sharma7ay
commented
1 year ago how can we rxploit fastjson-1-2-47-rce
here is no any path only domain show please provide full path that can be easy to exploit manually
Open princechaddha opened 1 year ago
sharma7ay
commented
1 year ago how can we rxploit fastjson-1-2-47-rce
here is no any path only domain show please provide full path that can be easy to exploit manually
princechaddha
commented
1 year ago @sharma7ay, could you please clarify what you mean by "here is not path only domain"? Are you suggesting that there is no specific path mentioned in the raw request within the fastjson-1-2-47-rce template?
Here are the IDs of templates that solely match based on the interact callback, but there can be instances where false positive results occur when running against a honeypot or a host that indiscriminately sends callbacks to any URL it receives in GET/POST data. To mitigate such cases, we can consider the following approaches:
Add additional matcher from the request endpoints and use them with the callback to confirm the vulnerability. You can refer to this template as an example: CVE-2021-33357.
If there is no response on the endpoint, we can extract any string from the
{{BaseURL}}to confirm the product. Using DSL condition matching, we can verify the product and the callback to confirm the presence of a vulnerable host.In the case of Remote Code Execution, we can add a payload with curl and include an additional matcher to verify if the user-agent was set to curl for the callback. This template can serve as an example: CVE-2020-11981.
By using these mitigation approaches, we can minimize false positive results and ensure more accurate identification of vulnerabilities.