Reflecting Techniques - PoCs and Polygloths CheatSheet
Lengo la PoCs na Polygloths hizi ni kumpa mtihani mchunguzi muhtasari wa haraka wa udhaifu ambao anaweza kudukua ikiwa matokeo ya kuingiza kwake yanarudi kwenye jibu.
Hati hii ya kudanganya haitoi orodha kamili ya vipimo kwa kila udhaifu, bali inatoa vipimo vichache vya msingi tu. Ikiwa unatafuta vipimo kamili zaidi, tafadhali fikia kila udhaifu uliopendekezwa.
Hutapata kuingizwa kwa aina ya Maudhui kama XXE, kwa sababu kawaida utajaribu mwenyewe ikiwa utapata ombi linalotuma data ya xml. Hapa pia hutapata kuingizwa kwenye database kwani hata ikiwa baadhi ya maudhui yanaweza kurejelewa, inategemea sana teknolojia na muundo wa DB ya nyuma.
Orodha ya Polygloths
Majaribio ya Msingi
Polygloths
Wapolygloths
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumiwa kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
Majaribio ya Msingi
Polygloths
Wapolygloths
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumiwa kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
Majaribio Muhimu
Test 1: CRLF Injection
Test 2: CRLF Injection in Headers
Test 3: CRLF Injection in Cookies
Test 4: CRLF Injection in Parameters
Test 5: CRLF Injection in POST Requests
Test 6: CRLF Injection in JSON Requests
Test 7: CRLF Injection in XML Requests
Alama Zilizosalia
Majaribio Muhimu
HTML Injection
Test 1: Kuingiza HTML katika maoni
Lengo: Kuingiza msimbo wa HTML katika sehemu ya maoni ya wavuti.
Maelezo: Jaribu kuingiza msimbo wa HTML kwenye sehemu ya maoni ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Hatua za kutekeleza:
Nenda kwenye sehemu ya maoni ya wavuti.
Ingiza msimbo wa HTML kama vile
<script>alert('XSS')</script>au<h1>Test</h1>.Tuma maoni yako na angalia ikiwa msimbo wa HTML unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Matokeo yanayotarajiwa: Ikiwa msimbo wa HTML unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kama vile XSS (Cross-Site Scripting).
Test 2: Kuingiza HTML katika uwanja wa fomu
Lengo: Kuingiza msimbo wa HTML katika uwanja wa fomu ya wavuti.
Maelezo: Jaribu kuingiza msimbo wa HTML kwenye uwanja wa fomu ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Hatua za kutekeleza:
Nenda kwenye uwanja wa fomu ya wavuti.
Ingiza msimbo wa HTML kama vile
<script>alert('XSS')</script>au<h1>Test</h1>.Tuma fomu yako na angalia ikiwa msimbo wa HTML unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Matokeo yanayotarajiwa: Ikiwa msimbo wa HTML unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kama vile XSS (Cross-Site Scripting).
Server-Side Template Injection (SSTI)
Test 1: Kuingiza msimbo wa SSTI katika uwanja wa fomu
Lengo: Kuingiza msimbo wa SSTI katika uwanja wa fomu ya wavuti.
Maelezo: Jaribu kuingiza msimbo wa SSTI kwenye uwanja wa fomu ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Hatua za kutekeleza:
Nenda kwenye uwanja wa fomu ya wavuti.
Ingiza msimbo wa SSTI kama vile
{{7*7}}au{{config}}.Tuma fomu yako na angalia ikiwa msimbo wa SSTI unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Matokeo yanayotarajiwa: Ikiwa msimbo wa SSTI unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kwenye mazingira ya seva.
Test 2: Kuingiza msimbo wa SSTI katika sehemu ya maoni
Lengo: Kuingiza msimbo wa SSTI katika sehemu ya maoni ya wavuti.
Maelezo: Jaribu kuingiza msimbo wa SSTI kwenye sehemu ya maoni ya wavuti na angalia ikiwa msimbo huo unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Hatua za kutekeleza:
Nenda kwenye sehemu ya maoni ya wavuti.
Ingiza msimbo wa SSTI kama vile
{{7*7}}au{{config}}.Tuma maoni yako na angalia ikiwa msimbo wa SSTI unatekelezwa na kuonyeshwa kwa watumiaji wengine.
Matokeo yanayotarajiwa: Ikiwa msimbo wa SSTI unatekelezwa na kuonyeshwa kwa watumiaji wengine, basi kuna hatari ya kuingizwa kwa msimbo wa hatari kwenye mazingira ya seva.
Majaribio ya Msingi
Majaribio ya Msingi
Majaribio Muhimu
Test 1
Test 2
Test 3
Test 4
Test 5
Test 6
Test 7
Test 8
Test 9
Test 10
Majaribio ya Msingi
Polygloths
Wapolygloths
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumika kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
Vipimo sawa vinavyotumiwa kwa Ombi la Upande wa Seva linaweza kutumika hapa.
Vipimo Vya Msingi
Polygloths
Wapolygloths
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to execute code within the file.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi wanavyoweza kutumika kufikia matokeo yanayotakiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum za kutekeleza nambari ndani ya faili.
Polygloths can be used in various hacking scenarios, such as bypassing file upload restrictions, evading antivirus detection, or executing arbitrary code on a target system. However, it is important to note that the use of polygloths for malicious purposes is illegal and unethical.
Wapolygloths wanaweza kutumika katika mazingira mbalimbali ya kudukua, kama vile kuepuka vizuizi vya kupakia faili, kuepuka kugunduliwa na programu za antivirus, au kutekeleza nambari isiyo na kikomo kwenye mfumo wa lengo. Hata hivyo, ni muhimu kuzingatia kwamba matumizi ya wapolygloths kwa madhumuni mabaya ni kinyume cha sheria na si maadili.
Majaribio ya Msingi
Polygloths
Wapolygloths
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web pentesting, polygloths can be used to exploit vulnerabilities in web applications.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa pentesting ya wavuti, wapolygloths wanaweza kutumika kudukua udhaifu katika programu za wavuti.
File Signatures
Saini za Faili
File signatures, also known as magic numbers, are unique sequences of bytes that can be used to identify the file type. By manipulating the file signature, a polyglot file can be created that appears as one file type but is interpreted as another.
Saini za faili, pia hujulikana kama nambari za uchawi, ni mfuatano wa pekee wa herufi ambazo zinaweza kutumika kutambua aina ya faili. Kwa kubadilisha saini ya faili, faili ya polyglot inaweza kuundwa ambayo inaonekana kama aina moja ya faili lakini inachukuliwa kama nyingine.
Examples
Mifano
Here are some examples of polyglot files:
Hapa kuna mifano ya faili za polyglot:
A file that appears as a JPEG image but is interpreted as an HTML file.
Faili ambalo linaonekana kama picha ya JPEG lakini linachukuliwa kama faili ya HTML.
A file that appears as a PDF document but is interpreted as a PHP script.
Faili ambalo linaonekana kama hati ya PDF lakini linachukuliwa kama skripti ya PHP.
A file that appears as a text document but is interpreted as a JavaScript file.
Faili ambalo linaonekana kama hati ya maandishi lakini linachukuliwa kama faili ya JavaScript.
Conclusion
Hitimisho
Polygloths can be powerful tools in the hands of a skilled hacker. By exploiting the ability of files to be interpreted differently depending on the context, polyglot files can be used to bypass security measures and execute malicious code. It is important for web pentesters to be aware of the existence and potential dangers of polyglot files in order to effectively assess and secure web applications.
Wapolygloths wanaweza kuwa zana zenye nguvu mikononi mwa hacker mwenye ujuzi. Kwa kudukua uwezo wa faili kuwa na tafsiri tofauti kulingana na muktadha, faili za polyglot zinaweza kutumika kuepuka hatua za usalama na kutekeleza nambari mbaya. Ni muhimu kwa wapentesters wa wavuti kufahamu uwepo na hatari za faili za polyglot ili kuweza kutathmini na kusaidia programu za wavuti kwa ufanisi.
XSS
Majaribio ya Msingi
Stored XSS
Stored XSS ni aina ya mashambulizi ya msalaba wa tovuti ambapo msanidi programu anaruhusu mtumiaji kuingiza data ambayo inaweza kutekelezwa kwenye ukurasa wa wavuti. Hii inaweza kusababisha shambulio la XSS ambapo msimbo mbaya unaweza kutekelezwa kwenye kivinjari cha mtumiaji.
Mifano ya majaribio ya msingi ya Stored XSS ni pamoja na:
Kuingiza script ya JavaScript kwenye uwanja wa maoni au chapisho la blogi na kuona ikiwa inatekelezwa wakati ukurasa unapakia.
Kuingiza tag ya na kujaribu kutekeleza msimbo wa JavaScript kupitia atribyuti ya "src" ili kuona ikiwa inafanya kazi.
Reflected XSS
Reflected XSS ni aina ya mashambulizi ya msalaba wa tovuti ambapo msanidi programu anaruhusu mtumiaji kuingiza data ambayo inaweza kutekelezwa kwenye ukurasa wa wavuti. Hii inaweza kusababisha shambulio la XSS ambapo msimbo mbaya unaweza kutekelezwa kwenye kivinjari cha mtumiaji.
Mifano ya majaribio ya msingi ya Reflected XSS ni pamoja na:
Kuingiza script ya JavaScript kwenye uwanja wa utaftaji na kuona ikiwa inatekelezwa wakati matokeo ya utaftaji yanapopakia.
Kuingiza tag ya na kujaribu kutekeleza msimbo wa JavaScript kupitia atribyuti ya "src" ili kuona ikiwa inafanya kazi.
Polygloths
Wapolygloths
Polygloths are files that can be interpreted as different file types depending on the context in which they are opened. This can be useful for bypassing security measures or executing malicious code. In the context of web applications, polygloths can be used to exploit vulnerabilities and gain unauthorized access.
Wapolygloths ni faili ambazo zinaweza kuchukuliwa kama aina tofauti za faili kulingana na muktadha ambao zinafunguliwa. Hii inaweza kuwa na manufaa kwa kuepuka hatua za usalama au kutekeleza nambari mbaya. Katika muktadha wa programu za wavuti, wapolygloths wanaweza kutumika kudukua udhaifu na kupata ufikiaji usiohalali.
Polygloths can be created by manipulating the file's header or by using specific file formats that allow for multiple interpretations. Some common examples of polygloths include files that can be interpreted as both image and executable files, or files that can be opened as both text and audio files.
Wapolygloths wanaweza kuundwa kwa kubadilisha kichwa cha faili au kwa kutumia muundo maalum wa faili ambao unaruhusu tafsiri nyingi. Baadhi ya mifano ya kawaida ya wapolygloths ni pamoja na faili ambazo zinaweza kuchukuliwa kama faili za picha na za kutekelezwa, au faili ambazo zinaweza kufunguliwa kama faili za maandishi na sauti.
When exploiting polygloths, it is important to understand the different interpretations that can be made and how they can be leveraged to achieve the desired outcome. This may involve manipulating the file's content or using specific tools or techniques to trigger the desired interpretation.
Wakati wa kutumia wapolygloths, ni muhimu kuelewa tafsiri tofauti ambazo zinaweza kufanywa na jinsi zinavyoweza kutumika kufikia matokeo yanayotarajiwa. Hii inaweza kuhusisha kubadilisha maudhui ya faili au kutumia zana au mbinu maalum kuzindua tafsiri inayotarajiwa.
Last updated