‫Instructor: Hi.
‫Within this challenge we're just gonna take a look
‫at the API5.
‫So we're already halfway over there.
‫So let's see.
‫This is about broken function level authorization.
‫It sounds awful like that.
‫The first challenge that we have completed.
‫Right?
‫And it's technically something like that
‫but we are gonna see the differences.
‫It says that you can register yourself as a user.
‫That's it.
‫Or is there something more?
‫So it says that I heard administrator logins often
‫but uses different route.
‫Okay.
‫So the key thing over here is that different route
‫or different route,
‫however you may want to pronounce it.
‫And as you can see it says
‫that you're gonna have to post to this, okay, the user.
‫If we use a different route
‫then we are gonna get something
‫like an administrator, right.
‫Or something like
‫maybe moderator, coordinator, something like that.
‫So over here in the get,
‫we're just gonna send an API ID or a user ID.
‫So this sounds like
‫and it works like the first challenge
‫that we have completed really.
‫So I'm gonna just go over here and test us.
‫So I'm gonna go to create user.
‫For the headers we're not gonna change anything
‫but for the username and password
‫for the body we're gonna have to change something, right.
‫So we have been given something like test user.
‫Test 1, 2, 3 or you can just write it on your own.
‫I'm just gonna go via test user three.
‫Okay, I'm not gonna change the password.
‫Name test, user address, mobile.
‫No, I'm not gonna change any of this.
‫I'm just gonna send this and here you go.
‫We get an ID back.
‫So this should be ID two.
‫Great.
‫Now in the get user
‫in the next endpoint I can just try
‫to get the user ID.
‫Because I already have the authentication key
‫as usual in the tests.
‫So it should have been saved to the get user endpoint.
‫If it's not you can just look at that logs.
‫Okay, but here you go.
‫It's saved in my case.
‫So since I already have that, okay, I can open the logs
‫and just compare it if you want.
‫Okay, here you go.
‫This is the API5 authentication key.
‫If it's in your case not saved
‫then you can just automatically override it
‫by copying and pasting over here.
‫And here you go.
‫In the body we don't have anything.
‫If I send this, I can get this ID details back.
‫Great.
‫Now in the first challenge, we already
‫have seen something like that.
‫So maybe we can try to change the idea
‫over here like this.
‫Okay, like if we change it to one, we don't get the details.
‫So they have fixed that issue.
‫So it says that username or password incorrect.
‫So the API at the backend is checking to see
‫if the authentication token matches with the ID.
‫So far so good.
‫Now if I change two ID
‫to something else I don't get it either.
‫Like minus 1, 0, 1, 2, 3.
‫But if I do the two then I can get this
‫because the authentication key actually matches
‫with the ID too.
‫But if you remember the clue,
‫if you remember the hint,
‫it says something about routes.
‫So I'm just gonna change this to admin.
‫As you can see, we're not still getting it.
‫I'm just gonna change the ID one more time.
‫We're not getting it.
‫Maybe just admin.
‫Nope, we're not getting it.
‫So we're gonna have to try this
‫because we know we ought to change the route.
‫Right, so I'm just going send this to Burp Suite.
‫I'm gonna give some proxy.
‫Yeah, it's already been edited over here.
‫So I'm gonna open the Burp Suite.
‫I'm gonna turn the intercept on
‫and I'm just gonna send this, okay, in a regular way.
‫And in the Burp Suite I'm just gonna send this
‫to repeater as usual because we are gonna repeat
‫this process a little bit.
‫And if I send this, I can get the second ID.
‫But if I change the route,
‫if I change this user to something else
‫then we should get it.
‫This should be the vulnerability
‫as long as we consider the documentation a reliable source.
‫So I'm just gonna delete this and say admin, for example.
‫We're not getting it, as you can see.
‫Maybe users.
‫Yeah, here you go.
‫In the second trial I found it, okay.
‫If I change this to users, if I change this route to users
‫then I can get the other users' details as well.
‫So this happens by the way in real life as well
‫because they think that, yeah, nobody knows
‫this user's route exists.
‫Only the developer knows.
‫So why not?
‫We just put everything over there.
‫And for development purposes we can just use this.
‫But the idea over here
‫is that we're still using the same authorization token
‫and should have checked that.
‫But it doesn't.
‫Okay, and we are getting this.
‫We're getting this all details about all users.
‫And of course if we send this to intruder, okay.
‫If we send this to intruder.
‫If we just change the route
‫with a payload with a list
‫then we can just do it like we have gotten
‫this user out of luck.
‫Right, I have just tried this
‫and it happened.
‫But if I add this as a parameter
‫using this sniper attack type,
‫I can come over here and I can use a word list
‫or I can add one by one.
‫Let's do an example.
‫Like I can just add anything that comes to my mind.
‫Admin, administrator, user,
‫users, passwords, something like that.
‫Or you can just try to search wordlist in Kali Linux.
‫You can find it and just use them as well.
‫Like maybe we can try password or something like that.
‫Just use whatever you want like
‫all users, admin, administrator.
‫If you start this attack, okay, it will just try them.
‫And as you can see, we got the users over here.
‫This is not luck right now.
‫We have gotten users out of luck.
‫I accept it but this is not luck.
‫This is just trying other wordlist, other payloads,
‫or other routes that can be embedded in the API.
‫And here you go.
‫We found it and we got the flag.
‫So this is different than the first challenge
‫because in the first challenge we have
‫just changed one parameter
‫but over here we are changing the route
‫and using the same authorization token to get the details
‫of every users in the database.
‫Great.
‫Now if you remember this
‫then it's going to be okay
‫because you can just use the this technique
‫to pen test against every possible API that's out there.
‫If you think that there is a slight chance
‫that you can find something like that
‫it would worth a lot of bug bounty money.
‫Great.
‫Now we are gonna stop here
‫and I'm not even going to just delete the proxy
‫because we need it as far as I see
‫in the next challenge as well.