Everybody I'm looking to next video and this video and we're talking about a type of vulnerability called
the authenticated slash on authenticated pages.
Now what's interesting about this is that sometimes when a web developer is developing an admin console
or any type of part of the web app there is an instance where the log in page that they build does not
it does its correct job it checks for the usernames and passwords and it redirects the user to the correct
page with like let's say some session variable set but in some cases a developer might not even bother
to check that you're actually logged in when actually viewing these pages because they're not supposed
to be used or seen until the user has actually logged in so the user shouldn't even know that they exist.
So if we take a look at this web app we see here it's 1 9 2 1 6 8 1 that 24 exceed its default Apache
but we don't know of any directory.
So let's take a quick look.
So if we run derby and give it our directory or our host go ahead and see what it finds.
We're just the default word.
This could not connect 1 night to so if we look here we got a few directories.
It looks like it found three directories total.
So it says a slash admin slash javascript let's see looks like just JavaScript and then inside javascript
there's something called J query.
So we've got a slash admin directory which is great however we want to know what files are in there.
So if we load up something called dir buster it allows us to enumerate the file names to see if anything's
pretty common in there.
So we'll give it our local host here to say you don't want that for and let's see here we can use the
rest of it the same.
We don't want to brute force any directories but we want to brute force the files.
We need to browse to award lists.
Right.
So let's go back to the local directory to the root directory so there Kelly comes with quite a few
word lists under user share and then you'll see something called word lists near the end here
wordless underneath wordless we've got a few options so we'll look at door buster and we'll do the standard
small directories and select that and we want to start in the admin directory that will go and start
with our extension is that business.
We are assuming this might be a PSB web service.
It's gonna start.
So we see down here.
It shows us listing and starting to put.
So we'll give this just a second.
All right we're gonna stop that.
So if you look here we actually found it said it found a file Edmund up BHP and it also found log in
BHP.
So let's take a look at that.
Let's take a look at log in BHP
admin slash perfect so we can see we do have an admin page.
So if we do admin and then admin incorrect password admin test admin
word doesn't look like it's letting us in but we do know that in some cases these quote authenticated
pages are actually UN authenticated.
So we can see that there's an admin not BHP so we can assume that maybe log into Page is meant to go
to admin.
So let's see if we can load to it directly just to see what options we might have because sometimes
it might load partial of the page.
Or for example if the BHP code that checks whether you're logged in is lower to the bottom of the page
or it's or it might not even be checking at all.
Which in this case that's the vulnerability we're looking for.
So we go to AB and up BHP perfect.
It says Welcome admin even though we work.
So the developer made an assumption that only admins are gonna be viewing this or know that it exists.
However in our case we looked at we we used to brute force or to find out whether or not we could see
the file or not.
So we got an edit users and a local command execution which might be interesting for us.
So but it's it's always good when you find an admin panel specifically to always do that double check
see where it's being redirected to try to log in try sequel injection when it comes to the log and pages
sometimes that'll let you through.
Sometimes it's just as simple as loading up door buster and trying to find out what pages are behind
that admin log and page and if you can find a few that actually come back as valid files go ahead and
test them go to the pages that you're not supposed to try to find out what what options you might have
in the addon pages.
So it's always just that one extra thing that you never know if a developer is going to miss or it's
going to be just present for you.
So this this could mean the full compromise in the box just because we found that admin not BHP.
So just keep this type of stuff in the back of your mind.
And it's always a good thing to just just double check just always go to that files to see what it is.