Lab: User role controlled by request parameter

April 21, 2025
  • Admin panel at /admin , which id’s admin using a forgeable cookie
  • Solve by accessing admin panel and delete user ‘carlos’
  • user – wiener pass – peter
  • /admin loads but no access
  • login to user shows admin access is controlled by cookie boolean value
  • change from false to true
  • reload of /admin gives access to admin panel

Leave a Comment » | Burp Suite | Tagged: , , | Permalink
Posted by admin

Lab: Unprotected admin functionality with unpredictable URL

April 21, 2025
  • Contains an unprotected admin panel
  • Located at an unpredictable location
  • Location is disclosed within the application
  • Access and delete user ‘carlos’
  • admin script loaded with website
  • amend url loads panel

Leave a Comment » | Burp Suite | Tagged: , | Permalink
Posted by admin

Lab: Unprotected admin functionality

April 19, 2025
  • Contains an unprotected admin panel
  • Delete user carlos for solve
  • Ammending URL with /admin has no results
  • amending /robots.text uncovers the following- Disallow: /administrator-panel
  • navigating to /administrator-panel loads an unprotected admin dashboard
  • A list of users is available where we can delete them at will

Leave a Comment » | Burp Suite | Permalink
Posted by admin

Lab: File path traversal, validation of start of path

April 13, 2025
  • Vulnerability contained within display of images
  • Application transmits full file path via a request parameter
  • Path validation by checking path begins with expected folder
  • /var/www/images
  • GET request list full path
  • GET /image?filename=/var/www/images/20.jpg
  • A good indication path validation is enabled
  • GET request using full path and path traversal returns 200
  • GET /image?filename=/var/www/images/../../../etc/passwd

Leave a Comment » | Burp Suite | Permalink
Posted by admin

Lab: File path traversal, traversal sequences stripped with superfluous URL-decode

April 13, 2025
  • File path traversal vulnerability contained in images
  • Application will block input containing path traversal sequences
  • Application performs URL DECODE before using path
  • Retrieve contents of /etc/passwd file
  • URL encoded ../ charcters
  • %2e%2e%2f – single
  • %252e%252e%252f – double encoded
  • ..%c0%af -non-standard
  • ..%ef%bc%8f -non-standard
  • Standard traversal characters returns 400 Bad Request / No Such File
  • Single URL encoded ../ characters returns 400
  • Also encoding etc/passwd returns 400
  • Double encoded %252e%252e%252f with /etc/passwd returns 200 and file contents in repeater

Leave a Comment » | Burp Suite | Permalink
Posted by admin

Lab: File path traversal, traversal sequences stripped non-recursively

April 13, 2025
  • Vulnerability contained in images
  • Application strips traversal sequences from user supplied filename
  • Retrieve contents of etc/passwd
  • Use of nested traversal sequences
  • Load Product Page
  • Intercept GET request for image
  • Original GET request returns 200
  • File traversal using ../ is stripped
  • However using nested traversal ….// traversal can work
  • Solved using ….//….//….//etc/password
  • Server response listed file contents

Leave a Comment » | Burp Suite | Permalink
Posted by admin

Lab: File path traversal, traversal sequences blocked with absolute path bypass

April 12, 2025

Using Burp Suite:

  • Contains path traversal vulnerability in product images
  • Application blocks traversal sequences
  • Treats supplied filename as absolute
  • Solve = retrieve contents of /etc/passwd
  • Intercepted GET request for product image
  • Sent to Repeater
  • Original Request ‘GET /image?filename=17.jpg’ returns 200 OK
  • Using absolute path /image?filename=/etc/passwd returns contents in response
  • ../ traversal was blocked

Burp Suite response returns the contents of the /etc/passwd file

Leave a Comment » | Uncategorized | Permalink
Posted by admin