‫Lecturer: Hi.
‫Within this lecture, we're gonna go ahead
‫and take a look at the API7 challenge.
‫So I'm gonna go back to the documentation
‫and just go for the API7.
‫Over here we see the title as Security Misconfiguration.
‫Okay.
‫And it says that it's an API,
‫so we are expecting cross origin requests.
‫Great, so it's about cross origin requests.
‫We're gonna see what a cross origin request is,
‫but for right now, I'm just gonna go ahead
‫and take a look at the post and get requests.
‫So first of all, we create a user,
‫and then we actually log in
‫with the user as far as I can see.
‫After we log in, we can get a key,
‫like an authorization key I believe, with this request.
‫And finally, we can log out from that user
‫if we just call this end point, great.
‫Now, this is very generic.
‫So we sign up, we log in, we get a key, we log out.
‫But what is cross origin request
‫and what does it have to do with any of this?
‫Right, so cross origin means we are
‫getting the request from another origin.
‫For example, not from this website,
‫not from the API's website, from my website
‫or from attacker's website.
‫So APIs actually have to take this into consideration.
‫Because why?
‫Because let's assume that I'm a hacker
‫and I create a website and I create a button
‫in that website to send a request to Facebook for example.
‫Let's assume that you're logged into
‫the Facebook in your browser, and I placed a button
‫in my website to send a request
‫to the Facebook and you clicked on it.
‫Now, Facebook receives this request
‫through my website, via my website, via my server,
‫so that I can see the request and I can see the responses
‫and I can get something out of it, right?
‫I can see the response, or I can get your authorization key.
‫So it's not good.
‫It has to take this into consideration
‫and it has to block whatever it has to block,
‫or it may just display a message saying that,
‫yeah, it's not the origin that I'm expecting,
‫but it has to follow up on that.
‫So I'm gonna go to Postman and just try
‫the username and password, like atil, atil123.
‫You can try whatever you want.
‫And as you can see, once I send this request,
‫as you can see, it's created and I have my ID over here.
‫Now, if I go to log in, now in the headers,
‫I have to have my authorization token
‫because it's already created for me
‫in the tests of this Create User API.
‫Now I'm gonna go and just send this, okay?
‫Without anybody.
‫And here you go, now I'm logged in
‫because I have sent that authorization token.
‫Now, so far so good.
‫I have created the user, I have logged in.
‫If I come over here, okay, if I send this request,
‫then I will get another authorization key like that.
‫Here you go.
‫Now username is this, password this,
‫and I have an authorization key.
‫Now I can use this authorization key to further do something
‫inside of that website or inside of that API.
‫Great, so far, so good.
‫Nothing seems to be broken
‫and I believe we can even log out from this one
‫and just log in back whenever we need to.
‫So let's try the user logout functionality.
‫Okay, for the last thing, I'm just gonna log out.
‫Here we go, I'm logged out.
‫Let's try that.
‫If I logged out, I shouldn't get the key, right?
‫Here we go.
‫If I send a request without logging in,
‫I'm not getting the key.
‫I have to log in, then I can just get the key.
‫So this API actually works well
‫but I'm gonna turn the intercept on before getting the key.
‫Okay, I'm logged in right now.
‫I'm logged in.
‫I will try to send this request,
‫get key request, and catch it in the Burp Suite.
‫Why I'm doing that?
‫Because I will see if I send this to repeater.
‫If I send this, then it will give me the key, right?
‫Because I'm logged in, API knows I'm logged in,
‫I'm sending this cookie, PHPSESSID,
‫so that it knows me, it knows that I'm logged in.
‫It will give me back my key.
‫So I'm gonna send it, here you go.
‫I get the key, but what happens if I change the origin?
‫I'm not gonna create a website in order to do that.
‫I'm just going to simulate it, okay?
‫In order to simulate it, I believe we can change
‫some headers inside of the request.
‫So I'm gonna search for origin header.
‫Okay.
‫Yeah, here you go.
‫Cross-origin resource sharing, CORS.
‫So if we take a look at that, yeah, here you go.
‫There is a portswigger.net tutorial over here and that's it.
‫As you can see, we can add
‫the origin header whenever we need to.
‫Great, so this will become like this.
‫So I'm gonna add the origin header from here,
‫and I'm just gonna change it to something random
‫like my own website, okay?
‫So right now, this request is coming from my website,
‫but the user has already been logged in
‫because I'm just sending the cookie of that particular user.
‫And here you go.
‫Now we got the flag.
‫So what happened?
‫As you can see, the request came from another website,
‫like a hacker's website, and we still got the key.
‫Okay, so a hacker can easily steal our information,
‫steal our key, using that particular vulnerability.
‫Of course, we didn't create a website from scratch.
‫We just simulated it by adding the origin header
‫over here in the request, but that's about it.
‫Great, so far, so good.
‫Now I'm gonna stop here and continue
‫within the next lecture for the next challenge.