https://netsec.expert/posts/ Recent content in Posts on Sam's Hacking Wonderland Hugo -- gohugo.io en the@netsec.expert (Sam Anttila) the@netsec.expert (Sam Anttila) ©{year} Thu, 04 Nov 2021 20:17:00 +0100 weekly https://netsec.expert/posts/automating-dom-xss/ Thu, 04 Nov 2021 20:17:00 +0100 the@netsec.expert (Sam Anttila) Thu, 04 Nov 2021 20:17:00 +0100 https://netsec.expert/posts/automating-dom-xss/ This article is a brief introduction to static analysis tools to hunt for client-side web vulnerabilities while giving some examples of ways I’ve successfully employed it so you can have fun with these tools too. What’s this about static analysis anyway? Static analysis is different from dynamic analysis (e.g., black-box testing with Burp). It never actually runs any code or depends on any running processes but instead parses raw source code. Sam Anttila bug hunting web development vulnerabilities https://netsec.expert/posts/mitigation-schmitigation-xss-and-httponly/ Mon, 16 Aug 2021 20:02:11 +0100 the@netsec.expert (Sam Anttila) Mon, 16 Aug 2021 20:02:11 +0100 https://netsec.expert/posts/mitigation-schmitigation-xss-and-httponly/ Did you know the ‘HttpOnly’ cookie attribute, intended to make it so that JavaScript can not read or write a particular cookie, is more of a handwavy suggestion than a requirement? It’s true. In the modern version of Chrome, regardless of the underlying OS, you can overwrite cookies with HttpOnly set. If you’ve been around long enough in web security or perhaps dug deep into the literature on web attacks, you might know this as ‘cookie jar overflow’, ‘cookie overflow’ (my favorite because it sounds delicious), or ‘cookie forcing’, because it’s really not a new attack. Sam Anttila bug hunting vulnerabilities web https://netsec.expert/posts/fuzz-the-unfuzzable/ Tue, 10 Aug 2021 16:12:30 +0200 the@netsec.expert (Sam Anttila) Tue, 10 Aug 2021 16:12:30 +0200 https://netsec.expert/posts/fuzz-the-unfuzzable/ Fuzzers are awesome! You write ‘em, set ‘em up and run ‘em… and out come delicious fun bugs! (The bugs are a guarantee – your skill will determine if it’s in your fuzzer or the target application) What I feel is less talked about is that fuzzing doesn’t have to be about finding crashes in binaries to yield cool results (You don’t even have to like binary exploitation! I don’t!), and stuff that won’t crash or aren’t binaries are far from “unfuzzable”; they just need a different approach. Sam Anttila bug hunting vulnerabilities fuzzing https://netsec.expert/posts/xss-in-2021/ Sun, 07 Feb 2021 12:00:00 +0000 the@netsec.expert (Sam Anttila) Sun, 07 Feb 2021 12:00:00 +0000 https://netsec.expert/posts/xss-in-2021/ It’s been a year since my last XSS cheatsheet, and a year of developments in XSS exploitology. Here’s a new and updated version jam-packed full of goodies that I use myself! Note: This cheat-sheet focuses on up to date and relevant items only. Would you take a cheat sheet with you to an exam that has a bunch of irrelevant stuff? No, of course not. I hate cheat sheets that Sam Anttila bug hunting vulnerabilities cheatsheet https://netsec.expert/posts/escape-dependency-hell-with-hugo/ Sun, 31 Jan 2021 11:31:28 +0100 the@netsec.expert (Sam Anttila) Sun, 31 Jan 2021 11:31:28 +0100 https://netsec.expert/posts/escape-dependency-hell-with-hugo/ The problem I really want to highlight something most people don’t discuss in depth when picking what technology stacks to use for their static website, something I’ve had to deal with frequently when writing for this site, and something that I found that Hugo was the only reasonable solution to. Dependencies. st=>start: Site para=>parallel: Site Generator op1=>operation: Dependency 1 op2=>operation: Dependency 2 op3=>operation: Dependency 3 st->para(path1,bottom)->op1->op3 st->para(path2,right)->op2->op3 Here’s a real-life scenario for you: Sam Anttila tech misc development https://netsec.expert/posts/breaking-python3-eval-protections/ Sat, 16 Jan 2021 20:02:11 +0100 the@netsec.expert (Sam Anttila) Sat, 16 Jan 2021 20:02:11 +0100 https://netsec.expert/posts/breaking-python3-eval-protections/ Today I’m presenting you some research I’ve done recently into the Python 3 eval protections. It’s been covered before, but it surprised me to find that most of the info I could find was only applicable for earlier versions of Python and no longer work, or suggested solutions would not work from an attacker perspective inside of eval since you need to express it as a single statement. Since these break every so often, I’ve gone to some length to describe how I arrived at my conclusions to hopefully proverbially ‘teach you how to fish’ so you can work out your own technique should any of the exact solutions I arrived at break in the future. Sam Anttila https://netsec.expert/posts/write-a-crypter-in-any-language/ Thu, 06 Feb 2020 12:00:00 +0000 the@netsec.expert (Sam Anttila) Thu, 06 Feb 2020 12:00:00 +0000 https://netsec.expert/posts/write-a-crypter-in-any-language/ Writing a 100% evasion crypter Today I will be showing you how to write your own crypter in any language you want. I will be using an earlier in-development version of my recently released free and open-source PowerShell crypter Xencrypt as the basis for my examples (and that’s the tool you see in action in the screenshot above) as I walk you through how to design and implement your own crypter. Sam Anttila tradecraft evasion https://netsec.expert/posts/xss-in-2020/ Sat, 01 Feb 2020 12:00:00 +0000 the@netsec.expert (Sam Anttila) Sat, 01 Feb 2020 12:00:00 +0000 https://netsec.expert/posts/xss-in-2020/ I dislike most XSS cheat sheets out there. Many attempt to be copy-and-paste sources (and never clean up things that stopped working 10 years ago) while ignoring that in most instances where you’re doing more difficult than trivial injection literally none of it will work for one reason or another (be it WAF or a XSS filter), and if it is trivial XSS then you just need one vector and not a million. Sam Anttila bug hunting vulnerabilities cheatsheet https://netsec.expert/posts/getting-detected-by-edrs/ Sat, 11 Jan 2020 12:00:00 +0000 the@netsec.expert (Sam Anttila) Sat, 11 Jan 2020 12:00:00 +0000 https://netsec.expert/posts/getting-detected-by-edrs/ Background Recently I had the opportunity to play around with EDRs and test what works and doesn’t. What struck me is just how many behaviours and actions EDRs actually monitor for, and that unfortunately (for red team at least) most tools are not at all developed to combat the level of monitoring that EDRs provide. Below, I’ve compiled the most common reasons why the tools and payloads I tested were getting flagged as malicious and suspicious by EDRs so that you can hopefully also learn from my experiences. Sam Anttila tradecraft evasion https://netsec.expert/posts/xss-through-svg/ Thu, 09 Jan 2020 12:00:00 +0000 the@netsec.expert (Sam Anttila) Thu, 09 Jan 2020 12:00:00 +0000 https://netsec.expert/posts/xss-through-svg/ The button below will write the following SVG image to the page (remember: SVG files are just code): alert("XSS through SVG"); "');"Load SVG file 1 2 3 4 5 6 7 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"> <circle cx="50" cy="50" r="48" fill="none" stroke="#000"/> <path d="M50,2a48,48 0 1 1 0,96a24 24 0 1 1 0-48a24 24 0 1 0 0-48"/> <circle cx="50" cy="26" r="6"/> <circle cx="50" cy="74" r="6" fill="#FFF"/> ***<script>alert("XSS through SVG");</script>*** </svg> Which when loaded will trigger the XSS payload marked above. Sam Anttila minitips vulnerabilities