Introduction # We’ve already learned a decent amount about of introductory information about OS command injection when we were studying for the Burp Suite Certified Practitioner Exam. That blog post can be found here, but today I want to go through some topics and techniques showcased in the HTB Academy module focused around command injections.
In this challenge we are greeted with a web page:
Introduction # To preface this post, I want to briefly describe my level of experience to help others who might take this exam better benchmark how long it might take them to study.
What is Prototype Pollution? # This type of vulnerability allows attackers to add arbitrary properties to global object prototypes that can be inherited by user-defined objects.
What is a JWT? # JSON web tokens (JWTs) are a standardized way to send some kind of cryptographically signed JSON data between systems. They can really contain any kind of data but are often used to determine if a claim being sent by an application was sent by the real application.
What is the HTTP Host Header? # HTTP host headers are mandatory request headers that specify the domain name the client is trying to access. For example, when you visit https://vulnerable.com/blog, the browser makes a request like this:
What is OAuth? # If you’ve ever looked around the web and found a site that allows you to sign in with your social media account, chances are that the feature being used there was build on the OAuth 2.0 framework. OAuth is used to request limited access to a user’s account on some other application. More importantly, this allows the user to grant access to an application without exposing their login credentials.
What is HTTP Request Smuggling? # HTTP request smuggling is a technique that interferes with the way a web application will process sequences of HTTP requests received from one or more users.
What is Web Cache Poisoning? # This is a technique where we can get the target web server and its cache in order to serve a harmful HTTP response to other users. This typically involves two steps - we need to get the web server to respond with some dangerous payload, then verify that this response is cached and served to other users.
What is SSTi? # Server-Side Template Injection (SSTi) is when an attacker is able to inject some native template syntax into a template, which is exceed as code by the server.
What is GraphQL? # GraphQL is a query language designed to provide efficient communication between clients and servers by having the client specify exactly what data they want in the response. This helps avoid overly large responses that you might see with other queries.
What is Serialization? # As the name suggests, serialization is the process of converting complex data into a simpler format that can be send as a stream of bytes. This makes it easier to write complex data into memory, files, or databases. It also simplifies the process of sending complex data over a network connection that varies in which components need to be sent.
What is a Web Socket? # WS (WebSockets) are widely used in modern web applications because they can initiate long-lived sessions over HTTP with asynchronous communication in both directions.
What is the DOM? # The document object model is a web browser’s representation of the elements on the page. Websites use JavaScript to manipulate nodes and objects in the DOM, and if an attacker controlled value is passed from a source into a dangerous function (or a sink), that is when a vulnerability would arise.
What is an API? # Application Programming Interfaces (APIs) allow for different software systems and applications to share data. An example of this might be a weather application, the application logic doesn’t have the inherent ability to determine the weather but it rather makes calls to some weather forecast API that is responsible for returning accurate data based on the request.
What is CSRF? # Cross-site request forgery allows an attacker to perform any actions that a normal user is able to. These attacks, when performed properly, can cause an end user to execute unwanted actions on a web application that they are authenticated to.
Before we get into the content here I want to clarify that I wasn’t able to find any CTF-type examples of clickjacking, so if you know of one please let me know.
What is CORS? # Cross-origin resource sharing (CORS) is a browser mechanism that allows for controlled access to resources located outside the original domain. It is meant to add flexibility to the same-origin policy.
This is going to be a longer post, so I am leaving out some more intuitive pieces of information like explaining impact and testing strategies because I think if you understand everything here, the other things will come naturally. There will also only be one lab here because I wasn’t able to find that many diverse CTF examples.
What is NoSQL Injection? # These types of attacks occur when attackers interfere with the queries that the web application sends to a NoSQL database. This could lead to authentication bypass, exfiltration of data, modification of data, denial of service, or possible code execution.
What is XML External Entity Injection (XXE)? # This vulnerability has to do with how certain web applications process XML data. If attackers are able to exploit this vulnerability, they can often view files on the application’s file system, and potentially run system commands or interact with other back-end systems.
What is Server Side Request Forgery? # SSRF is a vulnerability that allows attackers to cause the application to make requests to an unintended location from the server that the application is running on.
What Are Race Conditions? # Race conditions are relatively common and are closely related to business logic flaws.
What Are File Upload Vulnerabilities? # These vulnerabilities are often present when web applications contain file upload functionality that do not sufficiently validate things like the file’s name, type, contents, or size.
What is Access Control? # Access control is how we describe the constraints that we place on an authorized user in the context of accessing resources and performing actions.
What Are Business Logic Vulnerabilities # Business logic vulnerabilities are flaws in the design or implementation of an application that let attackers produce unintended behavior.
Information disclosures seem to be highly contextual depending on where you find them and what kinds of protections are in place. Either way, we will go over some common areas to look for information disclosure and how you could exploit it.
What is OS Command Injection? # This type of command injection allows attackers to execute system commands on the server that is running the vulnerable application.
This will be one of the much shorter entries in the list of applied review sections because path traversal is pretty straight forward.
For this applied review, we are going to go through authentication, which is an important part of securing your web applications.
The goal of this applied review is to review over SQL injection techniques taught in the PortSwigger labs and to apply those strategies to CTF challenges.