‫Instructor: Hi.
‫Within this lecture we're gonna start
‫pen testing our API, finally.
‫So far we have made our API,
‫vulnerable API run on our server.
‫We have installed Burp Suite and also Postman as well.
‫Right now, we're just gonna deep dive into what's going on
‫and why we are doing these things that we do
‫in order to understand it in a much better context.
‫So right now I have this website.
‫In here we have a documentation.
‫It explains the API endpoints like API1, API2, API3,
‫and it gives us clues, it gives us some kind of information
‫to solve the challenges.
‫As you can see, it says that
‫broken object level authorization or authentication
‫and this is the vulnerability that it has
‫inside of the API1.
‫And also we have the create user, get user,
‫and update user endpoints over here
‫with the relevant explanations.
‫So of course, this gives us a clue
‫and it actually gives us too much.
‫In the real world, if you think about it,
‫if you're going to do an API pen testing,
‫do you really get this kind of documentation?
‫It depends on the situation,
‫you may get or you may not get.
‫Of course, you won't get the vulnerabilities
‫written down for you like this,
‫but you may get a very detailed information.
‫Let me show you what I mean.
‫I'm going to just search for like Instagram API
‫or Facebook API.
‫So I'm just gonna go ahead
‫and go into the Instagram developer documentation.
‫Yeah, I believe this is the old one.
‫I'm just gonna go to developers.facebook.com.
‫You don't have to do that, by the way,
‫I'm just showing you this.
‫This is an API that developers can use
‫in their web applications or mobile applications.
‫I have used it before in my mobile applications.
‫If I go to guides, I can see the different kind
‫of documentations, different kind of endpoints over here.
‫If I click on any of them, like Business Discovery
‫I can see the requests and responses.
‫So this is a request, this is a GET request.
‫This is the end point.
‫So this is the version three, and we see the parameters,
‫we see the fields that we need to input, and here you go.
‫Now we see what it does and what is an ID,
‫what is the parameters, what are the headers,
‫and what kind of response do we get when we send this?
‫Okay. So these are the parameters, for example.
‫So as you can see, it's actually very possible
‫that you get a detailed documentation
‫having these sample requests and sample responses.
‫Here we have the ID of the Instagram account.
‫Here we have another request
‫and here we get another response like this.
‫As you can see, it's very possible.
‫However, Instagram does not only use these APIs.
‫Instagram has its own APIs.
‫Rather than everything listed over here,
‫they can follow some other accounts.
‫They can like some other accounts.
‫They do not include this kind of API endpoints
‫in their business development APIs.
‫Why?
‫Because they do not need to give access to those APIs.
‫They do not want developers to know how to send a comment,
‫how to like another post because they do not let them.
‫So there are two options over here.
‫You can find those APIs.
‫You can try to pen test them,
‫of course if you are allowed to do so.
‫And also you can pen test the endpoints
‫that are listed in here as well.
‫So far so good.
‫So now I really think you understand
‫that it depends on the situation.
‫You may get a detailed information
‫about the API data you are about to pen test or you may not.
‫So depending on the situation,
‫you're gonna have to work harder or not.
‫But in this case, since this is a CTF,
‫we even have this as a collection in the Postman.
‫So we can do everything in a much more easier way.
‫So over here we have the headers.
‫And most of the time we're not even going to bother
‫with the headers, we're just gonna work with the body.
‫So if it send a request, we get a response back.
‫So we have tried that this works,
‫but right now we're just gonna deep dive into it.
‫So first of all, I'm going to try
‫and find the preferences of the postman
‫because I want to make the fonts a little bit bigger.
‫I believe you cannot see it in a clear way.
‫Yeah, here you go.
‫I believe that's much better.
‫Right now in the body of the POST create user request,
‫we have sent a username
‫and a name and a course, apparently.
‫Okay, like this.
‫This was the name.
‫This was the course that we have sent
‫and also we have sent a password.
‫And for a response back,
‫we got a response and it actually includes an ID.
‫So let me see what's going on inside of the API1.
‫It says broken object level authorization.
‫So this refers the OWASP Top 10, API Top 10,
‫one of the top 10.
‫So this means that we can actually try to get
‫to see the details of the other users.
‫So we are going to see something
‫that we shouldn't be authorized to.
‫Okay.
‫So we are going to try and do that.
‫And as you can see,
‫as a hint it says that you can register yourself as a user.
‫That's it.
‫Is there something else?
‫Let's see if there's something else.
‫I'm gonna go to the resources and see.
‫We don't have any resources in the API1.
‫We have an API2 and 3.
‫All we need to do is just work with the Postman then.
‫Okay, so we already created the user.
‫We already created the user using the POST request over here
‫and we got a response back.
‫But also we have a GET user request over here.
‫Most probably we are gonna get the user details
‫giving this user ID.
‫And we know the user ID because it has been given to us
‫when we have sent the request with the create user.
‫The ID is five.
‫Now, if I go to get user,
‫as you can see in the parameters,
‫there's nothing in the headers,
‫there's nothing you should change.
‫But over here we have an API authentication.
‫And as you can see in the API authentication,
‫we have a value.
‫So it has a value, it has a current value over here,
‫and it didn't have an initial value.
‫So where did it come from?
‫Because we don't have anything in the body
‫and we even have the ID over here as well,
‫like it has ID of five.
‫So we didn't put that information.
‫How did it happen?
‫So as you can see, if we have the ID over here,
‫but how does Postman know about this?
‫So if you go to tests,
‫as you can see there are some kind
‫of JavaScript codes over here.
‫It gets the response back.
‫It gets the response back as adjacent request,
‫as adjacent response, sorry, and takes the ID out of it.
‫So you don't have to do anything with this tests.
‫The reason that I'm showing you
‫is that you can understand why this happens.
‫As you can see, it gets the ID
‫and it sets the idea as an environment variable.
‫Like if I delete this and if I write five,
‫that will be okay, but it does it for me.
‫So if it doesn't work for you for some reason
‫then you can do this manually.
‫You can come over here and change the environment variable
‫like the user ID to five.
‫And also for this authentication.
‫This authentication also has been defined in the tests.
‫As you can see, it gets the username, it gets the password
‫and it has like an algorithm over here.
‫It encrypts the username column password
‫with some kind of encryption
‫and it becomes the authentication key.
‫So this is a very standard thing to use
‫in creating tokens when you try to do tests.
‫And also it's given us over here in the console,
‫it says console.log.
‫So we should have seen that in the logs.
‫Okay, I'm gonna show you have to look at the logs,
‫but also it calls the Postman that set environment variable
‫and it saves that value as an authentication token
‫so that we don't have to copy and paste every time.
‫So if it didn't have that functionality,
‫then we would have to go over there
‫and copy and paste it every time.
‫The reason that I'm showing you this,
‫the creator of the CTF actually made it possible for us
‫not to deal with that kind of gibberish stuff.
‫We are not going to copy and paste values
‫because the tests over here
‫actually made it possible for us.
‫It saves it automatically.
‫In a real pen test,
‫again, maybe you need to copy and paste stuff
‫like take the authentication token
‫and give it in another value in another endpoint over there.
‫But it does that automatically for us right now.
‫If you understood that, then it is good.
‫So over here, as we can see,
‫it takes the username in
‫and it takes the password,
‫it encrypts them in somehow,
‫and it actually saves it in the API1 authentication
‫as a result over here.
‫And you can see the current value
‫of that authentication token.
‫If you don't get for some reason,
‫you can get it from the test results.
‫As you can see, we don't see
‫any kind of test results over here,
‫but we can see it from the logs, I believe.
‫Let me do that one more time.
‫I'm just gonna go into the body.
‫I'm gonna create another user
‫so that you can follow exactly what's going on.
‫I'm gonna call the zeynep.
‫You can call the zeynep anything you want.
‫And for the course, I'm just gonna say mobile pen testing.
‫I'm just gonna change the password as well.
‫Now, I'm gonna send this as a request
‫and I'm going to open the console from here.
‫So I'm gonna open the console, and here you go.
‫So this already has everything over here
‫and it already has the previous authentication token
‫in the console as well.
‫But if I send this, it will give me another ID.
‫It will give me another authentication token.
‫And as you can see, we have the new authentication token.
‫Right now since it should have saved
‫the ID authorization token.
‫If we scroll down a little bit,
‫we can see that the value has been changed right now.
‫Right now it has the new authentication token
‫and it should have the new API1 ID as well.
‫Because we have the six,
‫we have the authentication token over here.
‫Right now if I send this GET request,
‫as you can see, the current value of the ID is six.
‫So if you didn't get that,
‫you can copy and paste it from here
‫to paste for the related sections,
‫but most probably it'll work out for you fine.
‫Now, it doesn't have anything in the body
‫and I'm just going to just send a request
‫because we already have all kind of variables that we need.
‫So if I sent this as a request,
‫we get the responses back like this.
‫So I can get the response.
‫So everything seems to be okay.
‫So where is the vulnerability?
‫So what did I say to begin with?
‫We should see something that we shouldn't see
‫in order to discover this vulnerability.
‫Right now I have the API authentication for user six,
‫but if I change this API ID to user five, for example,
‫and just send this, as you can see,
‫I can see the details of the user five.
‫And if I just send the one,
‫as you can see, I can see the first user,
‫most probably an administrator user.
‫So it's not secure.
‫And here we have the flag.
‫This is the first flag.
‫Of course we are not even going to do something
‫with the flags, but when we see a flag,
‫we can understand that we solve that challenge.
‫As you can see, we manage to get the first ID,
‫first user information
‫using the sixth user's authentication token.
‫So basically we can change
‫and see every user detail from here.
‫And it means that,
‫this is all the office characters, I believe.
‫I hope you're an office fan.
‫And also I hope you understood that if this was a real API,
‫then we will just create a user.
‫And with that user's token,
‫with that user's authorization token,
‫we could have gotten every single user password
‫and user name or user details.
‫So this is not secure.
‫So it should have checked the user ID
‫versus the user authentication token.
‫If they don't match, it shouldn't have replied us back,
‫but it did so it's not secure.
‫And this is the vulnerability
‫that we are trying to find out.
‫And this is how it goes.
‫This is how we are going to do our pen tests.
‫I hope you understood it right now
‫and we're gonna stop here
‫and continue within the next one
‫to go into the second API and find the vulnerability.