Our latest roundup of notable technical research kicks off with web security pioneer

 breaking new ground again with his latest Black Hat USA presentation.

The PortSwigger director of research begins his writeup for ‘

Listen to the whispers: web timing attacks that actually work

’ by urging his peers to start listening to the “timing oracles” pervading websites since they are “eager to divulge their innermost secrets”. His latest 

 promises to “unleash novel attack concepts to coax out server secrets including masked misconfigurations, blind data-structure injection, hidden routes to forbidden areas, and a vast expanse of invisible attack-surface”. 🔥 With hypothetically-sound web timing attack techniques all too often failing when applied to real-world scenarios, he illustrates each technique for exploiting this neglected side-channel “with multiple real-world case studies on diverse targets”. The researcher also provides “battle-tested open-source tools” and a CTF. 👏

, a researcher of comparable renown, has unearthed another vast attack surface linked to architectural problems with 

Exploiting Hidden Semantic Ambiguity in Apache HTTP Server

’, which also featured at Black Hat, Tsai revealed how he pioneered 20 ‘confusion attack’ techniques and found nine related vulnerabilities. 

 He has cited the biggest highlights as escaping from DocumentRoot to System Root, bypassing built-in ACL/Auth with just '?', and turning XSS into RCE with legacy code from 1996. 💪 He also warned that more types of confusion attacks will emerge “unless the Apache HTTP Server undergoes architectural improvements or provides better development standards”.

The PortSwigger team had a productive August, with two of Kettle’s colleagues also publishing impressive research. 

 into access control bypasses and even RCE, and provides a CTF for road-testing the skills duly acquired. 🔥 And in 

Gotta cache 'em all: bending the rules of web cache exploitation

’ (👏 great title), Martin Doyhenard explores how various HTTP servers and proxies behave when parsing specially crafted URLs, as well as RFC ambiguities that create path confusion. He also details novel techniques for abusing parser discrepancies to achieve arbitrary web cache poisoning and deception in numerous websites and CDN providers. 💪

 a series of ‘broken access control vulnerabilities’ on a 

that, they claim, enabled attackers to read other users’ messages, access attachments (photos and videos) from their chats, and update someone else’s profile info, among other misdeeds. 😲 In a six-month disclosure timeline, the vendor apparently said the vulnerabilities have now been addressed.

A vulnerability in FIDO devices that use the Infineon SLE78 security microcontroller allows attackers to extract Elliptic Curve Digital Signature Algorithm (ECDSA) secret keys and 

, the side channel attack requires extended physical access, specialized equipment, and advanced understanding of electronics and cryptography. Credit goes to NinjaLab's Thomas Roche, who previously devised a side-channel attack that enabled the 

A pair of writeups concerning security weaknesses in 

 to flag next. 🤖 First, Microsoft has seemingly 

remediated a vulnerability enabling a chain of exploits

 affecting the chatbot, including prompt injection via a malicious email (or hidden in a shared document); automatic tool invocation without a human in the loop to read other emails or documents; ASCII Smuggling to stage, to the user invisible, data for exfiltration; rendering hyperlinks to attacker-controlled domains (websites, mailto:); and, optionally, conditional prompt injection. 

Second, Tenable Research has detailed a critical information-disclosure vulnerability in 

server-side request forgery (SSRF) that leveraged Copilot’s ability to make external web requests

. Combined with an SSRF protection bypass, the SSRF, which has now been patched, gave the researchers access to internal infrastructure for Copilot Studio.

Advanced server-side template exploitation with RCE everywhere

Our very own bug hunter and researcher enablement analyst has produced a pair of nifty hacking writeups since our last edition. 👊 In 

limitations are just an illusion: Advanced server-side template exploitation with RCE everywhere

, Brumens explains some novel techniques for exploiting SSTIs

with complex, unique payloads that leverage default methods and syntax from various template engines. Better still, he achieves RCE 

without needing any quotation marks or extra plugins

 within the templates. Brumens also found time to pen a writeup on how to 

perform white-box penetration testing on a Python web application

 running in a Docker container, and perform 

 in order to track our payloads throughout the process, and understand how security filters can hide vulnerabilities in plain sight. 💪

 on the topic at NahamCon 2024 has landed. As well as learning filter collision, transformation and space-excluding techniques on Dojo, now you can leverage 

 to turn your payload into a web application firewall nemesis. 🧠

We already have proof for the concept that open source vulnerabilities can have a catastrophic impact, in the form of the landmark 

 bug. The location of the devastating flaw, 

, happens to be among seven public Bug Bounty programs operated by the Sovereign Tech Fund, which invests in open digital infrastructure to ensure a resilient and sustainable open source ecosystem. 🌐 The comparable ubiquity of the other programs’ technologies – 

Systemd, GNOME, ntpd-rs, OpenPGP.js, Sequoia PGP 

 – means it’s not hyperbolic to say that finding similarly critical bugs in these programs could help to prevent some pretty devastating downstream impacts. 💥 Mindful of the significance of these programs, we’ve 

 and, indeed, the satisfaction of helping to secure some pretty fundamental digital infrastructure. 💰

To mark Cybersecurity Awareness Month – starting tomorrow – we’re also giving away exclusive swag for any valid bugs reported to our #OpenSource programs 🎯 🎁 This is part of our ‘OPEN the code; SOURCE the bounty’ campaign.

 with one of the world’s most successful hunters, 

. Among other things, the Israeli hacker shares his journey into Bug Bounty, revisits his most memorable bug discovery, reveals the secrets behind his success, discusses currently productive scopes, and offers invaluable advice for aspiring bug hunters. 💎

As well as financial rewards and invites to private programs, an ultimate dividend of all this hunting education and advice could be a place on our 

and the respect of your peers. To this end, let us give thanks to and express admiration for all-time runaway leader 

(third for Q3, and recent climber into the 

Xel was among those to add to their points tally through participation at our live Bug Bounty in Rome over the weekend

, the maker of Ferrero Roche, Kinder Bueno and other sweet-packaged delights. The event took place at RomHack 2024

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

invited participants to exploit a CWE-73: External Control of File Name or Path vulnerability

and read a file containing the challenge flag.

We are delighted to announce the winners of Dojo Challenge #35 below.

Want to create your own monthly Dojo challenge? Send us a message on X (Twitter)!

 feeds to be notified of upcoming challenges.

Read on to find out how one of the winners managed to solve the challenge.

We asked you to produce a qualified report explaining the logic allowing exploitation, as set out by the challenge. 

To ensure contestants actually solved the challenge themselves rather than copy-pasting the answer from elsewhere.

To determine contestants' ability to properly describe a vulnerability and its vectors within a professionally redacted report. This gives us invaluable hints on your unique talent as a bug hunter.

We want to thank everyone who participated and reported to the Dojo challenge. Many other high quality reports were submitted alongside those of the three winners. 😉

Below is the best write-up overall. Thanks again for all your submissions and thanks for playing!

An Arbitrary Local File Overwrite occurs when an attacker can overwrite specific local files on a target system with arbitrary content. This vulnerability typically arises due to insecure handling of file paths or poor validation in web applications, software, or systems.

This attack may lead to the disclosure of confidential data via local file inclusion, denial of service or remote code execution and other system impacts.

We are presented with a web application allowing us to send messages on a chat. We can give it a JSON file with the message content and recipient as input.

When analyzing source code, it's important to start with the entry point. In our case, this means retrieving user input. This user input first passes through the Web Application Firewall, which URL-encodes it. User input has been replaced in the following code by the 

 is first decoded using the decodeURIComponent() function. This acts as the inverse function of the URL encoding performed by the Web Application Firewall.

 If the user input is non-empty, it is parsed as JSON using 

. If the input format is not a valid JSON, then an error log is generated.

 At the last line, the “to” and “msg” arguments of this JSON are retrieved and used into the 

 class constructor. The initialization of the variable 

 was used as a hint to identify the JSON format, i.e. 

Code analysis - Part 2: Message class & its usage

The previous piece of code is followed by:

This is the only call to a method of the 

 class in the whole provided code. This method 

 should therefore be analyzed in details.

 which corresponds to the message recipient

 which corresponds to the content of the message

 which corresponds to the where the message is stored 

(in reality, in this code: the message is never really sent, it is simply stored in a file)

 method, which consists of two lines whose purpose is:

 argument, using a timestamp followed by the user input 

The line of code of interest here is the first one, let's see in details:

 argument, corresponding to the location where the file will be saved on the filesystem, takes as its value the return value of the 

 function is defined like this in NodeJs:

. Which means that a file is displayed in a format 

In its documentation, we can see that only the last part of the path is retained. Which means that adding a directory separators "

" would allow us to modify the return value of the function and retain only the part to the right of the separator.

In practice it means that if we send a value in the format "

This vulnerability allows us to write to a file in the target "file-write folder". Also, thanks to the second line of code, we can fill this file with any content we like.

If the newly created file was publicly accessible with execution rights, then we could have had a Remote Code Execution.

Code analysis - Part 3: Render of index.ejs

It renders and executes the EJS template present in the 

 argument of the message object created previously.

The code allows to write to file in the local folder with control over its name in 

Putting it together, we create a payload to overwrite the index.ejs file with any content:

 file has been replaced by our test content.

EJS is a templating language that lets us generate HTML markup with plain JavaScript. It has an 

 function that allows us to include any file in the file system if it has an extension (i.e. allowing Local File Inclusion). By default, the 

 extension is used, but it can be replaced by any other extension.
In order to retrieve the content of the flag.txt file, we use the following JSON payload :

Retrieving the flag : FLAG{W1th_Cr34t1vity_C0m3s_RCE!!}

Files such as /etc/passwd have no extension and are not recoverable via this type of payload.

Some sensitive files could be recoverable but are not available in this challenge. Example files: 

 with environment variable present at the root of the project (either in the write folder or one of its parent folder)

Arbitrary Local File Overwrite vulnerabilities pose significant security risks to systems. By exploiting these vulnerabilities, attackers can gain access to sensitive files on the server, execute remote code, or retrieve confidential data.
This can lead to privacy breaches, data integrity violations, or even complete compromise of the system. Vulnerable applications often include web services and other applications that handle user input data without properly controlling it, exposing these systems to significant risks of exploitation by malicious actors.

To protect against this vulnerability, we recommend following these measures:

Rigorously validate and filter the user input before processing it. Ideally, compare the user input with a whitelist of permitted values. If that isn't possible, verify that the input contains only permitted content, such as alphanumeric characters only. In our case it would prevent the directory separator "

After validating the supplied input, append the input to the base directory and use a platform filesystem API to canonicalize the path. Verify that the canonicalized path starts with the expected base directory and that the file respects the expected standards. In our case it would be a verification that the timestamp is present and that file is what we expect it to be (filetype/extension is correct, content is text only...)

 Educate developers and security teams on best practices for securing user inputs in web services.

By implementing these measures, you can effectively reduce the risks of such vulnerabilities in your applications and systems.

https://nodejs.org/api/path.html#pathbasenamepath-suffix

https://cwe.mitre.org/data/definitions/22.html

Dojo challenge #35 winners!

Halloween 🎃, Oktoberfest 🍺, and World Smile Day 😊 are not the only notable events happening next month… Our latest roundup of offensive security insights for CISOs, security teams and security-conscious devs begins with a reminder that 17 October is another date to mark in your calendar if you have a security role in an organisation providing critical services within the EU.

That’s the deadline by which member states must transpose the Network and Information Security (NIS) 2 Directive into national law. We’ve compiled 

10 need-to-know facts for organisations that might be affected

, which is designed to achieve “a high common level of security of network and information systems across the Union” more effectively than its 2016 predecessor, NIS 1. Or for a more in-depth explainer of NIS 2 and the implications for your SecOps strategy 

In this roundup (originally published as a LinkedIn newsletter called 

) we’d also like to flag the (fairly) recent publication of 

Gartner’s latest Hype Cycle for Security Operations

assess the maturity and value of a given security innovation

, whether it’s cyber AI assistants or pentesting-as-a-service, and their capability to adopt it. 🛠️ 

The Hype Cycle (to which no technology is seemingly immune) is visualised on two axes – mapping rising, falling then stabilising expectations of a given technology over time as reality outruns hype. The cycle always runs through five phases: innovation trigger, peak of inflated expectations, trough of disillusionment, slope of enlightenment, and plateau of productivity. It’s an interesting and valuable read from an independent, data-driven and respected market research firm. 📈

, widely considered to be one of the most talented and effective ethical hackers in the world. 👇 Nagli was speaking during his participation at our 

 recently shared his thoughts on the impressive 

 podcast, with Fredrick Lee joining co-hosts David Spark and Andy Ellis for the latest, beautifully-named episode, ‘

I Said I Was Technically a CISO, Not a Technical CISO

’ (they have form for great titles, with the previous instalment called ‘

Everyone Has a Zero-Trust Plan Until They Get Punched in the Face

Among other CISO-focused content we’ve browsed this week, notable highlights include a

interview with Sailaja Kotra-Turner, CISO and director of global infrastructure at

 (owner of Jack Daniel’s whiskey 🥃), and a piece exploring 

, for which journalist Sam Birchall spoke to a CISO and cyber firm CEO. 🤝

The continuing rise in the volume of new vulnerabilities is unsurprising, we admit – but we’ll flag it anyway! A 

 reveals that the number of new CVEs rose 43% year-on-year between H1 2023 and H1 2024, continuing the inexorable surge that began in 2017. The report also investigates trends in state-sponsored activity, new threat actor groups and why 

 are being targeted at an accelerated rate. 🧐

 on another all-too-common “clash of interpretations surrounding who reported a flaw, when it was discovered, how severe it is, and whether the resulting patch is adequate”, when it comes to coordinated vulnerability disclosure. This particular episode pertains to a ‘spoofing’ flaw fixed as a “defence-in-depth” issue in Trident, 

’s proprietary browser engine for Internet Explorer, which Trend Micro’s Zero Day Initiative (ZDI) team claims was an RCE that warranted a higher CVSS. 🔒

Other new content in our wheelhouse that might be worth a peek is a 

Inside the ‘three billion people’ data breach

Troy Hunt, founder of data breach notification site 

 and Microsoft regional director, has documented 

’, his blog post centres on National Public Data, “a data aggregator most people had never heard of where a 'threat actor' has published various partial sets of data with no clear way to attribute it back to the source. And they're already the subject of a class action”. The vendor is apparently claiming that 

 1.3 million people were affected, although Hunt discovered 134 million unique email addresses in the related data dump – which would amount to around 100 emails per individual if both of these numbers are accurate, 

We’re super-excited to break new ground next month when we run Italy’s 

 in Rome on 28 September. The identity of the organisation involved will, as usual, be kept under wraps until the event is about to begin. Learn about the 

Just in case you happen to be in the countries in question at the time, YesWeHack will also be showcasing our vulnerability management solutions at 

, (Nuremburg, Germany; 22-24 October). 📅🌍

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

This article explains how to perform white-box penetration testing on a Python web application running in a Docker container. In this white-box pentest, we will go through how to debug Python in VS Code in order to track our payloads throughout the process, and understand how security filters can hide vulnerabilities in plain sight.

Improve future black-box testing with code analysis

Visual Studio Code aka VS Code (or your preferred IDE)

, you can install the Python debugger extension from the extension tab on the left-hand side. Simply search for "

Our project will use the following file structure:

, and must be added or modified. The files below contain the final file content:

This is the vulnerable Python web application that we will run in a dockerised environment.

In our supervisord.conf file the only thing we need to modify is the 

python -m debugpy --listen 0.0.0.0:5678 --wait-for-client /app/6-ssti-classic.py

 to make sure our debugger listener starts once our Docker container boots up.

This will be the configuration used to tell Visual Studio Code how to connect to the Python Debugger running in a Docker container.

As well as building the Docker image, the Dockerfile installs and activates our Python debugger inside the Docker container.

To this file we will add a network called debug-net. We will then add a static IPv4 address to our Python web application: 172.20.0.111. Finally, we will open Python's debugger port: 5678.

This setup allows us to more effectively connect and communicate with the Python debugger running in the Docker container.

To validate that our setup is working properly, we need to start our Docker container, connect to Python Debugger, set up breakpoints in Visual Studio Code and, finally, perform a request to the web application to see if the debugger stops at these breakpoints.

Usually, you want to start this command in the background (using the argument 

), but if you’re unfamiliar with Docker, I recommend running the command as it appears above so that you can see the logs. Once the Docker container has finished the build process and starts, we notice this message from our Python debugger:

This message shows that our Docker started successfully and that Python’s debugger is now listening for a connection and primed to start debugging Python.

Now let's set up some breakpoints inside the Python web application code located in Visual Studio Code!

We can set up breakpoints by clicking on the red dot that appears when you hover over the line number.

Inside VS Code, go to the debugger section on the left-side panel (shortcut: 

). Once inside the debug section, press the green arrow icon located at the top (

With the debugger in Visual Studio Code is up and running and connected to Python's debugger, you should now see in the terminal that the Python web application is running.

Now our debugger is connected, it's time to perform a HTTP request to trigger the Visual Studio Code breakpoints. We can use the command line interface (CLI) tool cURL to send a GET request to our web application:

If everything goes as expected, you should not get a response back directly. Instead you should have some code highlighted inside VS Code that proves the debugger is working and that it stopped at the first breakpoint:

Now we know our setup and debugger are working as expected, it's time for the bug hunt.

As you may have already noticed, our web application is vulnerable to a server-side template injection (SSTI) vulnerability. Let’s try an SSTI payload: 

Next we analyse the request we sent containing our payload in the 

 GET parameter. In Visual Studio Code, we can see a breakpoint hit:

We then click the blue, triangular arrow at the top (the first arrow from left to right):

Take a close look at the debug side panel to the left: our payload, which was included in the GET parameter 

 Python variable. But you might also notice that the payload has been HTML-escaped – so in theory, if the web application is vulnerable to a SSTI, we should get an error.

Let's move to our next breakpoint to see what final input is given to the template engine:

, is HTML-escaped by the Python function 

And as predicted, we got a 500 server error in our HTTP response!

To confirm that the vulnerability now exists, we can use the payload 

 and see how Python reacts this time using VS Code's debugger:

Looking at our debugger result, we can see that everything looks good!

 appearing in the HTTP response from our vulnerable web application!

Now that we understand how our payload is being escaped and inserted, we can adapt the payload to exploit the web application and achieve a remote code execution (RCE)!

Because our payload is HTML-escaped before it is inserted into the template string, we cannot take advantage of quotes. And without being able to write the command as a pure string, it will be more challenging to provide a system command. Luckily, we have a solution: Read ‘

Limitations are just an illusion: Advanced server-side template exploitation with RCE everywhere

’ to learn how to achieve RCE without using quotation marks in your payload.

The YesWeHack Blog

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

Dojo challenge #35 winners!

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

White-box penetration testing: Debugging for Python vulnerabilities

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

Limitations are just an illusion - advanced server-side template exploitation with RCE everywhere

White-box penetration testing: Debugging for Python vulnerabilities

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Dojo challenge #34 winners!

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

DON'T WAIT FOR THE THREATS TO STRIKE

Products

Researchers

Resources

Company

Follow us