Hacking Web How to Hacking Web And Make Money Hacking Ethically (Yaworski, Peter) (Z-Library)
,
Science
No Description
293
Views
Registered users can read the full content for free
Register as a Gaohf Library member to read the complete e-book online for free and enjoy a better reading experience.
Page
1
(This page has no text content)
Page
2
(This page has no text content)
Page
3
Hacking Web How to Hacking Web And Make Money Hacking Ethically Peter Yaworski © 2019 - 2020 Peter Yaworski For Andrea and Ellie. Thanks for supporting my constant roller coaster of motivation and confidence. This book wouldn’t be what it is if it were not for the anonymous person Team, thank you for all the support, feedback and work that you contributed to make this book more than just an analysis of 30 disclosures. Contents 1. Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2. Attention Hackers! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 How It All Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Just 30 Examples and My First Sale . . . . . . . . . . . . . . . . . . . . . . . . 5 Who This Book Is Written For . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Chapter Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Word of Warning anda Favour....................................................................................... 10 4. Background ................................................................................................................ 11 5. HTML Injection.......................................................................................................... 14 Description ........................................................................................................................... .... 14
Page
4
Examples........................................................................................................... ......................... 14 1. Coinbase Comments ..................................................................................................... 14 2. HackerOne Unintended HTML Inclusion ................................................................. 16 3. Within Security Content Spoofing.............................................................................. 17 Summary ........................................................................................................................... ......... 19 6. HTTP Parameter Pollution ...................................................................................... 20 Description ........................................................................................................................... .... 20 Examples........................................................................................................... ......................... 21 1. HackerOne Social Sharing Buttons ............................................................................ 21 2. Twitter Unsubscribe Notifications ............................................................................. 22 3. Twitter Web Intents .............................................................................................................23 Summary ........................................................................................................................... ......... 25 7. CRLF Injection ........................................................................................................... 27 Description ........................................................................................................................... .... 27 1. Twitter HTTP Response Splitting ......................................................................................27 2. v.shopify.com Response Splitting ................................................................................ 29
Page
5
Summary ........................................................................................................................... ......... 30 8. Cross-Site Request Forgery...................................................................................... 31 Description ........................................................................................................................... .... 31 Examples........................................................................................................... ......................... 32 1. Shopify Export Installed Users ...............................................................................32 2. Shopify Twitter Disconnect ......................................................................................... 33 3. Badoo Full Account Takeover ..................................................................................... 34 Summary ........................................................................................................................... ......... 36 9. Application Logic Vulnerabilities ............................................................................. 37 Description ........................................................................................................................... .... 37 Examples........................................................................................................... ......................... 38 1. Shopify Administrator Privilege Bypass ..................................................................... 38 2. Starbucks Race Conditions .......................................................................................... 39 3. Binary.com Privilege Escalation ................................................................................... 40 4. HackerOne Signal Manipulation.............................................................................41 5. Shopify S3 Buckets Open.............................................................................................. 41
Page
6
6. HackerOne S3 Buckets Open...................................................................................... 42 7. Bypassing GitLab Two Factor Authentication.......................................................... 45 8. Yahoo PHP Info Disclosure .......................................................................................... 47 9. HackerOne Hacktivity Voting ..................................................................................... 48 10. Accessing PornHub’s Memcache Installation ......................................................... 51 Summary ........................................................................................................................... ......... 53 10. Cross-Site Scripting Attacks .................................................................................... 55 Description ........................................................................................................................... .... 55 Examples........................................................................................................... ......................... 56 1. Shopify Wholesale.......................................................................................................... 56 2. Shopify Giftcard Cart..................................................................................................... 58 3. Shopify Currency Formatting ...................................................................................... 60 4. Yahoo Mail Stored XSS ................................................................................................. 61 5. Google Image Search ..................................................................................................... 63 6. Google Tagmanager Stored XSS ........................................................................................64 Summary ........................................................................................................................... ......... 65
Page
7
11. SQL Injection ............................................................................................................. 67 Description ........................................................................................................................... .... 67 Examples........................................................................................................... ......................... 68 1. Drupal SQL Injection ..................................................................................................... 68 Summary ........................................................................................................................... ......... 70 12. Open Redirect Vulnerabilities .................................................................................. 71 Description ........................................................................................................................... .... 71 Examples........................................................................................................... ......................... 71 1. Shopify Theme Install Open Redirect ........................................................................ 71 2. Shopify Login Open Redirect....................................................................................... 72 3. HackerOne Interstitial Redirect ................................................................................. 73 Summary ........................................................................................................................... ......... 74 13. Sub Domain Takeover .................................................................................................. 75 Description ........................................................................................................................... .... 75 Examples........................................................................................................... ......................... 75 1. Ubiquiti sub domain Takeover
Page
8
.................................................................................... 75 2. Scan.me Pointing to Zendesk....................................................................................... 76 3. Swiping Facebook Official Access Tokens .......................................................................77 Summary ........................................................................................................................... ......... 80 14. XML External Entity Vulnerability ..................................................................... 81 Description ........................................................................................................................... .... 81 Examples........................................................................................................... ......................... 85 1. Read Access to Google ........................................................................................................85 2. Facebook XXE with Word..................................................................................................87 3. Wikiloc XXE................................................................................................................... .............. 89 Summary ........................................................................................................................... ......... 92 15. Remote Code Execution........................................................................................... 93 Description ........................................................................................................................... .... 93 Examples........................................................................................................... ......................... 93 1. Polyvore ImageMagick ................................................................................................... 93 Summary
Page
9
........................................................................................................................... ......... 95 16. Template Injection..................................................................................................... 96 Description ........................................................................................................................... .... 96 Examples........................................................................................................... ......................... 97 1. Uber Angular Template Injection................................................................................ 97 2. Uber Template Injection ............................................................................................... 98 3. Rails Dynamic Render ................................................................................................. 101 Summary ........................................................................................................................... ....... 102 17. Server Side Request Forgery.................................................................................. 103 Description ........................................................................................................................... .. 103 Examples........................................................................................................... ....................... 103 1. ESEA SSRF and QueryingAWS Metadata ............................................................... 103 Summary ........................................................................................................................... ....... 105 18. Memory............................................................................................................. ........ 106 Description ...........................................................................................................................
Page
10
.. 106 Buffer Overflow ................................................................................................................ 106 Read out of Bounds .......................................................................................................... 107 Memory Corruption ........................................................................................................ 109 Examples........................................................................................................... ....................... 110 1. PHP ftp_genlist()....................................................................................................... .... 110 2. Python Hotshot Module ............................................................................................. 111 3. Libcurl Read Out of Bounds....................................................................................... 112 4. PHP Memory Corruption........................................................................................... 113 Summary ........................................................................................................................... ....... 114 19. Getting Started........................................................................................................ 115 Information Gathering .......................................................................................................... 115 Application Testing .....................................................................................................................118 Digging Deeper ...................................................................................................................... 119 Summary ........................................................................................................................... ....... 121 20. Vulnerability Reports .............................................................................................. 122
Page
11
Read the disclosure guidelines. ........................................................................................... 122 Include Details. Then Include More................................................................................... 122 Confirm the Vulnerability .................................................................................................... 123 Show Respect for the Company......................................................................................... 123 Bounties ........................................................................................................................... ........ 125 Don’t Shout Hello Before Crossing the Pond ................................................................. 125 Parting Words ........................................................................................................................ 126 21. Tools.................................................................................................................. ..................128 Burp Suite ........................................................................................................................... ..... 128 Knockpy ........................................................................................................................... ........ 128 HostileSubBruteforcer ......................................................................................................... 129 sqlmap............................................................................................................... ..................129 Nmap................................................................................................................. ....................... 129 Eyewitness......................................................................................................... ...................... 130 Shodan............................................................................................................... ....................... 130 What CMS ...........................................................................................................................
Page
12
.......... 130 Nikto ........................................................................................................................... .................... 130 Recon- ng....................................................................................................................... ........... 131 idb...................................................................................................................... ..................131 Wireshark ........................................................................................................................... ........... 131 Bucket Finder................................................................................................................. ......... 132 Google Dorks................................................................................................................. ............... 132 IPV4info.com.................................................................................................... ....................... 132 JD GUI.................................................................................................................... ................................ 132 Mobile Security Framework ................................................................................................ 132 Firefox Plugins ........................................................................................................................ 133 FoxyProxy ........................................................................................................................... ...... 133 User Agent Switcher ........................................................................................................ 133 Firebug............................................................................................................... .................. 133 Hackbar.............................................................................................................. ................. 133
Page
13
Websecurify....................................................................................................... ................ 133 Cookie Manager+ ............................................................................................................. 133 XSS Me...................................................................................................................... ................. 134 Offsec Exploit-db Search................................................................................................. 134 Wappalyzer ........................................................................................................................ 134 22. Resources.......................................................................................................... ........ 135 Online Training............................................................................................................. .......... 135 Web Application Exploits and Defenses...................................................................... 135 The Exploit Database ....................................................................................................... 135 Udacity ........................................................................................................................... ..... 135 Bug Bounty Platforms ........................................................................................................... 135 Hackerone.com.................................................................................................. ............... 135 Bugcrowd.com.................................................................................................. ................. 136 Synack.com....................................................................................................... .................. 136 Cobalt.io ........................................................................................................................... .. 136 Video
Page
14
Tutorials............................................................................................................. ..... 136 youtube.com/yaworsk1 ................................................................................................... 136 Seccasts.com ...................................................................................................................... 136 Further Reading.............................................................................................................. ........ 136 OWASP.com ........................................................................................................................... ............. 136 Hackerone.com/hacktivity .............................................................................................. 137 Twitter #infsec .................................................................................................................. 137 Twitter @disclosedh1.................................................................................................... ........ 137 Web Application Hackers Handbook .......................................................................... 137 Bug Hunters Methodology.............................................................................................. 137 Recommended Blogs ............................................................................................................ 137 philippeharewood.com .................................................................................................... 137 Philippe’s Facebook Page - www.facebook.com/phwd-113702895386410 ......... 137 fin1te.net ........................................................................................................................... .. 138 NahamSec.com.................................................................................................. ................ 138 blog.it-securityguard.com .................................................................................................... 138
Page
15
blog.innerht.ml.................................................................................................. ................. 138 blog.orange.tw ................................................................................................................... 138 Portswigger Blog ............................................................................................................... 138 Nvisium Blog ...................................................................................................................... 138 blog.zsec.uk ........................................................................................................................ 138 Bug Crowd Blog ................................................................................................................ 139 HackerOne Blog................................................................................................................ 139 23. Glossary .................................................................................................................... 140 Black Hat Hacker .............................................................................................................. 140 Buffer Overflow ................................................................................................................ 140 Bug Bounty Program ........................................................................................................ 140 Bug Report ......................................................................................................................... 140 CRLF Injection ......................................................................................................................... 140 Cross Site Request Forgery............................................................................................ 141 Cross Site Scripting .......................................................................................................... 141 HTML Injection
Page
16
................................................................................................................. 141 HTTP Parameter Pollution ............................................................................................. 141 HTTP Response Splitting................................................................................................. 141 Memory Corruption ........................................................................................................ 141 Open Redirect............................................................................................................. ...... 141 Penetration Testing ...............................................................................................................142 Researchers........................................................................................................ ................ 142 Response Team ........................................................................................................................... .142 Responsible Disclosure ................................................................................................... 142 Vulnerability ....................................................................................................................... 142 Vulnerability Coordination ............................................................................................. 142 Vulnerability Disclosure .................................................................................................. 143 White Hat Hacker................................................................................................................ ... 143 1. Foreword The best way to learn is simply by doing. That is how we - Michiel Prins and Jobert Abma - learned to hack.
Page
17
We were young. Like all hackers who came before us, and all of those who will come after, we were driven by an uncontrollable, burning curiosity to understand how things worked. We were mostly playing computer games, and by age 12 we decided to learn how to build software of our own. We learned how to program in Visual Basic and PHP from library books and practice. From our understanding of software development, we quickly discovered that these skills allowed us to find other developers’ mistakes. We shifted from building to breaking and hacking has been our passion ever since. To celebrate our high school graduation, we took over a TV station’s broadcast channel to air an ad congratulating our graduating class. While amusing at the time, we quickly learned there are consequences and these are not the kind of hackers the world needs. The TV station and school were not amused and we spent the summer washing windows as our punishment. In college, we turned our skills into a viable consulting business that, at its peak, had clients in the public and private sector across the entire world. Our hacking experience led us to HackerOne, a company we co-founded in 2012. We wanted to allow every company in the universe to work with hackers successfully and this continues to be HackerOne’s mission today. If you’re reading this, you also have the curiosity needed to be a hacker and bug hunter. We believe this book will be a tremendous guide along your journey.It’s filled with rich, real world examples of security vulnerability reports that resulted in real bug bounties, along with helpful analysis and review by Pete Yaworski, the author and a fellow hacker. He is your companion as you learn, and that’s invaluable. Another reason this book is so important is that it focuses on how to become an ethical hacker. Mastering the art of hacking can be an extremely powerful skill that we hope will be used for good. The most successful hackers know how to navigate the thin line between right and wrong while hacking. Many people can break things, and even try to make a quick buck doing so. But imagine you can make the Internet safer, work with amazing companies around the world, and even get paid along the way. Your talent has the potential of keeping billions of people and their data secure. That is what we hope you aspire to.
Page
18
We are grateful to no end to Pete for taking his time to document all of this so eloquently. We wish we had this resource when we were getting started. Pete’s book is a joy to read with the information needed to kickstart your hacking journey. Happy reading, and happy hacking! Foreword 2 Remember to hack responsibly. Michiel Prins and Jobert Abma Co-Founders, anonymous person 2. Attention Hackers! When you read this book, we would absolutely LOVE to hear your comments on it. • Is it useful? • Is it well written? • Did you find anything to correct? • Is there anything missing? • Is there anything you want to see more of? • Is there anything you want to see less of? Send your comments to ap8453211@gmail.com and mention the word “book” in the subject header. Thank you! P.S. And of course, if you indeed think this book is fantastic, feel free to tweet about that and recommend the book to your friends. 3. Introduction Web Hacking 101 is my first book, meant to help you get started hacking. It’s an ongoing project which I continue to add content to and develop. I began writing it as a selfpublished explanation of 30 vulnerabilities, a by- product of my own learning. It quickly turned into so much more. My hope for the book, at the very least, is to open your eyes to the vast world of
Page
19
hacking. At best, I hope this will be your first step towards making the web a safer place while earning some money doing it. If you’re interested in continuing to learn with me, you can purchase the most recent version and receive updates for all future versions by visiting Web Hacking 101 on LeanPub 1 . This book is also available in Russian on LeanPub. How It All Started In late 2019, I stumbled across the book, We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous and the Global Cyber Insurgency by Parmy Olson and ended up reading it in a week. Having finished it though, I was left wondering how these hackers got started. I was thirsty for more, but I didn’t just want to know WHAT hackers did, I wanted to know HOW hackers did it. So I kept reading. But each time I finsihed a new book, I was still left with the same questions: • How do other Hackers learn about the vulnerabilities they find? • Where are people finding vulnerabilities? • How do Hackers start the process of hacking a target site? • Is Hacking just about using automated tools? • How can I get started finding vulnerabilities? But looking for more answers, kept opening more and more doors. Aroundthissametime,IwastakingCourseraAndroiddevelopmentcourses andkeeping an eye out for other interesting courses. The Coursera Cybersecurity specialization caughtmyeye,particularlyCourse2,SoftwareSecurity.Luckilyforme,itwasjustst arting (as of February 2019, it is listed as Coming Soon) and I enrolled. A few lectures in, I finally understood what a buffer overflow was and how it was exploited. I fully grasped how SQL injections were achieved whereas before, I only knew the danger. In short, I was hooked. Up until this point, I always approached web security from the developer’s perspective, appreciating the need to sanitize values and avoid using user input directly.
Page
20
Now I was beginning to understand what it all looked like from a hacker’s perspective. I kept looking for more information on how to hack andcame across Bugcrowd’s forums. Unfortunately they weren’t overly active at the time but there someone mentioned HackerOne’s hacktivity and linked to a report. Following the link, I was amazed. I was reading a description of a vulnerability, written to a company, who then disclosed it to the world. Perhaps more importantly, the company actually paid the hacker to find and report this! That was a turning point, I became obsessed. Especially when a homegrown Canadian company, Shopify, seemed to be leading the pack in disclosures at the time. Checking outShopify’s profile, their disclosure list was littered with open reports. Icouldn’t read enough of them. The vulnerabilities included Cross-Site Scripting, Authentication and Cross-Site Request Forgery, just to name a few. Admittedly, at this stage, I was struggling to understand what the reports were detailing. Some of the vulnerabilities and methods of exploitation were hard to understand. Searching Google to try and understand one particular report, I ended on a GitHub issue thread for an old Ruby on Rails default weak parameter vulnerability (this is detailed in the Application Logic chapter) reported by Egor Homakov. Following up on Egor led me to his blog, which includes disclosures for some seriously complex vulnerabilities. Reading about his experiences, I realized, the world of hacking might benefit from plain language explanations of real world vulnerabilities. And it just so happened, that I learn better when teaching others. And so, Web Hacking 101 was born. Just 30 Examples and My First Sale I decided to start out with a simple goal, find and explain 30 web vulnerabilities in easy to understand, plain language.
The above is a preview of the first 20 pages. Register to read the complete e-book.
AI Reading Assistant
Whole-book reading guide from stratified index samples; jump to passages in the text
AI guide
【One-Line Pitch】
A plain-language field guide to real-world web vulnerabilities and bug bounty hunting, built around documented reports and payouts. Best for aspiring ethical hackers, web developers, and anyone who wants to understand how common web flaws are actually found and reported.
【Book Arc】
- **Opening (~0%–10%)**: The table of contents and front matter lay out the book's structure: a catalog of vulnerability types (HTTP parameter pollution, CRLF injection, SQL injection, open redirects, subdomain takeover, and more), each followed by real examples and summaries. This stage orients you to the reference-style organization.
- **Early (~10%–30%)**: The author's origin story and mission — from curious kids breaking software to co-founding HackerOne — establishes the ethical bug-hunting mindset. The book's audience and chapter template are introduced: description, examples, summary, with each example tagged by difficulty, URL, report link, date, bounty, and takeaways.
- **Early–Middle (~30%–50%)**: Core vulnerability mechanics are taught through concrete cases. HTTP methods and input handling (Coinbase), unintended HTML inclusion (HackerOne), HTTP parameter pollution, CRLF injection and response splitting (Twitter, Shopify), CSRF (Shopify, Badoo), and authentication flaws (Binary.com) show how small parsing quirks become serious exploits.
- **Middle–Late (~50%–80%)**: The catalog continues into higher-severity classes — SQL injection (Drupal), open redirects, subdomain takeover, and memory-related vulnerabilities tied to low-level languages. The emphasis shifts from "what is it" to "how would I find this."
- **Late (~80%–95%)**: Practical career material: how to get started hunting, how to write an effective vulnerability report (stressed as one of the most important chapters), and recommended tools. The message is that reporting skill determines whether hacking effort turns into payment.
- **Ending (~95%–100%)**: Resources for continuing education — online training, exploit databases, and bug bounty platforms like HackerOne, Bugcrowd, Synack, and Cobalt — plus closing encouragement to keep learning.
【Key Takeaways】
- **The book is a reference, not a narrative** (Early): It is explicitly designed to be flipped through and kept open while hacking, with each vulnerability chapter following the same description–examples–summary template.
- **Real reports make abstract flaws concrete** (Early–Middle): Every example includes difficulty, URL, report link, date, bounty paid, and takeaways, so you see how a bug was actually discovered and valued.
- **Input handling is the recurring root cause** (Middle): Encoding tricks, hanging quotes, duplicate parameters, and CRLF sequences all exploit how servers and browsers parse user-controlled data differently.
- **Backend behavior varies, so testing beats theory** (Middle): HPP outcomes depend on whether PHP/Apache, Tomcat, or ASP/IIS handles duplicate parameters — you must experiment to confirm how a target behaves.
- **Authentication and CSRF flaws often hinge on missing validation** (Middle): Cases like Shopify's export endpoint and Binary.com's PIN parameter show that absent token checks or credential validation can expose accounts.
- **Reporting is as important as finding** (Late): The book treats the vulnerability report chapter as critical — an unreported or poorly explained bug yields no bounty.
- **Tools help, but curiosity and observation matter more** (Late): The tools chapter is generous but explicitly says nothing replaces creative thinking.
- **Ethics and consequences are part of the craft** (Early): The authors' TV-station stunt and punishment frame hacking as a skill that must be directed responsibly.
【Reading Tips】
- **Skim the front matter and TOC first**, then jump to the vulnerability chapters most relevant to your target or interest — the book is built for non-linear reading.
- **Deep-read the reporting and getting-started chapters** (Late), even if you skim the vulnerability catalog; these convert knowledge into actual bounty outcomes.
- **Treat each example as a case study**: note the difficulty rating, the bounty, and the takeaway, then ask how you would have found the same bug.
- **Pause on parsing and encoding details** (HPP, CRLF, hanging quotes) — these are the hardest conceptual spots and recur across many vulnerability types.
- **Keep it open while testing**: the structure is meant to support lookup during real hunting, not one-time reading.
【Coverage Limits】
This guide is based on stratified excerpts covering the table of contents, author introduction, chapter structure, and selected vulnerability examples; it does not cover every vulnerability chapter or the full text of the tools and resources sections in detail.
Passage locations
Page 4
.... 27 1. Twitter HTTP Response Splitting ......................................................................................27 2. v.shopify.com Response...
View in text
Page 17
We believe this book will be a tremendous guide along your journey.It’s filled with rich, real world examples of security vulnerability reports that resulted...
View in text
Excerpt 3
de of image tags. While doing so, I noticed that the editor would include a single quote within a double quote - what is known as a hanging quote. At that ti...
View in text
Excerpt 4
nload = function(){ var csrf_code = getCSRFcode(url_stats); csrf_url = 'https://eu1.badoo.com/google/verify.phtml?code=4/nprfspM3yfn2SFUBear\ 08KQaXo609JkArg...
View in text
Recommended for You
{{#thumbnailUrl}}
{{/thumbnailUrl}}
{{^thumbnailUrl}}
{{/thumbnailUrl}}
Loading recommended books...
Failed to load, please try again later
Tip the Site
Scan the WeChat Pay or Alipay code to tip. No login required.
WeChat Pay
Alipay