Mostrando entradas con la etiqueta captcha. Mostrar todas las entradas
Mostrando entradas con la etiqueta captcha. Mostrar todas las entradas

domingo, 7 de mayo de 2023

Capture TryHackMe Writeup


Scanning

We scan the open ports with the nmap tool with scripts and software versions.

 > nmap -sVC -p- --min-rate 5000 10.10.183.73 -Pn -n -oN nmap-10.10.183.73.txt  
 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 22:10 CEST  
 Nmap scan report for 10.10.183.73  
 Host is up (0.058s latency).  
 Not shown: 65534 closed tcp ports (conn-refused)  
 PORT  STATE SERVICE VERSION  
 80/tcp open http  Werkzeug/2.2.2 Python/3.8.10  
 | http-title: Site doesn't have a title (text/html; charset=utf-8).  
 |_Requested resource was /login  
 | fingerprint-strings:   
 |  FourOhFourRequest:   
 |   HTTP/1.1 404 NOT FOUND  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:27 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Content-Length: 207  
 |   Connection: close  
 |   <!doctype html>  
 |   <html lang=en>  
 |   <title>404 Not Found</title>  
 |   <h1>Not Found</h1>  
 |   <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>  
 |  GetRequest:   
 |   HTTP/1.1 302 FOUND  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:22 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Content-Length: 199  
 |   Location: /login  
 |   Connection: close  
 |   <!doctype html>  
 |   <html lang=en>  
 |   <title>Redirecting...</title>  
 |   <h1>Redirecting...</h1>  
 |   <p>You should be redirected automatically to the target URL: <a href="/login">/login</a>. If not, click the link.  
 |  HTTPOptions:   
 |   HTTP/1.1 200 OK  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:22 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Allow: HEAD, GET, OPTIONS  
 |   Content-Length: 0  
 |   Connection: close  
 |  RTSPRequest:   
 |   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"  
 |   "http://www.w3.org/TR/html4/strict.dtd">  
 |   <html>  
 |   <head>  
 |   <meta http-equiv="Content-Type" content="text/html;charset=utf-8">  
 |   <title>Error response</title>  
 |   </head>  
 |   <body>  
 |   <h1>Error response</h1>  
 |   <p>Error code: 400</p>  
 |   <p>Message: Bad request version ('RTSP/1.0').</p>  
 |   <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.</p>  
 |   </body>  
 |_  </html>  
 |_http-server-header: Werkzeug/2.2.2 Python/3.8.10  

domingo, 30 de octubre de 2022

Google Search captcha evasion + GooFuzz tool


Today I bring you a way to bypass the Google Search captcha.

Surely the image below sounds familiar to you, it is when Google Search detects suspicious activity and kindly asks us to solve a captcha to continue searching.

Meeting Google friends

Facebook has a utility for developers called "Echo debugging", in which it allows searches on a website, for example my blog:


As you can see in the image, from this Facebook resource we could get to see the source code of a website, but we will need to be authenticated and for that we will need to have a Facebook account.


Thinking outsite the box

Being clear that we can see the source code of a website (so far nothing relevant), it occurred to me to cross a search to Google Search filtering by the domain "nasa.gov", in the following image it is shown how it is possible to obtain results from Google Search from this utility.



So I tried several executions with different special dorks and noticed that at no time did it ask to solve the security captcha due to suspicious activity (It seems that they completely trust Facebook :P)

The following image shows a search for PDF files in the "nasa.gov" domain:


I know friend, it also occurred to me that this advantage could be used to automate it in a tool ;)

What is GooFuzz?


GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the target's server and by means of advanced Google searches (Google Dorking).


Although GooFuzz ​​​​does not require the use of Facebook cookies, I did find it interesting to add a functionality to evade the captcha and be able to make more requests on the browser.


By taking advantage of the "ByPass" functionality, we can use a dictionary of 100 words maximum without being blocked.

....SNIP.....

Proof of concept video with avoidance option:



What does Google think about this?

This was discovered a few years ago, where they mentioned that it was not a vulnerability, but I have to say that they have been silently solving it (another case of "Bad bounty").


Conclusions

Without going into detail about whether or not it is a vulnerability or deficiency, what it reveals is that an attacker would be able to abuse this technique to make massive requests and evade the search engine's detection system (captcha).

Thank you for your time in reading this article and I hope it has been of interest.

Until next time!