Tricky Oracle SQL Injection Situation

Recently I learnt few new stuff when solving SQL Injection found during pentest and also bugbounty. One of the new technique that seems new to me is the one that I learnt from my master, pokleyzz. This injection was found in a recent bugbounty program and the actual path/parameter were replaced.

The injection was found on the "idNumber" parameter of the following endpoint

/foo/?theName=YAP&idNumber=248001[here]

Common payloads were performed on this target and initially, I found the following payloads were working to identify TRUE/FALSE condition

/foo/?theName=YAP&idNumber=248001'+AND+'1'='1 TRUE
/foo/?theName=YAP&idNumber=248001'+AND+'2'='1 FALSE 

and also able to use pipe operator too

/foo/?theName=YAP&idNumber=248'||'001 TRUE
/foo/?theName=YAP&idNumber=24'||'8'||'001 TRUE
/foo/?theName=YAP&idNumber=24'||'X'||'001 FALSE

With these conditions, I was able to narrow down the database used by this application to Oracle, PosgreSQL, IBM DB2 or Informix.

At first, I thought this can be done using the same technique that I know:

See : https://blog.yappare.com/2012/04/advance-oracle-blind-sql-injection.html

However, the CASE() was not working. After few attempts, I stopped to figure out on using CASE(). Next, this technique was tried:

See: https://blog.yappare.com/2017/03/blind-sql-injection-in-erim-not-sure.html

No joy. Dead end. After almost two days of trying, I give up doing it myself and ask helps from few friends.
No luck. I tried my last option, pokleyzz. In just less than an hour, he showed me the technique that can be used.

/foo/?theName=YAP&idNumber=248'||<bruteforce any known SQL functions here>||'001

As a result, I found "rownum" was accepted and this indicates the DBMS is Oracle. To reconfirm, the following was queried:

/foo/?theName=YAP&idNumber=24800'||rownum||'

The above payload result in the website displayed list of "theName" product that starts with "idNumber" 24800

Interesting! Now how we can at least extract data from this injection? Another blocker was identified. It seems the application filtered/replaced the following characters

_ ( ) + . whitespaces

While I found this seems another dead end, pokleyzz showed another brilliant way to extract the data using the following payload:

 /foo/?theName=YAP&idNumber=248'||<bruteforce all column_name here>||'001 - We found few column names which one of it was "username"

Then final step was:

 /foo/?theName=YAP&idNumber=248001'and''||username||''like'<bruteforce-character>%

 I ran the Intruder on the above attacking point and voila, got the username 😼

As always, pokleyzz is the best master I have. 💻

Bye.

BUG-000114489 : SSRF in Portal for ArcGIS Leaking NTLMv2 Hashes

This was found and responsibly disclosed to the ArcGIS team last year. Issue was given BUG id 000114489 and patch has been released.

TL;DR

The attacking point can be captured from ArcGis Portal that located at /home/webmap/viewer.html

Bug Bounty : Account Takeover due to a Misconfiguration

First of all, I would like to thanks Bugcrowd's analyst especially beemo_bugcrowd for patiently updating the issue during the validation process.

Fiat Chrysler Automobiles announced their public bug bounty program through Bugcrowd in July 2016. More details can see it here: https://bugcrowd.com/fca
As always, I will try to poke around to see how many of the reports are currently being handled by the Bugcrowd for this program as if there are too many crowd, usually I will opt out from it. And the result, yes, there are lot of them especially XSS and CSRF issues. That was the reason these two issues immediately excluded to allow analyst team to filter out them.

I'm targeting Mopowerconnect.

Mopowerconnect

Due to that, I try to look on the other angle and I noticed something which is weird in my view which is the way account was created in Mopowerconnect (was in scope but now excluded). Why? Please refer the figure below:

Authentication process

*this is just based on my observation and own hypothesis during the testing.

To detail the figure above:

1. When a user creates an account at Mopowerconnect, the request will be sent to Chrysler to generate the authorisation and then at the same time will create another independent account which only be used by Sharepoint.
2. Means, if you create User1 at Mopowerconnect, Chrysler will processing it and provide you with the authorisation for Mopowerconnect as User1, and at the same time it will create another account for you which is to be used in Sharepoint, assume as UserS1.

How do I know there's a Sharepoint at the backend? This is because there's a misconfiguration which allow an attacker to directly access that framework through URL such as /_catalogs/masterpage/etc/etc . I first submit the misconfiguration issue, it was a dupe. Then I went to look around this Sharepoint pages to understand why it exist. There I noticed that, I'm browsing the Sharepoint pages using UserS1 account, not User1. 

Sharepoint UI

I went back to check on my Burp HTTP history to look on all of the responses. Then I found the request and the parameter that supply my another account, UserS1. It was weird to see there are two types of ID on the request.

Request made at Chrysler

 Then I created another testing account to double verify my hypothesis. And it is proven. At this point, I still can't think what's the best scenario I can do. Then, the idea came in. What if I try to reverse the process? Reset the password :)

The request when resetting the password looks similar. Thru Mopowerconnect UI you request to reset the password, then Chrysler will process it and send the information to the Sharepoint to be updated. Interesting.

Again, I reset the password but this time I've modified one of the value before Chrysler send it to the Sharepoint which is PRF_UID. I changed it into my second account and voila! The account was compromised :)

Combining with the issues due to the misconfigured access to the Sharepoint, I'm able to enumerate list of PRF_UID belongs to another users including the admin. And yes, I can takeover the admin's account as well.

Submitted to Bugcrowd, and it is not smooth as I assume because the request was actually being made at Chrysler domain which is out of scope. I knew that but since the issue is considered as Critical, I kept on insist them to forward the report to the client and let FCA themselves decide on this. Two different analysts reviewed the report and marked as Out of Scope. I was at the point to give up until I made a decision to email the issue to the FCA team myself. I used the Bugcrowd's support medium to deliver the message to the FCA team and also did ping another technical team from Bugcrowd to re-review it.

A week later, 

FCA team replied

 At a month later, the issue was fixed!

Fixed!

Thanks!

HQL Injection on Web Application Running Oracle Database

Hi,

Recent pentest encountered me with an application that it seems at first glance to vulnerable to SQL Injection as the common test usually I tested shows some firm behavior.

https://site.yappare/index.jsp?id=1' error

https://site.yappare/index.jsp?id=1'' no error / normal page

I believe this should be an Oracle SQL Injection after few tests. However, no result! SQLMap shows that this can be exploited via Time-Based but also no success at the end. During the fuzzing, an error message triggered as shown:

 Googling the error message pointing me to result as shown:

So, my initial understanding is slightly wrong. I should focus on Hibernate. Did some reading and looking for any good references for Hibernate Injection. These links really help me.

http://blog.h3xstream.com/2014/02/hql-for-pentesters.html

http://paulsec.github.io/blog/2014/05/05/blind-hql-injection-in-rest-api-using-h2-dbms/

After understand a little bit on how to do the injection. Did it via Blind technique as described by Paulsec, and voila! able to dump the current Hibernate version.

https://site.yappare/index.jsp?id=1') and substr(org.hibernate.cfg.Environment.VERSION,0,1)=’n' and ('1'='1

where n is actually numbers/characters that we are querying for.

Hibernate version 3.0.2

This is not enough to demonstrate the impact. Tried to read about hibernate/orm structure it seems they are using prepared statement query. I'm not able to get any clue how to query the database information. It'll be harder to me. Luckily Mikhail Egorov and Sergey Soldatov recent presentation helps me!

http://2015.zeronights.ru/assets/files/36-Egorov-Soldatov.pdf

It is possible to query a standard injection via DBMS_XMLGEN.getxml(‘SQL’) for Oracle dbms.

and Voilaa!! 

https://site.yappare/index.jsp?id=1') and NVL(TO_CHAR(DBMS_XMLGEN.getxml('Boolean Blind SQL Injection') and ('1'='1

Thanks!

Reference(s)

• http://blog.h3xstream.com/2014/02/hql-for-pentesters.html
• http://paulsec.github.io/blog/2014/05/05/blind-hql-injection-in-rest-api-using-h2-dbms/
• http://howtodoinjava.com/2014/10/27/complete-hibernate-query-language-hql-tutorial/#select_operation
• http://hsqldb.org/doc/guide/builtinfunctions-chapt.html
• http://kitkatsatonthemat.blogspot.my/2011/09/oracle-order-by-sql-injection.html
• http://2015.zeronights.ru/assets/files/36-Egorov-Soldatov.pdf

Referrer Leakage from HTTPS to HTTPS

From my recent bounty program participation, I failed to find any awesome bug for the whole bounty period. Requiring me to have an iOS9 to perform the full application test also one of the disadvantage as I don't own any Apple product :(

Then, I tried to look for any low hanging fruits on the application. Gotcha! HTTP Referrer Leakage!
When the password reset token provided to the user - after they reset - usually it'll come in a Hyperlink format where there are two ways for the user to use it. Either directly click on it or safely copy and pasted it in the browser.

I choose the second option in order to demonstrate the reset token is leaked to another external URL. And as can see in the figure below, the reset token actually being sent to the newrelic.com website.

Submitted this issue to the program's owner and the analyst responded that this is an issue that in 'Won't Fix' category. The first reason I obtained was it is because the referrer leaked from HTTPS to another HTTPS.
This is what actually hit something on my mind. I never thought about this before. Is the HTTP Referrer will not be logged by the external URL if both are using HTTPS?
With a help from my friend, we tried to simulate the situation. There are two cases. One from HTTPS to HTTP, the second one from HTTPS to HTTPS.


Doing some research  and found that, it is NOT!

Test Cases

HTTPS to HTTP will not leak the referrer

HTTPS to HTTPS will leak the referrer

By summary:

• HTTP Referrer will not be leaked to another URL if it is transmitted from HTTPS to HTTP. 
• HTTP Referrer will  be leaked to another URL if it is transmitted from HTTPS to HTTPS. 

So I get back to the bounty program to ask for review the submission again. Another staff replied with a better explanation why they consider this as a 'Won't Fix' issue. The reason are any of these:

(1) the impact is too low to qualify for a reward 

(2) a prerequisite to exploit the issue is heavy social engineering 

(3) a prerequisite to exploit the issue is being a man-in-the-middle or having theoretical access to a separate restricted resource

 So I believe the 1st reason is the suitable for this situation as the reset token in this case only one-time usable. The situation for an account to get reset via this issue is really rare by looking on the likelihood of it to happen. Furthermore, MiTM attack would not help in this case as the request is transmitted over SSL.

Nevertheless, no harm to submit the issue as they're are certain program that accepting this issue as a minor flaw and got rewarded.

• https://hackerone.com/reports/738
• https://hackerone.com/reports/13557
• https://hackerone.com/reports/5691
• https://hackerone.com/reports/47140

Reference(s)

1. https://isc.sans.edu/diary/When+does+your+browser+send+a+%22Referer%22+header+(or+not)%3F/16433
2. http://smerity.com/articles/2013/where_did_all_the_http_referrers_go.html
3. http://stackoverflow.com/questions/323200/is-an-https-query-string-secure
4. https://www.ietf.org/rfc/rfc2616.txt

Using HEAD to optimize Time Based SQL Injection

Was conducted a application pentest on a client site and found that the website is vulnerable to SQL Injection. The DBMS is MS SQL Server.

The problem:

1. There's a some sort of WAF or keyword filter looking for common SQLi payload such as 1 or 1=1 etc.
2. Only successful test was via Time Based, but the page doesn't load with a consistent time pattern which  affects the result. 
3. Automated tools doesn't help.
4. Burpsuite able to exfiltrate the IP address via DNS request but I have no external domain to test it manually. (eventually after found a way to exfiltrate via DNS, the result obtained seems different from Burpsuite)

Solution:

• My friend suggesting me to use HEAD then to ignore the content as it is the reason why the page doesn't have a consistent time response.
• Doing a some read on it and it works!

Change the method into HEAD at Burpsuite

Response now have a consistent pattern

• Time to run SQLMap then. So, is there an option to use HEAD in SQLMap? Yes it is. --null-connection
• However, SQLMap seems can't recognize it and the scan went failed. Probably I used a wrong options.
• Now, how we can we obtained the result faster and reliable without performing it manually. Burpsuite have the answer :) 
• We can use the Burpsuite to dump the information via Time Based SQLi technique. 

•  What we need to do just :

1. Change our Burpsuite's Timeout response to a value before our payload's value end. Example we want to delay the request for 10 seconds, so the value inside our Burpsuite should be 9 seconds.
   
   
   
2. Set our intruder and make sure the request still via HEAD.
3. Payload will be similar like 1;1'+if+((substring((@@version),§1§,1)))='§a§')+waitfor+delay+'0:0:10'—
4. Use Cluster Bomb for the Attack type in our intruder so we can have two different attack payloads in Burpsuite.
5. 1st payload type will be configured to use Number while the 2nd payload type should be alphanumerics and depends on you either to include special characters or not.
6. Run the intruder :)
7. We will have few results that have no status and length. That's actually the characters we are looking for. It became like that because the page will responded to TRUE and delay for 10 seconds. As we already configured to let our Burpsuite to have a timeout at 9 seconds, thus there'll be no result on it.
8. Organized the result from our intruder and we can see our desire output :)

Thanks!

References :

• https://funoverip.net/2010/12/blind-sql-injection-detection-with-burp-suite/
• https://depthsecurity.com/blog/blind-sql-injection-burpsuite-like-a-boss
• http://www.wisec.it/sectou.php?id=472f952d79293
• https://github.com/sqlmapproject/sqlmap/wiki/Usage

Whitelisting goes wrong

This summary is not available. Please click here to view the post.

Youtube - Stored XSS Strikes Back!

Hi,

Remember above picture? Most of you might thought its an XSS vulnerability in Gmail, sad to say it is not.haha..The bug actually exist in Youtube Api. Yes, similar to my previous post Yay the Nay in Youtube, this bug also came from the same Youtube Api.

The vulnerable parameter was track's name. Interesting part is, if you try to use XSS payload directly as track's name, it won't working. An error will appear saying you're trying to use special characters that are not allowed.

But due a glitch occur in this section, I was able to change the track's name by using "edit" function. By directly replay the request or tamper it, I can change the old_name into a new name with my XSS payload as shown below.

Once saved, the XSS successfully stored in my video. So does it mean if you watch the video from www.youtube.com it'll executed? Sadly, no. However, the XSS can be executed in Gmail, Google Docs/Presentation and Google Plus. This is because the video will be played using Google's player that was affected with this vulnerability.

Simple right?
Till next time,adios!

@yappare

10 January 2013 : Reported to Google
11 January 2013 : Received notification from Aleksandr, Google Security Team
12-14 January 2013 : Bug noticed was fixed around this date.
15 January 2013 : Received email regarding reward
22 January 2013 : Confirmation of fix from Google's team.


#edit: Prakhar my friend said that this XSS actually execute on youtube main domain as well since he was double check for me on that day and it work in www.youtube.com. sadly I dont have the screenshot as a proof

Again, from Nay to Yay in Google Vulnerability Reward Program!

Happy new year to everyone. This is my first post for 2014.

On 9th January 2014, I posted this on my twitter

https://twitter.com/yappare/status/421470672330571777/photo/1

So is this post related to that? Will get to it soon or probably next month.haha..

In this post I'm going to share to you a bug that manage me to be inside  Google Vulnerability Reward Program G+ Community here

The bug is a Self Stored XSS in Youtube. Yerp..

Let us see how the XSS exist.

1. In Youtube video manager, there's a function for a user to create Captions for his/her video(s).
2. Put our XSS payload in the script box and save.
3. Once we play the video, our XSS will be executed.
4. Check on below screenshots :)

But..there's a problem! The XSS only executing in Caption's Video Manager. Which in other word the XSS is only stored for that user only.

Hmmm...

There's must be a way to exploit or to manipulate this vulnerability. Last time I managed to find a way to Yaying this Nay in Google Adwords. You guys can check on it http://c0rni3sm.blogspot.com/2013/12/google-adwords-stored-xss-from-nay-to.html

I browsed a few times to see is there any share or embed function in this Captions thing. And then..

                                         

I noticed that, there's a function where a user can request for a translation from 3rd party or other users. So how this function working?

1. User request for his/her video for a translation.
2. User able to choose either from 3rd party or by other Google Users.

Manipulating time.Let assume that, there's a community for English series, Movies, Korean dramas that have some translator for Youtube's caption..and among them, there's an attacker >: )

1. Attacker will received the invitation.
2. Attacker put his/her evil code in the middle of translations.
3. Send to the requester for approval.

Once done, the requester will get an email notification and what she/he need to do is review the translated caption and approve it. So what happen next? The XSS will be executed 

and

Till next time, adios!

@yappare

03 December 2013 - Reported via VRP form

07 December 2013 - Received a reply from Martin,Google Security Team

07 December 2013 - Google Team asked for more information to reproduce

08-10 December 2013 - Fixed around these dates.

11 December 2013 - Received a reward email from Google

10 January 2014 - Kevin,Google Security Team confirmed the fix.

XSS in Google Local

Hi,

Quite lazy but still want to share among you guys. No use for me to keep it up for myself.

URL : http://www.google.com/local/add
Bug  : XSS,probability Stored XSS

The vulnerability exist in the Video attachment. If you guys use the double quotes (") in this form, it wont work. Double quotes already filtered.

However, the youtube's href point is using single quote and this character is not filtered.
Moreover, this youtube's link is located in a few usefull tag such as <a href=> <video src=> and some others.

Payload used: youtube.com/watch?v=blalala');alert(1);('a

thanks,
@yappare

Your Gmail Account Can Be Owned IF...

Heyya..wassup..here's another sharing from me.

This issue was found accidentally when I tried to make a testing Gmail account..from that event, I noticed that, your Gmail can be owned EASILY without any technical skill needed.

Before proceed with the full disclosure, two questions for you.
1 - Did you used your gmail in a shared network? (internal office,internet cafe,airport wifi,hotel,others?)

Image from www.itp.net

2 - Did you forgot to enable your 2nd authentication or security question?

Image from http://sondreb.com

If your answer for both of these questions is YES, just keep calm and rilex when your account got compromised. Is this a bug?An issue? In Google's Security Team opinion, NO. This is what Google use for their account recovery process.

Proof of Concept
paswedtest@gmail.com was created without any security question. In a same network with an attacker (***@gmail.com), this guy logged into his Gmail.

So what happen when you logged into your account? See below.

Is this related? Yeah. Lets check when we try to recover an account.

Above is the first hint. Recover using your recent device..so, is it possible to recover an account using a HP computer when I was logged using ACER computer yesterday?? YES. The recovery process never check on the device, but the truth is they check on the User-Agent. (based on few testing by me and my friends) 

Lets proceed.

Put our email (where we want the recovery link send to) as shown above. Do it need to be related with the account? NO.

auw crap!! I dont know any of these! Read the statement, you dont need the answer. Just close your eyes and put it randomly. The process would not check on it at all!

Auww!! another crap! Guy,chillex..Just choose "Skip these questions". This section is just for decoration.

This? Another decoration. No need to fill them. Just submit. But wait! Look on the half-blur text..something related with IP..yeah..this recovery need the IP. So is it necessary to use the same IP used during login? (e.g. 1.1.1.1).. from our testing, it can be recovered in 1.1.1.2, 1.1.1.99 too as long it still under a same segment.

Easy? Yeah so easy :)

For those using a shared network (school,library,hotel,airport,cafe,office,etc)..Good luck with your hunting

Owh wait. Did I report this to Google Team? Yes. Their response(s)

chio!