Share The-Power-Of-Recon

THE POWER
OF
RECON
OrwaGodfahter
ABOUT ME
• Orwa Atyat (OrwaGodfather) from Jordan
• Full time bug hunter
(Starting bug bounty 2020)
• Bugcrowd P1 Warrior Rank: Top 3
• 500+ critical/high bug submitted
• HOF: Meta / Google / Microsoft / Apple
• Hack Cup Winner 2022/2023 & Team Captain
• 10+ 0Days/CVEs
Microsoft IIS Testing
Response Manipulation
Methods &Tips
IIS
screenshot
screenshot
screenshot
screenshot
screenshot
Microsoft IIS tilde directory enumeration

this vulnerability allow to detect short names of files and directories in IIS app by using
some vectors in several versions of Microsoft IIS.
as an attacker can find important files and folders that they are not normally visible.
Next parts in IIS

Discovering , Tools , Wordlist for fuzzing , Testing , Tips
Last part in IIS

Example for critical bugs…..
IIS
screenshot
screenshot
screenshot
screenshot
screenshot
Discovering
1) Nuclei Template
nuclei-templates/fuzzing/iis-shortname.yaml
https://github.com/projectdiscovery/nucleitemplates/blob/d6636f9169920d3ccefc692bc1a6136e2deb9205/fuzzing/iis-shortname.yaml
2) Wappalyzer extenstion
IIS
screenshot
screenshot
screenshot
screenshot
screenshot
Discovering
3) Shodan  http.title:"IIS"
Company dork
Ssl:"Bsides Ahmedabad Inc." http.title:"IIS"
Host dork
Ssl.cert.subject.CN:"bsidesahmedabad.in" http.title:"IIS"
IIS
Tools For Testing
1) IIS Tilde Enumeration (Burp Extension)

2) Shortscan tool Github
[to detect short names of files and directories]
3) JetBrains dotPeek
[to analyze files such as dll file and export the source of that file]
4) visual studio code
[for read/review the code/source]
IIS
5) ffuf
Web directory brute forcer
Wordlist
https://github.com/orwagodfather/WordList/blob/main/iis.txt
Its can be used on vulnerable and normal IIS app
Its can be used on other web apps
IIS
Testing
Sortscan basic usage

$ shortscan https://url/
Burp Extension IIS Tilde Enumeration

Copy the target url and scan
**NOTE**
any valid dir endpoint such as 403,401,301,200 etc…
scan that endpoint again , not just the url
IIS
Testing
example
$ shortscan https://bsidesahmedabad.in/
$ shortscan https://bsidesahmedabad.in/admin/
$ shortscan https://bsidesahmedabad.in/test/
FFUF fuzzing
$ ffuf -w iis.txt -u https://bsidesahmedabad.in/FUZZ
$ ffuf -w iis.txt -u https://bsidesahmedabad.in/shortnameFUZZ
Shortname-FUZZ / shortname_FUZZ
IIS
IIS
IIS
IIS
Tips to complete the shortname and get a valid Dir/file
https://IIS/
[+] Identified directories: 1
|_ DS_STO~1
Identified files: 1
|_ DESKTOP~1.ZIP
1) FFUF
$ ffuf -w iis.txt -u https://IIS/ds_stoFUZZ
$ ffuf -w iis.txt -u https://IIS/desktopFUZZ.zip
$ ffuf -w iis.txt -u https://IIS/desktop-FUZZ.zip
$ ffuf -w iis.txt -u https://IIS/desktop_FUZZ.zip

IIS
2) Github dorking
Path:/ds_sto
IIS
3) Chat AI
IIS
4) Intruder (numbers 0-100000)/Etc….
IIS
Dir: QBTEST~1  after fuzzing I found a valid endpoint redirect to test
login QBTESTicare
IIS
Example for critical bugs…
1 full source backup

|_ admin~1.ZIP  with previous tips found admin_backup.zip
what i got ???
* credentials in source file

* machine key
* valid unauth upload endpoint  uploaded a shell to RCE
IIS
Example for critical bugs…
3) DLL file  export source  Access to AWS credentials
File: UTILIT~1.DLL  UTILITies.dll  send it to JetBrains dotPeek
exported the project  start code review
IIS
and there's a more and more and more.....
references
https://learn.microsoft.com/en-us/previous-versions/aspnet/2wawkw1c(v=vs.100)
https://book.hacktricks.xyz/pentesting-web/deserialization/exploiting-__viewstate-knowing-the-secret
https://github.com/bitquark/shortscan
https://twitter.com/ctbbpodcast/status/1688607912434819073
https://www.youtube.com/watch?v=HrJW6Y9kHC4
https://www.youtube.com/watch?v=cqM-MdPkaWo
RESPONSE MANIPULATION
Authentication Bypass
Permissions: Edit , ADD , Del etc..
Prices & Currency

Authentication Bypass examples…
• Login page response
• Standard login  302 login • HTTP/1.1 302 Found
page redirection with large • Location: ../login/?redirect=//location/?5
Content-Length • Replacement content
• Deleted header
Location: ../login/?redirect=//location/?5
• Bypassed authentication using • HTTP/1.1 200 OK
Burp Suite Match And Replace.
• Match And Replace
type: response header
match : HTTP/1.1 302 Found
replace: HTTP/1.1 200 ok
• Tip: If the response is 302 with • Match And Replace

type: response header
a big Content-Length try to
match : Location: ../login/?redirect=//location/?5
bypass it replace:
RESPONSE
MANIPULATION
Request Response
POST /Account/Login HTTP/1.1 HTTP/1.1 400 Bad Request
Host: XXXX Connection: close
{"username":"bsides","password":"orwaBsides"} Content-Type: xxxxx

Server: xxxxx
false
Tip:
1 replace [400 bad request] to [200 ok]
2 replace [false] to [true]
its can be done via match and replace
Create account in the employee login panel Response

{"registration ":false,"Etc………
• Replaced the registration value
Replaced contents
• Created an employee account and retrieved login
{"registration ":true,"Etc………
panel privileges
Permissions examples…
Normal Response Replaced Response

"login_permission":user," "login_permission":admin,"
"Admin":false, " "Admin":true, "
{"permissions":["can_read"]} {"permissions":["can_read","can_write"]}
{"status":"0"} {"status":"1"}
{"status":"failure"} {"status":"success"}
Prices & Currency examples…
Normal Response
"code":"USD,","baseAmount":99.10,"
Replaced Responses
"code":"USD,","baseAmount":10.99,“
"code":"INR,","baseAmount":99.10,“
"code":“EUR,","baseAmount":99.10,"
METHODS &TIPS
1) Bypass waf using origin IP via match & replace in burp
2) My method about get more sub domains via amass
3) My method about discovering more domains & 3rd party’s & endpoints
METHODS &TIPS
1) Bypass waf using origin IP via match & replace in burp
best resources to find origin IPs
• shodan.io  Ssl.cert.subject.CN:"domain/subdomain"
• en.fofa.info  normal search for domain/subdomain
• search.censys.io  normal search for domain/subdomain
• securitytrails.com  normal search for domain/subdomain
METHODS &TIPS
any ip can be use as origin IP for this tip as example [400 bad request IP]
Example for Origin IP from shodan Ssl.cert.subject.CN:"godfather.orwa.com"
godfather.orwa.com  200 / Waf

127.0.0.1  400 bad request
===>
METHODS &TIPS
Match & Replace

Type: Request header
Match: Origin IP
Replace: Waf host
Now when you visit the origin IP  https://ip/ the response 200
you will have access to host app without waf
METHODS &TIPS
METHODS &TIPS
2) My method about get more sub domains via amass
* Add API Keys / Credentials to amass config file /home/.config/amass/
* 2 steps to run amass ….
Step 1
amass enum -passive -norecursive -noalts -d bsidesahmedabad.in -o sudomins.txt
Step 2
amass enum -passive -norecursive -noalts -df sudomins.txt -o more-subdomains.txt
testing on Ex appcheck  normal 230 sub  step 1 259 sub  step 2 326 sub
METHODS &TIPS
3) My method about discovering more domains & 3 rd party’s &
endpoints
•Urlscan.io/search
Ex. bsidesahmedabad.in
keywords
bsidesahmedabad.* / bsidesahmedabad-*
Remove duplicate results
Ex. [bsides.* -bsidesahmedabad.in]
Ex. [bsidesahmedabad.* -bsidesahmedabad.in]
Ex. [bsidesahmedabad.in -www.bsidesahmedabad.in -help.bsidesahmedabad.in]
METHODS &TIPS EX:
METHODS &TIPS
• bing & google dorking
keywords
site:domain.com
Remove duplicate results
-site:duplicate.domain.com
Ex.
site:bsidesahmedabad.in -site:supprot.bsidesahmedabad.in
METHODS &TIPS EX:
METHODS &TIPS
• Mixing Fofa & Shodan search engines
Getting Favicon hash from fofa
METHODS &TIPS
METHODS &TIPS
Favicon hash form fofa it can be used on shodan via dork
http.favicon.hash:xxxxxxxxxx
METHODS &TIPS
Favicon hash help customers to locate the spam/fake/phishing hosts….
References for more tips for dorking in sohdan and for finding
more endpoints
The Power Of Shodan
https://www.youtube.com/watch?v=WgMGLlpznao
METHODS &TIPS
• Endpoints Tool (Waymore)
https://github.com/xnl-h4ck3r/waymore
• Wayback Machine (web.archive.org)

• Common Crawl (index.commoncrawl.org)
• Alien Vault OTX (otx.alienvault.com)
• URLScan (urlscan.io)
METHODS &TIPS
• checking endpoints manually is more useful
EX:
host.com/xxx/xxxx/xxx.zi [.zip]
host.com/xxx/xxxx/xxx.p [php/pdf]
host.com/xxx/xxxx/xxx.ex [exe]
THANK YOU
https://twitter.com/godfatherorwa
https://bugcrowd.com/orwagodfather
https://hackerone.com/mr-hakhak

Share The-Power-Of-Recon

Uploaded by

Copyright:

Available Formats

Share The-Power-Of-Recon

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Share The-Power-Of-Recon

Uploaded by

Copyright:

Available Formats

THE POWER

Microsoft IIS tilde directory enumeration

Next parts in IIS

Last part in IIS

1) IIS Tilde Enumeration (Burp Extension)

Sortscan basic usage

Burp Extension IIS Tilde Enumeration

$ ffuf -w iis.txt -u https://bsidesahmedabad.in/shortnameFUZZ

$ ffuf -w iis.txt -u https://IIS/desktopFUZZ.zip

$ ffuf -w iis.txt -u https://IIS/desktop-FUZZ.zip

$ ffuf -w iis.txt -u https://IIS/desktop_FUZZ.zip

1 full source backup

* credentials in source file

Permissions: Edit , ADD , Del etc..

Prices & Currency

• Tip: If the response is 302 with • Match And Replace

Host: XXXX Connection: close

{"username":"bsides","password":"orwaBsides"} Content-Type: xxxxx

Create account in the employee login panel Response

Normal Response Replaced Response

best resources to find origin IPs

godfather.orwa.com  200 / Waf

Match & Replace

• Wayback Machine (web.archive.org)

You might also like