Welcome back to security Miss configuration session. In
this second part. We will review some security misconfigurations.
We have already found in previous Hands-On exploitations.
We will jump straight to our intentionally vulnerable
application and then move to the mitigation Parts.
In our first session. We exploited the SQL
injection vulnerability in the login form at
that time. We also found the security Miss configuration, but
we didn't give it too much attention. Let's do
it now.
As in our first session submitting, our payloads returned
an internal server error response. Let's check the
response body.
We got the Json object, which we will copy to our text editor
so that we can read it easily.
The return Json has a single top level property called
error, which includes several other properties and
values that we will carefully analyze. The compile information
about our Target system.
Starting with the message property. We see that the error was triggered
by the database engine which we now know that
is a sequel late.
Let's keep track of system knowledge. We get from this error message.
The syntax error happens near the string, which
is not something we have submitted. In fact, it
looks like a hash. We will find several hash
algorithms detectors online. Let's try
one of them.
So, we now know that passwords are hashed using the
md5 algorithm.
Next, we have stack, Trace stack
traces. Give us a few Executives steps immediately
before an exception has occurred.
In this case based on the cold script path. We
know the application location in the file system.
We also know the application is written in node.js, based
on the Node underscore modules folder in
the bath.
The same way, we know that implementation uses the npm sequel.
Eyes package.
Continuing through the Jason, never object. We can even
find the exact SQL query sent to the database. And
now we also know that there's a user's table, which
has at least three Fields email password
and deleted at
There are other implementation details. We may assume
based on the error message for instance because
of the delete at table field. User account
shall not. Be really deleted but instead soft
deleted or flag this deleted.
In our XML, external entity session
xxe, exploitation was only possible
due to a security Miss configuration. Let's
check it.
While authenticated, as a regular user, we have access to
the complain feature which allows invoice uploads. We
used it before to upload our militias XML
file.
This business-to-business feature has been deprecated, but
deployed and the XML processing is still possible.
Next. We will discuss what makes
the application vulnerable and how to prevent it.