You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: API Key Leaks/IIS-Machine-Keys.md
+18-23Lines changed: 18 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,6 @@
15
15
*[Edit Cookies With The Machine Key](#edit-cookies-with-the-machine-key)
16
16
*[References](#references)
17
17
18
-
19
18
## Viewstate Format
20
19
21
20
ViewState in IIS is a technique used to retain the state of web controls between postbacks in ASP.NET applications. It stores data in a hidden field on the page, allowing the page to maintain user input and other state information.
@@ -29,26 +28,25 @@ ViewState in IIS is a technique used to retain the state of web controls between
29
28
By default until Sept 2014, the `enableViewStateMac` property was to set to `False`.
30
29
Usually unencrypted viewstate are starting with the string `/wEP`.
31
30
32
-
33
31
## Machine Key Format And Locations
34
32
35
-
A machineKey in IIS is a configuration element in ASP.NET that specifies cryptographic keys and algorithms used for encrypting and validating data, such as view state and forms authentication tokens. It ensures consistency and security across web applications, especially in web farm environments.
33
+
A machineKey in IIS is a configuration element in ASP.NET that specifies cryptographic keys and algorithms used for encrypting and validating data, such as view state and forms authentication tokens. It ensures consistency and security across web applications, especially in web farm environments.
The `validationKey` attribute specifies a hexadecimal string used to validate data, ensuring it hasn't been tampered with.
41
+
The `validationKey` attribute specifies a hexadecimal string used to validate data, ensuring it hasn't been tampered with.
44
42
45
-
The `decryptionKey` attribute provides a hexadecimal string used to encrypt and decrypt sensitive data.
43
+
The `decryptionKey` attribute provides a hexadecimal string used to encrypt and decrypt sensitive data.
46
44
47
-
The `validation` attribute defines the algorithm used for data validation, with options like SHA1, MD5, 3DES, AES, and HMACSHA256, among others.
45
+
The `validation` attribute defines the algorithm used for data validation, with options like SHA1, MD5, 3DES, AES, and HMACSHA256, among others.
48
46
49
47
The `decryption` attribute specifies the encryption algorithm, with options like Auto, DES, 3DES, and AES, or you can specify a custom algorithm using alg:algorithm_name.
50
48
51
-
The following example of a machineKey is from Microsoft documentation(https://docs.microsoft.com/en-us/iis/troubleshoot/security-issues/troubleshooting-forms-authentication).
49
+
The following example of a machineKey is from [Microsoft documentation](https://docs.microsoft.com/en-us/iis/troubleshoot/security-issues/troubleshooting-forms-authentication).
* in the registry when **AutoGenerate** is enabled (extract with https://gist.github.com/irsdl/36e78f62b98f879ba36f72ce4fda73ab)
63
+
* in the registry when **AutoGenerate** is enabled (extract with [irsdl/machineKeyFinder.aspx](https://gist.github.com/irsdl/36e78f62b98f879ba36f72ce4fda73ab))
* [BApp Store > ViewState Editor](https://portswigger.net/bappstore/ba17d9fb487448b48368c22cb70048dc) - ViewState Editor is an extension that allows you to view and edit the structure and contents of V1.1 and V2.0 ASP view state data.
# --modifier = `__VIEWSTATEGENERATOR` parameter value
151
146
# --encrypteddata = `__VIEWSTATE` parameter value of the target application
152
147
```
153
148
154
149
* Then generate a ViewState using [pwntester/ysoserial.net](https://github.com/pwntester/ysoserial.net), both `TextFormattingRunProperties` and `TypeConfuseDelegate` gadgets can be used.
# --validationkey = validation key from the previous command
161
157
```
162
158
163
-
164
159
### MAC Is Enabled And Encryption Is Enabled
165
160
166
161
Default validation algorithm is `HMACSHA256` and the default decryption algorithm is `AES`.
167
162
168
-
If the `__VIEWSTATEGENERATOR` is missing but the application uses .NET Framework version 4.0 or below, you can use the root of the app (e.g: `--apppath="/testaspx/"`).
163
+
If the `__VIEWSTATEGENERATOR` is missing but the application uses .NET Framework version 4.0 or below, you can use the root of the app (e.g: `--apppath="/testaspx/"`).
169
164
170
165
* **.NET Framework < 4.5**, ASP.NET always accepts an unencrypted `__VIEWSTATE` if you remove the `__VIEWSTATEENCRYPTED` parameter from the request
*[Deep Dive into .NET ViewState Deserialization and Its Exploitation - Swapneil Kumar Dash - October 22, 2019](https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
199
194
*[Exploiting Deserialisation in ASP.NET via ViewState - Soroush Dalili - April 23, 2019](https://soroush.me/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
200
195
*[Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net - Claranet - June 13, 2019](https://www.claranet.com/us/blog/2019-06-13-exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserialnet)
201
196
*[Project Blacklist3r - @notsosecure - November 23, 2018](https://www.notsosecure.com/project-blacklist3r/)
202
-
*[View State, The Unpatchable IIS Forever Day Being Actively Exploited - Zeroed - July 21, 2024](https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/)
197
+
*[View State, The Unpatchable IIS Forever Day Being Actively Exploited - Zeroed - July 21, 2024](https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/)
Copy file name to clipboardExpand all lines: Business Logic Errors/README.md
+4-14Lines changed: 4 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,6 @@
2
2
3
3
> Business logic errors, also known as business logic flaws, are a type of application vulnerability that stems from the application's business logic, which is the part of the program that deals with real-world business rules and processes. These rules could include things like pricing models, transaction limits, or the sequences of operations that need to be followed in a multi-step process.
Unlike other types of security vulnerabilities like SQL injection or cross-site scripting (XSS), business logic errors do not rely on problems in the code itself (like unfiltered user input). Instead, they take advantage of the normal, intended functionality of the application, but use it in ways that the developer did not anticipate and that have undesired consequences.
@@ -32,7 +30,6 @@ Common examples of Business Logic Errors.
32
30
* Investigate the possibility of posting reviews impersonating other users.
33
31
* Attempt Cross-Site Request Forgery (CSRF) on this feature, as it's frequently unprotected by tokens.
34
32
35
-
36
33
### Discount Code Feature Testing
37
34
38
35
* Try to apply the same discount code multiple times to assess if it's reusable.
@@ -41,17 +38,14 @@ Common examples of Business Logic Errors.
41
38
* Test for vulnerabilities from missing input sanitization such as XSS, SQL Injection on this feature.
42
39
* Attempt to apply discount codes to non-discounted items by manipulating the server-side request.
43
40
44
-
45
41
### Delivery Fee Manipulation
46
42
47
43
* Experiment with negative values for delivery charges to see if it reduces the final amount.
48
44
* Evaluate if free delivery can be activated by modifying parameters.
49
45
50
-
51
46
### Currency Arbitrage
52
47
53
48
* Attempt to pay in one currency, for example, USD, and request a refund in another, like EUR. The difference in conversion rates could result in a profit.
54
-
55
49
56
50
### Premium Feature Exploitation
57
51
@@ -60,32 +54,28 @@ Common examples of Business Logic Errors.
60
54
* Look for true/false values in requests/responses that validate premium access. Use tools like Burp's Match & Replace to alter these values for unauthorized premium access.
61
55
* Review cookies or local storage for variables validating premium access.
62
56
63
-
64
57
### Refund Feature Exploitation
65
58
66
59
* Purchase a product, ask for a refund, and see if the product remains accessible.
67
60
* Look for opportunities for currency arbitrage.
68
61
* Submit multiple cancellation requests for a subscription to check the possibility of multiple refunds.
69
62
70
-
71
63
### Cart/Wishlist Exploitation
72
64
73
65
* Test the system by adding products in negative quantities, along with other products, to balance the total.
74
66
* Try to add more of a product than is available.
75
67
* Check if a product in your wishlist or cart can be moved to another user's cart or removed from it.
76
68
77
-
78
69
### Thread Comment Testing
79
70
80
71
* Check if there's a limit to the number of comments on a thread.
81
72
* If a user can only comment once, use race conditions to see if multiple comments can be posted.
82
73
* If the system allows comments by verified or privileged users, try to mimic these parameters and see if you can comment as well.
83
74
* Attempt to post comments impersonating other users.
0 commit comments