Tweet

Harsh Bothra

3 Jan, 8 tweets, 4 min read

#learn365 Day-3 SAML Vulns
SAML (Security Assertion Markup Language) is widely used for authentication. It uses XML schema and is prone to multiple security vulnerabilities. Some of the common security issues are:

1. XML Signature Wrapping (XSW) Attacks:
(1/n) #bugbountytips

(2/n)
.. XSW Attacks happen when the XML Digital Signature (XML DSig) is not validated which is used to establish a trust b/w IDPs & Service Providers.
This attack can lead to situations like Privilege Escalation, Authentication Abuse & Denial of Service as well.

(3/n)
Good Resource on SAML Signature Attacks: research.aurainfosec.io/bypassing-saml…
Burp Extensions: SAML Raider
There are multiple variants of XSW attacks from XSW1 to XSW8 (Way of exploitation varies a bit). You can read more about them here in little details: github.com/swisskyrepo/Pa…

(4/n)
2. XML Attacks: Due to the improper input validation and DTD processing, the SAML implementation might be Vulnerable to XXE and XML DoS Attacks like Billian Laugh Attack.
3. SAML Message Integrity Abuse: Using the SAML Message from other users or forged SAML message to ...

(5/n)
... bypass the restriction or may lead to bypass the authentication.
4. Missing or Invalid Signature may allow an attacker to forge a signature and abuse the implementation.
5. SAML Message Replay: Assertion ID should be unique and one ID should be accepted only once.

(6/n)
6. CSRF: Due to improper validation it is possible to carry out CSRF in SAML Implementation.
7. XML Comment Handling: A threat actor who already has authenticated access into an SSO system can authenticate as another user without that individual’s SSO password.

(7/n)
8. XSLT (eXtensible Stylesheet Transformation Language) Attack can also be leverage against SAML Implementation.
9. Token Recipient Confusion - Attacker Token is used to login to Victim Account.
Labs:
1. PentesterLabs
2. github.com/yogisec/Vulner…
3. github.com/dogangcr/vulne…

(n/n)

SAML Security CheatSheet - github.com/OWASP/CheatShe…
Interesting Resources:
- sso-attacks.org/Category:Attac…
- epi052.gitlab.io/notes-to-self/…
- epi052.gitlab.io/notes-to-self/…
- epi052.gitlab.io/notes-to-self/…
H1 Reports
- hackerone.com/reports/888930
- hackerone.com/reports/812064
- hackerone.com/reports/223014

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @harshbothra_

Harsh Bothra

@harshbothra_

4 Jan

#Learn365 Day-4: Unauthenticated & Exploitable JIRA Vulnerabilities

There are multiple security vulnerabilities associated with the various versions of JIRA software which are exploited in wild and is one of my personal favourite 3rd Party apps to hunt.

#BugBountyTips

(1/n)

(2/n)
1. CVE-2020-14179 (Information Disclosure)
a. Navigate to <JIRA_URL>/secure/QueryComponent!Default.jspa
b. It leaks information about custom fields, custom SLA, etc.

2. CVE-2020-14181 (User Enumeration)
a. Navigate to <JIRA_URL>/secure/ViewUserHover.jspa?username=<uname>

(3/n)
3. CVE-2020-14178 (Project Key Enumeration)
a. Navigate to <JIRA_URL>/browse.<project_key>
b. Observe the error message on valid vs. invalid project key. Apart from the Enumeration, you can often get unauthenticated access to the project if the protections are not in place.

Read 9 tweets

Harsh Bothra

@harshbothra_

2 Jan

#learn365 Day-2: Regular Expression Denial of Service (ReDoS)
Due to weakly implemented RegEx Sometimes it is possible to perform a DoS attack by making this expression to evaluate an expression which will make the application work relatively slow. (1/n)

#bugbountytips

(2/n) Usually, this attack is explored and exploited when the source code is available and you can figure out what regular expressions are used in the code at what fields. For example, at the mobile no input field, what is the regex that validates the mobile no input field.

(3/n) However, you can also try to find this in Black/Gray Box engagements.

Method: Open the JavaScript files and search for the "RegExp(" function and try to figure out what function utilize that particular Regex.
Evaluation: github.com/2bdenny/ReScue This is a good tool...

Read 6 tweets

Harsh Bothra

@harshbothra_

1 Jan

#learn365 Day-1: 2FA Bypass Techniques
1. Response Manipulation - In response if "success":false, change it to "success":true
2. Status Code Manipulation - If Status Code is 4xx, try to change it to 200 OK and see if it bypass restrictions.

(1/n)
#bugbountytips

(2/n)
3. 2FA Code Leakage in Response: Check the response of the 2FA Code Triggering Request to see if the code is leaked.
4. JS File Analysis: Rare but some JS Files may contain info about the 2FA Code, worth giving a shot.
5. 2FA Code Reusability: Same code can be reused.

(3/n)
6. Lack of Brute-Force Protection: Possible to brute-force any length 2FA Code.
7. Missing 2FA Code Integrity Validation: Code for any user acc can be used to bypass the 2FA
8. CSRF on 2FA Disabling: No CSRF Protection on disabling 2FA, also there is no auth confirmation.

Read 6 tweets

Harsh Bothra

@harshbothra_

31 Dec 20

Before wrapping up 2020, I would like to thank each and every one of you to make this year really amazing. This year has been an amazing journey and completed almost all milestones. Looking forward to more contribution and collaboration with the community. Special Thanks to (1/n)

@Bugcrowd

(2/n)
@Bugcrowd @SynackRedTeam @cobalt_io for the awesome platforms and glad to be a part of it.
@hakluke @codingo_ @vortexau @guximrama & all other people amazing triage team at BugCrowd & good content.
@impratikdabhi @RogueSMG @AseemShrey @HackerSploit for amazing content.

@InfoSecComm

(3/n)
@InfoSecComm @PentesterLab @SecurityTube @PentesterLand @WebSecAcademy for great learning resources.
@_c0c0n_ @RedTeamVillage_ @redteamvillage @hacback17 @dc9140 @AhmOwasp @bugbountyvillag for great virtual conferences and allowing me to speak at your summits.

Read 6 tweets

Harsh Bothra

@harshbothra_

29 Aug 20

Burp Extensions that I use: (1/n)

1. Autorize - To Test BACs
2. Burp Bounty - Profile-based Scanner
3. Active Scan++ - Add more power to Burp's Active Scanner
4. AuthMatrix - Authorization/PrivEsc Checks
5. Broken Link Hijacking - For BLH

#bugbountytips #bugbounty

(2/n)
6. Collaborator Everywhere - Pingback/SSRF
7. Command Injection Attacker
8. Content-Type Converter - Trying to bypass certain restrictions by changing Content-Type
9. Decoder Improved - More Decoder Features
10. Freddy - Deserialization
11. Flow - Better HTTP History

(3/n)
12. Hackvertor - Handy type conversion
13. HTTP Request Smuggler
14. Hunt - Potential Vuln Identifier
15. InQL - GraphQL Introspection testing
16. J2EE Scan - Scanning J2EE Apps
17. JSON/JS Beautifier
18. JSON Web Token Attacker
19. ParamMiner - Mine Hidden Parameters

Read 5 tweets

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Share this page!

Harsh Bothra

Try unrolling a thread yourself!

More from @harshbothra_

Harsh Bothra

Harsh Bothra

Harsh Bothra

Harsh Bothra

Harsh Bothra

Did Thread Reader help you today?

Like this author's thread?