in this class.
I'm going to show you an example of
an information disclosure combined with an insecure access control
or in my opinion broken access control which will
allow us to gain access to the admin page
as we do that. I'm also going to introduce you to the H T. T. P.
Trace method and see how useful it
is in understanding how the target application works
and how it can help us with exploiting it and discovering bugs within it.
So we have a normal application here. As usual.
The link is in the resources and you
want to test every single functionality within it.
But I know the bug is actually in the admin page.
So if we go to the admin page you will see you again
an informative air message saying the interface is only available to local users.
Even if you didn't get an informative error message like this.
And the admin page just simply didn't even load didn't
even ask you for a user name and a password
that should trigger your curiosity or your bug hunter or
hacker mentality that we spoke about because we want to understand
how is it knowing that I'm not the admin and it's not letting me see anything
to try to understand how this page works. We're going to turn on our interceptor
and we're going to load the admin page again.
And when we do that we can see we have a simple get
request to the path that we are requesting which is the admin.
If you look at the values being sent, everything is fine.
We'll look at the cookies and there's only a session cookie.
So there's nothing weird.
We'll look at the body parameters in here and there is nothing as well.
So there's nothing that is being sent that would allow do have application to know
that I'm not admin and to know that it shouldn't even show me login boxes
in such scenarios.
I'd usually forward the packet to see if there is more data
being sent and sure enough there is more data being sent.
But again if you analyze this data you will not see anything useful.
So we forward it again and that's it simply do have
applications saying I'm not gonna load for you because you're not admin
in that case the next thing I would do is try to send the same request.
But instead of get so let me just send it now.
Instead of getting here I would type trace
so so far we saw post and get as
http methods to request paths within the target website.
And another http method that we can use is the trace method.
The trace method is really useful in such scenarios because it
helps us debug or understand how the target web application works
because when we send a trace
to the target web server,
the target web server will response by simply sending
us back the request that we sent to it.
This is very very useful because it lets us understand whether the
data that we sent to the server got modified at some stage.
So in some cases you send a request like so to the target server.
But that request will pass through a number of
points or nodes before it reaches the target server.
And these points or notes can actually modify the original request that you sent.
For example you started with this request but the end result that the
target web server receives could possibly contain extra headers and extra data.
And the target web server might use this
data to identify you or treat you differently.
Therefore when we use the trace method the web server is going to send us back the
request that it received after it got modified
along with the modified headers and the modified data
and will be able to read the request and compared to the original request that we sent
and see if there is any extra headers and if they are useful in any way.
So we're gonna go back to our example and we already modified the
original Get request and now we're sending a trace request to the admin.
We're going to forward the request
And perfect as you can see we managed to download a text file
and if we open this text file
you will notice here at the bottom we actually have an extra header called X custom I.
P authorization.
So the original request that we sent contained all of this data
but somehow along the way this particular header
was modified and added to the target web server
and the I. P. That you see in here is actually my I. P.
So I can simply just go to google and type my I. P.
And sure enough it is the same I. P.
That is being used to the web server.
So looking at this again and employing your
hacker or bug hunter mentality you can see
that somewhere along the line this header is being added along with your own I.
P.
And then the admin pages not loading.
Therefore the chances are the admin pages not loading for you
because the web server knows that you're not the admin.
So you should either try to put the admins I. Pee in here.
So you're gonna have to try somehow to find the admins I. P.
Or you should simply replace this with a reference to the local I. P.
So 127001 is one way of referencing the local host or the local I. P. Of a computer.
So right now we're just trying we're doing a trial and error.
We're not sure if this is gonna work. This is an educated guess.
And what we're trying to do is we're trying to send this header
and saying that we are a local user on the target computer.
And hopefully based on this information the web application is going to think that
we are the admin and we should be allowed to see the admin page
now to send this. We're gonna copy all of this.
We're gonna close the page and I'm gonna turn off the interceptor for now.
We're gonna go to the options
and we're gonna use the much and replaced feature.
So previously you saw how we can use it too
much a certain string and replace it with something else.
But right now we don't want to match anything. We actually just want to add
this text that we just copied
to every single request.
So we're going to click on add
and we're going to leave the match empty
and we're simply just going to fill whatever we
want to add to the requests in the replace part
we're gonna click on. Ok. And we're gonna make sure that it is ticked
and that's it. Now.
We don't even need to have the interceptor on as I showed before because
is automatically going to add this rule to every packet that goes through it.
So we're simply just gonna go and load the admin page again.
And perfect as you can see the admin page
loads for us because now the web application thinks
that we are coming from the local computer from
the local host because we're adding this extra header
to every single request that is being sent.
And
In this header we're saying that we are
coming from the local computer because 127001 is
a reference to the local computer to the
local host and therefore the web applications,
thinking that we should have access to this page.
Now again, as usual, once you're done with this,
you want to make sure that you either intake your rule or even remove it
because you don't want it to be applied to every single request that gets sent.
Now this is one example of where the trace method is useful,
but you can use it in any other scenario
when the web application is behaving in an unknown manner
and you want to debug that further and have a
better understanding of how the swab application is working.