2018-05-18T19:28:59+00:00 https://shivam043.github.io Shivam Singh shivam043@gmail.com 2017-01-12T00:00:00+00:00 https://shivam043.github.io/2017/01/12/Directi2 <p>This post is regarding critical vulnerability i found on directi’s codechef.com</p> <h2 id="proof-of-concept">Proof of Concept</h2> <p>Earlier,I have reported a critical vulnerability(directory traversal) in the main domain(codechef.com).This time I thought of looking into the subdomains of codechef.com.<br /> Through subdomain bruteforcing one domain caught my attention https://mail.codechef.com. <br /> So,started looking for some juicy stuffs through dir-buster. <br /> Got 200ok response from info.php file.<br /> OWASP-A6 (https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure) <br /> <img src="https://shivam043.github.io/public/blog/s11.png" alt="Here is the screenshot:" /></p> <p>Disclosure of phpinfo server file:<br /> <img src="https://shivam043.github.io/public/blog/s12.png" alt="Here is the screenshot:" /> <img src="https://shivam043.github.io/public/blog/s13.png" alt="Here is the screenshot:" /></p> <h2 id="sql-injectioncritical-">SQL-INJECTION(CRITICAL) <br /></h2> <p>https://www.owasp.org/index.php/SQL_Injection Through some googling, I found that mail.codechef.com was using sendy email newsletter application.<br /> Two vulnerabilities were available publicly through exploit database of sql-injection.Here is the screenshot-&lt;/br&gt; Url-https://www.exploit-db.com/exploits/31898 <br /> <img src="https://shivam043.github.io/public/blog/s14.png" alt="Here is the screenshot:" /> mail.codechef.com is using a vulnerable version of sendy.<br /> <img src="https://shivam043.github.io/public/blog/s14.png" alt="Here is the screenshot:" /></p> <p>Url-&gt;https://mail.codechef.com/app?i= [vulnerable-sql-injection-point] <br /> Sqlmap confirms the sql-injection.This is a critical vulnerability which can compromise the server. Fix-Upgrade to the latest version <br /> <img src="https://shivam043.github.io/public/blog/s15.png" alt="Here is the screenshot:" /><br /></p> <h2 id="cross-site-scripting-">CROSS-SITE SCRIPTING-</h2> <p>https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) Inserting a javascript payload in the redirect parameter leads to its execution.<br /> <img src="https://shivam043.github.io/public/blog/s16.png" alt="Here is the screenshot:" /><br /></p> 2016-12-28T00:00:00+00:00 https://shivam043.github.io/2016/12/28/Apnaghar <h3 id="this-post-is-a-project-made-on-python-framework-flask">This post is a project made on Python Framework Flask</h3> <h2 id="about">About</h2> <h4 id="apnaghar-is-a-webapp-build-on-python-framework-flask-which-helps-user-to-choose-properties-listings-based-on-locationcompare-property-rateschat-with-the-owner-of-the-property-and-filter-the-properties-by-locationluxury-and-price">Apnaghar is a webapp build on Python Framework Flask which helps user to choose properties listings based on location,compare property rates,chat with the owner of the property and filter the properties by location,luxury and price<br /></h4> <p><a href="https://github.com/shivam043/ApnagharModified">Project Link</a><br /></p> 2016-10-11T00:00:00+00:00 https://shivam043.github.io/2016/10/11/Directi1 <h1 id="this-post-is-regarding-critical-vulnerability-i-found-on-directis-codechefcomwas-awarded-a-bug-finder-t-shirt-and-a-1000-laddus-as-a-part-of-rewarding-system">This post is regarding critical vulnerability i found on directi’s codechef.com.Was Awarded a bug finder t-shirt and a 1000 laddus as a part of rewarding system.</h1> <h2 id="proof-of-concept">Proof of Concept</h2> <p>I started digging using burpsuite for session mishandling and idor but found nothing.<br /> On going deeper using a Google Dork (Advanced Search Technique on Google) site:www.codechef.com inurl:”php” <br /> Executing the dork above on Google gives me these results:<br /> <img src="https://shivam043.github.io/public/blog/dork.png" alt="A Screenshot of the google dork" /></p> <p>So, I got 3 results with same URL Scheme<br /> www.codechef.com/download.php?file=[vulnerable]<br /> I figured out that the “file” parameter is the File Name which got downloaded automatically. So, It quickly reminds me that this kind of URL Scheme is possibly vulnerable to Directory Traversal. <br /> <img src="https://shivam043.github.io/public/blog/s1.png" alt="A Screenshot of the local file dowbload" /></p> <p>After browsing the URL above, something popped out and asked me to download a file and here’s the content of the file I have downloaded.<br /> <img src="https://shivam043.github.io/public/blog/s2.png" alt="A Screenshot of the etc file which i have downloaded" /></p> <p>I also viewed etc/profile ,etc/services,server configuration file,php configuration file and many others files like backup files which contain sensitive data.<br /> <img src="https://shivam043.github.io/public/blog/s3.png" alt="Here’s downloaded files(It is possible to download more system files)" /></p> 2016-04-06T00:00:00+00:00 https://shivam043.github.io/2016/04/06/livestreamer <p>LiveStreamer is a python script that streams live channel in a webpage <a href="https://github.com/shivam043/LiveStreamer">link to project</a><br /></p> <h2 id="running-the-script">Running the script</h2> <p><img src="https://shivam043.github.io/public/blog/livestreamer.png" alt="A Screenshot of the script in action" /></p> 2015-01-27T00:00:00+00:00 https://shivam043.github.io/2015/01/27/gocomic <p>GoComicDownloader is a python script that downloads new comics which are added daily to the website <a href="https://gocomics.com">GoComic</a> <br /><a href="https://github.com/shivam043/GoComicDownloader">link to project</a></p> <h2 id="running-the-script">Running the script</h2> <p><img src="https://shivam043.github.io/public/blog/bruteforce-cyberoam-shell.png" alt="A Screenshot of the script in action" /></p>