Showing posts with label Hacking. Show all posts

Friday, December 30, 2016

[High] HTML Injection - Stored (Blog)

Posted by Unknown 4:59:00 PM

# Introduction

: BWAPP → High → HTML Injection - Stored (blog)

# Training

: I put the value I used in the low step, As a result, output is as follows.

I check at /var/www/bWAPP/htmli_stored.php to see how it works.

I check functions_external.php to see the xss_check_3 function.

The htmlspecialchars function has been mentioned previously, so it is omitted.

Unknown

0 Comments

Monday, December 26, 2016

Beebox Hacking Study Web

[low] HTML Injection - Stored (Blog)

Posted by Unknown 5:59:00 PM

# Introduction

: BWAPP → Low→ HTML Injection - Stored (blog)

# Training

: The ''htmli_stored.php'' page is a blog format.

Therefore, It is possible to save HTML tags so that the administrator can output unintended contents. Or When type in the text field on the blog and click [Go], Transfer the input and move to another page.

The contents of the exercise are as follows.

: Moving from htmli_stored.php to htmli_post.php using a text field.

First, copy the page format from htmli_post.php to use the htmli_post.php page format.

When fetching page formates, It's easy to import using the web developer tools in browser.

Put this code in the textfield and click [submint] to add it.

When user enter data in both fields and press [Go], the user moves to the page.

Unknown

0 Comments

Friday, December 23, 2016

Beebox Hacking Study Web

[High] HTML Injection - Reflected (POST)

Posted by Unknown 11:00:00 AM

# Introduction

:BWAPP → High → HTML Injection - reflected (POST)

# Training

: At the high level, It use the function used in the previous level and htmlspecialchars function. So, Encode the characters used in the tag with UTF-8 so that they are not recognized as HTML Tag.

Unknown

0 Comments

Beebox Hacking Study Web

[Medium] HTML Injection - Reflected (POST)

Posted by Unknown 10:33:00 AM

# Introduction

:BWAPP → Medium→ HTML Injection - reflected (POST)

# Training

:As before, I did the exercises without reference to the source code. When I input the value used in the previous step, It will be output as plain text as follows.

So, I checked the input values to the server using the buff suite.

I found that the value passed to the server is encoded( <, > encoded to %3C, %3E).If I input this values, I thought that the specific function of html_post.php encode it once and pass it to the server. If I visualize what I think, it is as follows.

When I input the value, It was passed to the server as follows.

When I forward values, I could use the html tags.

Unknown

0 Comments

Beebox Hacking Study Web

[low] HTML Injection - Reflected (POST)

Posted by Unknown 9:38:00 AM

# Introduction

:BWAPP → Low→ HTML Injection - reflected (POST)

# Training

: htmli_post.php uses POST Method to transfer data. So, Variable values sent to the server are not exposed to the URL. You can check the '/var/www/bWAPP/htmli_post.php' for practice, but I used a proxy tool(Burp suite).

First, When I enter a value into a variable, I confirmed that the output is the same as html_get.php.

One difference is that the variable values are not exposed to the URL, as described above.

I set the proxy settings and modified the variable values using the buff suite.

The modified values are the same as the html tags used in html_get.php

Unknown

0 Comments

Thursday, December 22, 2016

Beebox Hacking Study Web

[High] HTML Injection - Reflected (GET)

Posted by Unknown 7:29:00 PM

# Introduction

:BWAPP → Medium→ HTML Injection - reflected (GET)

# Training

: At this level, all of the previous level values are output as plain text as shown below.

I checked the source code as well as the medium level. First, I checked the source code of htmli_get.php. At the htmli_get.php, I found that using the xss_check_3 function at high level.

Next, At the Functions_external.php, I could see what this function is.

I found that the htmlspecialchars function bypass the input value. This function is a basic function provided by php. It returns special characters used in HTML as UTF-8.

So, If you want to prevent HTML injections, you can use this function to make the characters used in HTML tags recognizes as text.

Unknown

4 Comments

Beebox Hacking Study Web

[medium] HTML Injection - Reflected (GET)

Posted by Unknown 6:56:00 PM

# Introduction.

: BWAPP → Medium→ HTML Injection - reflected (GET)

# Training

: If we enter the input value in the middle step like the low step, the output is as follows.

I wondered why this is so I checked the source code. The source code is located in /var/www/bWAPP. The contents of the source code are as follows.

I could see that the function xss_check_1 is used at the medium level. The xss_check_1 could be found in functions_external.php.

I could see that < & > convert to another character. Therefore, I typed URL encoding of the character used in the tag.

%3Ch1%3ESuccess%3C%2Fh1%3E
%3Cimg src=http://192.168.10.119/bWAPP/images/bee_1.png%3E

The results were as follows.

Unknown

0 Comments

Beebox Hacking Study Web

HTML Injection - Reflected (GET)

Posted by Unknown 2:32:00 PM

# Introduction.

: BWAPP → Low → HTML Injection - reflected (GET)

# Training.

This 'html_get.php' is a page that prints the user's input value as follows.

And If you check the URL, you can see that the input value and variable name are exposed in the URL. Because it is the GET method.

In order to test the input items, I inserted HTML tags in the First name and Last name.

<h1> Success</h1>
<img src=http://192.168.10.119/bWAPP/images/bee_1.png>

The input result is as follows.

Unknown

0 Comments

Beebox Hacking Study Web

What is "HTML Injection"

Posted by Unknown 1:56:00 PM

# HTML Injection

: HTML Injection is a subclass of code injection attack. An attack that inserts malicious HTML Code into vulnerable parameters. Using this, the attacker inserts the HTML Tag on the page that the user requested to link and connects to the unintended content or the malicious site.

# Reflection technique.

: It is an attack that inserts a malicious HTML tag in the URL and causes the HTML tag to be executed on the user's PC Who clicked the link. ( In particular, when data is transmitted by the GET Method, the variable name & input value are exposed in the URL.

# Storage technique.

: It is an attack that causes malicious HTML tag to be stored in DB so that the HTML Tags are executed on the PC of the users who has confirmed the stored tags. If attacker upload a malicious HTML tag to a public domain, attacker can attack multiple users.

Unknown

0 Comments

Beebox Beebox posting list Hacking Study Web

Beebox Posting List

Posted by Unknown 1:21:00 PM

This page is about the Beebox posting list document.

The purpose is to find the information I want more easily. There is no content that is not practiced directly.

# Concept

What is "HTML Injection"

# Training ( low )

# Training ( Medium )

# Training ( High )

Unknown

4 Comments

Tuesday, December 20, 2016

Hacking Study System

Basic Stack Corruption (Stack Buffer Overflow)

Posted by Unknown 4:25:00 PM

# Basic Stack Corruption.

: Buffer Overflow refers to a vulnerability that overwrites contiguous memory when more data is inserted than the allocated buffer. The vulnerability occurs because the string processing function doesn't check the length of the input value. (ex. strcpy )

The following program was used for the basic stack corruption at Ubuntu Linux 14.04.

The goal is to execute the vuln() function using the vulnerability of strcpy.

Since this version of Ubuntu uses various memory protection techniques, we have compiled it with the following options:

gcc -fno-stack-protector -mpreferred-stack-boundary=2 -o bof bof.c

After compiling, we can look at using gdb as follows.

The contents of attack based on the above contents are as follows.

Now find the address of vuln() needed to create the payload using GDB.

Since we find the address of vuln(), now we can complete the payload.

I overwrite buffer[30]&SFP with the letter "A", and modulated the RET address with the address of vuln(). So, After the main function was terminated, the vuln function is executed and a root privileged shell is executed.

Unknown

0 Comments

Monday, December 12, 2016

Hacking System System hacking posting list

System Hacking Posting list

Posted by Unknown 7:25:00 PM

# Posting List.

This page is the system hacking (pwnable) posting list document.

The order of the list is sorted by the date I posted. I created this page because it is not easy to find the specific part I want in the category on this blog.

> List.

Unknown

0 Comments

Saturday, December 10, 2016

Hacking Study System

Shell Code

Posted by Unknown 12:17:00 PM

This Document is intended for research & study purposes.
We warn you that any legal liability that arises when using this document for commercial or malicious purposes is at your own risk.

#Shell Code.

:In hacking, a shellcode is a small piece of code used as the payload in the exploitaion of a S/W vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient. However, attempts at replacing the term have not gained wide acceptance. Shellcode is commonly written in machine code. --from Wikipedia

#How to make Shell Code.

The procedure for creating shell code is as follows.

Implement code that you want to run in C or another high-level language.
Disassembling using GDB and finding the required part.
Implement with only the essential parts required for system calls.
Compile and Output the machine language using Objdump.
If there is a null, Return a null value, Remove it by processing.
Complete machine code with one sentence.

# Make the local shell code.

:Local Shell Code refers to the shell code that operates in the local environment.

The Shell Code to create is the code that executes the Root Shell using the execve function in Red Hat Linux 9. The code contents are as follows.

The execve function is itself a System call function. If we look at the prototype of the execve function, the arguments of the execve functions are the execution path, the start address of the argument array, and the address of the enviroment variable array, respectively.

Now, compile this code with the static option, and run it. we can see shell running as follows:

The static option is used to compile, not to use the shared lib, and to contain all the content used in the program.

To create a shell code, we first need to implement it in assembly language. Therefore, we use GDB to get the information we need when coding with ASM.

If we disassembly the execve using GDB, you can see the ASM commands above. Put a bp on execve +36 where int0x80 ix located. and look at the values of registers as shown below.

When expressing execve (str[1], str, &str[1]), use eax, ebx, ecx and edx. the system call number of execve is 11. the values of the execve receive as arguments are 0 address, the address of "/bin/sh", and "/bin/sh" and write as asm code, we can write as follows.

Use this code to check the machine code using objdump.

In order to function properly with the Shell Code, there must be no null characters. Examples of ways to remove null values include short jump, modify register width, and xor operation.

These methods use only enough space for their own use, they can not enter Null. because they do not have space left.

The modified code that removed the null value is as follows.

Check again with objdump to see if there is a null value that could not be removed.

The shell code is extracted using this file because the null value no longer exists.

If we run this shell code, the shell will run fine, but we will not be able to run the shell with root permission. because there is no code to get root's privileges. Therefore, We need to add the code about getting root previlege. ex. setuid(0)