Security research, field notes, and practical experiments
Independent technical notes by Willis Vandevanter, published in reverse chronological order.
Misconfigured GraphQL implementations can allow for attackers to bypass authorization and access internal APIs. These “secondary context attacks” exploit the gap between GraphQL’s frontend interface and backend REST services, often turning simple path …
The @trickest Inventory project is an interesting resource. It has a massive set of hostnames, live services, spidered URLs, and cloud data organized by Bug Bounty program. There is so much more data than I have interest in storing for my needs. In fact, the …
Edit: 1.1b fixes an auto shutdown issue in burpsuite, I would highly recommend this release over 1.1a. The rest of the post still applies. This is a small release but a useful one. Release 1.1b adds the ability to parse projects for portions of siteMap and …
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the …
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the …
SSRF protocol smuggling involves an attacker injecting one TCP protocol into a dissimilar TCP protocol. A classic example is using gopher (i.e. the first protocol) to smuggle SMTP (i.e. the second protocol): 1 …
I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is to be (1) simple, (2) fast, and (3) work on many platforms with only one dependency – nokogiri. …
Recently ColdFusion was shown vulnerable to XXE based attacks in OXML documents; CVE-2016-4264. The blog post linked gives an example building the file using python; cool! It’s easy to backdoor files in a similar fashion with OXML XXE. The fastest way to do …
Finding hosts or domain names associated with a company where the domain name does not include the name of the company can sometimes be difficult. There are common ways to do it such as ASN or scope information (e.g. bug bounty ToE or IP block). One technique …
Just wanted to post some details from my BH USA 2015 briefing “Exploiting XXE In File Upload Functionality”. https://www.youtube.com/watch?v=LZUlw8hHp44 I also gave an updated version of the presentation in November for the Blackhat Webcast Series. It included …