ro Profile picture
Sep 4 β€’ 10 tweets β€’ 4 min read
#Learn365 - Day 1⃣ 6⃣

Can write single Exploit payload which can exploit both HTML and JS injection in this ?

Yes we can, they are POLYGLOT payloads.
A context sensitive injection payloads, a thread. πŸ§΅πŸ‘‡

#infosec #appsec #bugbountytips #security Image
Polyglot payloads capable of executing in multiple contexts.

A simple Example:
Input is flowing through HTML and JavaScript contenxt both and HTML is executed first then JS.

If you design the payload with JS context, HTML parse would fail, and XSS wont execute.
Which means you have to design your payload which can pass both the contexts and still execute.

In above case there are two contexts,

HTML
&
JS

First HTML context is executed.

Lets take a look at the payload now.
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Complicated ?

Not really.

Lemme disect that for you in the next one.
1. jaVasCript: - is URL scheme in HTML and label in JS
2. /*-/*`/*\`/*'/*"/**/ - Multi line comment in JS and literal in HTML
3. "/* */oNcliCk=alert() ) - execution in JS
4. //%0D%0A%0d%0a// - comment in JS, and CRLF in HTTP response header
5. </stYle/</titLe/</teXtarEa/</scRipt/--!> - HTML tag breaking seq
6. \x3csVg/<sVg/oNloAd=alert()//>\x3e" - SVG element in HTML
HTML context would look like the one in below image.

MAKING HTML HAPPY.

![banners](images/polyglots/htmlcontext.png)
JS context would look like.

MAKING JS HAPPY.

In the end, making both of them happy.
![banners](images/polyglots/jscontext.png)
This is just one single example of multi context single paylaod. There could be lot of other cases as well.

@0xSobky has perfectly jot that down in his blog on polyglots : github.com/0xsobky/HackVa…
If you like the thread, consider retweeting it out :)
Also I am running #Learn365 to share security bits, if you want to stay updated, consider following @sec_r0

I soon may be landing a zine on Polyglots on SecurityZines, so stay tuned at getrevue.co/profile/securi…

β€’ β€’ β€’

Missing some Tweet in this thread? You can try to force a refresh
γ€€

Keep Current with ro

ro Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @sec_r0

Sep 5
#Learn365 - Day 1⃣ 7⃣

Since we are talking about Polyglots, today I have SQLi Polyglot for you.
A context insensitive sqli payload polyglot, a thread. πŸ§΅πŸ‘‡

#infosec #appsec #bugbountytips #security Image
When it comes to SQLi, the SQli polygot is the payload that runs in context of ' (single quote) and " (double quote).

E.g
SLEEP(1) /*' or SLEEP(1) or'" or SLEEP(1) or "*/

Will execute in both the contexts.
How ?

Let's see next.
MYSQL_QUERY = "SELECT * FROM users WHERE username = '<input>'" ;

Would turn into

MYSQL_QUERY = "SELECT * FROM users WHERE username = 'SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/" '";

Carefully observe, the Payload is happy. Image
Read 6 tweets
Aug 25
#Learn365 - Day 6⃣

Can you identify and exploit the #security bug? πŸ€”

In today's thread lets learn about exploit writing πŸ§΅πŸ‘‡

#infosec #appsec #bugbountytips #security
This is SQLi. easy to guess. Which field is vulnerable : username.

But the tricky part is how to exploit it.
If you disect the code, you would notice that SQL statement should always return one single word. Otherwise comparison will anyway fail in PHP code.

What next ?
What do you think will happen if I input :

" or 1=1;--

Think first !!
.
.
.
.
.
.
This will make SQL return entire password column.
Inturn, PHP check will fail at line #2.

So, you have to make SQL statement return 1 single word, and that should be password which u can match.
Read 11 tweets
Aug 24
#Learn365 - Day 5⃣

CORS Headers. πŸ€”

What are they ? And how they bypass SOP ?

Learn about them in this thread πŸ§΅πŸ‘‡

#infosec #bugbountytips #CORS #http
In last thread, we talked about SOP, while SOP blocks the response, CORS is use to bypass SOP the most sensible way.

CORS is Cross Origin Resource Sharing.

It allows sharing response across different origins possible. Can we call it Bypassing SOP ?

Yes.
Lets say,

Domain A wants to Talk to Domain B for getting some information.

A
Read 7 tweets
Aug 23
#Learn365 - Day 4⃣

SOP 🫧, Same Origin Policy.
A browser security framework that every #hacker should know.

Know what is it in this thread πŸ§΅πŸ‘‡

#infosec #security #appsec #cybersecurity #SOP #http Image
SOP is browser security model, and I find lot of folks out there, who still dont understand it in and out.
Let me cover it here, in few threads.

Let's Start.
It is a browser security model πŸ”₯. Now what does that means ?
It simply means this control is enforced by browser to make user visiting a site more secure from attackers.

Browser creates virtual boundaries to segregate sites and this boundary is identified with ORIGINS.
Read 9 tweets
Jul 30
πŸ“„ I have reviewed nearly 250+ resume for security engineering role in my company, recently !!

πŸš€Below are few suggestions for a good RESUME from hiring perspective.

πŸ§΅πŸ‘‡

#infosec #security #InfoSecJobs #resume
Header
↓
Summary
↓
Work Exp
↓
A Section for Books, Patents, Blogs, OSS, Certs Etc
↓
Your Skill relevant to job you are applying.
↓
Awards & Recognition
↓
Educational Qualifications (Last thing I care for)
↓
Who are you out of work.
πŸͺHeader Section. Keep it short, keep it clear. This is a hook.

Few things to put in header section (Good to have links).
1⃣ Links to Certifications.
2⃣ Public profiles: github, dev, medium, twitter, linkedin etc
3⃣ Info : How to reach you back.
4⃣ Your current role title
Read 12 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(