WIXLIB

Releasing updates is a common issue with custom applications. The vendors do notprovide updates in most cases. Therefore, these inherent vulnerabilities will continueto be present until the time application is used.There are several known Web application vulnerabilities. Open Web ApplicationSecurity Project, more commonly known as OWASP, releases the top 10 Webapplication vulnerabilities, which are released after every few years. This data iscollected from various organizations through extensive research, and then the top 10Web applications are selected. Remember - there are hundreds of Web applicationvulnerabilities, and therefore, when performing an ethical hack, you can focus on thekey ones but do not ignore to test for the other vulnerabilities. The top 10 Webapplication vulnerabilities of 2017 released by OWASP are:A1:2017 - InjectionA2:2017 - Broken AuthenticationA3:2017 - Sensitive Data ExposureA4:2017 - XML External Entities (XXE)A5:2017 - Broken Access ControlA6:2017 - Security MisconfigurationA7:2017 - Cross-Site Scripting (XSS)A8:2017 - Insecure DeserializationA9:2017 - Using Components with Known VulnerabilitiesA10:2017 - Insufficient Logging & MonitoringThis module will cover a few of these vulnerabilities that you can find and exploit.Note: In this module, you will use a Web application named bWAPP, which isdesigned with more than 200 vulnerabilities. It is not legal to exploit a liveWeb application on the Internet, and therefore, you will use this Webapplication to learn the art of exploiting a Web application. It will not bepossible to cover all types of vulnerabilities due to the short time in the labenvironment.In this exercise, you will learn about finding and exploiting Web applicationVulnerabilities.

Learning OutcomesAfter completing this exercise, you will be able to:Perform Broken Authentication AttacksView Session ID in URLConduct OS Command Injection AttackPerform Server-side Includes Injection Attack (SSI)Perform Cross-site Scripting AttackPerform Cross-site Scripting (XSS) — Reflected (HREF) AttackYour DevicesYou will be using the following devices in this lab. Please power these on now.PLABDC01 - (Windows Server 2019 - Domain Server)PLABWIN10 - (Windows 10 - Workstation)PLABKALI01 - (Kali 2019.2 - Linux Kali Workstation)Task 1 - Perform Broken Authentication AttacksAuthentication is a process that confirms a user’s identity using a username andpassword. The user’s identity is validated by the server or the Web application. In aWeb application scenario, the authentication process is as follows:On a login form of a Web application, the user enters the login credentials in theform of a username and password.After the user submits the user credentials, they are then sent to the Webapplication, where the user credentials are verified for the user, and then a

session is created and stored in a database.A cookie is sent to the user’s system.When a user makes a subsequent request, the session ID is verified with the onethat is stored in the database. The Web browser at the client end stores andsends the token as a cookie to the server. If both the session ID values match,the user’s request is processed. However, if the values do not match, then therequest is not processed any further.After performing certain tasks, when a user logs out from the Web application,from the client and the server, the session is destroyed.In this task, you will learn to perform broken authentication attacks. To do this,perform the following steps:Step 1Ensure you have powered on all the devices listed in the introduction and connect toPLABWIN10. The desktop should be displayed.

Figure 2.1 Screenshot of PLABWIN10: Showing the desktop ofPLABWIN10.Step 2In the Type here to search text box, type the following:Internet ExplorerFrom the search results, select Internet Explorer.

Figure 2.2 Screenshot of PLABWIN10: Selecting Internet Explorer fromthe search results.Step 3The Internet Explorer window is displayed. In the address bar, type the followingURL:http://192.168.0.10/bWAPPPress Enter.

Figure 2.3 Screenshot of PLABWIN10: Entering the URL for the bWAPPapplication in the address bar.Step 4The login page of the bWAPP Web application is displayed. In the Login text box,type the following username:beeIn the Password text box, type the following password:

bugClick Login.Figure 2.4 Screenshot of PLABWIN10: Entering the user credentials andclicking the Login button.Step 5A notification bar is displayed about remembering the password. Click Not for thissite.

Figure 2.5 Screenshot of PLABWIN10: Clicking the Not for this site buttonon the notification bar.Step 6From the Choose your bug: drop-down, select Broken Authentication Insecure Login Forms, and click Hack.Figure 2.6 Screenshot of PLABWIN10: Selecting Broken Authentication Insecure Login Forms and clicking Hack.Step 7The login page is displayed.Figure 2.7 Screenshot of PLABWIN10: Showing the login page.Step 8Several times, the developers hard-code the login information in the login form. It isquite easy to extract login information. To do this, right-click anywhere on the loginform and select View source.Figure 2.8 Screenshot of PLABWIN10: Right-clicking the Webpage andselecting View source.Step 9A Debugger window opens in the bottom section of the Webpage and displays thesource code for the login page. Review the code from line 59 to 63. Notice theusername and password. It displays the login name as tonystark and password as Iam Iron Man.

Figure 2.9 Screenshot of PLABWIN10: Showing username and password inthe source.Step 10Close the Debugger window.Figure 2.10 Screenshot of PLABWIN10: Showing the hard-coded passwordin the code.Step 11Let’s try another type of Broken Authentication. From the Choose your bug:drop-down, select Session Management - Administrative Portals, and clickHack.Figure 2.11 Screenshot of PLABWIN10: Selecting Session Management Administrative Portals and clicking Hack.Step 12The Session Mgmt. - Administrative Portals Webpage is now loaded.Figure 2.12 Screenshot of PLABWIN10: Showing the Session Mgmt. Administrative Portals Webpage.Step 13Click on the address bar and notice the last part of the URL. It is mentioningadmin 0, which means that a session ID is being passed in the query string.

Figure 2.13 Screenshot of PLABWIN10: Showing the admin 0 as thesession ID in the URLStep 14Change the admin 0 to admin 1 and press Enter.Figure 2.14 Screenshot of PLABWIN10: Changing the session ID in theURL.Step 15Notice the outcome of the change that you made in the URL. The Webpage nowdisplays a message that you have unlocked the page using URL manipulation.Figure 2.15 Screenshot of PLABWIN10: Showing the output of changingthe session ID.Step 16Logout management is one of the common vulnerabilities in Web applications. Evenif the user logs out, the user session is still alive. One of the common methods is toclick the Back button on the Web browser to get back to the same session afterlogging out.Let’s perform a logout management attack on this Web application. From theChoose your bug drop-down, select Broken Authentication - LogoutManagement and click Hack.Figure 2.16 Screenshot of PLABWIN10: Selecting Broken Authentication Logout Management and clicking Hack.

Step 17The Broken Auth - Logout Management Webpage is loaded. Right-click thehere in the Click here to logout statement and select Open in new tab.Figure 2.17 Screenshot of PLABWIN10: Opening a new tab by rightclicking here in the logout statement.Step 18The bWAPP - Login tab opens. Click the bWAPP - Login tab. Notice that you arelogged out successfully. Close this tab.Figure 2.18 Screenshot of PLABWIN10: Showing the Login page on thesecond tab.Step 19Notice that you are back on the first original tab. You are still logged in this tab.Click Bugs.Figure 2.19 Screenshot of PLABWIN10: Clicking Bugs in the menu bar onthe first tab.Step 20The Portal Webpage is loaded successfully. This means that you were still able towork within the Web application.Figure 2.20 Screenshot of PLABWIN10: Showing the Portal Webpage.

Keep the Internet Explorer window open.Task 2 - View Session ID in URLOne other major vulnerability with the Web application is using the session IDs inthe URL. If a session ID is sent in the URL, an attacker can grab the current session,specifically if the session ID is sent in cleartext. The attacker can eavesdrop on thesession and capture the current session to impersonate the user. The session IDshould be sent to the Web server in the body part of the request. An encryptedconnection must be used for sending the request so that it cannot be intercepted bythe attacker. In this task, you will learn to view the session ID in a URL. To performthis task, perform the following steps:Step 1Ensure you have powered on all the devices listed in the introduction and connect toPLABWIN10. The Internet Explorer window should be open with the bWAPPWeb application loaded.Note: If, for some reason, you had closed the Internet Explorer window orlogged out of the current session, ensure that you log back into the bWAPPWeb application.From the Choose your bug drop-down, select Session Management - SessionID in URL and click Hack.Figure 2.21 Screenshot of PLABWIN10: Selecting Session Management Session ID in URL and clicking Hack.Step 2The Session Mgmt. - Session ID in URL Webpage is loaded. Pay attention to thelast part of the URL - there is a session ID, which is in cleartext. This could lead to aneavesdropping attack by the attacker.

Figure 2.22 Screenshot of PLABWIN10: Showing the session ID in theURL.Keep the Internet Explorer window open.Task 3 - Conduct OS Command Injection AttackCommand injection is a type of attack in which the attacker executes arbitrarycommands through a vulnerable application to the host operating system. When anapplication allows the unsafe user-supplied data, such as forms, cookies, HTTPheaders, to be passed to the host system, the attacker can take advantage of thisvulnerability to gain access to the underlying host system. Command injectionattacks take place because input fields accept arbitrary data without sufficient inputvalidation.In this task, you will learn to conduct an OS command injection attack. To do this,perform the following step:Step 1Ensure you have powered on all the devices listed in the introduction and connect toPLABWIN10. The Internet Explorer window should be open.From the Choose your bug drop-down, select OS Command Injection and clickHack.Figure 2.23 Screenshot of PLABWIN10: Selecting OS Command Injectionand clicking Hack.Step 2The OS Command Injection Webpage is displayed. Notice that in the DNSLookup text box, the following text is entered by default:

www.nsa.govClick Lookup.Figure 2.24 Screenshot of PLABWIN10: Clicking Lookup on the OSCommand Injection Webpage.Step 3Notice the output. The firewall blocks the DNS query to go out of the labenvironment, and therefore, you get a connection timed out error.Figure 2.25 Screenshot of PLABWIN10: Showing the error as the output ofLookup.Step 4Replace the existing text in the DNS lookup text box and type the following: hostnameClick Lookup.Figure 2.26 Screenshot of PLABWIN10: Entering hostname and clickingLookup.Step 5

The output is now displayed.In the notification bar regarding AutoComplete to remember Web entries, clickNo.Figure 2.27 Screenshot of PLABWIN10: Showing the output of the hostname command.Step 6Replace the existing text in the DNS lookup text box and type the following: net userClick Lookup.Figure 2.28 Screenshot of PLABWIN10: Entering net user and clickingLookup.Step 7The output is now displayed. There are two users, nobody, and bee.Figure 2.29 Screenshot of PLABWIN10: Showing the output of the netuser command.Step 8Switch to PLABKALI01. Invoke Firefox from the left pane and load the followingWebsite:

http://192.168.0.10/bWAPPOn the Login Webpage, use the following credentials:Login:beePassword:bugClick Login.Note: If you get a prompt to save credentials, click Don’t Save.Figure 2.30 Screenshot of PLABKALI01: Entering the user credentials ofthe Login page.Step 9From the Choose your bug drop-down, select OS Command Injection and clickHack.Figure 2.31 Screenshot of PLABKALI01: Selecting OS Command Injectionand clicking Hack.Step 10

The OS Command Injection Webpage is now loaded.Replace the existing text in the DNS lookup text box and type the following: whoamiClick Lookup.Figure 2.32 Screenshot of PLABKALI01: Entering whoami and clickingLookup.Step 11The output of the command is displayed.Figure 2.33 Screenshot of PLABKALI01: Showing the output of whoami.Step 12Replace the existing text in the DNS lookup text box and type the following: pwdClick Lookup.Figure 2.34 Screenshot of PLABKALI01: Entering pwd and clickingLookup.

Step 13The output of the command is displayed. It displays the directory for the currentWeb application.Figure 2.35 Screenshot of PLABKALI01: Showing the output of pwdStep 14You can also read the contents of a file using the command injection attack. Replacethe existing text in the DNS lookup text box and type the following: cat /etc/passwdClick Lookup.Figure 2.36 Screenshot of PLABKALI01: Entering cat /etc/passwd andclicking Lookup.Step 15Notice the output is displayed. The contents of the /etc/passwd file are displayed.Figure 2.37 Screenshot of PLABKALI01: Showing the output of the cat/etc/passwdTask 4 - Perform Server-side Includes Injection Attack (SSI)SSI directives are used in Web applications to provide dynamic content to the HTMLpages. SSIs execute a set of defined actions before the Webpage is loaded. Therefore,the Web server, which hosts the Web application, analyses the SSI before the HTML

page is loaded in the user’s Web browser. The SSIs are mainly injected into the fieldsthat accept inputs. When the field input is submitted, the script, which was added tothe input field, is executed. In an SSI attack, the attacker injects malicious scriptsinto the HTML pages. By injecting the scripts, the attacker can gain access tosensitive information or even execute shell commands. The SSI directives areinjected in input fields, and they are sent to the Webserver.To perform an SSI attack, perform the following steps:Step 1Ensure you have powered on all the devices listed in the introduction and connect toPLABWIN10. The Internet Explorer window should be open.From the Choose your bug drop-down, select Server-side Includes (SSI)Injection and click Hack.Figure 2.38 Screenshot of PLABWIN10: Selecting Server-side Includes(SSI) Injection and clicking Hack.Step 2The Server-Side Includes (SSI) Injection Webpage is loaded. In the Firstname text box, type the following:plabIn the Last name text box, type the following:user

Click Lookup.Figure 2.39 Screenshot of PLABWIN10: Entering the user credentials onServer-Side Includes (SSI) Injection page.Step 3Notice that the output is displayed with an IPv4 address.Figure 2.40 Screenshot of PLABWIN10: Showing the output and clickingthe Back button.Step 4Click the Back arrow to navigate back to the previous page.Back on the Server-Side Includes (SSI) Injection Webpage, you need to insertthe following into the First name text box: script alert("Hacked") /script In the Last name text box, type the following:userClick Lookup.Figure 2.41 Screenshot of PLABWIN10: Entering a script in the First namefield and user in the Last name field.

Step 5Notice the output. The script embedded in the First name text box has beenexecuted successfully.Click OK.Figure 2.42 Screenshot of PLABWIN10: Showing the output of the enteredscript as prompt.Step 6Again, the text on the Webpage is changed to the IPv4 address. Click the Backbutton on the Web browser.Figure 2.43 Screenshot of PLABWIN10: Showing the output and clickingthe Back button.Step 7Back on the Server-Side Includes (SSI) Injection Webpage, you can also fetchthe cookie from the Web server. you need to insert the following into the Firstname text box: script alert(document.cookie) /script In the Last name text box, type the following:user

Click Lookup.Figure 2.44 Screenshot of PLABWIN10: Fetching the cookie from the Webserver by using a script in the First name text box.Step 8Notice the output. The script embedded in the First name text box has beenexecuted successfully. The cookie is being displayed in the dialog box. Click OK.Figure 2.45 Screenshot of PLABWIN10: Showing the cookie in the dialogbox.Step 9Again, the text on the Webpage is changed to the IPv4 address. Click the Backbutton on the Web browser.Figure 2.46 Screenshot of PLABWIN10: Showing the output and clickingthe Back button.Step 10Back on the Server-Side Includes (SSI) Injection Webpage, you can show thecurrent document name. you need to insert the following into the First name textbox: !--#echo var "DOCUMENT NAME" -- In the Last name text box, type the following:

plabClick Lookup.Figure 2.47 Screenshot of PLABWIN10: Entering a script in the First nametext box.Step 11Notice the output. It displays the current document name before the last name,which is plab. Click the Back button on the Web browser window.Figure 2.48 Screenshot of PLABWIN10: Showing the output and clickingthe Back button.Step 12Back on the Server-Side Includes (SSI) Injection Webpage, you can show thevirtual path and filename. To do this, you need to insert the following into the Firstname text box: !--#echo var "DOCUMENT URI" -- In the Last name text box, type the following:plab

Click Lookup.Figure 2.49 Screenshot of PLABWIN10: Entering a script in the First nametext box.Step 13Notice that the output shows the virtual path and the file name. Click the Backbutton on the Web browser.No

Jul 12, 2021 · Exercise 1 - Web Application Password Cracking. Web applications are accessed using user credentials, which are stored in a database. in the backend. There are several methods to store user credentials. If user. credentials are stored in clear text, then they are prone to an attack and can be read easily. You can also encrypt the user credentials.