Leshipai

Tackling the Business Logic Labs from Portswigger Lab: Excessive trust in client-side controlsDescription This lab doesn’t adequately validate user input. You can exploit a logic flaw in its purchasing workflow to buy items for an unintended price. To solve the lab, buy a “Lightweight l33t leather jacket”.You can log in to your own account using the following credentials: wiener:peter SolveOur goal is to buy the $1337 L33T jacket while our store credit being significantly less at $100. T...

Tackling the Access Control Labs from Portswigger Lab: User ID controlled by request parameter with password disclosureDescription This lab has user account page that contains the current user’s existing password, prefilled in a masked input.To solve the lab, retrieve the administrator’s password, then use it to delete the user carlosYou can log in to your own account using the following credentials: wiener:peter SolveWe have our test creds wiener:peter so we login normally and access our...

Tackling the Access Control Labs from Portswigger Lab: Unprotected admin functionalityWe don’t have test credentials like we usually do. First thing we do , is check the robots.txt file: We see a path /administrator-panel which upon visiting it , we are able to delete the users and solve the lab: Lab: Unprotected admin functionality with unpredictable URLNo test creds once again . We are supposed to look for the admin path , supposedly its unpredictable so that crosses out wordlists. Fi...

Tackling the Multi Factor Auth Labs from Portswigger If the user is first prompted to enter a password, and then prompted to enter a verification code on a separate page, the user is effectively in a “logged in” state before they have entered the verification code. In this case, it is worth testing to see if you can directly skip to “logged-in only” pages after completing the first authentication step.Some sites don’t check to see if the MFA stage was verified successfully Lab: 2FA simpl...

Tackling Vulnerabilities in Other Auth Mechanisms Labs from Portswigger Lab: Brute-forcing a stay-logged-in cookieOnce again we are provided with valid logins wiener:peter . When logging in , there is a checkbox stay-logged-in which we check since that’s what we are testing for. Inspecting the HTTP response: 1234567HTTP/2 302 FoundLocation: /my-account?id=wienerSet-Cookie: stay-logged-in=d2llbmVyOjUxZGMzMGRkYzQ3M2Q0M2E2MDExZTllYmJhNmNhNzcw; Expires=Wed, 01 Jan 3000 01:00:00 UTCSet-Cookie:...

Hi , here I try to tackle Byte’s challenge from Hackuten. A three-part SOCMINT challenge. This covers the first part. Challenge Description The user “Nick_Hunt” tends to leave small details behind when sharing observations online. Your task is to follow his activity, connect the dots and recover the flag. ReconnaissanceWe are provided with a username Nick_Hunt and now have to find an account associated with the username. Using a username search tool such as WhatsMyName we find several res...

In the following writeup , I try to tackle and document the lsb from BugForge.io named Galaxy-Dash-006. A Broken Access Control Lab. Galaxydash-006On loading the challenge site we get a signup/login form where we are able to create an account and an organization/team. We register two accounts victim1 and victim2 for test purposes. Off the rip , the most interesting functionality is the team and add team functionality This is very interesting since it essentially lets you re...

This post kicks off a series documenting my walkthroughs of the PortSwigger Web Security Academy labs. Herein, I’m revisiting the Authentication module.The goal of these write-ups isn’t to provide exhaustive guides, but concise, practical snapshots focused strictly on methodology and exploitation steps. Lab: Username enumeration via different responsesTrying to enumerate the username -> Sent the candidate usernames with an irregularly long password and observed the response length . Spo...

The Past weekend I took part solo in the Monthly Hacktoria CTF event. The CTF event featured Geolocating Lidl stores around the world. What follows is the approach I took to solve the challenges. Location 1Solution End of 30 km/h zone — means there is a 30 km/h road nearby. Also it’s a German road sign. Forested area Cell mast Parking area Unique architecture of the Lidl Light post StepsFirst thing I tried was a reverse image search using Google, which did not yield any result...