GitBook: [#2797] pp
This commit is contained in:
CPol
gitbook-bot
parent
c6b5cc40ea
commit
72cbd88461
|
|
@ -377,7 +377,8 @@
|
|||
* [CSRF (Cross Site Request Forgery)](pentesting-web/csrf-cross-site-request-forgery.md)
|
||||
* [Dangling Markup - HTML scriptless injection](pentesting-web/dangling-markup-html-scriptless-injection.md)
|
||||
* [Deserialization](pentesting-web/deserialization/README.md)
|
||||
* [NodeJS - \_\_proto\_\_ & prototype Pollution](pentesting-web/deserialization/nodejs-proto-prototype-pollution.md)
|
||||
* [NodeJS - \_\_proto\_\_ & prototype Pollution](pentesting-web/deserialization/nodejs-proto-prototype-pollution/README.md)
|
||||
* [Client Side Prototype Pollution](pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.md)
|
||||
* [Java JSF ViewState (.faces) Deserialization](pentesting-web/deserialization/java-jsf-viewstate-.faces-deserialization.md)
|
||||
* [Java DNS Deserialization, GadgetProbe and Java Deserialization Scanner](pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.md)
|
||||
* [Basic Java Deserialization (ObjectInputStream, readObject)](pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.md)
|
||||
|
|
|
|||
|
|
@ -136,8 +136,8 @@ For more information about escaping from **pickle jails** check:
|
|||
|
||||
If you want to learn about this technique **take a look to the following tutorial**:
|
||||
|
||||
{% content-ref url="nodejs-proto-prototype-pollution.md" %}
|
||||
[nodejs-proto-prototype-pollution.md](nodejs-proto-prototype-pollution.md)
|
||||
{% content-ref url="nodejs-proto-prototype-pollution/" %}
|
||||
[nodejs-proto-prototype-pollution](nodejs-proto-prototype-pollution/)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### [node-serialize](https://www.npmjs.com/package/node-serialize)
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
# NodeJS - \__proto\_\_ & prototype Pollution
|
||||
# NodeJS - \_\_proto\_\_ & prototype Pollution
|
||||
|
||||
## Objects in JavaScript <a href="053a" id="053a"></a>
|
||||
|
||||
First of all, we need to understand `Object`in JavaScript. An object is simply a collection of key and value pairs, often called properties of that object. For example:
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
In Javascript, `Object`is a basic object, the template for all newly created objects. It is possible to create an empty object by passing `null`to `Object.create`. However, the newly created object will also have a type that corresponds to the passed parameter and inherits all the basic properties.
|
||||
|
||||
|
|
@ -12,7 +12,7 @@ In Javascript, `Object`is a basic object, the template for all newly created obj
|
|||
console.log(Object.create(null)); // prints an empty object
|
||||
```
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
Previously we learned that an Object in javascript is collection of keys and values, so it makes sense that a `null` object is just an empty dictionary: `{}`
|
||||
|
||||
|
|
@ -30,25 +30,25 @@ function person(fullName, age) {
|
|||
}
|
||||
```
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
```javascript
|
||||
var person1 = new person("Satoshi", 70);
|
||||
```
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
## Prototypes in JavaScript <a href="3843" id="3843"></a>
|
||||
|
||||
One thing to note is that the prototype attribute can be changed/modified/deleted when executing the code. For example functions to the class can be dynamically added:
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
Functions of the class can also be modified (like `toString` or `valueOf` the following cases):
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
## Inheritance
|
||||
|
||||
|
|
@ -56,9 +56,9 @@ In a prototype-based program, objects inherit properties/methods from classes. T
|
|||
|
||||
Note that, if you add a property to an object that is used as the prototype for a set of objects (like the myPersonObj), the objects for which it is the prototype also get the new property, but that property is not printed unless specifically called on.
|
||||
|
||||
.png>)
|
||||
.png>)
|
||||
|
||||
## \__proto\_\_ pollution <a href="0d0a" id="0d0a"></a>
|
||||
## \_\_proto\_\_ pollution <a href="0d0a" id="0d0a"></a>
|
||||
|
||||
You should have already learned that** every object in JavaScript is simply a collection of key and value** pairs and that **every object inherits from the Object type in JavaScript**. This means that if you are able to pollute the Object type **each JavaScript object of the environment is going to be polluted!**
|
||||
|
||||
|
|
@ -155,7 +155,7 @@ Imagine that we have a prototype pollution that makes it possible to set `Object
|
|||
|
||||
For example, `obj[a][b] = value`. If the attacker can control the value of `a` and `value`, then he only needs to adjust the value of `a`to `__proto__`(in javascript, `obj["__proto__"]` and `obj.__proto__`are completely equivalent) then property `b` of all existing objects in the application will be assigned to `value`.
|
||||
|
||||
However, the attack is not as simple as the one above, according to [paper](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf), we can only attack when one of the following three conditions is met:
|
||||
However, the attack is not as simple as the one above, according to [paper](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript\_prototype\_pollution\_attack\_in\_NodeJS.pdf), we can only attack when one of the following three conditions is met:
|
||||
|
||||
* Perform recursive merge
|
||||
* Property definition by path
|
||||
|
|
@ -516,10 +516,9 @@ requests.get(TARGET_URL)
|
|||
|
||||
## Client-side prototype pollution to XSS
|
||||
|
||||
* [https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution)
|
||||
* [https://github.com/BlackFan/client-side-prototype-pollution](https://github.com/BlackFan/client-side-prototype-pollution)
|
||||
|
||||
You can also use the tool [**https://github.com/dwisiswant0/ppfuzz**](https://github.com/dwisiswant0/ppfuzz?tag=v1.0.0) to try to find this kind of vulnerabilities.
|
||||
{% content-ref url="client-side-prototype-pollution.md" %}
|
||||
[client-side-prototype-pollution.md](client-side-prototype-pollution.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## What can I do to prevent?
|
||||
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
# Client Side Prototype Pollution
|
||||
|
||||
## Discovering using Automatic tools
|
||||
|
||||
The tools [**https://github.com/dwisiswant0/ppfuzz**](https://github.com/dwisiswant0/ppfuzz?tag=v1.0.0) and [**https://github.com/kleiton0x00/ppmap**](https://github.com/kleiton0x00/ppmap)** **can be used to find prototype pollution vulnerabilities. And there is an easy way to once they found the vulnerabilities **discover where is the vulnerable code**:
|
||||
|
||||
* Using one of the tools **find a vulnerability** and get a **payload** that will **set a property** in the constructor. In ppmap you will be given something like: `constructor[prototype][ppmap]=reserved`
|
||||
* Now, set a **breakpoint in the first line of JS code** that is going to be executed in the page, and refresh the page with the payload so the **execution is paused there**.
|
||||
* While the JS execution is paused **paste the following script in the JS console**. This code will indicate once the property 'ppmap' is created, so you will be able to find where it was created.
|
||||
|
||||
```javascript
|
||||
function debugAccess(obj, prop, debugGet){
|
||||
|
||||
var origValue = obj[prop];
|
||||
|
||||
Object.defineProperty(obj, prop, {
|
||||
get: function () {
|
||||
if ( debugGet )
|
||||
debugger;
|
||||
return origValue;
|
||||
},
|
||||
set: function(val) {
|
||||
debugger;
|
||||
return origValue = val;
|
||||
}
|
||||
});
|
||||
|
||||
};
|
||||
|
||||
debugAccess(Object.prototype, 'ppmap')
|
||||
```
|
||||
|
||||
### Finding the root cause of Prototype Pollution <a href="5530" id="5530"></a>
|
||||
|
||||
Go back to **Sources** and click “Resume script execution”. After you do that, the whole javascript will be executed and ppmap will be polluted again as expected. With the help of the Snippet we can find where exactly the ppmap property is polluted. We can click on the Call Stack and you will face different stacks where the pollution happened.
|
||||
|
||||
But which one to choose? Most of the time Prototype Pollution happens on Javascript libraries, so aim for the stack which is attached to the .js library files (look at the right side just like in the image to know which endpoint the stack is attached to). In this case we have 2 stacks on line 4 and 6, logically we will choose the 4th line because that line is the first time where Pollution happens, which mean that this line is the reason of the vulnerability. Clicking on the stack will redirect us to the vulnerable code.
|
||||
|
||||
|
||||
|
||||
This trick was taken from [https://infosecwriteups.com/hunting-for-prototype-pollution-and-its-vulnerable-code-on-js-libraries-5bab2d6dc746](https://infosecwriteups.com/hunting-for-prototype-pollution-and-its-vulnerable-code-on-js-libraries-5bab2d6dc746) for access it for more information.
|
||||
|
||||
## Recompilation of payloads for vulnerable libraries
|
||||
|
||||
* [https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution)
|
||||
* [https://github.com/BlackFan/client-side-prototype-pollution](https://github.com/BlackFan/client-side-prototype-pollution)
|
||||
|
|
@ -112,7 +112,7 @@ setTimeout(function(){w.postMessage('text here','*');}, 2000);
|
|||
|
||||
In scenarios where the data sent through `postMessage` is executed by JS, you can **iframe **the **page **and **exploit **the **prototype pollution/XSS **sending the exploit via `postMessage`.
|
||||
|
||||
A couple of **very good explained XSS though `postMessage`** can be found in [https://jlajara.gitlab.io/web/2020/07/17/Dom_XSS_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom_XSS_PostMessage\_2.html)
|
||||
A couple of **very good explained XSS though `postMessage`** can be found in [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)
|
||||
|
||||
Example of an exploit to abuse** Prototype Pollution and then XSS** through a `postMessage` to an `iframe`:
|
||||
|
||||
|
|
@ -134,11 +134,11 @@ Example of an exploit to abuse** Prototype Pollution and then XSS** through a `p
|
|||
|
||||
For **more information**:
|
||||
|
||||
* Link to page about [**prototype pollution**](deserialization/nodejs-proto-prototype-pollution.md)****
|
||||
* Link to page about [**prototype pollution**](deserialization/nodejs-proto-prototype-pollution/)****
|
||||
* Link to page about [**XSS**](xss-cross-site-scripting/)****
|
||||
* Link to page about [**client side prototype pollution to XSS**](deserialization/nodejs-proto-prototype-pollution.md#client-side-prototype-pollution-to-xss)****
|
||||
* Link to page about [**client side prototype pollution to XSS**](deserialization/nodejs-proto-prototype-pollution/#client-side-prototype-pollution-to-xss)****
|
||||
|
||||
## References
|
||||
|
||||
* [https://jlajara.gitlab.io/web/2020/07/17/Dom_XSS_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom_XSS_PostMessage\_2.html)
|
||||
* [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)
|
||||
* [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd)
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ If the introduced data may somehow being reflected in the response, the page mig
|
|||
* [ ] ****[**Dangling Markup**](dangling-markup-html-scriptless-injection.md)****
|
||||
* [ ] [**File Inclusion/Path Traversal**](file-inclusion/)****
|
||||
* [ ] [**Open Redirect**](open-redirect.md)****
|
||||
* [ ] ****[**Prototype Pollution to XSS**](deserialization/nodejs-proto-prototype-pollution.md#client-side-prototype-pollution-to-xss)****
|
||||
* [ ] ****[**Prototype Pollution to XSS**](deserialization/nodejs-proto-prototype-pollution/#client-side-prototype-pollution-to-xss)****
|
||||
* [ ] [**Server Side Inclusion/Edge Side Inclusion**](server-side-inclusion-edge-side-inclusion-injection.md)****
|
||||
* [ ] [**Server Side Request Forgery**](ssrf-server-side-request-forgery.md)****
|
||||
* [ ] [**Server Side Template Injection**](ssti-server-side-template-injection/)****
|
||||
|
|
|
|||
Loading…
Reference in New Issue