hey everyone thanks for tuning in
for my talk today about vulnerability
inheritance
finding bugs is calling bounties and
third-party integrations
so let's go along to conduct my session
on the deathcon absolute village
and i hope you all will enjoy it and
learn some stuff
for the future about bounty hunting
experience
who am i my name is danielle and what is
three years old
i'm an absolute researcher at anti
security i'm a bsc computer science
student
i'm doug monty hunter by guerrillas of
natalie on haka one
background and cena and then my personal
blog
will post like apps on at the
gardner.com
so please for the session today
how will this session benefit you
we'll talk about cell party integrations
i'll give you examples of subpart
integrations
why should we find programs and
sometimes integrations and how to
identify assets running
self-doubt integrations later
we'll go over the concepts improve your
sub number of currencies flow
locate all bounty targets running a
certain volatile component
and create nuclear templates for mass
figure heating tasks
after the reconnaissance fund we will
look over
a short overview of the attack vectors
enchanting olympia
and some proof of concept for my own
background experience
approaching the mountains in 2021 the
number of lag monthly programs
is a never-ending list there are so many
problems
with so many assets to test and explore
which assets should be focused on after
the economic phase
is a question often often been asked by
background
hunters a possible solution for this
question
would be targeting the assets maintained
by self-taught integrations
let's go to the cell county integration
first there are html based self-help
integrations
such as intel from live chat analytics
of marquette
and billing of stripe
secondly and this is the part we will
focus more on the session today
our dns based integrations such as
customer service of zendesk
e-commerce shopify marketing of overcame
problems service blogs webinar teaching
and basically there are a lot more
self-party vendors
who offer integrations of certain
functionality for our websites
what are the benefits of targeting and
celebrant integrations
first the writing shows there are many
vendors around different angles
so there are many more many vendors to
find bugs on
there are many types of them they are
all in different niches
so we can find some specific business
projects around
on different vendors which will affect
the target we are
targeting with our background team
hunting
second we'll be deploying forget
strategy offer the blind spot for the
target
after the initial configuration so after
our
target implements his help disposal for
example
he will go over the initial
configuration but he won't monitor it
from
any emerging cves or vulnerabilities
which are not assigned cvds
but are considered a web zero days or
one day
which have been published on expert dbo
on twitter
it can affect the target
the cell phone will be one bug many more
of the assets
it will find the bug or set but even
though every asset on the internet
who uses this vendor is affected
the final point would be defense
mechanisms are not enforced
on dns integrations if we have strict
one of csp
on our main critical assets it will
probably
not imply on the subdomain that we are
hosting
which actually talia said a self-party
vendor
so if we host the submarine with the
scenic third party integration
it will most likely not have the strict
workforce thing
but we've set to protect our main
website
in this session we'll be focusing on the
dns based cell targeting preventions
first let's go over how does dns based
integration work
so we have c name and a reports
before diving into the integration flow
let's take a look at the following
example
about c name and a records so this is an
example from wikipedia
and for example we have dna zone as the
following we have bothered the subdomain
for example.com
with a scenario and we have the full
submarine
with an airport to a certain iphone
what we actually do when we send to uofl
the browser tab
we actually issue an a record lookup for
the bounce underneath
the resultant looks of a record for an
ip to display the contents of our
website
but because it actually points to a
ceiling icon it will check again
if foo have an arrow for the island he
will go there or the c name
until he finds an ipads when we are
looking at full
we will find the idea that specified we
can know the content
for bob for the initial search
let's have another example of support
subdomain
example.com to be help desk and exam
disk
so the flow is in the form we have the
customer to visit the support subdomain
the result will be new for the support
subdomain a records
or its dns account it will find
that it has a cnn record to extend this
subdomain
named example now
we know the example subdomain and
zendesk
actually have an error called display so
what
the resolver will do now it will look
for the dns records of the example in
subdomain
and zendesk it will find that it has an
error code which will display the
contents
of the example some domain at our
support
subdomain at the main website we look
for
so the main takeaway would be the
supports of the way that example the
phone
is aliasing the example domain and
zendesk
the contents presented with the target
subdomain are exactly as in the
understand banking integrity website
so now let's go over the reconnaissance
parts
the flow will be divided into two key
areas
the first will beat on the scanner's set
fundamentals
integrated with our tablet we'll do
subdomains lookup for it
passive active permutation we will
resolve the subdomains
and we will extract the name of the
result domains
the second phase would be to discover
assets maintained
by self-party vendor we will use google
notes reversing and lookup
customer space and past fingerprinting
with nuclei so friends
let's discover windows integrated with
our target
we will take wildcard.example.com
with our example target
so we'll start with some numbering
policies
first we'll do passive standards
these are the tools that i use when i do
passive atomic super
sample finder chaos hamas robot
github sandalwoods and the cure rates
they all have in common that those are
passive supplements look up tools
we don't issue any active requests to
our target
they are collecting data from different
resources on the internet
the expected output for these bosses
would be generic subunits
such as hem admin david trump
many bad monkey hunters stopped at this
phase they think they found all the
available sentiments on the internet our
target
and they continued their hunting for
this point this is a huge mistake
because this they miss a lot of demands
but relying only on passing something
soccer the second phase would be active
which is wood boxing i use pure dns for
the botox
and acetone list for the longest
the expected output will be unique
sergeants such as administered
suv assets internal debt
and test stage the cell
and another important phase would be
permuted saturated
which has dnsg for the permutated
generation of the substance
the expected output would be unique to
rooted subjects
such such as int advanced then qa
test then dash assets or panel dash s
we take the entire sub that we found
after this point
and the editing critical and
non-internal
sub domain names to those endpoints to
see if there are
some variations to specifically to our
target
leaving one of these steps aside will
will leave you with less arguments than
your competitors
and you will surely find less of the
rest of your target so it's critical to
follow each of these steps
when you're doing about multi-hunting
and especially with the reconnaissance
phase
the next step would be to resolve the
collected subjects
we reduce fuel dns for it we will ask
you to resolve
the list of subdomains which we found
after this point
we will use the resolvence text file we
will save the results
on the resolve subdomains dot txt
later we will extract the ceiling
records for the result submarines
using http install we will issue the
ceiling plan
the regret for closing bracket to
display
only the submarines which end the scenic
record
as we can look on halfway one subdomains
we can see that there are a few cell
party integrations
that they are using like zendesk cloud
for from hosting the gs link centering
google flip for the resources and
details for some of the documentation
now we'll go for exploitation after we
extend the senior records and the result
domains
we should opt to ignore the following
defense will be exploitation on the
scene in providing instance
to find the required communities there
will be more to follow in the circles
and the second will be for the subways
for non-syrian related wonders such as
on exodb
or twitter to see someone that reported
the unique
effect in certain window you need to
check if any of the adventures you found
actually have some bugs published on the
internet
the second phase will be to discover
assets maintained by vendor
let's take our demo set part integration
willian.com
as an example so what we'll do now
will strengthen the internet utilizing
certain google drives such as the in
your way of intent
will look for the first c name for the
customer's page
and for the past campaign so then
let's detect patterns is google document
the first pattern to detect will be
common subordinated
for example if our vendor is providing a
learning area
as well.com most of the assets which
will be the customers apart
will create a new level subdomain to
host the contents of it
so we can use the site keyword of the
google docs to look for every website
which have the learning keyword and
submarine
we will issue this request from google
cell we will find all submarines
all assets on the internet which ever
learn something
second you can use the credits of the
html page
often vendors love to present power by
section
or power by line by the end of the html
page
we can use this to find more instances
of the same vendor
with the in-text hero of the woman
the cell would be with the page title
similarly before many vendors love to
put on the title
the name so we can use the entitled
keyword of google
to search for every asset that google
knows that
ended in its title window platform
the second step to go would be to find
the dell series
when we look for targets we can know
which of our
what are the scenarios of our targets
but we can't do it the other way around
we can't ask our c name who points to it
the only way to do it would be to look
on some online crawlers
which scan the entire internet and
scroll the data
of their websites on the databases doing
so
they have a list of websites and the
senior records
so what we can actually do we can
navigate one of these sites
and we will ask it do you know any
senior record
with the record of willem.com
then it will display from the database
all the assets
that they found before that have a
senior record
to a vulnerable event so i gave you a
few examples
like spicy rapid seven shonen profile
and sundays
we provide such
the services will be customers page
often vendors have to present their big
customers on the trusted buy pages when
you go to the marketing websites at the
double down
you can find it if you scroll down below
the customers drafted by
often some of these will advance the
programs and it makes the job easier for
us
finding one of their assets
the final point will be past
fingerprinting we will be weaponizing
nuclear
let's take a look on the real world
scenario that i found six months ago
of open redirect on all singletrip
instances
which is a teaching platform
the signatures that indicates the
vulnerability
will be a synonym record pointing to
anything under thinkific.com
and that the first of the url is api sso
v2 sso jwt
go to android.com will actually direct
us to apple.com
so now we found that every asset which
operates under thinkific is affected so
we want to find all assets
affected by the vulnerability we don't
want to go over each subdomain
and try on the set browser central the
following path
to see for the redirection so we'll use
nuclei for our help
let's look for them how to create a
nuclear template
we'll go over each field and the step
this is the yaman file for the single to
be the leg i've shown before
and now we'll get a little bit deeper
into it
first we have the id which is their
length name
when match is found when you found when
you find a vulnerable website
the tool will be telling us in the
result the id contents
in our example think it to the direct
the second part of the yaml file
would be the infrared we have
the also feel the awesome key is the
awesome name
the severity key is the severity we set
for our vulnerability
it will be printed out when we find
image
and with the simple networks it does as
i said here is regulate
because if you want to scan for all
opening direct on all our assets
or every template that actually provides
operator
uh open event opportunities so we can
issue a scan
to scan only for templates with the
direct tag
this is what is used next we have the
request
route when to specify the method we
won't do it
we want our request to lose in our
example will be get
now we need to specify the vulnerable
path which will indicate that the
vulnerability actually exists
in our case it's the same example as
i've shown before
now we want to specify our matches we
want to
we want the tool to alert us if there is
vulnerability
so we need to tell it what to look for
what html is formed
to indicate that there is an actual
vulnerable instance in front of us
so i want to use two matches here so i
use the matches condition key
with the end value
i want the first matcher to be a status
point i want the statistic to be
co2 which indicates the direction
the next matcher should be a word i want
a certain word
in the http response to indicate to me
that
the request actually directed us to the
website i specified
but it wasn't as simple as neo2
direction to another subdomain
but it was interaction to every.com
so we specify the words the value that
it tells to us when the redirection
actually occurred
so when there is a singer to be the leg
he issues the following message
on the a h return with everything.com
and certain qualifiers like shown in the
picture
so it corresponds the request we send to
the past we've said about
includes the following wall we have
default we found a volatile asset
and we specify that we want the response
to be on the body part of the html
now we want to execute the template on
our http prompt server
so you start for the node http segment
we specify nuclei with the template of
synthetic direct
and as you can see in the results it
alerts to us
that we found a significant which is the
id
and this is one subdomain of my
background in target
that is actually affected by the
vulnerability so if i will copy the link
that i got as a result from the nokia
and based on the page
you will direct me to every dot com
that's important the concepts part we
will see some of this example practical
in the publish concept
section now let's go to the attack
networks
so we found the cell phone integration
what volume type should we look for
i suggest focusing on rotation attention
to client-side vulnerabilities
such as excesses and open elements for
the following reasons
one they are easier to discover two
the cell then belongs to the vendor we
need to remember that if we attach a
cell party integration as a c name or
with an iq
the iprs is actually the vendors what we
find
rce or ssr it's a legitimate
vulnerability but it affects the vendor
we want to find the abilities to change
to affect our boundary target and not
the vendor
so it's better to focus on climate
cycles
the third point will be changing but so
we want to find a small
band that will help us to have greater
impact
on the target we are hunting
so let's look at the attack vectors and
chaining for impact
first we have dns configurations such as
subdomain takeover
and done in data circuits something we
take over the codes
when we add a subdomain that points to
an instance
like shopify s3 bucket
in the azure instances which the record
is no longer claimed
by the organization but on the register
the settlement still points to that
record
what we will do when we get to the
server rain and then the content
presented
on the target sun domain will be in our
control
then in dns regardless is actually
really similar
we can take for example eip fade aws
if our target used on this registrar to
point on an eip
supplement on an elastic ip and then
he released the elastic ip from his
adwords account
we didn't change his records we can move
off for elastic repeat until we get the
match our target
and the impact is actually the same as
other rectangle
the second part would be plant side
vulnerabilities
such as corset flipping and openly
direct
now the chain for these vulnerabilities
on our main asset the main template
mental multi target
will be what business logic errors for
example
we can take over shopify subdomain and
put our credit card on it
so customers will make purchases on the
sound domain of the target thinking
it's in legitimate websites to make
shopping website
for target but the money will go to us
where of course bypasses if the main if
our target on his main
asset functionality relies on the
requesting issue
from one of his subdomains even when
consequently
or any dns configuration we can send we
can send requests
for the subdomain of the target so we
can bypass the course
protections which look forward
originating
for one subdomain from target
cook is expectation we can exfiltrate
cookies called
the main dimensional target that can
lead to account therefore
sslv microsoft if we have certain
functionality
which issue requests for central missile
same of our target
and it only allows to put subdomains for
target
if we end openly direct or of course
expecting
dns records we can actually convert the
middle action to another
internal resources of our target by
doing so we can write us
ssr protections and almost like i said
if we direct you again to any allowed
subdomain for target
and we control the intellectual center
for a certain subdomain
you can issue a direct which will
possibly lick the
oscar from victim 12 controlled instance
so these are the attack methods and the
chance we can do
and i hope it will be more clear with
the proof of concept
section so now let's look at some plc
the first one will be ssrn f6e stored
xss and open iterate
on the central webinars window which
would be that for the stock
although the vulnerabilities are already
fixed
our target was events.haploid.com
and the three reports are already
distraught for my account for about four
months
and you can look at the links that are
provided after the talk is made
so what i actually did i wanted to find
some ads on hockey one cell
so i did a standalone sense and i found
events.happyone.com as one of the
saturdays
it looked actually it looked actually a
little weird for me
because it doesn't look like the actual
development that everyone uses on the
main website or
other summaries so i had the suspicion
that it
it's actually a ceiling so when i'm in
the scene and open it
i've actually seen the response with the
ceiling totally ducted webinars vendor
later i wanted to perform endpoints
before the sense
on the scenery to do that i used way to
kill accumulates tool
by tom longnong which fetches the same
endpoints file target for weighted
archive
i looked for any url param welcome
follow to it to find opening delay sslf
it's something that i usually do after i
search for endpoints on a certain target
and in that sponsor request i've seen
the following
day facts conferences get recorded
slides xmln.xml
will create around few of them it sounds
really bonus
so the question is will the endpoint
fetch external assets or xml files and
render those if he does i can achieve
exercise
on hacker once update i thought there is
no chance
to happen because we're talking about
haka one here and finding a subdomain
wallet really hard
although it actually worked the vendor
with the conferences get recorded inside
xml url
fetched the contents at presenting on
attacking.com
x67 or you can see in the ipfree myself
this exercise payload on an xml file
and i managed to achieve a process
scripting on hacker one server
i reported this to haka one and several
other
programs from happy one in background
and they got a few bunches from it
the next one will be stored openly
direct on a teaching platform
they tell this on twitter snapchat
amazon facebook
and the vendor was intended
so what i've done was looking for bugs
on twitter so i did several concepts on
later i found that slice for twitter.com
that takes lightsaber
and twitterflightschool.com itself i'll
point you with a cinnamon record
to intel.com we can look on the page
rendered under twitterclasscool.com we
can actually see the power by
signature that we discussed earlier with
internal valuement
so what i did i was calling the
application for any vulnerable airports
and i found the following widgets
experience destination url
which accepted any external asset
that have put at the destination neural
key
value and redirected to it what actually
happened
is if the victim visited the url before
whenever he tries to navigate to any
endpoint on twitterslifeschool.com
or the other twitter subdomains it will
issue a request to get
student and redirects him with co2
status
to every dot com so it's actually stored
open direct
he can't navigate to any other
functionality on the italian website
he's navigated on
and every time he hits research
navigates to another endpoint
you will then be directed to our control
domain in this case to emmy.com
the only way to fight out for me was to
clean the cookies or close the browser
session
so after i found out the vulnerability
and i've seen that it's actually running
on the tail room
i wanted to do the velocity lookup
i used spicy for this particular cave
and i looked for any c name which
includes internal or isreco
i found out two results one from amazon
the one for facebook
which offers lag monty programs
themselves as well so it was nice to see
the vulnerability that i found from
hannibal twitter
affecting facebook and amazon from the
same hunting session
so we posted this to twitter and the
report is already disclosed
and uploaded to several other followers
and made some nice launches for it as
well
the next one will be stored in success
through email marketing innovation
there are many private formats affected
and the vendor is oracle responses
the viewing browser feature allows
customers to view their emails on the
browser
with a dedicated dedicated sideway of
our target
so as you can see from the pictures in
the right there are some emails after we
sign
up that allow us to view the view in
browser
or can see this email click here html
injection handling or images is quite
common
but considered as a low impact issue as
you can see from the image of the right
therefore targeting bounty targets
utilizing responses in the templates
which provides the viewing problem
functionality will help us escalate the
html
injection issue to start whatsapp
scripting on the targets
so what i did i found that responsive
uses certain pattern for the urls
displaying the client emails
which includes the following string pad
it says
short link i'll use the following google
though
with the in url google key and it helped
me locate some interesting targets
when you prone to installed and
successful mobility
what i did i supplied first and last
name inputs on silent phones
of anytime any bounty target who uses
responses
with an xss payload like shown below of
image slc
and i waited to receive emails like the
following structure
for the instance of the email i wanted
to see only the closing time
it means that there might be a rendering
of my email
and after we see some indication like
the picture shown
and clicked on viewing browser
clicking on the view and browser button
will direct using the expected time
domain
for the target so as you can see from
the pictures i found center installed
excesses
after clicking on the view involved
because the page rendered our first last
name
with the crosstalk scripting page so
reported it with several parts of guns
and got some bounties from it so it was
very nice
the next one it's not public yet but
it's important to start already
it's an opening director on staff
network 7.8
the targets are many programs and the
vendor is set
so the discovery as i was testing a new
program
and manually manually went to something
and found an interesting endpoint which
indicated this
actually running itself so i was
authenticated to some functionality
of the submarine and they wanted to log
off the following point was accepted
through a post request simply changing
it to a get
and setting my website at the redirect
url value
resulted in an open indirect within more
than ten thousand websites
we didn't suffer so when i tried to log
off
from the subdomain it issued a post
request
for a change to get and put my own blog
at the directory and i hadn't
vulnerability
so what i did i created the nuclear
template to skyrocket
i want to alert for a vulnerability with
the response in exchange to our request
on
any subdomain that i had in my records
by providing the following path
we'll return the status for the co2 to
the direction
and the location header of my blog
gallery.com
so i ran it on my targets and i found
several of these
which elected big the subway direct with
the link of the vulnerable instance
so i actually found 142 times affected
and reported several of these i
discovered these nest mines
so they are probably long time affected
that i didn't scan
let's go over the summary of the talk
so the key takeaways i wanted to take
from this session
is about one attacking surprise
integration is profitable
and it's fun finding a single bag that
affects many assets
gives you more profit and more value for
the work you dedicate
instead of finding single single
specific bugs on tablets
the second point would be the constant
it's a critical part
of successful backpacking you can't rely
on your possible sources you want to
find as
much subdomains as possible scaling
up equals saving time you can't navigate
to medium
submarines with a certain stream to
search it it's vulnerable
you have to use no clearing of other
tools as long as you send
hundreds of requests a second to many
subdomains
instead of doing the manual work the
sell will be impact
always opt for chaining bugs there's
nothing wrong with toting
law or medium bugs too many problems as
long as it is in scope
and you get value from it and the last
point is anyone can do it
not nonsense the vulnerabilities that
presented in this session
was really complex to find we just need
to know
what to look at so i thank you very much
for tuning in
you can hit me up with feedback or
follow questions on my twitter
at nebula and i thank you all and i wish
you
a very happy and successful event going
forward
thank you very much