Nilesh Kumar

Sometimes, during file upload we come across situation wherein there would be check on the file extension at the client side as well as server side too. If the application does allow only .jpeg extension to be uploaded, the client side java script checks for the extension of the file before passing the request. We all know that how easily this can be defeated. Some applications, checks for the extension at the server side also. That's not easy to bypass. However there are some ways with which it still can be bypassed. Most of server side scripts are written in high level languages such as Php, Java etc who still use some C/C++ libraries to read the file name and contents. That leads to the problem. In C/C++ a line ends with /00 or which is called Null Byte. So whenever the interpreter sees a null byte at the end of the a string, it stops reading thinking it has reached at the end of the string. This can be used for the bypass. It works for many servers, specially php servers. T...

I have seen many a times, even though there's already a Burp cert is installed on the Android device, the browser throws an error and Burp does not capture the request. This issue is mostly prevalent with Kitkat 4. As browser errors can be bypassed by clicking Proceed, but Banking apps keep throwing 'SSL Error' messages. Not sure what happens, but below works for me in such cases: 1. Download the Burp certificate. It'll be downloaded as 'cert.der' 2. Go to download folder, rename it as 'cert.cer' . Recommend to have a file explorer app which makes renaming easy. 3. Copy it to /storage/sdcard0 folder. 4. Go to Settings-> Security-> Trusted Credentials-> User. Remove the old Portswigger (Burp) certificates. 5. Go to Settings-> Security-> Install from device storage. Tap it and it installs your new certificate automatically. Now you are done. You'll notice all well now, the app communications being intercepted by Burp. Maybe ...

jtool comes with a capability of running on Linux environment. Some ipa scanning tools are created to run on Linux environment where mac environment is not available. In such cases tools such as otool and class-dump-z will not work. So jtool can be an alternative to otool. For more information on jtool please refer to http://www.newosxbook.com/tools/jtool.html . It lists down various commands which have same output as otool or a equivalent. There are several commands mentioned in link. But for our customized requirements and basis checks I have listed down the below ones after running on many binaries. The outputs are similar or equivalent to otool and class-dump-z: Commands for checking PIE flag (ASLR) in jTool jtool -d -v -arch | grep stack ·           Automatic Reference Counting (ARC) protection: jtool -d -v -arch | grep _objc_release ·           To check if the devic...

This continues from my earlier posts on SQLi in search fields: http://nileshkumar83.blogspot.sg/2012/10/sql-injection-in-search-field.html I recently found one sqli which was both in nature- generic sqli and blind sqli. As I have already said, search boxes are always an unusual suspect and we tend to generally overlook them. But the field was not vulnerable to simple queries like ' or ''=', would have missed it if would not have tried similar to ' or ''='' or ''='. I fired Burp intruder and got a couple of more payloads which worked. Still I am not able to understand the difference between these two queries, why they yield different results. Anyways, the sqli got exploited and the app displayed all the records from the table. Now turn for blind sqli: The same field was also vulnerable to blind sqli. This became more important as the automated tools such as SQLmap, failed due to some errors or the apps being unstable. So it is p...

Run the following commands: First go the path of your vdi: /var/root/VirtualBox VMs/Linux/Linux.vdi and then run this command: VBoxManage modifyhd Linux.vdi --resize Output will be similar to this: 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100% and you are done. Sometimes you require superuser privileges to go into above directories. Just type suod -s, it'll present a bash shell, using which you should be able to enter the VM directory and then follow the above commands. Should be easy.

Both are pretty powerful tools when it comes to intercept and modify http communications. But at some point of time, they become even more powerful combo if tied with each other. They complement each other. In a recent pentest I came across a similar situation where in Burp was not able to intercept a specific kind of traffic and Fiddler came to rescue. The application was designed to upload video. The initial communication was straight forward, I mean logging into application, filling up the video details etc. And all these were easily captured by Burp except the point where you hit the Upload Video and it connects to a different server and surprisingly it was not captured by Burp, not sure why, even after repeated attempts. So, I fired Fiddler to see if the it sees this request. But it's a;ways to play with requests using Burp due to it's various functionalities like, Intruder, Repeaters etc. But it was necessary to capture this request in Burp. So the below steps can be...

Sometimes the iOS binary contains the symbol table which provides information about symbols linking a specific function in the binary. Presence of symbol tables make run time analysis of the binary easy for the attackers using gdb, cycript tools etc. So, it's recommended to strip the symbols off the binary. The following commands shows the symbols linked to the funcion:  # nm 0001556ad t _mySecretFuncion An easy way to strip them is to use Strip command or strip the symbol table of C/C++ function information is by going into Xcode and changing around the Deployment Postprocessingand Strip Linked Product flags to YES.