Knopflerfish bundle httpconsole 4.0.1 XSS

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Type: Cross Site Scripting x2
[x] Vendor: Knopflerfish Project
[x] Vendor Website: https://www.knopflerfish.org
[x] Bundle Name: httpconsole
[x] Bundle Version: 4.0.1
[x] Bundle DL: https://www.knopflerfish.org/releases/current/osgi/jars/httpconsole/httpconsole_all-4.0.1.jar
[x] Found by: Anarchy Angel
[x] Twitter: @anarchyang31
[x] URL: https://aahideaway.blogspot.com
[x] Mail : anarchy[dot]ang31@gmail[dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[1] Pre-authentication XSS in login page.
Method: POST
URL: http://knopflerfish-server:8080/servlet/console
Variable: loginname

exp:
POST /servlet/console HTTP/1.1
Host: http://knopflerfish-server:8080
...

loginname=[XSS]&loginpwd=asd&login_cmd=Login
====


[2] Post authentication XSS in management console.
Method: POST
URL: http://knopflerfish-server:8080/servlet/console
Variable: cmd_install_url

exp:
POST /servlet/console HTTP/1.1
Host: http://knopflerfish-server:8080
...

bundle_id=29&cmd_install_url=[XSS]&cmd_installurl=install

Ummm firsties? :)

Files for part 3 of 3 from Fully Functional & Programmed in Multiple Techniques

This time we covered broadcast receivers abuse in android applications.

Here is the android studio project

Slides from the demo

Here is the cheatsheet I keep talking about :)

Many thanks to stl2600 and Arch Reactor for allowing me to do stuff in the space! I hope everyone enjoyed this small series of presentations.

Thank you all!

Files for part 2 of 3 from Fully Functional & Programmed in Multiple Techniques

This time we covered content provider abuse in android applications.

Here is the android studio project

Slides from the demo

I hope everyone enjoyed this presentation.

Thank you.

Files for part 1 of 3 from Fully Functional & Programmed in Multiple Techniques

More info on series here - https://www.meetup.com/St-Louis-2600/events/skcdpnyxgbjb/

Source for the app HERE

Apps to inspect other apps AndroidManifest.xml file and manipulate activities:
Apk Analyzer by Martin Styk
Apk Analyzer by Dinostudio8891
Same name and some duplication, but one gives you a better view of the AndroidManifest.xml file (Martin), and the other gives you more control over the exposed elements (Dino). You can find them in the play store.

Sorry it took me so long to get this up...

Three part series on android app pen-testing at stl2600/dc314 by me!

Come join me while I do a three part series on android app pen-testing at the next three stl2600/DC314 meetings! 

First session is setup and intent spoofing. (5/6/18)

Second is exploiting exported content providers and insecure file storage. (6/4/18)

Third is exploiting exported broadcast receivers. (7/1/18)

In each case we examine the source code of an app with the vuln and
and how to exploit. Then discuss the hallmarks on how to find them in other apps "grep dorks".

People can/should bring their own systems to play along! I hope to see you there!

More info HERE

Advanced HaX11 Social Engineering Functionality

One of the features of HaX11 is the ability to open a full screen browser on the target machine to any URL you like. It is intended to be used in a social engineering attack on the target to attempt to get passwords or other sensitive information but you can use it for what ever you can imagine. Its easy to use, but does require you to have a web server running somewhere the target machine can access.

This attack also has a higher success rate as far as executing relative to the apps other functions on the target machine because rather then depending on the configuration of the target to share windows/desktops, you share a window to it!

Another thought I was playing around with was a type of ransomeware attack where you just keep popping the window until they give you bitcoins. The idea is the victim will have no idea whats really going on and might assume they really are infected with some of the ransomeware they see on TV. The scareware approach might work as well. Anyway that just a few ideas, but how you use it is really up to you. Enjoy.

Happy New Year & Big SharePointSpy update!

Happy New Year!! I hope everyone's is better than the last! To bring in the new year is a big update to SharePointSpy already available on GitHub! It features a new, more user friendly UI, and an anonymous or specific user scan! Please check it out and let me know what you think. Thank you and good luck in the new year!