in this example we're going to cover a
slightly more advanced exploitation of an org vulnerability.
It's slightly more advanced because we have to communicate with a
user or social engineer a user to exploit it properly.
So basically exploiting a C. S. R. F vulnerability through the initial
vulnerability.
So the o our vulnerability is resulting into a CSR F vulnerability.
Now I covered csRS vulnerabilities but just a quick recap,
CSR F happens when the requests are not validated by the server side.
So when the server gets a request
it doesn't validate whether the user actually created the request or if it
was created by someone else and the user is just executing that request.
So a possible exploitation of this,
the hacker would forge a specific request that is useful to them.
For example changing the user's password to a password they know
and then social engineer the user to submit that request.
So it could be a RL or a html page.
If the user submits that request to the target website,
the target website will not verify that the user actually created this request.
Therefore it will execute it but it's going to
execute it as if this user submitted it.
Therefore the hacker knows what this request is
because they created it and therefore managing to either
change the password of the user or get them
to submit something that is useful to them.
Now in this example with
if the target website does not verify the origin of the requests,
then a hacker could log into their account using the normal login feature,
not using the social login feature
and then analyze how the website links
normal accounts normal logins to the social accounts
and then use this knowledge to forge a request that
would link an account to a social media account.
Then send that forged request to the user
and social engineer the user to submit that request to the website.
So effectively the user is going to be asking the website
to link this account with the hackers social media account.
Therefore as a result the hacker is gonna log in with their
social media account but they'll end up logging in as the user
because the hackers social media account is linked to the user account
now because the user was the one that submitted the linking request
you'll have a better understanding of all of this.
Once we apply this in practice in the lab.
So let's have a look at it here and have a quick read over the description first of all.
Let's see what's given us.
So it's given us the blog website account which
is winner peter and the social media profile.
Is this? So I'm simply gonna put that in my notes
and let's access the lab as you can see this is
just another blog similar to the one we had before.
You could view posts. If you want to view the posts.
For example when you click in here you can see that you get a post I. D.
You should test that but this is not what we're talking about today.
So let's go to my account.
And as you can see you can log in with a normal
user name and password or you can log in with social media.
So this is a more realistic example because usually you are given the option to log in
with normal user name and password that is stored
on the blog website with a normal account.
Or you can log in with a social media account with data
that you've given to a different website or to a different provider.
So we have the information in here for the
user name and the password still the same winner.
Peter let's just log in normally.
And again you can see you get normal account,
you get your email and also gives you an option to attach a social profile.
So we can just click on it now and then come
back and clear the http history and look at it again.
I just don't want to do it in two steps.
You should do it in two steps and real examples just to see how it works.
But we've already done it before. So I'm gonna clear the history
and we're simply gonna actually click on attach a social profile.
So now it's asking us to log in again.
But again assume that you've been redirected to google now
and you're being asked to log into your google.
So your google account gets attached to this website.
So we are given the information here.
So it's peter dot winner the user name and the password is hot dog.
And again obviously we got more requests in here.
Now facebook or whatever website you have is telling you that this blog is gonna
try to access your profile and your email and we're gonna say that's fine.
I want I'm okay with this and cool.
Now as you can see on the blog website we're being
told you have successfully linked to your social media account.
So click and continue bring us back home.
But now our social media account is linked and is attached to this current account.
So so far we haven't really done any hiking.
We've just been using this website using its features
and we can basically just come in here and analyze
all of the requests that were sent in order
to attach our social media account to this website.
Again,
as usual at the start as you can see we have a client idea that is being sent with a link
going down. You can see some requests for interactions. Not really very useful.
Let's click on the auth and see what's happening in here.
So it's asking for an authentication if we go back here,
we have something called another auth
another authentication request to the same user
and next we have another this time it's called Oo dash linking.
So again this is very very interesting because what we're looking for is the O. R.
And this time you could see that it's it has a certain code in here or a certain token.
Now if we look at the author in here, look at the response of it.
You could see if you look at the token given in this response it ends with GP five and
if we look at the often here you will see that this is being sent as a request.
So just to make this simple we made a request to
forward slash auth to try to authenticate a specific user.
The server came back with this token
with a specific token with a specific code this
is the server of the social media network.
So for example google and then we use
this token in order to authenticate ourselves with the
blog so we can see the token is being sent in here again in the request.
So we got the token in the response of the previous
request and then we sent it as part of the request.
And when we send this to the blog the blog is gonna say okay
yeah I know this guy and I'm going to associate them with this account.
So
if we get somebody such as the admin,
if we send them this request and they submitted themselves,
if the request is accepted by the server then this might actually logs us
in as admin because we don't see a state being sent in the request.
That means that this is possibly vulnerable to see
srf so that that would be another value that
you would see that being sent in here to
associate the current request with the current user.
So that if I send this to somebody else,
the request will fail because they will get a different idea or a different token.
It's actually called ST in O. R.
And that is used to prevent CSR F to prevent us from doing something like this.
So what we need to do is we simply need to right click this and copy its U. R. L.
And then we need to put it in a page and send
this page to the admin and we don't know it could work.
It could not work.
They're usually in these kind of cases you should create
another account and run the file or run the U.
R. L. From that other account and see if it logs you into the first account.
So let me show you. We're simply going to create a very simple html page.
And we're gonna have a an I. Frame.
The S. R. C. Is gonna be the link that I just copied. This is the source.
And we're simply going to close the I. Frame
and we're good to go.
So the idea here is you create an account first of all to forge
this request because you can't really know what kind of requests you can make.
So we're going to create an account, we're going to create the request that we want.
You'll put it in an html page and then you create
another account and run this html page from this other account.
And if it works, that means you have a CSR f.
It's as simple as that because you managed to get another person
to send a request that they do not want to send themselves.
You cannot force them to send that request.
Now in our case we can't really send this to
an admin account because we don't have an admin account.
So what they've done with this lab,
So this is something that you only have to do in this lab.
It might look confusing but it's you're not gonna do it
in real life because we can't send this to another person.
And this vulnerability requires to have a person.
What they did is they made a an exploit server.
So let me open this in a new tab.
And basically this is just a server where you can put your
code in it and you can click on deliver exploit to victim.
So you can see from the name itself,
explanatory it's gonna mimic as if an admin
victim clicked your code or clicked your exploit.
Now before exploiting this,
we need to generate a new token to use in our exploit code
because the token that's already there has
already been used and therefore expired.
So this current request that we have is not really
very good because it's already been used and it's expired.
So we actually need a fresh new code that is not used.
So we're gonna turn on the interceptor
and we're simply gonna click on attach a
social profile when we do this we're gonna get
a brand new code that we can use to send to our victim to our target.
So forward this is the growth linking as you can see we got a new I. D.
Now we're gonna copy it and we're gonna go back to our
text file and just to show you how this is different.
Now see how this code this code in here and with G. P.
Five right now we have a completely different code and this one is not used,
this one is used, it's expired, we can't use it.
So we're gonna remove it and we're gonna use this one and this is pretty much our code,
we're going to copy the I.
Frame.
And the thing is now if I forward this request it will
be received by the server and therefore it will expire again.
The code that we just got that we're so happy with will expire again.
So what we need to do is we actually need to drop that packet as
you can see it's gone is dropped and now we're simply going to go back
we're gonna turn off the interceptor.
We're gonna log out because we we're hopefully gonna log
in with our target account once we exploit this properly.
And let's go in here and let's paste our code,
we're gonna deliver the exploit to the victim
and let's go back click on my account
and click on login with social media
and perfect,
now if you look I am logged in as admin so initially I was not
logged in as admin but now I'm logged in as admin so I can click and
continue and we have our admin page in here so I can click on admin page
and I can actually go ahead and delete users now because I have admin privileges.