A recap of the Q&A session on Twitter
[This article was originally posted in June 2020. It disappeared from the blog when a data-center from OVH burned down and was republished in April 2021. Please note my opinions may have evolve (f.e. regarding Burp’s feature requests).]
Last week, I was invited by Intigriti to run a mentoring session on Twitter, something similar to Reddit’s “Ask Me Anything”. During nearly four hours, I answered (mostly) technical questions on bug bounties, SSRF vulnerabilities, and more. Given how messy conversations are on Twitter, I decided to collect all my answers (and the corresponding questions!), slightly edit them and publish the result below. Ready?
« What are some ways to escalate SSRF if you can’t just access AWS metadata for instance? Do you stop or pivot further? »
My targets would be (in this order) #1 metadata (easy, possibly high impact) #2 loopback (not limited to localhost) #3 internal network (RFC 1918) #4 public IP space (bypassings ACLs). And I always try to pivot (that’s where the fun is, imo).
« What are the features you look at when searching for SSRF? The places where you look first? »
Of course, I’d start with features taking URLs as input (RSS feed, API testbed, image downloader, SSO configuration, …). Then, I would upload formats embedding URLs (HTML, XML + doctypes, SVG, Office). Sometimes, libraries allow to both upload a file or provide an URL. Test both, even if the GUI shows only the file upload part. Finally, test for SSRF caused by careless micro-services interactions, with payloads like “123/../../../../backups/” (must be URL-encoded, possibly twice) for integer paramaters. The frontend receives “/pages/users?id=123%2F..%2F..%2F” and requests
/api/users/123/../../ on the backend.
« What do you try with external blind SSRF ? For example you can trigger a GET to the URL of the HTTP “Referer” header but that’s it… What do you do in such situation? »
If paid on impact (bug bounty), I usually don’t give a f*ck. Among other reasons, because the probability to be out-of-scope is high. If paid on effort (pentest), I’d ask the customer.
« Easy way to find SSRF? »
The most basic way is to look for parameters whose name matches ‘*url*’ or whose value matches ‘^http*’. Shouldn’t work anymore on hardened targets.
« Are there any other way to access the internal network of a website other than SSRF? »
Other vulnerabilities like RCE, XXE and SQLi cand be used to access internal resources. Abusing headless browsers is a good option too!
« Do you have any tips for finding out if there is a Blind SSRF somewhere apart from this article on Portswigger? Perhaps things like HTTP response time differences, etc? (I mean blind SSRF to limited scope like internal resources only) »
A fully blind SSRF means #1 asynchronous processing #2 no DNS resolution. If #1 isn’t true, delays can be used (open vs closed ports, TCP timeouts on DROP rules, /dev/random vs /dev/urandom …). If #2 isn’t true, DNS pingbacks to a wildcard domain with a low TTL can be used to confirm the bug. Exploitation is another story… On internal networks, maybe trying //host/share/file.ext and looking at DNS/NBNS traffic.
« Is it even possible to find SSRF via elb & ingress servers, without digging into the application? »
ELB is an AWS-specfic products, but yes, bugs in reverse-proxies were used as SSRF vectors for years. Cf CVE-2011-4317, impacting Apache.
« Have you ever had an SSRF where you can only retrieve image files such as jpg and png (not svg and no time based attacks possible), if so were you able to further exploit this ? »
Absolutely! If the filetype is verified on the file itself (post-download), then it’s just another blind SSRF, which can be exploited with the usual blind RCE exploits (f.e. Consul). If the check is done on the URL (pre-download), misinterpretations may be abused (f.e. “/the/target/endpoint/;.jpg”)
« Could you give an example/scenario of pivoting and how you approach the same in SSRF? »
Two SSRF-related examples of pivoting…
– Compromising an unreachable Solr server with CVE-2013-6397
– How I got a root shell on Yahoo’s monitoring servers (pages 48 to 57)
« For SSRF on an endpoint that is only rendering images without processing, how would you exploit it? Any good resources on this topic? »
That’s a tricky situation, but there may have an blindly exploitable service lying around. The most famous generic examples were the Consul RCE bugs: fixed port on loopback and without authentication (the situation improved in the recent years). One of the bugs (the /join one) simply required a GET to loopback and an unfiltered outbound TCP port. Another bug (requiring a POST to loopback with controlled body) was published in 2017. We were calling these bugs “head shots”: RCE via SSRF, using a single HTTP request, exploitable in nearly all situations (even fully blind ones) as long as Consul was there.
« Whats the most optimal way to keep your Proxy History and Logger++ clutter-free? »
There’s no optimal way, only a bunch of strategies. Mine: dedicated browser (AutoChrome or PwnFox) with all the traffic going through Burp Suite (bonus: easy identification of 3rd-party services), Proxy History is never emptied, scope matches what I can legally hack, and the display filter is set by default to “Everything in scope”. Logger++ is emptied before every significative action (like an active scan) and results are processed using generic (!= 404, != fonts) or app-specific filters and colors. Cf this tweet by @CoreyD97 on using Logger++ aliases.
« What @Burp_Suite feature request would be on top of your wishlist? »
My Top 3:
– #1 Left-right display in Proxy History (requested years ago!!). Luckily, both extensions Flow and Logger++ have this feature.
– #2 Add HTTP headers via session handling rules. My work-around is to use the extension “Add Custom Header” (essential when doing post-auth testing of APIs).
– #3 Proper support for CAA DNS records in Collaborator. That would allow automatic renewal of @letsencrypt wildcard certificates whitout relying on ugly hacks.
« Which Burp Suite version do you recommend 1.7.x or 2.x? Which one do you use for your daily work? »
2.x, without any hesitation. Switching has a cost (mostly understanding all the changes in Spider and Scanner) but it is worth it. However, the numerous recent bugs in the editor are a PITA :-/
« What’s the best way of crawling an entire website (but staying within the subdomain)? Burps crawler always seems to finish after fewer than 100 requests. »
If using 2.x, open “Configuration library” from the Burp menu bar and pay attention to crawling options: optimization, limits and handling of application errors. If necessary, enable the crawling debug logs by clicking on the cog next to “Crawl strategy”.
« Use cases of Burp macros apart from session handling?
»
Everything you want to automate. Example: modify your profile’s status by POST-ing to /api/status/me and fetch the updated profile via GET /web/profile/[ID] when looking for stored XSS.
« Because of the sheer amount of data being logged into the Proxy History, people sometimes miss out on important hints. It would be nice to have a HUD as browser plugin to directly see findings on page. Is that something that you would see fit for Burp Suite?
»
I’m really not a big fan of injecting a HUD in every page I visit/test. The probability for negative interactions (from false positives to broken features) looks too high to me. So I would clearly not use it…
« How much RAM do you use for Burp? Any suggestion on how to reduce CPU and RAM usage especially when doing an active scan? Thanks! »
I usually run Burp on my station (32Gb of RAM) or laptop (16Gb). Never had a memory problem, but I’m not running huge active scans. Note that passive Javascript analysis consumes a lot of resources.
« Any advice when Burp finds just an external DNS interaction but not an HTTP one? »
Try all TCP ports, including 0. Try UDP, if available (tftp, HTTP/3). Limit yourself to the inside part of the network. Or maybe it’s just a DNS lookup (very common on X-Forwarded-For headers, for logging purposes).
« It would be helpful, if you can share some scenarios/bug classes in which the Burp Match & Replace option can be effectively used for a pentest/bug bounty hunting. »
Sure, here we go! (directly copied from my training slides):
– Exploit the Intel AMT vulnerability, by @tenablesecurity
– Disable caching, by @cryptogangsta
– Avoid entering complex passwords (useful on mobile), again by @cryptogangsta
– Search for trivial XSS and SQLi, by @daeken
And much more: switch JSON values from False to True (or the opposite), disable or hijack CSP reporting, …
« How was life before Burp? Because it definitely made a big difference! »
Before Burp, we had other intercepting proxies (like Paros). And before that, browser extensions were the thing (Hackbar, Tamper Data, …). But you have to keep in mind that web apps were much simpler in the old days…
« Your favorite books for the mid level of web hacking?
»
– The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws, 2nd Edition
– The Tangled Web: A Guide to Securing Modern Web Applications
– Web Application Obfuscation
– Real-World Bug Hunting: A Field Guide to Web Hacking
« How have you learned when you started and how did you learn still ? »
A single answer for both questions: reading and practicing…
« People mostly use Burp for Web and API security assessment. How do I use Burp Suite for mobile penetration testing? Which security issues can we find with Burp in mobile apps, e.g. Android & iOS? Want a guideline regarding this. 🙂 »
I’m far from being good at mobile pentesting, but here’s some cheat-sheets written by people from @randorisec. By the way, they also have a online training dedicated to these subjects.
« When everything else has failed on a specific request, what is your last test before moving on ? How do you fuzz (with or without Burp) something suspicous ? »
My last resort options both use Intruder: character frobbing and fuzzing. Fuzzing is done on one or more injection points, with URL-encoded (my preference) or raw values. Regarding frobbing:
– Documentation of the “Character frobber” Intruder payload
– Real-life example where I frobbed an opaque value and gained RCE
« What are your most useful/successful payloads to discover reverse-proxy bypass or misconfig ? »
Everything in this article!
« I have been learning from last 10 months and I have a good understanding of CSRF , IDOR , directory traversal up to some extent XSS and a few other vulns but I have not found my first bug. Any suggestion for me … »
Practice your self-confidence by first finding and exploiting bugs that you know they are there (for example, on Juice Shop). Then move to easy bug bounty programs with no rewards and a large scope (example: NGOs).
« How do you pick up new research target. Will you give some insight on your research approach/methodology? What goal(s) do you set for yourself when you embark on a research topic? Thank you for doing this Q&A. »
This subject was covered during my recent interview with @nahamsec, with additional details here…
« What are request/place we test mostly for XXE? I mean how to identify a request to test for XXE? »
JSON endpoints are a commonly overlooked XXE vector (because they may also accept XML data). And the extension “Content Type Converter” is perfect for this use-case. Here’s a @Hacker0x01 report describing exactly that kind of bug.
« What bugs do you look in websites most of the time? Is it XSS, CSRF, or what? »
For bug bounty, I don’t look for XSS and CSRF bugs. Mostly injections, RCE, XXE, SSRF and business-related vulnerabilities.
« I’m trying to know more about XXE & HTTP Request smuggling. How to improve myself? »
Solve all the corresponding @websecacademy challenges? (here and there)
« What is a good way/place to learn about filter bypasses and bug classes from zero to good enough »
Filter bypasses: the best reference on this subject is the book “Web Application Obfuscation”. Quite underated, but really good! Regarding bug classes, WebSecAcademy should do the job.
« Any tips for testing for RCE? In my experience a lot of RCE reports are not disclosed, and payloads aren’t that largely available, making it hard to get a feeling for what might be vulnerable. »
RCE is an impact, not a vulnerability class. Vulnerabilities you’re looking for: command injections (of course), SQLi (f.e. with xp_cmdshell), leaked or weak credentials (CMS admin can change Jinja templates), file creation (overwrite a script), SSRF to an internal unprotected admin interface, and of course, everything with a CVE (ImageTragick, ShellShock, …). And I disagree which the point that RCE reports and/or payloads aren’t commonly available. Relevant Google dork: “site:hackerone.com/reports/ rce”.
It’s hard to evaluate how useful this Q&A session was from a mentoring point of view. I hope it was, at least a bit, and that archiving the discussions here may help in the long-run.