0.1, localhost, 192.168.1.2, target.com or /admin, /console
Client-IP:
Connection:
Contact:
Forwarded:
From:
Host:
Origin:
Referer:
True-Client-IP:
X-Client-IP:
X-Custom-IP-Authorization:
X-Forward-For:
X-Forwarded-For:
X-Forwarded-Host:
X-Forwarded-Server:
X-Host:
X-Original-URL:
X-Originating-IP:
X-Real-IP:
X-Remote-Addr:
X-Remote-IP:
X-Rewrite-URL:
X-Wap-Profile:
# Try to repeat same Host header 2 times
Host: legit.com
Stuff: stuff
Host: evil.com
# Bypass type limit
Accept: application/json, text/javascript, */*; q=0.01
Accept: ../../../../../../../../../etc/passwd{{'
# Try to change the HTTP version from 1.1 to HTTP/0.9 and remove the host header
# 401/403 bypasses
# Whitelisted IP 127.0.0.1 or localhost
Client-IP: 127.0.0.1
Forwarded-For-Ip: 127.0.0.1
Forwarded-For: 127.0.0.1
Forwarded-For: localhost
Forwarded: 127.0.0.1
Forwarded: localhost
True-Client-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Custom-IP-Authorization: 127.0.0.1
X-Forward-For: 127.0.0.1
X-Forward: 127.0.0.1
X-Forward: localhost
X-Forwarded-By: 127.0.0.1
X-Forwarded-By: localhost
X-Forwarded-For-Original: 127.0.0.1
X-Forwarded-For-Original: localhost
X-Forwarded-For: 127.0.0.1
X-Forwarded-For: localhost
X-Forwarded-Server: 127.0.0.1
X-Forwarded-Server: localhost
X-Forwarded: 127.0.0.1
X-Forwarded: localhost
X-Forwared-Host: 127.0.0.1
X-Forwared-Host: localhost
X-Host: 127.0.0.1
X-Host: localhost
X-HTTP-Host-Override: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Remote-Addr: localhost
X-Remote-IP: 127.0.0.1
# Fake Origin - make GET request to accesible endpoint with:
X-Original-URL: /admin
X-Override-URL: /admin
X-Rewrite-URL: /admin
Referer: /admin
# Also try with absolute url https:/domain.com/admin
# Method Override
X-HTTP-Method-Override: PUT
# Provide full path GET
GET https://vulnerable-website.com/ HTTP/1.1
Host: evil-website.com
# Add line wrapping
GET /index.php HTTP/1.1
Host: vulnerable-website.com
Host: evil-website.com
# can pair with alert();
document.cookie;
# Use HTTP::Cookie library <https://github.com/sparklemotion/http-cookie>
# Following examples were taken from the readme.md from above repository
## One cookie
cookie = HTTP::Cookie.new("uid", "u12345", domain: 'example.org',
for_domain: true,
path: '/',
max_age: 7 * 86400)
header['Set-Cookie'] = cookie.set_cookie_value
## Several cookies
jar = HTTP::CookieJar.new
jar.load(filename) if File.exist?(filename)
header["Set-Cookie"].each { |value| jar.parse(value, uri) }
header["Cookie"] = HTTP::Cookie.cookie_value(jar.cookies(uri))
# python has a cookie library!
# Following example taken from the python documentation
import cookielib, urllib2
cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
r = opener.open("http://example.com/")
# POST file
curl -X POST -F "file=@/file/location/rev.php" http://$ip/upload.php --cookie "cookie"
# POST binary data to web form
curl -F "field=<rev.zip" http://$ip/upload.php -F 'k=v' --cookie "k=v;" -F "submit=true" -L -v
#Install openvas
apt update
apt install openvas
#Run the setup script
openvas-setup
#Check that it is running on port 939
netstat -tulpn
#Login by using a browser and navigating to: https://127.0.0.1:939
fe80::/10 - febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff Unique Link Local 169.254.x.x APIPA
(built from MAC address on Linux, 7th bit flips, adds ff:fe in the center)
fc00::/7 - fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff Unique Local Unicast 10.x.x.x, 172.16.x.x, 192.168.x.x
2000::/3 - Global Unicast routable
ff02::1 - Multicast All Nodes
ff02::2 Multicast ROUTER nodes
Digest Authentication (uses htdigest)
-->susceptible to MITM attack!
Integrated Windows Authentication
-->will not function over proxy
Form-Based Authentication
-->not inherently encrypted, often poor implimentation
# To spider a site and write all found words to a file
cewl -w <file> <url>
# To spider a site and follow links to other sites
cewl -o <url>
# To spider a site using a given user-agent
cewl -u <user-agent> <url>
# To spider a site for a given depth and minimum word length
cewl -d <depth> -m <min word length> <url>
# To spider a site and include a count for each word
cewl -c <url>
# To spider a site inluding meta data and separate the meta_data words
cewl -a -meta_file <file> <url>
# To spider a site and store email adresses in a separate file
cewl -e -email_file <file> <url>
# robots.txt
curl http://example.com/robots.txt
# headers
wget --save-headers http://www.example.com/
# Strict-Transport-Security (HSTS)
# X-Frame-Options: SAMEORIGIN
# X-XSS-Protection: 1; mode=block
# X-Content-Type-Options: nosniff
# Cookies
# Check Secure and HttpOnly flag in session cookie
# If you find a BIG-IP cookie, app is behind a load balancer
# SSL Ciphers
nmap --script ssl-enum-ciphers -p 443 www.example.com
# HTTP Methods
nmap -p 443 --script http-methods www.example.com
# Cross Domain Policy
curl http://example.com/crossdomain.xml
# allow-access-from domain="*"
