Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Interpret it!
Search
Bo0oM
August 15, 2020
Research
0
1.1k
Interpret it!
Let's look at the source code that wasn't interpriposed.
Bo0oM
August 15, 2020
Tweet
Share
More Decks by Bo0oM
See All by Bo0oM
Защита от вредоносной автоматизации сегодня
bo0om
0
500
Defending against automatization using nginx
bo0om
0
770
Antibot pitch deck
bo0om
0
110
31337
bo0om
0
130
Your back is white
bo0om
0
300
FTP2RCE
bo0om
1
7.2k
At Home Among Strangers
bo0om
1
3.7k
2000day in Safari
bo0om
2
2.1k
Partyhack 3.0 - Telegram bugbounty writeup
bo0om
0
4k
Other Decks in Research
See All in Research
「並列化時代の乱数生成」
abap34
3
910
The many faces of AI and the role of mathematics
gpeyre
1
1.4k
20240918 交通くまもとーく 未来の鉄道網編(太田恒平)
trafficbrain
0
350
Weekly AI Agents News! 10月号 プロダクト/ニュースのアーカイブ
masatoto
1
150
文化が形作る音楽推薦の消費と、その逆
kuri8ive
0
200
ソフトウェア研究における脅威モデリング
laysakura
0
930
Weekly AI Agents News! 8月号 プロダクト/ニュースのアーカイブ
masatoto
1
210
論文読み会 KDD2024 | Relevance meets Diversity: A User-Centric Framework for Knowledge Exploration through Recommendations
cocomoff
0
110
非ガウス性と非線形性に基づく統計的因果探索
sshimizu2006
0
440
PetiteSRE_GenAIEraにおけるインフラのあり方観察
ichichi
0
190
Weekly AI Agents News! 10月号 論文のアーカイブ
masatoto
1
400
Weekly AI Agents News!
masatoto
26
35k
Featured
See All Featured
A designer walks into a library…
pauljervisheath
204
24k
Put a Button on it: Removing Barriers to Going Fast.
kastner
59
3.6k
Build your cross-platform service in a week with App Engine
jlugia
229
18k
Code Reviewing Like a Champion
maltzj
520
39k
jQuery: Nuts, Bolts and Bling
dougneiner
61
7.5k
The Cult of Friendly URLs
andyhume
78
6.1k
KATA
mclloyd
29
14k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
32
2.7k
How GitHub (no longer) Works
holman
311
140k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
159
15k
How To Stay Up To Date on Web Technology
chriscoyier
789
250k
Why You Should Never Use an ORM
jnunemaker
PRO
54
9.1k
Transcript
How do I see the source code? • Include files
(header.inc) • Backup files • Temp files (nano, vim, etc) • .git or another version-control system • Arbitrary file reading
Interpret it! Anton “Bo0oM” Lopanitsyn
Server configuration errors Multiple routing and microservices location / {
try_files $uri $uri/ /index.html; ... } location /blog { … }
Server configuration errors Multiple routing and microservices
How to find it? https://example.com/config.php - 200, 0B https://example.com/config.php -
200, 3KB Content-type: application/octet-stream text/plain
Find a vulnerability in the config! location ~ ^(.+\.php)(.*)$ {
fastcgi_split_path_info ^(.+\.php)(.*)$; fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name; fastcgi_param DOCUMENT_ROOT /var/www/html; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_index index.php; }
Nope https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_split_path_info
Windows + Nginx = <3 https://example.com/config.php - 200, 0B https://example.com/config.pHP
location ~ ^(.+\.php)(.*)$ location ~ ^(.+\.php)(.*)$ Linux (case sensitive): https://example.com/config.pHP - 404 Windows: https://example.com/config.pHP - 200
Nginx /etc/nginx/site-enabled/default server { listen 80 default_server; listen
[::]:80 default_server; root /var/www/html; index index.html index.htm index.nginx-debian.html; server_name _; location / { try_files $uri $uri/ =404; } }
None
None
None
Apache /etc/apache2/sites-enabled/000-default.conf <VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined </VirtualHost>
Apache /etc/apache2/sites-enabled/example.conf <VirtualHost *:80> DocumentRoot /var/www/html/example.com <FilesMatch "\.ph(p[3-5]?|tml)$"> SetHandler application/x-httpd-php
</FilesMatch> …
How to find it? example.com, IP: 123.123.123.123 Check http://123.123.123.123/config.php http://123.123.123.123/example/config.php
http://123.123.123.123/example.com/config.php
CDN’s https://forum.example.com https://cdn.example.com/forum/static/123/123.jpg https://cdn.example.com/forum/config.php Unbelievable, but the fact is, some
move the whole project to cdn!
0day
Blog: https://bo0om.ru Twitter: @i_bo0om Telegram channel: @webpwn