Showing posts with label vulnerabilities. Show all posts
Showing posts with label vulnerabilities. Show all posts

Wednesday, April 26, 2017

XCat Tool that aides in the exploitation of blind XPath injection vulnerabilities

XCat Tool that aides in the exploitation of blind XPath injection vulnerabilities


XCat is a command line program that aides in the exploitation of blind XPath injection vulnerabilities. It can be used to retrieve the whole XML document being processed by a vulnerable XPath query, read arbitrary files on the hosts filesystem and utilize out of bound HTTP requests to make the server send data directly to xcat.

XCat is built to exploit boolean XPath injections (Where only one bit of data can be extracted in one request) and it requires you to manually identify the exploit first, this does not do that for you.

Features
  • Exploits both GET and POST attacks
  • Extracts all nodes, comments, attributes and data from the entire XML document
  • Small and lightweight (only a few pure-python dependencies)
  • Parallel requests
  • XPath 2.0 supported (with graceful degrading to 1.0)
  • Advanced data postback through HTTP (see below)
  • Arbitrarily read XML files on the servers file system via the doc() function (see below)
  • Arbitrarily read text files on the servers file system via crafted SYSTEM entities

Examples
If you run a windows machine you can install Jython and start the example application (example_application/ironpython_site.py). The syntax for a simple command you can execute against this server is:
xcat --method=GET http://localhost:8080 title=Foundation title "1 results found" run retrieve

This command specifies the HTTP method (GET), target URL (our localhost server), the GET or POST) data to send (title=Bible), the vulnerable parameter (title) and a string to indicate a true response (Book found). Executing this will retrieve the entire XML file being queried.
>> xcat --method=GET http://localhost:8080 title=Foundation title "1 results found" run retrieve
Injecting using FunctionCall
Detecting features...
Supported features: String to codepoints, XPath 2, Read local XML files, Substring search speedup
Retrieving /*[1]
<?xml version="1.0" encoding="utf-8"?>
<library>
 <rentals>
 <books>
 <!-- A comment -->
 <book>
...

The the retrieval of documents can be sped up in a number of different ways, such as using the doc function to make the server send data directly to XCat (explained in more detail below). Each of the techniques is called a feature and can be viewed by using the test_injection command. This will display information about the injection, including the type (integer, string, path name) and various features that XCat has is able to use. XCat knows which features are best and will gracefully degrade if they fail for any reason.
>> xcat --method=GET --public-ip="localhost" http://localhost:8080 title=Foundation title "1 results found" test_injection
Testing parameter title:
FunctionCallInjection: /lib/something[function(?)]
 - EfficientSubstringSearch
 - OOBDocFeature
 - CodepointSearch
 - XPath2
 - DocFeature
 - EntityInjection


Download XCat

Go to link download

Read more »
Posted by at
Labels: , , , , , , , , , , ,

Wednesday, April 5, 2017

Web Application Protection Tool to detect and correct vulnerabilities in PHP web applications

Web Application Protection Tool to detect and correct vulnerabilities in PHP web applications



WAP 2.0 is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP (version 4.0 or higher) and with a low rate of false positives. WAP detects and corrects the following vulnerabilities:
  • SQL Injection (SQLI)
  • Cross-site scripting (XSS)
  • Remote File Inclusion (RFI)
  • Local File Inclusion (LFI)
  • Directory Traversal or Path Traversal (DT/PT)
  • Source Code Disclosure (SCD)
  • OS Command Injection (OSCI)
  • PHP Code Injection

This tool semantically analyses the source code. More precisely, it does taint analysis (data-flow analysis) to detect the input validation vulnerabilities. The aim of the taint analysis is to track malicious inputs inserted by entry points ($_GET, $_POST arrays) and to verify if they reaches some sensitive sink (PHP functions that can be exploited by malicious input). After the detection, the tool uses data mining to confirm if the vulnerabilities are real or false positives. At the end, the real vulnerabilities are corrected with the insertion of the fixes (small pieces of code) in the source code. WAP is written in Java language and is constituted by three modules:
  • Code Analyzer: composed by tree generator and taint analyser. The tool has integrated a lexer and a parser generated by ANTLR, and based in a grammar and a tree grammar written to PHP language. The tree generator uses the lexer and the parser to build the AST (Abstract Sintatic Tree) to each PHP file. The taint analyzer performs the taint analysis navigating through the AST to detect potentials vulnerabilities.

  • False Positives Predictor: composed by a supervised trained data set with instances classified as being vulnerabilities and false positives and by the Logistic Regression machine learning algorithm. For each potential vulnerability detected by code analyser, this module collects the presence of the attributes that define a false positive. Then, the Logistic Regression algorithm receives them and classifies the instance as being a false positive or not (real vulnerability).

  • Code Corrector: Each real vulnerability is removed by correction of its source code. This module for the type of vulnerability selects the fix that removes the vulnerability and signalizes the places in the source code where the fix will be inserted. Then, the code is corrected with the insertion of the fixes and new files are created.     

Download WAP

Go to link download

Read more »
Posted by at
Labels: , , , , , , , , , , ,

Monday, March 13, 2017

FuckShitUp Multi Vulnerabilities Scanner written in PHP

FuckShitUp Multi Vulnerabilities Scanner written in PHP



Basically, FSU is bunch of tools written in PHP-CLI. Using build-in functions, you are able to grab urls using search engines - and so, dork for interesting files and full path disclosures. Using list of urls, scanner will look for Cross Site Scripting, Remote File Inclusion, SQL Injection and Local File Inclusion vulnerabilities. It is able to perform mass bruteforce attacks for specific range of hosts, or bruteforce ssh with specific username taken from FPD. Whenever something interesting will be found, like vulnerability or broken auth credentials, data will be saved in .txt files - just like urls, and any other files. FSU is based on PHP and text files, its still under construction so i am aware of any potential bugs. Principle of operation is simple.
More urls -> more vulns. For educational purposes only.

Intro

  • Data grabbing:
    • URLs (geturl/massurl) -> (scan)
    • Configs, Databases, SQLis (dork)
    • Full Path Disclosures / Users (fpds) -> (brutefpds)
    • Top websites info (top)
  • Massive scanning
    • XSS, SQLi, LFI, RFI (scan)
    • FTP, SSH, DBs, IMAP (multibruter)
    • Accurate SSH bruteforce (brutefpds)

Plan

  • Web Apps
    • Grab urls via geturl or massurl (massurl requires list of tags as file)
    • Scan urls parameters for vulns with scan
  • Servers
    • Pick target, get ip range
    • Scan for services on each IP and bruteforce with multibruter
    • Grab full path disclosures, and so linux usernames
    • Perform SSH bruteforce for specific user with brutefpds
  • Info grabbing
    • Use dork for automatic dorking
    • Use fpds for full path disclosure grabbing
    • Use search for searching someone in ur databases
    • Use top for scanning all top websites of specific nation
  • Others
    • Stat shows actual statistics and informations
    • Show display specific file
    • Clear and filter - remove duplicates, remove blacklisted urls

Others

MultiBrtuer requirements (php5):
  • php5-mysql - for mysql connections
  • php5-pgsql - for postgresql connections
  • libssh2-php - for ssh connections
  • php5-sybase - for mssql connections
  • php5-imap - for imap connections
TODO:
  • Fix problems with grabbing large amount of urls
  • More search engines
  • SQL Injector
  • RFI shell uploader
  • FSU is not secure as it should be

Download FuckShitUp

Go to link download

Read more »
Posted by at
Labels: , , , , , ,
Subscribe to: Posts (Atom)