Today, in this post i will be sharing my write-up on Admin panel bypass that I have found while doing my regular bug bounty
This write-up is very unique, because it does not need authentication at first place and it does not require any sort of response manipulation, no brute force, and no old school stuff.
While testing a target, I came across a subdomain that was an admin panel, upon inspection I thought it was hard to get into and better to leave, as it requires a valid username and then a valid phone number linked to that, after that it sends an OTP to that mobile number, then it will grant access to the Admin Panel.
Let's Break the Application's Logic
When you visit the subdomain (Admin panel), it asks you to enter the Username. If the Username is Valid then it will ask you to enter the valid Phone number connected to the username. If the phone number is found, then it will send an OTP, after OTP verification is successful it grant access to the Admin panel.
The most difficult part is guessing the username and a valid phone number. If you send multiple requests, then WAF will block you, and it is challenging to brute force.
The application is running on PHP., I thought I could give it a try for SQL injection, but it failed.
Its Time to exploit
Upon observing the HTTP requests and Responses from Burp's Proxy History, after entering a valid Username admin, it redirected to the phone.php page there we have to enter a valid phone number and OTP
Now, in the phone.php page we have to enter a valid phone no and a valid OTP, to my surprise, the phone number was hardcoded in the response itself. In the source code of the page in JavaScript, I used the phone number and sent an OTP to that number
After analysing the source code (view-source), I have noticed that it was only validating the OTP on the client side. If the OTP is valid, then it redirects the User to set a password, for me I cannot access the OTP, since it was sent to the admin.
Out of curiosity, I have opened the page setpass.php
Now it asked for a new password and a confirmation password. I set a random password and submitted. The application successfully processed the request
Now I came back to the login page, and entered the username and the newly set password. Boom, it redirected me to the dashboard. For some reasons I cannot show you the internal admin panel screenshots
In this article, let us discuss what Bug Bounty is and how to get started with
Bug Bounty as a complete beginner. This article will guide you on where
to start, how to learn and how to earn
I have been a bug bounty hunter for a while. Of course, I got some
certifications for reporting critical bugs to companies and some bounties, too; I will share my journey, how I got into bug bounty, where I started, and some valuable tips and resources you can learn
effectively.
Table of Contents
What is Bug Bounty
Bug Bounty is a process where companies invite hackers
and offer bounties for finding vulnerabilities in their
Software/Applications, which can be any type of Application, not just limited to
Web, Mobile, or Desktop.
What is a Bug Bounty Program
Suppose a company invites Hackers and security Researchers to test their applications for bugs/vulnerabilities. In that case, you can consider that
company as a program, but remember there are many types of programs, such as
VDP and reward-based programs.
VDP
A vulnerability Disclosure Program (VDP) is a procedure that Companies and Organisations have set. They Invite security researchers to test their applications, some programs reward bounties for the findings, and some offer Hall of Fame or certifications.
Reward Based Programs
In reward-based programs, Companies define the reward for each vulnerability and pay according to the impact of the vulnerability, By testing these reward-based programs, you can showcase your findings and get paid for it
How to get started in bug bounty
A bug bounty is not something that you can join a program, test for vulnerabilities, and get paid too quickly. When I was a beginner, I too thought it too easy to join a program and browse the target application to find vulnerabilities and report,
I used to do the same with all programs and ended with no bugs found. I thought that the applications were highly secure, and it was challenging to find the actual bugs,
But wait, bug bounty is an art that can be mastered,
As a beginner, I needed to figure out Where to start bug bounty. I used to watch some YouTube videos and well-known vulnerabilities and tried to find the same vulnerabilities with every program but found nothing.
I want you to avoid making the same mistake. Here, you can follow the process carefully.
Learn the Basics of How the Internet Works
If you are a beginner, first learn how the Internet works and the protocols, IPs, ports, etc.
Since I had a Computer Science background, I skipped When I started my bug bounty journey. I didn't need to know How the web or the Internet works.
Start With the web first.
I suggest you to start. With web application pentesting, you need to know how the websites function and the technologies behind each web application; again, you need not be an expert at the beginning.
Or you can even start with Android app pentesting it involves some API pentesting part, still, you should have web app pen testing knowledge.
Learn the basics of web development.
You don't have to be an expert, but to learn how web applications work, it's optional. But Having a basic knowledge of HTML, Javascript, and PHP will give you an overview of how the Frontend and Backend stuff works again. There are many frameworks that developers often use to create websites, so you need not worry at the beginning.
Where to Start
Before you begin, you have to master web application pentesting first. When I was starting, there were not enough resources to learn now. There were no limitations on free resources.
Here are a few things to remember: Make sure you have a Linux distro installed on your system, like Kali Linux or Parrot Os, because these distros come with many tools and easy to install many other bug bounty tools
Practice Vulnerable web application exploitation.
I highly recommend you use DVWA, BWAPP. Vulnerable web applications to learn web application penetration testing: These can be installed on your local machine, and you can practice on it
Here are a few online resources you can utilize to enhance your web application security skills. I highly recommend you try the Portswigger Academy labs, which will take you from zero to an expert level.
There is no end to Cyber Security. After learning and completing all the labs, you should be ready to test for real-world web applications. You can join bug bounty hunting platforms and start your journey there, or you can manually search for the websites that offer bounties for finding vulnerabilities in their web applications.
I have personally Joined the following Platforms. You can find a lot of programs to test on.
Hello there, In this tutorial, we will be discussing how to install and use
Sqlmap in termux
What is Sqlmap?
Sqlmap is an automatic SQL Injection scanner and exploitation tool written in
Python. We use this tool to detect SQL injection vulnerabilities in websites
and exploit
how to use sqlmap in termux
Follow the below steps to use sqlmap in Termux.
After Installing Termux, You have to install the following packages, so
type the commands in termux
This tool is a combination of many other subdomain enumeration tools. You can either install other tools manually or install the necessary tools using the setup script
The main advantage of this tool is it can go through parallel and grabs all the subdomains in a txt file,
Available Tools and online services:
Tools:
Findomain
SubFinder
Amass
AssetFinder
Httprobe: To Probe For Working HTTP and HTTPS Subdomains.
anew: To delete duplicates when using -s/--silent option.
online services:
WayBackMachine
crt.sh
BufferOver
Httpx for checking live domains
After enumerating the sub-domains, I always used to check the status of the subdomains, filter out the live domains, and remove the unnecessary or bogus domains.
For that, I use httpx, a tool by Project Discovery.
This tool can filter out the live domains in a faster way. It can get the page title and detect the technology used by the domain.
Browser Extensions
Here are the browser extensions that I use while doing recon
Wappalyzer
Wappalyzer is a free browser extension that Fingerprints the Technologies the target website uses.
WhatRuns
WhatRuns is similar to Wappalyzer. This extension is recommended by Jason Haddix on his Bug Bounty methodology. Since then, it was a must-use tool for me.
Shodan
Shodan is a search engine for Hackers. They also offer a Browser extension that can detect the target's Open ports on the browser, giving us a clear insight into what services the target runs.
Cookie Editor
The cookie editor plugin will be helpful when testing the target with multiple logins and cookie-based attacks.
Radom user agent
I often use this extension to test how the website responds on different devices and bypass some restrictions.
Web Proxies
Burp suite
Burp suite is becoming a must-use tool for hackers. I always use this tool to intercept the request response of the target.
Port Scanning
Nmap
Nmap is a powerful port scanner. Who else will keep it aside,
Naabu
Naabu is a port scanning tool developed by project discovery. It can detect open ports from a list of URLs
Smap
Smap is another fast port scanner developed by Somedev. It does not make any contact with the target and is based on shodan.
Shodan
I use shodan. It will be helpful when scanning is not allowed by the Program.
Automated Tools
Nuclei
Nuclei is an automatic vulnerability detection tool developed by Project Discovery. It can go through the templates and check if the target is vulnerable to any vulnerabilities.
Sqlmap
Who will forget Sqlmap? We all started with it. Sqlmap is an automatic SQL injection detection and exploitation tool written in Python.
Wpscan
Wpscan is an automatic WordPress vulnerability scanner. It can detect the latest vulnerabilities in WordPress websites.
Fuzzers
As a web application pentester, it's essential to fuzz the hidden directories of the target. Here are my favourite fuzzers
Dirsearch
Dirsearch is a web directory brute-forcer written in Python. You can find the go version also.
In this tool, you can use the default wordlist, or give the path of the wordlists.
ffuf
ffuf is my second best directory fuzzer. It is a little bit faster. You can customize the requests according to your need.
Dirbuster
it is a GUI-based Directory brute forcing tool. The main advantage of this tool is you can customize the settings as per your needs and prevent your IP from being banned by the Web application firewall.
WAF Detection
Most of the targets are protected by some kind of Web application firewalls. We have to detect the WAF and bypass it for maximum impact,
Here are the tools I use for WAF detection
wafw00f
This tool can detect almost all web application firewalls.
WhatWaf
This is an advanced Waf Detection Tool.
Others
This section contains some uncategorized tools, wordlist etc.
Wordlists I often use
PayloadAllTheThings
SecLists
Conclusion:
This Article will be updated again, I use even more tools that I did not mentioned here, I hope these tools will give you the best results, making your bug bounty journey much easier
Today In this post, I will be sharing a unique writeup on SQL injection with Authorization Headers token.
A little bit intro to Authorization Tokens,
=> An Authorization token is generated and signed by the servers and is used to verify the users by unique tokens.
=> After the successful login, the server sends an authorization token, and web developers often store it in the browser's local storage or session storage.
=> Modern Websites use JWT(JSON Web Tokens) for User Authorization. It doesn't mean that each Authorization token is JWT. It depends on the backend and the Framework that the website uses,
Without wasting time, let's jump into the story
I am not a regular Bug Bounty hunter. You can say I am a seasonal Bug bounty hunter. I was bored and tried to search for some private bug bounty programs through google dorks, And Randomly selected a program for hunting. I did not do basic recon like Subdomain enumeration or any Dorking as I started with the main target.
For me, it was a typical day. I just fired up the Burp suite and opened the target site. as per the company policy, I am unwilling to reveal the target.
With the help of the Wappalyzer Plugin, I have noticed that the target runs on PHP. For me, PHP is vulnerable by nature. As a Web developer, I have plenty of experience building websites in PHP and fixing vulnerabilities.
While attacking targets, I have a practice of directory brute-forcing and checking the robots.txt file at the initial stage of my recon process.
I used Dirsearch to find the hidden directories, but no luck. I did not get anything fishy other than the admin page.
I tried Opening the admin page by visiting target/admin/
But No Luck it throws an error 403 Forbidden
I did not give up too quickly, again tried to Fuzz inside the admin page using Dirsearch. This time events page got 200 responses.
Without any delay, I have opened the page target/admin/events/
I have noticed that the page is a regular login page, where it has two ways to log in, one for the author and another for the super admin
Exploitation Starts here
As I said, there are two links for login pages, One for author and another for admin, I have choose the first one, and It redirected me to target/admin/events/?classic_login=true
and it pops up for username and password, I have started giving wrong credentials and observed the response from the server, and after playing for a while, I have supplied the username and password as 1'
Luckily it displayed the SQL error.
I tried to reproduce it, but it doesn't work, and the login popup is wholly gone. Even after refreshing the page, the error message is displayed there, as I thought it might be some backend error.
I have gone to the burp proxy history and noticed no regular POST form data sent or JSON data.
I was gone blank for a while and later opened the link in Incognito mode, and the popup appeared for login. Again observed the request and response.
Found Nothing :P
Later, I noticed a Header Value Authorization with a token.
As a web developer, I know How the Authorization tokens work, and I Have good Knowledge of PHP, MERN stack and a bit of Django Framework. I can easily guess the tokenization developers use
The Header Looks as follows.
Authorization: Basic Base64Values
You might often see this Header in Modern Web applications.
Authorization: Bearer <TOKEN>
Pro Tip: On the backend side, in most cases, the Bearer is ignored, and developers match the token with the issued token. If that was a JWT, then developers often decode it instead of verifying that's where Improper Access Control, Account takeover occurs.
Let's continue the story
I have sent the request to the repeater, selected the Token and decoded it using the Burp decoder, as I guessed the encryption type by its length and nature. It was not a JWT, but the base64 value of 1':1'
I quickly remembered the Sqlmap tool, captured the entire request, and saved it to a text file.
.
And tried to run sqlmap, but the problem occurs at base64 encoding. Though sqlmap supports base64 encode, the scenario is there was a colon : between the values.
as the application behaves as follows
It takes the username and passwords and encodes the values with base64 with the separation of :
eg: username:password
base64 <username>:<password>
Though I was good at manual SQL injection exploitation, there was a live mode of base64 encoding and applying the payload in the repeater. For that, I tried to find the Number of columns for the target.
and supplied the payload for username and password as: 1' Order By 1-- -:1' Order By 1-- -
Login
