Hello, everyone, and welcome to this video.
So in this video, you're going to see SRF, but interesting test case.
We are going to see how when any developer blacklist or block certain characters into any application
just to mitigate any one liability like SRF in this case, how are we going to bypass that and successfully
perform the attack?
So developers usually use blacklist filters, which is a very bad technique to block certain characters.
As I input as many names, security researchers are able to bypass those blacklist filters by using
a different versions which can bypass the blacklist.
Many name application blocks whose name like 127 zero zero one or localhost.
And also, time in Bloks Sensitive, you are in slike slash edman, slash BHP, my admin slash dashboard.
So in that case, what should be done?
Let's understand this, using a principle with the help of animation on the left hand side is the attacker
and on the right hand side is the one rebel overapplication with this example dot com.
So the attacker is going to send a request and the request is going to be a get request of slash admin
dashboard, the hostess example, dot com and into the other parameter, which is the one rebel parameter
into the body.
The attacker put the localhost IP address.
Now there is a proper blacklist filter which has been applied by the developer.
And when the web application, which is the example dot com, sends the response to the attacker, it
says four zero three for Britain.
Now, the attacker forms a Newgate request in which he is going to put the you are as the integer version
of the localhost IP address.
And he also uses.
The oral encoding version of Slash into the get barometer.
Now, there are two things that the attacker has bypassed.
First is a blacklist folder of Lubeck IP or localhost and a blacklist folder of slash you oral encoding
it.
And the wonderful application successfully gives a 200 OKing.
I hope you guys understood that the impact remains the same.
As we have seen in the previous videos, the steps for this would be so we are going to exploit a Web
application to induce request to be interviewed by bypassing the access control.
We will bypass the blacklist filters in order to perform a successful SRF.
And once we have done that, we will perform some sensitive actions as an unauthenticated users and
our attack will be successful.
So let's jump onto the practical day and see how can we perform SRF to bypass the blacklist filters?
All right, so you can see over here, this is the Web Security Academy is out of blacklist based input
filter Web application.
So let's quickly jump on to this product, let's say.
And once we are onto this, let's click on check stock and you can see the stock which is available
to go to, you'd intercept on.
And again, click on tech stock guru Bob.
And now I'm just going to send this to repeated and repeated, I hit send and you can see we are seeing
a response.
Now, let's just copy this and send this to Decoder and let's try to decode it and understand what actually
it wants to say.
And you can see there is a quarrel, but just stop, Dot.
We like to shop dot net bought AT&T product stock check productivity.
And already now going back over here, we know that there is a blacklist based input filter.
But still, let's give it a try and say we want to scan the localhost and hit send and we got error,
which is external stock check blocked for security reasons, which was expected.
All right.
So now let's go back over here.
And there are very awesome bypasses for SRF, as you can see one of it over here.
Then we can just make the Lubeck IP address, which is 127 zero zero dot one to 127 dot one.
And you can see.
A lot of security researchers have posted this bypass.
Now, let's just try if this works or not, into your browser itself, I'm just going to put it over
here and hit enter and you can see it converts to a low back IP address automatically.
So the behavior of the browser is also the similar in which it converts this IP address to a Lubeck
IP.
Perfect.
Now, if you want to read more about how this works, you can read more about it.
I'm going to give the reference of I need it on and you can just read about why this behaves in this
manner.
All right.
So now as we know this, we are going to take use of this.
And instead of localhost, let me show you what the Lubeck IP address as well as it is blocking.
Let's remove this and just add one, as we have seen into the browser.
This works as a local host or Lubeck IP as a Chrome browser is redirecting our request to the local
IP address hit send.
And again, we are successfully able to bypass our first mitigation.
Perfect.
Now we want the admin portal and hit send and you can see this is the second mitigation or the blacklist
filter in which the developer has put a blacklist filter of the keyword, which is admin, and we are
not able to send a successful request as it is getting blocked.
Now what to do?
So we are going to see one more awesome way to bypass this, which is you are encoding.
So we are going to you are you are in code slash.
As you can see, it includes two percent to.
Let's try if we can bypass it, using percent to f hit send and you can see it still blocks no issues.
Let's do a double encoding.
So we are going to encode person to F again.
And let's see, yeah, so now let's see if this works.
So let's go to Bob again and pasted over here.
Hit send and you can see it, it's still blocking.
All right.
So it may be a case that they are just blocking the key word, which is admon.
So let's just make it capital and see if we are able to bypass it and hit send.
And again, see, we are successfully able to bypass the SRF blacklist based input filter.
A Web application, so let's see if we are able to see our panel and we are able to see the successful
admin panel.
Perfect.
Let me just render this for you.
And you can see we have the access to admin panel now.
As you can see, you here, so we are able to bypass the first mediation.
Now let's see for the second one.
So when I hit send, you can see we get blocked for security reasons because this has been blocked as
an blacklist filter.
So let's just make this capital and let's see if you are able to bypass this and hit send.
And you can see we are able to successfully bypass this.
Let's set for admin and you can see we are able to delete two users.
Let us just simply copy this.
Go here and add it over here and hit send.
And again, we have successfully able to solve the lab.
There is another way to do it as well.
Perfect.
Now, one more thing that you should know.
This is you can also use this as a bypass.
Also, if you go to the IP refought converter and you put your localhost or Lubeck IP over here and
you hit and convert, there are different formats that you can see here.
One of the format is the digital format and you can also use the integer format to bypass a lot of SRF
based filters.
For instance, you can see we have successfully able to get our results and it looks perfectly fine.
So now let's move ahead and let's perform a sensitive action in which we are going to delete a user.
So now we are also going to you all in the E parameter into this, as we saw it was not working.
So now do you want to include this?
We can use any free you all encoder available online.
So I have already you all encoded it.
And let me put it over here and show you how does it looks like.
Let me click on my decode and you can see finally it looks something like this, which is the bypass
for the localhost or the Lubeck I.P. address slash admin.
This part is the same that we have been to now in all our Estacada videos.
So we are using the same endpoint.
So let's see if we are able to complete it.
So let's just hit send and you can see three zero two phone.
Let's go to our application and you can see congratulations, you have solved the lab.
So I hope you guys understood how we are able to successfully solve this blacklist for the lab.
Officer Zarif, thank you.