Skip to content

Commit 801aecb

Browse files
swisskyreposwisskyrepo
committed
GraphQL + HPP
1 parent e6466b4 commit 801aecb

File tree

3 files changed

+114
-62
lines changed

3 files changed

+114
-62
lines changed

‎GraphQL Injection/README.md

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -7,23 +7,23 @@
77

88
- [Tools](#tools)
99
- [Enumeration](#enumeration)
10-
- [Common GraphQL endpoints](#common-graphql-endpoints)
11-
- [Identify an injection point](#identify-an-injection-point)
10+
- [Common GraphQL Endpoints](#common-graphql-endpoints)
11+
- [Identify An Injection Point](#identify-an-injection-point)
1212
- [Enumerate Database Schema via Introspection](#enumerate-database-schema-via-introspection)
1313
- [Enumerate Database Schema via Suggestions](#enumerate-database-schema-via-suggestions)
14-
- [Enumerate the types' definition](#enumerate-the-types-definition)
15-
- [List path to reach a type](#list-path-to-reach-a-type)
14+
- [Enumerate Types Definition](#enumerate-types-definition)
15+
- [List Path To Reach A Type](#list-path-to-reach-a-type)
1616
- [Methodology](#methodology)
17-
- [Extract data](#extract-data)
18-
- [Extract data using edges/nodes](#extract-data-using-edgesnodes)
19-
- [Extract data using projections](#extract-data-using-projections)
20-
- [Use mutations](#use-mutations)
17+
- [Extract Data](#extract-data)
18+
- [Extract Data Using Edges/Nodes](#extract-data-using-edgesnodes)
19+
- [Extract Data Using Projections](#extract-data-using-projections)
20+
- [Mutations](#mutations)
2121
- [GraphQL Batching Attacks](#graphql-batching-attacks)
22-
- [JSON list based batching](#json-list-based-batching)
23-
- [Query name based batching](#query-name-based-batching)
22+
- [JSON List Based Batching](#json-list-based-batching)
23+
- [Query Name Based Batching](#query-name-based-batching)
2424
- [Injections](#injections)
25-
- [NOSQL injection](#nosql-injection)
26-
- [SQL injection](#sql-injection)
25+
- [NOSQL Injection](#nosql-injection)
26+
- [SQL Injection](#sql-injection)
2727
- [Labs](#labs)
2828
- [References](#references)
2929

@@ -46,9 +46,9 @@
4646

4747
## Enumeration
4848

49-
### Common GraphQL endpoints
49+
### Common GraphQL Endpoints
5050

51-
Most of the time the graphql is located on the `/graphql` or `/graphiql` endpoint.
51+
Most of the time GraphQL is located at the `/graphql` or `/graphiql` endpoint.
5252
A more complete list is available at [danielmiessler/SecLists/graphql.txt](https://github.com/danielmiessler/SecLists/blob/fe2aa9e7b04b98d94432320d09b5987f39a17de8/Discovery/Web-Content/graphql.txt).
5353

5454
```ps1
@@ -63,7 +63,7 @@ A more complete list is available at [danielmiessler/SecLists/graphql.txt](https
6363
```
6464

6565

66-
### Identify an injection point
66+
### Identify An Injection Point
6767

6868
```js
6969
example.com/graphql?query={__schema{types{name}}}
@@ -211,7 +211,7 @@ You can also try to bruteforce known keywords, field and type names using wordli
211211
212212
213213
214-
### Enumerate the types' definition
214+
### Enumerate Types Definition
215215
216216
Enumerate the definition of interesting types using the following GraphQL query, replacing "User" with the chosen type
217217
@@ -220,7 +220,7 @@ Enumerate the definition of interesting types using the following GraphQL query,
220220
```
221221
222222
223-
### List path to reach a type
223+
### List Path To Reach A Type
224224
225225
```php
226226
$ git clone https://gitlab.com/dee-see/graphql-path-enum
@@ -246,7 +246,7 @@ Found 27 ways to reach the "Skill" node from the "Query" node:
246246
247247
## Methodology
248248
249-
### Extract data
249+
### Extract Data
250250
251251
```js
252252
example.com/graphql?query={TYPE_1{FIELD_1,FIELD_2}}
@@ -256,7 +256,7 @@ example.com/graphql?query={TYPE_1{FIELD_1,FIELD_2}}
256256
257257
258258
259-
### Extract data using edges/nodes
259+
### Extract Data Using Edges/Nodes
260260
261261
```json
262262
{
@@ -272,7 +272,7 @@ example.com/graphql?query={TYPE_1{FIELD_1,FIELD_2}}
272272
}
273273
```
274274
275-
### Extract data using projections
275+
### Extract Data Using Projections
276276
277277
:warning: Don’t forget to escape the " inside the **options**.
278278
@@ -281,7 +281,7 @@ example.com/graphql?query={TYPE_1{FIELD_1,FIELD_2}}
281281
```
282282
283283
284-
### Use mutations
284+
### Mutations
285285
286286
Mutations work like function, you can use them to interact with the GraphQL.
287287
@@ -299,7 +299,7 @@ Common scenario:
299299
* 2FA bypassing
300300
301301
302-
#### JSON list based batching
302+
#### JSON List Based Batching
303303
304304
> Query batching is a feature of GraphQL that allows multiple queries to be sent to the server in a single HTTP request. Instead of sending each query in a separate request, the client can send an array of queries in a single POST request to the GraphQL server. This reduces the number of HTTP requests and can improve the performance of the application.
305305
@@ -323,7 +323,7 @@ Query batching works by defining an array of operations in the request body. Eac
323323
```
324324
325325
326-
#### Query name based batching
326+
#### Query Name Based Batching
327327
328328
```json
329329
{
@@ -348,7 +348,7 @@ mutation {
348348
> SQL and NoSQL Injections are still possible since GraphQL is just a layer between the client and the database.
349349
350350
351-
### NOSQL injection
351+
### NOSQL Injection
352352
353353
Use `$regex`, `$ne` from []() inside a `search` parameter.
354354
@@ -364,7 +364,7 @@ Use `$regex`, `$ne` from []() inside a `search` parameter.
364364
```
365365
366366
367-
### SQL injection
367+
### SQL Injection
368368
369369
Send a single quote `'` inside a graphql parameter to trigger the SQL injection
370370

‎HTTP Parameter Pollution/README.md

Lines changed: 73 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -5,50 +5,93 @@
55
## Summary
66

77
* [Tools](#tools)
8-
* [How to test](#how-to-test)
9-
* [Table of reference](#table-of-reference)
8+
* [Methodology](#methodology)
9+
* [Parameter Pollution Table](#parameter-pollution-table)
10+
* [Parameter Pollution Payloads](#parameter-pollution-payloads)
1011
* [References](#references)
1112

1213

1314
## Tools
1415

15-
No tools needed. Maybe Burp or OWASP ZAP.
16+
* **Burp Suite**: Manually modify requests to test duplicate parameters.
17+
* **OWASP ZAP**: Intercept and manipulate HTTP parameters.
1618

17-
## How to test
1819

19-
HPP allows an attacker to bypass pattern based/black list proxies or Web Application Firewall detection mechanisms. This can be done with or without the knowledge of the web technology behind the proxy, and can be achieved through simple trial and error.
20+
## Methodology
2021

21-
```
22-
Example scenario.
23-
WAF - Reads first param
24-
Origin Service - Reads second param. In this scenario, developer trusted WAF and did not implement sanity checks.
22+
HTTP Parameter Pollution (HPP) is a web security vulnerability where an attacker injects multiple instances of the same HTTP parameter into a request. The server's behavior when processing duplicate parameters can vary, potentially leading to unexpected or exploitable behavior.
23+
24+
HPP can target two levels:
25+
26+
* Client-Side HPP: Exploits JavaScript code running on the client (browser).
27+
* Server-Side HPP: Exploits how the server processes multiple parameters with the same name.
2528

26-
Attacker -- http://example.com?search=Beth&search=' OR 1=1;## --> WAF (reads first 'search' param, looks innocent. passes on) --> Origin Service (reads second 'search' param, injection happens if no checks are done here.)
29+
30+
**Examples**:
31+
32+
```ps1
33+
/app?debug=false&debug=true
34+
/transfer?amount=1&amount=5000
2735
```
2836

29-
### Table of reference
37+
38+
### Parameter Pollution Table
3039

3140
When ?par1=a&par1=b
3241

33-
| Technology | Parsing Result |outcome (par1=)|
34-
| ------------------ |--------------- |:-------------:|
35-
| ASP.NET/IIS |All occurrences |a,b |
36-
| ASP/IIS |All occurrences |a,b |
37-
| PHP/Apache |Last occurrence |b |
38-
| PHP/Zues |Last occurrence |b |
39-
| JSP,Servlet/Tomcat |First occurrence |a |
40-
| Perl CGI/Apache |First occurrence |a |
41-
| Python Flask |First occurrence |a |
42-
| Python Django |Last occurrence |b |
43-
| Nodejs |All occurrences |a,b |
44-
| Golang net/http - `r.URL.Query().Get("param")` |First occurrence |a |
45-
| Golang net/http - `r.URL.Query()["param"]` |All occurrences in array |['a','b'] |
46-
| IBM Lotus Domino |First occurrence |a |
47-
| IBM HTTP Server |First occurrence |a |
48-
| Perl CGI/Apache |First occurrence |a |
49-
| mod_wsgi (Python)/Apache |First occurrence |a |
50-
| Python/Zope |All occurrences in array |['a','b'] |
51-
| Ruby on Rails |Last occurrence |b |
42+
| Technology | Parsing Result | outcome (par1=) |
43+
| ----------------------------------------------- | ------------------------ | --------------- |
44+
| ASP.NET/IIS | All occurrences | a,b |
45+
| ASP/IIS | All occurrences | a,b |
46+
| Golang net/http - `r.URL.Query().Get("param")` | First occurrence | a |
47+
| Golang net/http - `r.URL.Query()["param"]` | All occurrences in array | ['a','b'] |
48+
| IBM HTTP Server | First occurrence | a |
49+
| IBM Lotus Domino | First occurrence | a |
50+
| JSP,Servlet/Tomcat | First occurrence | a |
51+
| mod_wsgi (Python)/Apache | First occurrence | a |
52+
| Nodejs | All occurrences | a,b |
53+
| Perl CGI/Apache | First occurrence | a |
54+
| Perl CGI/Apache | First occurrence | a |
55+
| PHP/Apache | Last occurrence | b |
56+
| PHP/Zues | Last occurrence | b |
57+
| Python Django | Last occurrence | b |
58+
| Python Flask | First occurrence | a |
59+
| Python/Zope | All occurrences in array | ['a','b'] |
60+
| Ruby on Rails | Last occurrence | b |
61+
62+
63+
### Parameter Pollution Payloads
64+
65+
* Duplicate Parameters:
66+
```ps1
67+
param=value1&param=value2
68+
```
69+
70+
* Array Injection:
71+
```ps1
72+
param[]=value1
73+
param[]=value1&param[]=value2
74+
param[]=value1&param=value2
75+
param=value1&param[]=value2
76+
```
77+
78+
* Encoded Injection:
79+
```ps1
80+
param=value1%26other=value2
81+
```
82+
83+
* Nested Injection:
84+
```ps1
85+
param[key1]=value1&param[key2]=value2
86+
```
87+
88+
* JSON Injection:
89+
```ps1
90+
{
91+
"test": "user",
92+
"test": "admin"
93+
}
94+
```
5295
5396
5497
## References

‎Headless Browser/README.md

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
* [Headless Commands](#headless-commands)
1111
* [Local File Read](#local-file-read)
12-
* [Debugging Port ](#debugging-port)
12+
* [Debugging Port](#debugging-port)
1313
* [Network](#network)
1414
* [Port Scanning](#port-scanning)
1515
* [DNS Rebinding](#dns-rebinding)
@@ -20,11 +20,20 @@
2020

2121
Example of headless browsers commands:
2222

23-
```ps1
24-
google-chrome --headless[=(new|old)] --print-to-pdf https://www.google.com
25-
firefox --screenshot https://www.google.com
26-
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu --window-size=1280,720 --screenshot="C:\tmp\screen.png" "https://google.com"
27-
```
23+
* Google Chrome
24+
```ps1
25+
google-chrome --headless[=(new|old)] --print-to-pdf https://www.google.com
26+
```
27+
28+
* Mozilla Firefox
29+
```ps1
30+
firefox --screenshot https://www.google.com
31+
```
32+
33+
* Microsoft Edge
34+
```ps1
35+
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu --window-size=1280,720 --screenshot="C:\tmp\screen.png" "https://google.com"
36+
```
2837
2938
3039
## Local File Read
@@ -52,7 +61,7 @@ Target: `google-chrome-stable --headless[=(new|old)] --print-to-pdf https://site
5261
```
5362
5463
55-
## Debugging Port
64+
## Debugging Port
5665
5766
**Target**: `google-chrome-stable --headless=new --remote-debugging-port=XXXX ./index.html`
5867

0 commit comments

Comments
 (0)