Exam Notes with username wiener and password peter after every invalid

login attempt and thus reset the timer  The right

or password  So the account that will get locked has our right
username which we will then need to bruteforce.
enumerated username will have a significantly different
Authentication response time than the rest of the other users.
We set the first payload to the usernames wordlist  Set the second
payload to be an invalid username followed by $$ to append NULL
2 Then we can enumerate the password in the same way payloads to it with Cluster bombs options and force this to repeat 5 times
Username enumeration via different responses
but have the usernames set to change between per user.

This lab can simply be solved by bruteforcing usernames <right username> and wiener and passwords change between The right username will get an error message showing that it got locked
wordlist with any single invalid password → the right the tried password and peter to make a successful login After getting the username simply brute force the password wordlist with
username will give a response length different from the rest. attempt after every try. sniper → the right password will give no response with status code 200 .

Then take this username and brute force its password simply
We can also solve this lab by simply using Pitch Fork attack → supplying an
with the given password wordlist until a response code 302
X-Forwarded-For:<num> in the first payload to spoof the IP of the request and
is obtained or a response with a different length is obtained make sure its a number from 1-1000  Then simply putting payload 2 as the
enumerated usernames wordlist and its also important to set the password
Username enumeration via subtly different responses very long to make the request take longer for a valid username.

Sometimes when all responses have different lengths we can We can double check a username to be valid by right click its request → Brute-forcing a stay-logged-in cookie
send to repeater → check if the response time is still high (bottom right
fetch for the response message when a username is trying to number in milliS ) Cookies in this lab are basically the string <username>:<hashed
log in  In this case a wrong username gives Invalid username
password> encoded in base64  which means we can brute
or password. but a right username gives Invalid username or Broken brute-force protection, IP block
force the cookies of carlos by simply sending carlos:<md5 hash
password without a . at the end  We can brute the
We can simply bypass IP blocks by iterating each incorrect thatʼs encoded in base64 as a whole until
of tried password>
username like that then simply brute its password after.
login attempt with a correct login attempt using user we get a valid session ID.
Username enumeration via response timing wiener:peter  Since we want to login to user carlos  We We will brute force this by intercepting the request to the
first have a wordlist with users written in each line as my-account page of carlos and replacing the stay-logged-in
This lab firstly implements locking an account via IP address wiener,carlos,wiener,carlos … etc and password are also cookie value with brute forced value (make sure the session=
after too many login attempts  We can simply bypass this iterated in the same but but for each tried password for value is made different)
by making a valid login after every wrong login try using carlos we have password peter after that for a successful Under Payload processing, add the following rules in order.
wiener:peter to reset the invalid attempts number.
login and reseting the number of tries. These rules will be applied sequentially to each payload
1 So we first enumerate the username by simply having a
Username enumeration via account lock before the request is submitted.
wordlist with the given usernames but having username
wiener in between every 2 usernames and set the password
Valid usernames will get locked after 4 login attempts or so Hash: MD5
to always be peter  This will cause it to make a valid login Add prefix: carlos:
while invalid ones keep getting the message invalid username Encode: Base64-encode

This lab allows us to access the admin page by passing the

X-Original-URL header in the web request and settings its

value to our desired url ( /admin ).

If we pass a request with headers
User role can be modified in user profile GET /login and X-Original-URL: /admin  We will see options to

delete wiener and carlos ( href=”/admin/delete?username=carlos” ).

The lab only allows users with roleid: 2 to visit the admin We try to put
page. if we try to change the user email, intercept the X-Original-URL: /admin/delete?username=carlos header but it gives
2FA simple bypass request and the reply within repeater  We will see a JSON us a warning where no username is passed → so we pass it
inserted in the request body containing our new email and in the original GET header and use
Simply Login to user carlos  Then visit /my-account page GET /login?username=carlos
then we recieve another JSON within the response body  Causing user carlos to be
within the URL to avoid entering the 2FA code. X-Original-URL: /admin/delete
containing our current roleid value of 1. deleted successfully
We can try changing the
Access control vulnerabilities roleid within the request JSON and sending it within

Unprotected admin functionality repeater  This should now allow us to visit the admin page.

Visiting robots.txt reveals a secret admin panel allowing us

to delete user carlos
Modified
Unprotected admin functionality with unpredictable URL Initial Request First
Response

Response
Taking a look at the dashboard source code leaks the url of Final Response

the admin panel called /admin-h5cx1t → allowing us to delete

With that
user carlos.
response, our
User role controlled by request parameter user wiener has Method-based access control can be circumvented
of 2 and
roleid
Visiting the /admin url and intercepting the request reveals a In this lab … access control is dependent on the http request
can visit /admin
parameter called Admin=<Boolean> passed in the body that method utilized.  We can simply bypass this restriction by
url.
controls if the user is Admin or not  Change it to Admin=true capturing a request the admin performed to change some
to visit the admin page successfully. user (carlos in this case) → save it for later → then login to
URL-based access control can be circumvented our account (wiener) and navigate to the profile page and
capturing this request which holds a certain session ID 

Place wienerʼs session ID in place of session ID of the User ID controlled by request parameter with password webpage once requested with this button.
previous admin role changing request performed by the disclosure txt files are numbered and ordered like this →
admin in addition to changing the body to upgrade role of This lab is pretty straightforward  There is a vulnerability <num>.txt like 1.txt , 2.txt …. etc.

user wiener. allowing us to access different user accounts based on the ?

We can chat a little bit → request the chat log with
Now sending this alone in repeater will result in an id=<username>parameter  Their password are disclosed view transcript button and intercept this request  Then

unauthorized reply  So we just within a pre-filled field within the /my-account page. change the GET request txt file number till we find an
right click the request → C hange request method  It will now Simply login to our wiener account → navigate to interesting file with a password logged from the chat
become a GET request with the same previous body page and intercept it → modify ?id=wiener to ?
/my-account
Multi-step process with no access control on one step
parameter but passed in the url instead. to access the administrator account page
id=administrator

which reveals their password in the reply body  Then The flaw here is that if we log in with an administrator
finally login to user administrator with these credentials and account → go to admin panel and attempt to upgrade a user
delete user carlos from the admin panel. role to admin (carlos in this case) → we have 3 steps ⇒ 1
load the page with the form to choose those roles and the
user ⇒ 2 submit the form ⇒ 3 confirm the form in a
Wiener Account profile
Final modified Request with
separate page.
Admin legit request to request
the injected session ID
change carlos role
Now we can take this request in the 3rd step which contains
3 body parameters of
User ID controlled by request parameter
action=upgrade&confirmed=true&username=carlos made by the

For this lab we can perform horizontal privilege escalation by administrator after upgrading user carlos role to admin →
simply modifying the ?id= parameter from wiener to carlos send it to repeater  Login to our account weiner and go to
in the account page  We should get carlosʼs API key from /my-account page to obtain our own session ID  finally place

the returned reply body. this session ID instead of the one in the intercepted page of
the admin upgrading carlos role → change username=carlos to
User ID controlled by request parameter with data leakage in
username=wiener in the body to upgrade our own account.
redirect

This lab simply can be solved by changing the ?id=<username> Insecure direct object references
when accessing the /my-account webpage where the returned
This lab allows us to chat with someone and then click the
webpage will leak information about the requested user like
view transcript button to obtain all the chat logs so far →
his API key.
These chat logs are stored in a .txt file and are returned in a
 Then  Login to wiener → intercept request to /my-account
page  Obtain the session ID in this request  Within the
intercepted request in Repeater replace session ID to
wieners → replace webpage username parameter to wiener

instead of carlos → wiener should now have admin

privileges.

Referer-based access control SQL injection vulnerability allowing login bypass

The flaw here is that the web application relies on the Referer This lab is using SQL query SELECT * FROM users WHERE username =

value to allow/deny access to sub web pages  Referer 'wiener' AND password = 'bluecheese’ in the login form  We can
contains the URL this request came from  For example to bypass it by simply inserting administrator’—- as the
access the /admin webpage we do need admin privileges but username ( administrator is what we want) where the
to access the /admin/admin-roles we only need to have the the
SQL Injection Vulnerabilities quotations were closed and the rest of the SQL statement
Referer value in the request body set to some valid URL
that checks for the password was commented ( SELECT * FROM
SQL injection vulnerability in WHERE clause allowing retrieval users WHERE username = 'administrator'-- ' AND password =
coming from the root admin page ( Referer: of hidden data
https://0ad700f3041d7c3d823810ba008b000d.web-security-
'bluecheese’ ) thus allowing us to login to user administrator.
) The app takes parameters from the user from the URL
academy.net /admin
SQL injection UNION attack, determining the number of
arguments in /filter?category=<product category> to filter columns returned by the query
released products only by category within SQL.  We need
to SQL inject this URL to display all products regardless of Itʼs possible to obtain data from other databases using the
Thus  Login to account administrator → admin panel page
UNION keyword allowing us to execute additional SELECT
→ intercept request of upgrading user carlos to admin role → being released or not (all products)  SQL statement is
SELECT * FROM products WHERE category = 'Gifts' AND released = 1 → queries and append results to the original query.
Send to Repeater  We can see the url as /admin-roles?
We simply intercept request and change url header to  UNION statements like
username=carlos &action=upgrade with the username of upgraded
/filter?category=Accessories' OR 1=1—- To be able to display all
SELECT a, b FROM table1 UNION SELECT c, d FROM table2 demands
user passed in the url itself
released and unreleased products.

that the 2 SELECT queries have the same number of columns After finding the number of columns of a target table we This lab has SQLi vulnerability just like the previous 2 labs
and same corresponding datatypes. need to find the datatype of its columns.  Normally we are but we were given that there is table users with username
interested in string datatype including username/passwords. and password columns (type string)  After performing the
determining the number of columns for a UNION SQLi attack
 In a scenario with 4 detected columns  We inject queries previous labs checks to find number of columns and
2 ways :
like ' UNION SELECT 'a',NULL,NULL,NULL-— → ' UNION SELECT datatypes → /filter?category=Pets' UNION SELECT NULL,NULL-—
Injecting the following SQL keywords to order results by a certain NULL,'a',NULL,NULL-— → ' UNION SELECT NULL,NULL,'a',NULL-— → ' worked so we have 2 columns → /filter?category=Pets'
existing column ' ORDER BY 1-- → ' ORDER BY 2-- → ' ORDER BY 3-- →
UNION SELECT NULL,NULL,NULL,'a'-— → where we inserted a string UNION+SELECT 'a','a'-—also worked to the original target table
….etc.  And keep incrementing until the column number is not even
existent where either an error message will show up or some indicator in one certain column and checked the returned results  If has 2 columns of type string  Perfect !
like an empty page shows up … the important thing is an indicator of an the corresponding column in the main targeted table does Now to obtain the username and password from table users
incorrect column number selected → telling us that we just exceeded
indeed have a string in the same column where we injected we simply add that as the
the number of columns by 1.
 Then no error message/empty page will be returned and UNION SELECT ... query ⇒ 'UNION SELECT username,password from
Injecting the following SQL keywords to UNION the previous existing
results will be returned with an additional row containing the users-— URL becomes /filter?category=Pets ' UNION SELECT
query with columns of NULL → ' UNION SELECT NULL-- → ' UNION SELECT
NULL,NULL-- → ' UNION SELECT NULL,NULL,NULL-- → ….etc.  In this case we
row we injected. username,password from users-- )
will keep getting errors until the number of NULL columns matches the
This lab has an SQLi vulnerability just like the previous lab Weʼve obtained the administrator password so we can now login to it.
number of columns in the main SQL query we are trying to inject. 
When a match occurs an additional row of NULLs will be inserted at (allowing us to UNION with the main table in the main query
the bottom of the returned table  Weʼve used NULL since itʼs and conclude the number of columns it has) but we
compatible with every datatype so it makes life a bit easier on us. SQL injection UNION attack, retrieving multiple values in a
additionally need to find the which columns in the main table single column
This lab has an SQLi vulnerability in the products filters are of type string → intercept a filter request to the
allowing us to UNION with the main table in the main query Accessories category  Send to Repeater → find the number This lab has all the previous vulnerabilities as well  We
and conclude the number of columns it has  Simply of columns like the previous lab We found 3 columns here) found 2 columns  But unfortunately only 1 of 2 columns in
intercept a filter request to the Accessories category → → Then we simply inject queries in the order ' UNION SELECT the target table contains a string !  ' UNION SELECT NULL,'a' from
' D4q3MO ',NULL,NULL-- , ' UNION SELECT NULL,' D4q3MO ',NULL-- …. users-— seems to return an OK response) but we need 2 to be
Send to Repeater → keep injecting into the URL filter query
/filter?category=Accessories'+UNION SELECT NULL-- starting with ' With string 'D4q3MO' cuz the lab demands to display an able to see both the username and password combinations
UNION SELECT NULL-- , ' UNION SELECT NULL,NULL-- , then ' UNION additional row with this string) until we donʼt get an  Now to bypass that we can use a string concatenation
SELECT NULL,NULL,NULL--until finally getting an OK response error/empty page and results are returned → eventually the syntax allowing us to inject a UNION query to retrieve the
from the server (the server will keep replying with an internal query /filter?category=Accessories ' UNION SELECT username first as part of the 2 returned columns allowed by
error if the UNION statement doesnʼt match the column NULL,'D4q3MO',NULL-— returns an OK response from the server the UNION query ….. and then concatenate the password to
number) and this is the right query. that result ( ' UNION SELECT NULL,username + || ‘~’ || password from
users-- ) as well.  The final URL query is /filter?
SQL injection UNION attack, finding a column containing text SQL injection UNION attack, retrieving data from other tables category=Accessories' UNION SELECT NULL,username || '~' || password
FROM users-—

We can now login as the administrator account. give us the usernames and password of all users in this table Within the repeater we keep sending trial and error requests for each
character by getting a string for each character and do that for the
including the administrator. Welcome
SQL injection attack, querying the database type and version whole password chars  We can filter for Welcome string
on MySQL and Microsoft
To know when we have finished getting the password characters →
Note: We also have information_schema.tables for a list of all the tables TrackingId=YbMBxdMReB7RA33U' AND SUBSTRING((SELECT password FROM users WHERE username
This lab is really similar to the previous lab except we are but we use information_schema.columns at once since it has the tables and = 'administrator'), 21, 1) < '0 is the only statement that returns true with < '0

working with a Microsoft MySQL server instead of Oracle their columns. condition since the NULL character is smaller than 0 in ASCII  therefore
Thus we donʼt need to always supply a valid table name to the length of the password is 20.
(trying
the UNION SELECT statement for it to work)  If we inject ' Blind SQL injection with conditional responses TrackingId=YbMBxdMReB7RA33U' AND SUBSTRING((SELECT password FROM users WHERE username

we get a valid OK response and thus we

UNION SELECT NULL,NULL# = 'administrator'), 99, 1) < '0 also gives true since all characters after the
Some pages arenʼt meant to display content from MySQL but last valid password character return which is smaller than in ASCII.)
have 2 columns.  If we inject ' UNION SELECT 'a','a'# we also NULL 0

has some indications that the injected MySQL query was

do get a valid OK response and thus we have 2 string
successful or not in which we can use to enumerate
columns (even better !  Finally we can now retrieve the DB
passwords character by character. → value
version by ' UNION SELECT NULL,@@version#  URL query
TrackingId=YbMBxdMReB7RA33U within the web request can be
becomes /filter?category=Accessories' UNION SELECT NULL,@@version
# inject after with an SQL statement that queries every single
password character from table users for user administrator

We used the # for comments … since for some reason -- isnʼt against other characters using > , < and = operators. →
working Rinse and repeat until we get the full password. → statement
SUBSTRING((SELECT password FROM users WHERE username =

'administrator'), 1, 1) returns characters of administrator

SQL injection attack, listing the database contents on non-
Oracle databases password starting from index 1 and going forward up to 0
characters … if we put SUBSTRING((SELECT password FROM users WHERE
After finding the number of columns with ‘ UNION SELECT username = 'administrator'), 1, 3)  It will get the 1st, 2nd and
NULL,NULL-— (so 2 columns)  We queried available tables and
3rd characters.
their columns using ' UNION SELECT table_name,column_name FROM ⇒
information_schema.columns--  Filtering within the returned SUBSTRING((SELECT password FROM users WHERE username =

webpage for keywords ‘usernameʼ and ‘passwordʼ we find Will obtain the 2nd character of the
'administrator'), 2, 1)

them in the same table named users_oobqmu and its columns password … and so on for later chars.
involve username_kglsny and password_rptdch for the username
TrackingId=YbMBxdMReB7RA33U' AND SUBSTRING((SELECT password FROM users WHERE username
and password.  Finally we can query for the username and = 'administrator'), 1, 1) > 'm  Checks if password character is later than m
password columns from table users_oobqmu with ' UNION SELECT in ASCII table → if yes the page returns true by having Welcome as a string
username_kglsny,password_rptdch FROM users_oobqmu-- and that should of returned page → otherwise Welcome isnʼt returned