{"id":252,"date":"2018-10-17T06:36:16","date_gmt":"2018-10-17T06:36:16","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/owasp-security-shepherd-session-management-challenge-one-solution-lsb-ls-blog\/"},"modified":"2018-10-17T06:36:16","modified_gmt":"2018-10-17T06:36:16","slug":"owasp-security-shepherd-session-management-challenge-one-solution-lsb-ls-blog","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/owasp-security-shepherd-session-management-challenge-one-solution-lsb-ls-blog\/","title":{"rendered":"OWASP Security Shepherd- Session Management Challenge One \u2013 Solution \u2013 LSB \u2013 ls \/blog"},"content":{"rendered":"

We have another solution in the OWASP Security Shepherd challenges and we enjoyed completing this one. You can find out about Session Management from OWASP here<\/a>. So let\u2019s get on with the challenge!!<\/p>\n

Below is the screen we are presented with and if we click on the Administrators Only Button we are told we are not admin. Simple enough, we need to escalate our privileges to admin to complete the challenge.<\/p>\n

\"sesh1\"<\/p>\n

Apparently the dogs have been released. This challenge will require a proxy for us to intercept the packet before it hits the server to see what is going across the airwaves. We will use Burp Suite for this task which comes as a default tool in Kali Linux.<\/p>\n

Hyperledger Fabric Fundamentals (LFD271) $299<\/a><\/p>\n

You can find out how to configure your browser to work with Burp Suite here<\/a>. So let\u2019s hit the Admin button again and catch the packet in Burp. [ Click on images for a better view. ]<\/p>\n

\"sesh2\"<\/a><\/p>\n

At the bottom of the data being sent over the wire we can see a few Boolean statements. AdminDetected=false, what can we do with that?<\/p>\n

$299 REGISTERS YOU FOR OUR NEWEST SELF PACED COURSE! LFD201 \u2013 INTRODUCTION TO OPEN SOURCE DEVELOPMENT, GIT, AND LINUX!<\/a><\/p>\n

Let\u2019s change it to true and forward the packet to the server?<\/p>\n

\"sesh3\"<\/p>\n

Whoops!! That was detected on the server, probably best to not do that again. So what\u2019s next? Let\u2019s look at the packet again to see what other information we can extract from it. We will send the packet again, click the admin button, catch it in the proxy and inspect the packet.<\/p>\n

\"sesh2\"<\/a><\/p>\n

Looking more carefully this time at the packet we should notice that there is a strange cookie in there and it\u2019s called checksum. The checksum looks to be encoded with an MD5 hash. So let\u2019s right click on the packet in Burp and send to our decoder tab to decode the hash.<\/p>\n

REGISTER TODAY FOR YOUR KUBERNETES FOR DEVELOPERS (LFD259) COURSE AND CKAD CERTIFICATION TODAY! $499!<\/a><\/p>\n

\"sesh4\"<\/a><\/p>\n

Bingo!! When we decode the hash we can see that it queries if userRole=admin. This cookie seems to be checking if the user is an admin and just encoded with the MD5 algorithm. We can\u2019t just send that to the server, that is a normal request and we are just back to the start. So maybe we need to change it slightly and then send it to the server?<\/p>\n

How about we lengthen the word admin to administrator?<\/p>\n

\"sesh5\"<\/a><\/p>\n

Let\u2019s quickly encode that back to MD5 with the tabs on the right hand side, replace the checksum in the sending packet with our new checksum and then forward that packet to the server.<\/p>\n

\"sesh6\"<\/a><\/p>\n

Looks fine and dandy, will we gain privileges? Let\u2019s Forward the packet and see what happens.<\/p>\n

\"sesh7\"<\/p>\n

Perfecto!! To be honest, we didn\u2019t get this first go and it was a bit of a challenge. But I managed to get there in the end. Hacking requires us to have attention to detail and knowing when cookies are sent in a HTTP request helps us to be able to manipulate those cookies. Having a basic understanding of encryption helps too as we were able to identify the hash used in the cookie. So another level of SecShep DEFEATED!!<\/p>\n

Thanks for reading and I hope it helps you in some way.<\/p>\n

QuBits 2018-10-10<\/p>\n

ENROLL IN THE LINUX FOUNDATION LFC210 \u2013 FUNDAMENTALS OF PROFESSIONAL OPEN SOURCE MANAGEMENT TODAY! $179<\/a><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

We have another solution in the OWASP Security Shepherd challenges and we enjoyed completing this one. You can find out about Session Management from OWASP here. So let\u2019s get on with the challenge!! Below is the screen we are presented with and if we click on the Administrators Only Button we are told we are … <\/p>\n

Continue reading “OWASP Security Shepherd- Session Management Challenge One \u2013 Solution \u2013 LSB \u2013 ls \/blog”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-252","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=252"}],"version-history":[{"count":0,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/252\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}