Day 86/100 Hack and Improvement

less than 1 minute read

Day 86 comes with some readings on HTTP Smuggling and one liner to grab spring boot in shodan!

Hacking companies through help desk

From Rajesh Ranjan. #day86 comes with a simple oneliner to grab spring boot from Shodan…

shodan search org:"YOUR_TARGET_HERE" http.favicon.hash:116323821 --fields ip_str,port --separator "" | awk '{print $1":"$2}' | while read host do ;do ffuf -u https://$host/FUZZ -mc 200 -w spring-boot.txt ;done

where spring-boot.txt is:

env
mappings
info
tarce
metrics
health
autoconfig
beans
configprops
dump
heapdump

Falling In Love with Web Cache Poisoning and HTTP Smuggling attacks

From Sam (CoffeeJunkie). Trying to learn couple attacks and vulns, it didn’t really seem that it was working well. I was unfocused and didn’t really know how to concentrate in one single thing at the time to hunt. An advice given that I took it was just to study and concentrate in three vulnerability types so I can get good at it and replicate it in different scenarios. Well, HTTP Desync attacks just blew me away, therore I’ll be studying and hitting my targets with these vulns.

Here goes an amazing talk from albinowax related to these attacks.

Rengine

via GIPHY

Leave a comment