Elvis Wiki - User contributions [en]

Ffuf

2023-01-03T14:12:31Z

FBirnegger: /* Fuzz for Subdomains */

[[File:Ffuf_logo.png|thumb|Ffuf Logo]]

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show the most important flags and different commands for the most useful use-cases. It can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist and (optional) Keyword after semicolon
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
==== Fuzz for directories ====
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: to specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===
==== Fuzz for Subdomains ====
ffuf -w wordlist.txt:FUZZ -u http://FUZZ.SERVER_IP:PORT/

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===

==== Fuzz for parameter names in GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== Fuzz for parameter names in POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
==== Fuzz for directories recursively ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T14:10:57Z

FBirnegger: /* Enumerate files with certain extensions */

[[File:Ffuf_logo.png|thumb|Ffuf Logo]]

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show the most important flags and different commands for the most useful use-cases. It can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist and (optional) Keyword after semicolon
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
==== Fuzz for directories ====
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: to specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===
==== Fuzz for Subdomains ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===

==== Fuzz for parameter names in GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== Fuzz for parameter names in POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
==== Fuzz for directories recursively ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T14:07:40Z

FBirnegger: /* Summary */

[[File:Ffuf_logo.png|thumb|Ffuf Logo]]

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show the most important flags and different commands for the most useful use-cases. It can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist and (optional) Keyword after semicolon
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
==== Fuzz for directories ====
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===
==== Fuzz for Subdomains ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===

==== Fuzz for parameter names in GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== Fuzz for parameter names in POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
==== Fuzz for directories recursively ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T14:04:31Z

FBirnegger: /* Input & Output */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist and (optional) Keyword after semicolon
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
==== Fuzz for directories ====
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===
==== Fuzz for Subdomains ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===

==== Fuzz for parameter names in GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== Fuzz for parameter names in POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
==== Fuzz for directories recursively ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T14:03:47Z

FBirnegger: /* Directory Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
==== Fuzz for directories ====
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===
==== Fuzz for Subdomains ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===

==== Fuzz for parameter names in GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== Fuzz for parameter names in POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
==== Fuzz for directories recursively ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T14:03:07Z

FBirnegger: /* Recursive (Directory) Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
Generic command
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===
==== Fuzz for Subdomains ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===

==== Fuzz for parameter names in GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== Fuzz for parameter names in POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
==== Fuzz for directories recursively ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T14:02:43Z

FBirnegger: /* Parameter Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
Generic command
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===

==== Fuzz for parameter names in GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== Fuzz for parameter names in POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
To find directories recursively.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T14:01:39Z

FBirnegger: /* Vhosts Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===
Generic command
ffuf -w wordlist.txt -u http://SERVER_IP/:PORT/FUZZ

=== Page Fuzzing ===
==== Fuzz the file extensions ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

==== Enumerate files with certain extensions ====
ffuf -w lowercase.txt:FUZZ u http://SERVER_IP:PORT/FUZZ -e .php,.html,.txt
* -e: specify the extensions

==== Fuzz filenames ====
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ.php

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===
==== Fuzz for VHosts ====

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===
To find parameter names.

==== GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
To find directories recursively.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T13:58:46Z

FBirnegger: /* POST Requests */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===

=== Page Fuzzing ===

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===
To find Vhosts.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===
To find parameter names.

==== GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value

=== Recursive (Directory) Fuzzing ===
To find directories recursively.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T13:57:01Z

FBirnegger: /* Vhosts Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===

=== Page Fuzzing ===

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===
To find Vhosts.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: FUZZ.SERVER_IP

* -H: to determine HTTP Header field with value

=== Parameter Fuzzing ===
To find parameter names.

==== GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value; multipe

=== Recursive (Directory) Fuzzing ===
To find directories recursively.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T13:55:52Z

FBirnegger: /* Recursive (Directory) Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===

=== Page Fuzzing ===

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===
To find Vhosts.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: Fuzz.SERVER_IP

=== Parameter Fuzzing ===
To find parameter names.

==== GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value; multipe

=== Recursive (Directory) Fuzzing ===
To find directories recursively.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T13:55:26Z

FBirnegger: /* Vhosts Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===

=== Page Fuzzing ===

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===
To find Vhosts.

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/ -H ‘Host: Fuzz.SERVER_IP

=== Parameter Fuzzing ===
To find parameter names.

==== GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value; multipe

=== Recursive (Directory) Fuzzing ===
To find directories recursively.

ffuf -w /opt/useful/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T13:54:26Z

FBirnegger: /* Recursive (Directory) Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===

=== Page Fuzzing ===

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===

=== Parameter Fuzzing ===
To find parameter names.

==== GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value; multipe

=== Recursive (Directory) Fuzzing ===
To find directories recursively.

ffuf -w /opt/useful/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T13:54:00Z

FBirnegger: /* Parameter Fuzzing */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==
Ffuf is a web fuzzer written in Go. It Is pre-installed in Kali Linux and sponsored by Offensive Security. The tool can be used for different Fuzzing use-cases and it supports recursive Fuzzing.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
$sudo apt install ffuf

== Cheatsheet ==
=== Useful flags ===
==== Match & Filter ====
* '''-mc''' : Match response codes
* '''-mr''' : Match regex pattern
* '''-ms''' : Match reponse size
* '''-fc''' : Filter response codes
* '''-fr''' : Filter regex pattern
* '''-fs''' : Filter reponse size

==== Input & Output ====
* '''-w''' : Wordlist
* '''-mode''' : Operation Mode (Clusterbomb, Pitchfork)
* '''-request''' : File with a HTTP request
* '''-o''' : Output file
* '''-of''' : Output file format

=== Directory Fuzzing ===

=== Page Fuzzing ===

=== Subdomain Fuzzing ===

=== Vhosts Fuzzing ===

=== Parameter Fuzzing ===
To find parameter names.

==== GET Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php?FUZZ=key -fs xxx

==== POST Requests ====
ffuf -w parameter-wordlist.txt:FUZZ -u http://SERVER_IP:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

* -X: to determine the HTTP Method
* -d: to determine POST data
* -H: To use HTTP Header field with value; multipe

=== Recursive (Directory) Fuzzing ===

ffuf -w /opt/useful/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

* -recursion: to enable recursive Fuzzing
* -recursion-depth: to determine the recursion depth
* -v: to output the full URL for a better overview

== Courses ==
* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==
* https://github.com/ffuf/ffuf#installation
* https://www.kali.org/tools/ffuf/

[[Category:Pentesting]]

Ffuf

2023-01-03T13:44:51Z

FBirnegger: /* Recursive Fuzzing */

Ffuf

2023-01-03T13:44:22Z

FBirnegger: /* Recursive Fuzzing */

Ffuf

2023-01-03T13:44:01Z

FBirnegger: /* Recursive Fuzzing */

Ffuf

2023-01-03T13:43:37Z

FBirnegger: /* Recursive Fuzzing */

Ffuf

2023-01-03T13:40:03Z

FBirnegger: /* Cheatsheet */

Ffuf

2023-01-03T13:39:33Z

FBirnegger: /* Cheatsheet */

Ffuf

2023-01-03T13:27:27Z

FBirnegger:

Ffuf

2023-01-03T13:25:17Z

FBirnegger: /* References */

Ffuf

2023-01-03T13:24:05Z

FBirnegger:

Ffuf

2023-01-03T13:23:20Z

FBirnegger: /* References */

Ffuf

2023-01-03T13:22:05Z

FBirnegger: /* Overview */

Ffuf

2023-01-03T13:21:47Z

FBirnegger:

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Overview ==

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with

$sudo apt install ffuf

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:21:01Z

FBirnegger: /* Summary */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with

$sudo apt install ffuf

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:20:43Z

FBirnegger: /* Overview */

== Overview ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with

$sudo apt install ffuf

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:19:46Z

FBirnegger: /* Installation */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with

$sudo apt install ffuf

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:19:35Z

FBirnegger: /* Installation */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with

$sudo apt install ffuf

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:19:17Z

FBirnegger: /* Installation */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with

$sudo apt install ffuf

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:16:12Z

FBirnegger: /* Installation */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
`$sudo apt install ffuf`

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:15:56Z

FBirnegger: /* Requirements */

== Summary ==
This Wiki Entry is about the Tool ffuf (Fuzz Faster You Fool). The article will show different commands for the most useful use-cases and can be utilized as a cheatsheet.

== Installation ==
If you are using Kali Linux you can use ffuf straight away because it is pre-installed. If you are using another Linux Distribution you can install the tool with
´$sudo apt install ffuf´

== Cheatsheet ==
...

=== Directory Fuzzing ===

== References ==
...

[[Category:Pentesting]]

Ffuf

2023-01-03T13:14:49Z

FBirnegger: /* Summary */

UPnP vulnerabilities

2022-01-04T23:09:03Z

FBirnegger: /* Mirai Botnet */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]<ref name="mirai"/>

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* <ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>
* <ref name="mirai">https://www.imperva.com/blog/how-to-identify-a-mirai-style-ddos-attack/</ref>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T23:08:32Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* <ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>
* <ref name="mirai">https://www.imperva.com/blog/how-to-identify-a-mirai-style-ddos-attack/</ref>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T23:05:46Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* <ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T23:03:20Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* <ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T23:03:04Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==
<references>

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* <ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

</references>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T23:02:05Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==
<references>

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/

</references>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T22:58:40Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==
<references>

<ref name="upguard">https://www.upguard.com/blog/what-is-upnp</ref>
<ref name="devicearch">https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf</ref>
<ref name="gitcallstranger">https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp</ref>
<ref name="fbi">https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices</ref>
<ref name="ocf">https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards</ref>
<ref name="iot">An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020</ref>
<ref name="sdk">https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk</ref>
<ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

</references>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T22:56:41Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==
<references>

<ref>https://www.upguard.com/blog/what-is-upnp</ref>
<ref>https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf</ref>
<ref>https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp</ref>
<ref>https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices</ref>
<ref>https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards</ref>
<ref>An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020</ref>
<ref>https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk</ref>
<ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

</references>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T19:26:21Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==
<references>

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* <ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

</references>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T19:25:08Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* <ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T19:24:03Z

FBirnegger: /* References */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* <ref name=callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>

[[Category:Basics]]

UPnP vulnerabilities

2022-01-04T19:22:32Z

FBirnegger: /* CallStranger Attack */

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]<ref name="callstranger"/>

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/

[[Category:Basics]]

UPnP vulnerabilities

2021-12-21T21:04:53Z

FBirnegger:

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.

[[File:Mirai-botnet-diagram.png]]

== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/

[[Category:Basics]]

UPnP vulnerabilities

2021-12-21T21:02:51Z

FBirnegger: Created page with "== Summary == This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol. == UPnP == UPnP is a protocol stack whi..."

== Summary ==

This document is about the general vulnerability and also about two well-known vulnerabilities of the UPnP protocol.

== UPnP ==

UPnP is a protocol stack which allows devices to connect to a network withouth further manual configuration. The automatic configuration by the UPnP protocol includes IP address assignment, port forwarding and eventing.
This is done with a networking architecture which uses the TCP/IP protocol as well as other internet protocols like HTTP and DHCP. In a UPnP Network there are always one or more control devices (e.g. a router)
and one or more service devices. (e.g. Smartphones, Printers, Smart Home Devices, etc.) This makes UPnP an easy and flexible way to provide connectivity in a network.

== UPnP Vulnerability ==
There are many known vulnerabilities and security risks when talking about the UPnP
Standard. On the Common Vulnerability and Exposure (CVE) website 130 different
known vulnerabilities with the keyword ̈UPnPcan be found. Also, some known state
institutions, like the FBI have publicly recommended to disable UPnP in general. The
reason, according to the FBI Webpage, is that there are UPnP exploits which allow
access to different IoT devices. Not only these known vulnerabilities make security such
an important issue when talking about UPnP. The standard has also some general
vulnerabilities by design. In some steps in UPnP networking there is no verification, integrity check or access control. There are also some UPnP SDKs which can be exploited.

== CallStranger Attack ==
In attack type, malicious actors send UPnP SUBSCRIBE requests to a target in which the CALLBACK header value is
modified. The CALLBACK head value indicates to which machine the answer should be send to. With this vulnerability the callbacks could be directed anywhere. This attack could allow:
• Scanning of internal ports
• Reflected or amplified DDoS attacks
• Bypassing DLP and network security to exfiltrate data
The “CallStranger” Attack was fixed in April 2019

[[File:upnp_callstranger.jpg]]

== UPnP Flash Attack ==
This attack type is starting off with the victim opening a malicious SWF (Adobe Flash Player) file in the browser. This starts a silent attack
which sends UPnP requests to the victim’s browser. These requests could open ports on the victim’s
computer or change the primary DNS-Server of the victim. The UPnP Flash Attack is still not fixed and thus, it is still possible to carry out this attack.

== Mirai Botnet ==
A real-world example of a large-scale UPnP attack is the Mirai Botnet which was discovered in 2018.
In this attack hundreds of thousands of routers over the internet where scanned and the attack
software was searching for exposed Telnet ports which were added by UPnP. The Attackers BruteForced the default passwords of the devices and added these to the botnet.
The botnet was then used to start large-scale DDoS attacks which shut down some target servers. A depiction of a simplified DDoS Attack with the Mirai Botnet can be seen in the picture below.
[[File:Mirai-botnet-diagram.png]]
== Courses ==

* [[Ausgewählte Kapitel der IT Security]] (2021)

== References ==

* https://www.upguard.com/blog/what-is-upnp
* https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf
* https://github.com/yunuscadirci/CallStranger/blob/master/CallStrangerhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
* https://www.fbi.gov/news/stories/cyber-tip-be-vigilant-with-your-internet-of-things-iot-devices
* https://openconnectivity.org/developer/specifications/upnp-resources/upnp/standards
* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp+sdk
* https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/

[[Category:Basics]]

File:Mirai-botnet-diagram.png

2021-12-21T21:02:13Z

FBirnegger:

File:Upnp callstranger.jpg

2021-12-21T20:56:48Z

FBirnegger: