Hello, everyone, and welcome to this video.
So in this video, we are going to see a lot of attacks with whitelist based input filters.
So some developers use whitelist filters to block certain characters as an input and only allows certain
characters and numbers.
Into the Web application.
Apart from that, if any of the characters are being supplied, the request has been rejected or it
does not get processed.
Many applications block host names like the Lubeck IP address or localhost or even time special characters
or sometimes sensitive yardings like Slash Admin or ETrade, which can be used for embedded credentials
or hash.
Let us understand the principle of a whitelist filter bypass using SRF with the help of an animation
you can see on your left is the attacker and on the right is the one labeled web application, which
is example dot com.
That I can send the request of a get slash admin dashboard, the hostess example dot com and into the
body parameter, there is a quarrel with these Lubeck IP address, 127, not zero, not one.
And the server sends a response to that occurred with four zero three forwarding.
Now, the attack, it bypasses this whitelist of filtering in which the Web server, which is example
dot com checks, if there is a Lubert IP address which is passed.
But in case we made that using the embedded credentials Stickney, then we are able to bypass it.
And we successfully get a 200 OKing.
So what does the impact impact a similar to the previous videos that we have seen, that attack that
is able to get sensitive actions onto the server and he can bypass access, control and authentication
to protected resources and also get access to that computer.
What are the steps that we are going to perform, we are going to bypass the whitelist filters in order
to perform this SRF, if we are successful to perform sensitive actions as indicated, use it, then
I will attack a successful.
So it is a practical time and let's quickly jump into the practical and understand how can we bypass
the whitelist based filtering, there is the application which is necessary for whitelist based input
filter.
Let's quickly start the application and solve the lab.
We have to change the structure, order to access the admin interface and HGP Golan's localhost slash
admin.
There is no board specified, so it is running on the default mode as it is mentioned.
Actually, DP will assume it is running on Portelli and we have to delete the user, which is Carlos
developer has also deployed an entire society of defense.
So we are going to bypass that as well.
All right.
So our Web application has successfully deployed.
Let's quickly jump over here and let's click on this couple umbrella's picture and let's quickly click
on check stock.
And you can see we are able to get a response.
Now, let's capture this request into our boxwood for further inspection.
So let me just skip these requests.
No, I do not want them again, let's click over here, check stock and wait for the link at the request
over here.
And we have got it now.
The request is into our repeated time, and this is what we get into the stock epper parameter.
Let's quickly send this to Decoder and see what is it.
And again, see, there is a you are Elvis's stock that we like to shop dot net bought AT&T product,
stock check, product ID and store any.
But as we mentioned into the question, there was no port AT&T.
So we are not going to consider it anymore and make all our payloads on board.
Eddie only.
OK, so first, let's try the basic one that we're going to put a localhost and hit send, it was obvious
that it is going to throw our external stop check host must be stopped.
What we like to shop dot net.
So it says it wants the host, which is stock that we like to shop dot net.
It is not going to take this.
They have waitlisted this and we need this particular.
You are allowed into our payload.
All right.
So let's do something like this.
Let's make a subdomain out of it and let's see.
And you can see we still get an error, which means this is not working.
All right.
So let me address it.
And you can see we got a different error that is missing parameter.
And that is if you tried this into your Web browser rating, anything at the rate something it is going
to redirect after whatever is written after the aderet, if you want to see.
Let me just show you as well.
Let's go to Google dot com or let's say Yahoo dot com, ETrade Google dot com.
So it is going to redirect to Google dot com.
Perfect.
Let's get back over here.
And now let's say we write admin at the rate maybe we are able to bypass it.
No.
So let's change this and let's try one more thing, Audur.
Let's keep it to localhost again.
And let us simply remove all this stuff.
We do not want it.
Let's try just reported and it and it gives the same error, which is missing parameter.
Now, when we removed the error estimate and it is giving an internal server error.
Let us look at it again and again, see missing barometer, let's add a slash admin over here and observe
what happens.
And you can see we get the same error and it is not working.
Now, what we can do is we can add a hash over here, but fragment and absorb what happens.
Let it send and you can see it worked.
It worked.
When we have double encoded our part fragment, that was hash.
So you need to keep in mind that hash was not working, but when we encoded it basically double encoded,
it worked.
And you can see the response.
We have got the endpoint, which is the delete username.
Perfect.
Now let's send this to Decoder.
And you can see when we.
Smartly got this, and you can see it just comes back to the part fragment, which is hash.
So this is first and this is second encoding.
Perfect.
Now, let's copy this end point as we need to delete the user, which is Carlos, add it over here and
hit send.
Just remove it and hit send before hitting send, let let's see that we are locked in into the admin
panel and these are all the users hit send and perfect.
We should have been sold a lot.
And you can see we are successfully able to sell the lab with the help of bypassing of a white listing
based input filter.
I hope you guys understood.
Thank you.