Showing posts with the label Cross Site Scripting
Saturday, 5 February 2022
Tuesday, 3 July 2018
Attacking JSON Application : Pentesting JSON Application
Hello all, Its quite long time i have dosn`t updated my blog. So here we go.
Today we will see how we can pentest JSON Web Application.
Note- Some of the methods are taken from third party resources and some are presented as my personal experience.
First What Is JSON According To JSON Website.
JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999
"In a lemon language JSON is typically used Javascript to pass the parameter". Like Below HTTP Request.
GET /site/getuserinfo=narendrabhati HTTP/1.1
Host: websecgeeks.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:44.0) Gecko/20100101 Firefox/44.0
Content-Type: application/json;
Sunday, 23 April 2017
Pentesting Node.js Application : Nodejs Application Security
Pentesting Node.js Application : Nodejs Application Security
Hello folks, Today we will see how we can do Pentesting Of NodeJS Application : Attacking NodeJS Application.
As we know that Javascript is a very common and important language and also a light wight which do our most of task very easily.
But we also know that, Great efficiency comes with great risk. Node JS is a kind of server side programming language derived from JS.
According to Wiki
Node.js is an open-source, cross-platform JavaScript run-time environment for executing JavaScript code server-side. Historically, JavaScript was used primarily for client-side scripting, in which scripts written in JavaScript are embedded in a webpage's HTML, to be run client-side by a JavaScript engine in the user's web browser. Node.js enables JavaScript to be used for server-side scripting, and runs scripts server-side to produce dynamic web page content before the page is sent to the user's web browser. Consequently, Node.js has become one of the foundational elements of the "JavaScript everywhere" paradigm,[4] allowing web application development to unify around a single programming language, rather than rely on a different language for writing server side scripts.
Today we will see some of the vulnerabilities which can be exploited in Node.JS application. We will also take a look on the source code for better understanding.
Wednesday, 23 November 2016
Slack Stored XSS(Cross Site Scripting)
Slack Stored XSS(Cross Site Scripting)
Hello Guys,
From a very long, I didn't`t write any blog post. :(
Well, Today we are going to see a Vulnerability in Slack Of Stored XSS(Cross Site Scripting) :)
One of the Slack URI - https://api.slack.com/apps/[appid]/general is not handling the user input properly, In a "name" parameter.
The input is getting reflected into the page without being properly sanitised or filtered, As a result it was possible for an attacker to Triager a Stored XSS Attack.
Interesting thing is that, This vulnerability can be exploited on other team and his member, As per this behaviour Slack Awarded $1000 for this vulnerability.
Wednesday, 24 August 2016
Hostgator Open Redirection And Reflected XSS Vulnerability
Host gator was found vulnerable to Open Redirection & Reflected XSS
Vulnerable URL - https://www.hostgator.in/
Vulnerable Parameter = newurl
Impact : Allow attackers to trick the users to redirection to other(attacker) domain which can be use for phishing attacks. Etc.
Tuesday, 23 August 2016
0 Desk Reflected XSS
0 Desk Reflected XSS POC Video
Sunday, 15 May 2016
Web2py Vulnerabilities 2.14.5 : LFI,XSS,CSRF,Brute Force Attack
Web2py Vulnerabilities
This post is about Web2py Vulnerabilities which we have found, POC`s are created under Mac OS X EI Capitan, But also tested on windows 7 as well as linux platform.
#Download the vulnerable App - https://drive.google.com/file/d/0B-LjC3oY6tUpZlNkV3BnZU85Y0E/view?usp=sharing
# Exploit Title : Web2py 2.14.5 Multiple Vulnerabilities LFI, XSS,CSRF, Brute Force On Login
# Reported Date : 2-April-2016
# Fixed Date : 4-April-2016
# Exploit Author : Narendra Bhati
# CVE ID : LFI - CVE-2016-4806 , Reflected XSS - CVE-2016-4807 , CSRF - CVE-2016-4808, Login Brute Force - CVE-2016-10321
# Tested On : MAC OS X EI Capitan, Windows 7 64 Bit, Most Linux Platforms.
# Fix/Patching : Update To Web2py. 2.14.6
# Facebook : https://facebook.com/imnarendrabhati
# Twitter : http://twitter.com/imnarendrabhati
Sunday, 9 November 2014
X3 CMS XSS And CSRF "CVE-2014-8771 , CVE-2014-8772"
Hello all friends , today i am disclosing the issue which i found in X3CMS ( 0.5.1 & 0.5.1.1 )
So Here Is The X3 CMS XSS And CSRF
There were two vulnerabilities ,
- 1.) CSRF
- 2.) Reflected XSS [POST]
Sunday, 2 November 2014
Modx XSS And CSRF Bypass "CVE-2014-8773 , CVE-2014-8774 , CVE-2014-8775"
Modx XSS And CSRF Bypass
Hello all Bro`s :) ;) , Leets and learners , Hope you all are well and enjoying your bounties as well as ;)
Today we will see how i got Modx XSS And CSRF Bypass ( Modx CSRF + XSS = A Perfect Disaster ) ;)
Attacker Scenario Is Inspired From Symantec CSRF
So What Is Modx
MODX is the web content management system (CMS) that gives you complete control over your site and content, with the flexibility and scalability
Saturday, 25 October 2014
Prevent XSS In PHP
Hello all today we will see that how we can Prevent XSS In PHP
I am posting this for newbies or fresher who are want to know about that , So here i am using a Simple PHP Code for better understanding
I am also a newby in PHP and will try my best to help you as much as i can
====================================================
<IMG STYLE=”position:absolute; TOP:100px; LEFT:500px; WIDTH:600px; HEIGHT:300px” SRC=”/wp-content/uploads/2014/06/21.jpg”>
<?php
if(isset($_GET[search]))
$display= $_GET[search];
echo “You searched for ” . $display ;
?>
<html>
<title>Testing Application of Websecgeeks</title>
<form name=”searchsomething” method=”GET” action=”xssfixing.php”>
<p>Search For Content</p><input type=”text” input name=”search”/><br><br>
<input type=”submit” input name=”submit” value=”Search Content”/>
</form>
====================================================
Here You can see we are taking an input from search field called “search” and storing the value of it into the “display” variable and using the same variable for displaying the entered text without filtration or sanitation
It is a simple sign of XSS vulnerability,
For Prevent this we can use htmlentities or htmlspecialcharactors function , Which will be nneedfulyou will know at the end
You can use
htmlentities($variablenamewhichisdisplayingtheuserinput) ,
Exa. – According to our code – htmlentities($display)
htmlspecialcharactors($variablenamewhichisdisplayingtheuserinput)
Exa. – According to our code -htmlspecialcharactors($display)
=====================================================
Lets applied this same in our code
<IMG STYLE=”position:absolute; TOP:100px; LEFT:500px; WIDTH:600px; HEIGHT:300px” SRC=”/wp-content/uploads/2014/06/21.jpg”>
<?php
if(isset($_GET[search]))
$display= $_GET[search];
echo “You searched for ” . htmlentities($display) ;
?>
<html>
<title>Testing Application of Websecgeeks</title>
<form name=”searchsomething” method=”GET” action=”xssfixing.php”>
<p>Search For Content</p><input type=”text” input name=”search”/><br><br>
<input type=”submit” input name=”submit” value=”Search Content”/>
</form>
====================================================
Step By Step Video
As you can see that we have added htmlentities function right before the $display variable to prevent XSS Attack
use htmlspecialcharactors or htmlentities function for filtration or sanitation , If your site is UTF8 encoded then you should htmlspecialcharactor function and use htmlentities is only if your pages use encodings such as ASCII or LATIN-1 instead of UTF-8.
Comment below if you feel any problem or have queries
Note – Thanks for all your feedback on facebook , this post will update soon with other techniques also , Thanks
Monday, 20 October 2014
Google XSS Vulnerability
Hello friends today i will show you how i Got Google XSS Vulnerability ,When i searching in google support section i think may be i should try to finding xss here ,Then i start trying ,First as usual i put my name in search box " bhati "
Google XSS Vulnerability
Monday, 20 October 2014
Exposed Session Variables-Exploitation
Hello all folks and dear friends this post is specially dedicated to learners and also if you dont know about this vulnerability or can say exploitation And if you already know about it , then you can Re-Read it again , Reading is this is absolutely free =D ;) sorry for the Bad joke
=============================================================================================
Today we will talk about the Exposed Session Variables-Exploitation and how we can exploit the same in real attack scenario !
Sunday, 5 October 2014
Heroku XSS
Hello all folks _/_ Bhai Ji
s , Bhaiya Jis, i was quite busy in my office work and etc , thats why i was unable to write some good stuffsWell , Today we will talk about Heroku XSS ,
Lets come to the point , First i want to tell you that , while testing Heroku i was thinking that i cant find something interesting , because many researchers have already discovered many things , So The Chance For A Valid Bug Is Quite Low =D
==========================================================================================
Wednesday, 25 June 2014
Wordfence Firewall Plugin XSS "CVE-2014-4664"
"Wordfence Firewall Plugin XSS" "CVE-2014-4664"
So lets come to post
Today we will see that how i got "Word Press Firewall Plugin Wordfence XSS"
Monday, 23 June 2014
Referrer CSRF Bypass ( Not Effective But Alternative )
Referrer CSRF Bypass ( Not Effective But Alternative )
=============================================
Hello all friends we are meeting again in very short time ;-)
Today we will see how we can bypass the Referrer CSRF Bypass
By using Chained Vulnerability..
So Lets Begin
Sunday, 16 February 2014
Facebook User Enumeration Vulnerability By Bypassing Brute ForceProtection
Facebook User Enumeration
Hello all readers today i am going to show you that how i got user enumeration vulnerability in facebook "Facebook User Enumeration" Vulnerability
==============================
Bug Status - Reported On 3-5-2013
They said that rate limit is working according to their settings , but they reward me for co-coordinating with them about this report
Reward - $1000
Saturday, 16 November 2013
Net Protector XSS Content Spoofing Antivirus .Net Protector Anti VirusXSS And Content Spoofing Vulnerability
Net Protector Anti Virus XSS And Content Spoofing Vulnerability ( Net Protector XSS Content Spoofing Antivirus)
No 1 Anti Virus In India "Net Protector Anti Virus XSS And Content Spoofing Vulnerability" ( Lol )
Hello all this post is about "Net Protector Anti Virus XSS And Content Spoofing Vulnerability"
while searching looking into site i had found that on the the network manager log in page
Net protector is using a parameter called "txtMsg="
