260 lines
44 KiB
HTML
260 lines
44 KiB
HTML
|
<!doctype html>
|
||
|
|
<html lang="en">
|
||
|
|
<center>
|
||
|
|
<head>
|
||
|
|
|
||
|
|
|
||
|
|
<script src="https://cdn.jsdelivr.net/npm/fuse.js/dist/fuse.js"></script>
|
||
|
|
<!-- mathjax -->
|
||
|
|
<script src="https://code.jquery.com/jquery-3.5.1.min.js"></script>
|
||
|
|
<script type="text/javascript" src="/static/js/auto-complete.js"></script>
|
||
|
|
<script type="text/javascript" src="/static/js/lunr.min.js"></script>
|
||
|
|
<script type="text/javascript" src="/static/js/search.js"></script>
|
||
|
|
<link rel="stylesheet" href="/static/stylesheet.css">
|
||
|
|
<link rel="stylesheet" href="/static/auto-complete.css">
|
||
|
|
<br>
|
||
|
|
<title>In the Open</title>
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
|
|
|
||
|
|
|
||
|
|
</head>
|
||
|
|
<body>
|
||
|
|
<!-- topmenu -->
|
||
|
|
<div class="menu">
|
||
|
|
<a href="/" style="text-decoration:none">In the Open</a>
|
||
|
|
</div>
|
||
|
|
<div class="search-container">
|
||
|
|
<label for="search-by"><i class="fas fa-search"></i></label>
|
||
|
|
<input data-search-input="" id="search-by" type="search" placeholder="Search..." autocomplete="off">
|
||
|
|
<!--button type="submit"><i class="search"></i>🔍</button>-->
|
||
|
|
<span data-search-clear=""><i class="fas fa-times"></i></span>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
<div class="menu">
|
||
|
|
</div>
|
||
|
|
<!--br><br-->
|
||
|
|
</center>
|
||
|
|
<p></p>
|
||
|
|
<div class="columns">
|
||
|
|
<!-- Sidebar -->
|
||
|
|
<div class="column column-1">
|
||
|
|
<ul><details id=crypto ontoggle="linkClick(this); return false;" ><summary>Crypto</summary><ul><details id=openssl ontoggle="linkClick(this); return false;" ><summary>Openssl</summary><ul><li><a href="/crypto/openssl/openssl.html">openssl</a></li><li><a href="/crypto/openssl/openssl_engine.html">openssl_engine</a></li></ul></details><li><a href="/crypto/rsa.html">rsa</a></li></ul></details><details id=enumeration ontoggle="linkClick(this); return false;" ><summary>Enumeration</summary><ul><details id=containers ontoggle="linkClick(this); return false;" ><summary>Containers</summary><ul></ul></details><details id=docs ontoggle="linkClick(this); return false;" ><summary>Docs</summary><ul><li><a href="/enumeration/docs/aws.html">aws</a></li><li><a href="/enumeration/docs/cewl.html">cewl</a></li><li><a href="/enumeration/docs/dns.html">dns</a></li><li><a href="/enumeration/docs/docker_enumeration.html">docker_enumeration</a></li><li><a href="/enumeration/docs/ffuf.html">ffuf</a></li><li><a href="/enumeration/docs/gobuster.html">gobuster</a></li><li><a href="/enumeration/docs/kerberoast.html">kerberoast</a></li><li><a href="/enumeration/docs/kubectl.html">kubectl</a></li><li><a href="/enumeration/docs/ldap.html">ldap</a></li><li><a href="/enumeration/docs/linux_basics.html">linux_basics</a></li><li><a href="/enumeration/docs/microk8s.html">microk8s</a></li><li><a href="/enumeration/docs/nfs.html">nfs</a></li><li><a href="/enumeration/docs/nikto.html">nikto</a></li><li><a href="/enumeration/docs/nmap.html">nmap</a></li><li><a href="/enumeration/docs/port_knocking.html">port_knocking</a></li><li><a href="/enumeration/docs/rpcclient.html">rpcclient</a></li><li><a href="/enumeration/docs/rsync.html">rsync</a></li><li><a href="/enumeration/docs/rustscan.html">rustscan</a></li><li><a href="/enumeration/docs/shodan.html">shodan</a></li><details id=snmp ontoggle="linkClick(this); return false;" ><summary>Snmp</summary><ul><li><a href="/enumeration/docs/snmp/onesixtyone.html">onesixtyone</a></li><li><a href="/enumeration/docs/snmp/snmpcheck.html">snmpcheck</a></li></ul></details><li><a href="/enumeration/docs/websites.html">websites</a></li><li><a href="/enumeration/docs/wfuzz.html">wfuzz</a></li><li><a href="/enumeration/docs/wpscan.html">wpscan</a></li></ul></details><details id=network_scanners ontoggle="linkClick(this); return false;" ><summary>Network_scanners</summary><ul></ul></details><details id=windows ontoggle="linkClick(this); return false;" ><summary>Windows</summary><ul><li><a href="/enumeration/windows/bloodhound.html">bloodhound</a></li><li><a href="/enumeration/windows/event_log.html">event_log</a></li><li><a href="/enumeration/windows/manual_enum.html">manual_enum</a></li><li><a href="/enumeration/windows/powershell.html">powershell</a></li><li><a href="/enumeration/windows/rpcclient.html">rpcclient</a></li><li><a href="/enumeration/windows/sysinternals.html">sysinternals</a></li><li><a href="/enumeration/windows/sysmon.html">sysmon</a></li><li><a href="/enumeration/windows/vss.html">vss</a></li></ul></details></ul></details><details id=exfiltration ontoggle="linkClick(this); return false;" ><summary>Exfiltration</summary><ul><details id=dns ontoggle="linkClick(this); return false;" ><summary>Dns</summary><ul><li><a href="/exfiltration/dns/dns.html">dns</a></li></ul></details><details id=linux ontoggle="linkClick(this); return false;" ><summary>Linux</summary><ul><li><a href="/exfiltration/linux/nc.html">nc</a></li><li><a href="/exfiltration/linux/wget.html">wget</a></li></ul></details><details id=windows ontoggle="linkClick(this); return false;" ><summary>Windows</summary><ul><li><a href="/exfiltration/windows/evil-winrm.html">evil-winrm</a></li><li><a href="/exfiltration/windows/loot.html">loot</a></li><li><a href="/exfiltration/windows/smb_connection.html">smb_connection</a></li></ul></details></ul></details><details id=exploit ontoggle="linkClick(this); return false;" ><summary>Exploit</summary><ul><details id=CPUs ontoggle="linkClick(this); return false;" ><summary>CPUs</summary><ul><li><a href="/exploit/CPUs
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
<div class="column column-2">
|
||
|
|
<span class="body">
|
||
|
|
<style>pre { line-height: 125%; }
|
||
|
|
td.linenos .normal { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
|
span.linenos { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
|
td.linenos .special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
|
span.linenos.special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
|
.codehilite .hll { background-color: #2C3B41 }
|
||
|
|
.codehilite .c { color: #546E7A; font-style: italic } /* Comment */
|
||
|
|
.codehilite .err { color: #FF5370 } /* Error */
|
||
|
|
.codehilite .esc { color: #89DDFF } /* Escape */
|
||
|
|
.codehilite .g { color: #EEFFFF } /* Generic */
|
||
|
|
.codehilite .k { color: #BB80B3 } /* Keyword */
|
||
|
|
.codehilite .l { color: #C3E88D } /* Literal */
|
||
|
|
.codehilite .n { color: #EEFFFF } /* Name */
|
||
|
|
.codehilite .o { color: #89DDFF } /* Operator */
|
||
|
|
.codehilite .p { color: #89DDFF } /* Punctuation */
|
||
|
|
.codehilite .ch { color: #546E7A; font-style: italic } /* Comment.Hashbang */
|
||
|
|
.codehilite .cm { color: #546E7A; font-style: italic } /* Comment.Multiline */
|
||
|
|
.codehilite .cp { color: #546E7A; font-style: italic } /* Comment.Preproc */
|
||
|
|
.codehilite .cpf { color: #546E7A; font-style: italic } /* Comment.PreprocFile */
|
||
|
|
.codehilite .c1 { color: #546E7A; font-style: italic } /* Comment.Single */
|
||
|
|
.codehilite .cs { color: #546E7A; font-style: italic } /* Comment.Special */
|
||
|
|
.codehilite .gd { color: #FF5370 } /* Generic.Deleted */
|
||
|
|
.codehilite .ge { color: #89DDFF } /* Generic.Emph */
|
||
|
|
.codehilite .gr { color: #FF5370 } /* Generic.Error */
|
||
|
|
.codehilite .gh { color: #C3E88D } /* Generic.Heading */
|
||
|
|
.codehilite .gi { color: #C3E88D } /* Generic.Inserted */
|
||
|
|
.codehilite .go { color: #546E7A } /* Generic.Output */
|
||
|
|
.codehilite .gp { color: #FFCB6B } /* Generic.Prompt */
|
||
|
|
.codehilite .gs { color: #FF5370 } /* Generic.Strong */
|
||
|
|
.codehilite .gu { color: #89DDFF } /* Generic.Subheading */
|
||
|
|
.codehilite .gt { color: #FF5370 } /* Generic.Traceback */
|
||
|
|
.codehilite .kc { color: #89DDFF } /* Keyword.Constant */
|
||
|
|
.codehilite .kd { color: #BB80B3 } /* Keyword.Declaration */
|
||
|
|
.codehilite .kn { color: #89DDFF; font-style: italic } /* Keyword.Namespace */
|
||
|
|
.codehilite .kp { color: #89DDFF } /* Keyword.Pseudo */
|
||
|
|
.codehilite .kr { color: #BB80B3 } /* Keyword.Reserved */
|
||
|
|
.codehilite .kt { color: #BB80B3 } /* Keyword.Type */
|
||
|
|
.codehilite .ld { color: #C3E88D } /* Literal.Date */
|
||
|
|
.codehilite .m { color: #F78C6C } /* Literal.Number */
|
||
|
|
.codehilite .s { color: #C3E88D } /* Literal.String */
|
||
|
|
.codehilite .na { color: #BB80B3 } /* Name.Attribute */
|
||
|
|
.codehilite .nb { color: #82AAFF } /* Name.Builtin */
|
||
|
|
.codehilite .nc { color: #FFCB6B } /* Name.Class */
|
||
|
|
.codehilite .no { color: #EEFFFF } /* Name.Constant */
|
||
|
|
.codehilite .nd { color: #82AAFF } /* Name.Decorator */
|
||
|
|
.codehilite .ni { color: #89DDFF } /* Name.Entity */
|
||
|
|
.codehilite .ne { color: #FFCB6B } /* Name.Exception */
|
||
|
|
.codehilite .nf { color: #82AAFF } /* Name.Function */
|
||
|
|
.codehilite .nl { color: #82AAFF } /* Name.Label */
|
||
|
|
.codehilite .nn { color: #FFCB6B } /* Name.Namespace */
|
||
|
|
.codehilite .nx { color: #EEFFFF } /* Name.Other */
|
||
|
|
.codehilite .py { color: #FFCB6B } /* Name.Property */
|
||
|
|
.codehilite .nt { color: #FF5370 } /* Name.Tag */
|
||
|
|
.codehilite .nv { color: #89DDFF } /* Name.Variable */
|
||
|
|
.codehilite .ow { color: #89DDFF; font-style: italic } /* Operator.Word */
|
||
|
|
.codehilite .w { color: #EEFFFF } /* Text.Whitespace */
|
||
|
|
.codehilite .mb { color: #F78C6C } /* Literal.Number.Bin */
|
||
|
|
.codehilite .mf { color: #F78C6C } /* Literal.Number.Float */
|
||
|
|
.codehilite .mh { color: #F78C6C } /* Literal.Number.Hex */
|
||
|
|
.codehilite .mi { color: #F78C6C } /* Literal.Number.Integer */
|
||
|
|
.codehilite .mo { color: #F78C6C } /* Literal.Number.Oct */
|
||
|
|
.codehilite .sa { color: #BB80B3 } /* Literal.String.Affix */
|
||
|
|
.codehilite .sb { color: #C3E88D } /* Literal.String.Backtick */
|
||
|
|
.codehilite .sc { color: #C3E88D } /* Literal.String.Char */
|
||
|
|
.codehilite .dl { color: #EEFFFF } /* Literal.String.Delimiter */
|
||
|
|
.codehilite .sd { color: #546E7A; font-style: italic } /* Literal.String.Doc */
|
||
|
|
.codehilite .s2 { color: #C3E88D } /* Literal.String.Double */
|
||
|
|
.codehilite .se { color: #EEFFFF } /* Literal.String.Escape */
|
||
|
|
.codehilite .sh { color: #C3E88D } /* Literal.String.Heredoc */
|
||
|
|
.codehilite .si { color: #89DDFF } /* Literal.String.Interpol */
|
||
|
|
.codehilite .sx { color: #C3E88D } /* Literal.String.Other */
|
||
|
|
.codehilite .sr { color: #89DDFF } /* Literal.String.Regex */
|
||
|
|
.codehilite .s1 { color: #C3E88D } /* Literal.String.Single */
|
||
|
|
.codehilite .ss { color: #89DDFF } /* Literal.String.Symbol */
|
||
|
|
.codehilite .bp { color: #89DDFF } /* Name.Builtin.Pseudo */
|
||
|
|
.codehilite .fm { color: #82AAFF } /* Name.Function.Magic */
|
||
|
|
.codehilite .vc { color: #89DDFF } /* Name.Variable.Class */
|
||
|
|
.codehilite .vg { color: #89DDFF } /* Name.Variable.Global */
|
||
|
|
.codehilite .vi { color: #89DDFF } /* Name.Variable.Instance */
|
||
|
|
.codehilite .vm { color: #82AAFF } /* Name.Variable.Magic */
|
||
|
|
.codehilite .il { color: #F78C6C } /* Literal.Number.Integer.Long */</style>
|
||
|
|
<div class="column column-3">
|
||
|
|
<ul>
|
||
|
|
<li><a href="#re-registration">Re-registration</a></li>
|
||
|
|
<li><a href="#usage">Usage</a></li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
<h1 id="re-registration">Re-registration</h1>
|
||
|
|
<p>Let's understand this with the help of an example, say there is an existing user with the name admin and now we want to get access to their account so what we can do is try to re-register that username but with slight modification. We are going to enter " admin"(notice the space in the starting). Now when you enter that in the username field and enter other required information like email id or password and submit that data. It will actually register a new user but that user will have the same right as normal admin. And that new user will also be able to see all the content present under the user admin.</p>
|
||
|
|
<h1 id="usage">Usage</h1>
|
||
|
|
<ul>
|
||
|
|
<li>Re-register. The name is taken, that's the point, but alter the string</li>
|
||
|
|
</ul>
|
||
|
|
<div class="codehilite"><pre><span></span><code><span class="w"> </span><span class="n">try</span><span class="w"> </span><span class="n">to</span><span class="w"> </span><span class="n">register</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="n">user</span><span class="w"> </span><span class="n">name</span><span class="w"> </span><span class="n">darren</span><span class="p">,</span><span class="w"> </span><span class="n">you</span><span class="p">'</span><span class="n">ll</span><span class="w"> </span><span class="n">see</span><span class="w"> </span><span class="n">that</span><span class="w"> </span><span class="n">user</span><span class="w"> </span><span class="n">already</span><span class="w"> </span><span class="n">exists</span><span class="w"> </span><span class="n">so</span><span class="w"> </span><span class="n">then</span><span class="w"> </span><span class="n">try</span><span class="w"> </span><span class="n">to</span><span class="w"> </span><span class="n">register</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="n">user</span><span class="w"> </span><span class="s">" darren"</span><span class="w"> </span><span class="k">and</span><span class="w"> </span><span class="n">you</span><span class="p">'</span><span class="n">ll</span><span class="w"> </span><span class="n">see</span><span class="w"> </span><span class="n">that</span><span class="w"> </span><span class="n">you</span><span class="w"> </span><span class="n">are</span><span class="w"> </span><span class="n">now</span><span class="w"> </span><span class="n">logged</span><span class="w"> </span><span class="n">in</span><span class="w"> </span><span class="k">and</span><span class="w"> </span><span class="n">will</span><span class="w"> </span><span class="n">be</span><span class="w"> </span><span class="n">able</span><span class="w"> </span><span class="n">to</span><span class="w"> </span><span class="n">see</span><span class="w"> </span><span class="n">the</span><span class="w"> </span><span class="n">content</span><span class="w"> </span><span class="n">present</span><span class="w"> </span><span class="n">only</span><span class="w"> </span><span class="n">in</span><span class="w"> </span><span class="n">Darren</span><span class="p">'</span><span class="n">s</span><span class="w"> </span><span class="n">account</span><span class="w"> </span><span class="n">which</span><span class="w"> </span><span class="n">in</span><span class="w"> </span><span class="n">our</span><span class="w"> </span><span class="k">case</span><span class="w"> </span><span class="n">is</span><span class="w"> </span><span class="n">the</span><span class="w"> </span><span class="n">flag</span><span class="w"> </span><span class="n">that</span><span class="w"> </span><span class="n">you</span><span class="w"> </span><span class="n">need</span><span class="w"> </span><span class="n">to</span><span class="w"> </span><span class="n">retrieve</span><span class="p">.</span><span class="w"></span>
|
||
|
|
</code></pre></div>
|
||
|
|
</span>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div id="footer">
|
||
|
|
|
||
|
|
<p></p>
|
||
|
|
<center>
|
||
|
|
© Stefan Friese
|
||
|
|
</center>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<script>
|
||
|
|
function linkClick(obj) {
|
||
|
|
if (obj.open) {
|
||
|
|
console.log('open');
|
||
|
|
if (sessionStorage.getItem(obj.id) && !(sessionStorage.getItem(obj.id) === "open")) {
|
||
|
|
sessionStorage.removeItem(obj.id);
|
||
|
|
}
|
||
|
|
sessionStorage.setItem(obj.id,"open");
|
||
|
|
console.log(obj.id);
|
||
|
|
|
||
|
|
} else {
|
||
|
|
console.log('closed');
|
||
|
|
sessionStorage.removeItem(obj.id);
|
||
|
|
|
||
|
|
}
|
||
|
|
// if (obj.open) {
|
||
|
|
// console.log('open');
|
||
|
|
// if (sessionStorage.getItem("opened") && !(sessionStorage.getItem("opened") === obj.id)) {
|
||
|
|
// sessionStorage.removeItem("opened");
|
||
|
|
// }
|
||
|
|
// sessionStorage.setItem("opened", obj.id);
|
||
|
|
// console.log(obj);
|
||
|
|
|
||
|
|
// } else {
|
||
|
|
// console.log('closed');
|
||
|
|
// sessionStorage.removeItem("opened");
|
||
|
|
//
|
||
|
|
// }
|
||
|
|
}
|
||
|
|
|
||
|
|
//if ( sessionStorage.getItem("opened")) {
|
||
|
|
// var item = sessionStorage.getItem("opened")
|
||
|
|
// document.getElementById(item)['open'] = 'open';
|
||
|
|
//}
|
||
|
|
let _keys = Object.keys(sessionStorage);
|
||
|
|
if (_keys) {
|
||
|
|
for ( let i = 0; i < _keys.length; i++ ) {
|
||
|
|
document.getElementById(_keys[i])['open'] = 'open';
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
// const detailsElement = document.querySelector('.details-sidebar');
|
||
|
|
// detailsElement.addEventListener('toggle', event => {
|
||
|
|
// if (event.target.open) {
|
||
|
|
// console.log('open');
|
||
|
|
// if (sessionStorage.getItem("opened") && !(sessionStorage.getItem("opened") === detailsElement.id)) {
|
||
|
|
// sessionStorage.removeItem("opened");
|
||
|
|
// }
|
||
|
|
// sessionStorage.setItem("opened", detailsElement.id);
|
||
|
|
// console.log(detailsElement);
|
||
|
|
//
|
||
|
|
// } else {
|
||
|
|
// console.log('closed');
|
||
|
|
// sessionStorage.removeItem("opened");
|
||
|
|
//
|
||
|
|
// }
|
||
|
|
// });
|
||
|
|
//
|
||
|
|
// async function fetchIndexJSON() {
|
||
|
|
// const response = await fetch('/index.json');
|
||
|
|
// const index = await response.json();
|
||
|
|
// return index;
|
||
|
|
// }
|
||
|
|
// // Extract the `q` query parameter
|
||
|
|
//var queryStringRegex = /[\?&]q=([^&]+)/g;
|
||
|
|
//var matches = queryStringRegex.exec(window.location.search);
|
||
|
|
//if(matches && matches[1]) {
|
||
|
|
// var value = decodeURIComponent(matches[1].replace(/\+/g, '%20'));
|
||
|
|
//
|
||
|
|
//
|
||
|
|
// // fetchIndexJSON()
|
||
|
|
// // .then(index => { console.log(index['index']);});
|
||
|
|
// // Load the posts to search
|
||
|
|
// fetch('/index').then(function(posts) {
|
||
|
|
// // Remember to include Fuse.js before this script.
|
||
|
|
//
|
||
|
|
// var fuse = new Fuse(posts, {
|
||
|
|
// keys: ['title', 'tags', 'content'] // What we're searching
|
||
|
|
// });
|
||
|
|
//
|
||
|
|
// // Run the search
|
||
|
|
// var results = fuse.search(value);
|
||
|
|
// //console.log(results);
|
||
|
|
//
|
||
|
|
// // Generate markup for the posts, implement SearchResults however you want.
|
||
|
|
// // var $results = SearchResults(results);
|
||
|
|
//
|
||
|
|
// // Add the element to the empty <div> from before.
|
||
|
|
//// $('#searchResults').append($results);
|
||
|
|
// });
|
||
|
|
//}
|
||
|
|
</script>
|
||
|
|
|
||
|
|
<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@2/MathJax.js"></script>
|
||
|
|
<script src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML" type="text/javascript"></script>
|
||
|
|
</script>
|
||
|
|
<script type="text/x-mathjax-config">
|
||
|
|
MathJax.Hub.Config({
|
||
|
|
config: ["MMLorHTML.js"],
|
||
|
|
jax: ["input/TeX", "output/HTML-CSS", "output/NativeMML"],
|
||
|
|
extensions: ["MathMenu.js", "MathZoom.js"]
|
||
|
|
});
|
||
|
|
</script>
|
||
|
|
</body>
|
||
|
|
</html>
|