So far, we tested every feature
within the home page,
from the book in to the login page
and there's no other features below.
So the next thing that we're gonna do
is test the menu and the locations pages.
So starting with the menu page,
we're just gonna load it normally.
And as you can see, it just loads a normal menu page
with the menu and with some categories on the top.
None of this is clickable.
And we don't have any parameters in here
to inject and play with.
So we're just gonna turn on our proxy
and load it again to see
if we can find anything interesting in Burp.
So far, nothing is that interesting.
So we're just gonna continue forwarding this.
And these are just CSS files,
so they're styling files that are loading a certain font
from a host that is called fonts.googleapi.com.
So it's nothing to do with our target.
This is very important.
You need to make sure that you do not test stuff
that is outside of the scope.
So our scope is this website.
So anything that is outside of this website
should not be tested.
So that's why we're ignoring all of this.
And here we go.
We have another request that is made to our host.
Again, nothing that interesting in here.
So we're gonna forward.
And now we actually have something interesting.
So we have a request in here
that is being made to some kind of an API
to a file called loader.php.
We have a parameter name f
and the value that is sent to it seems like a file name.
So it starts with a forward slash,
which we know from the directory traversal vulnerabilities,
a forward slash means we're starting
to specify a file path starting at the base directory.
And we have a file name that is called reviews.php.
So this a very, very interesting request.
And therefore, I'm gonna right click
and send it to my repeater.
And in here, I'm just gonna send it as is
just to see the normal result that I would get.
And if I render this result,
as you can see, we're actually gonna get reviews
because it's requesting reviews.php.
And we have the review content
and the name of the person that submitted the review.
So this is really, really cool
but what I would do at this stage,
once I see this, this is a very strong clue
that I should test for directory traversal
or local file inclusion vulnerabilities.
And as we know, the way we do this
is by doing ../../..
Go back as many files as we want
and then test for a file that exists by default
on the target, like /etc/passwd.
Now, I covered this in details in a full section.
That's why I'm doing it very quickly in here.
If you don't understand what I'm doing,
then please go back and revise that lecture
or that section.
So we're gonna send it
and as you can see, we get nothing.
And as you saw in the previous section
when I covered these vulnerabilities,
just because you got nothing from your first request
does not mean you should give up.
There are so many ways to bypass security
and to actually get this to work.
So you should really test everything
that I showed you before
and you should go ahead and use the intruder,
again as I showed you before.
But once you do all of that,
you will notice that this parameter
is actually not vulnerable
to a local file inclusion
or a directory traversal vulnerability.
Therefore, in that case,
I'm just gonna go back to its original form
and just think what is being done in here?
So right now, this loader.php
is requesting another file
that is called reviews.php.
So maybe I can't, maybe it's implemented properly
so that I can't actually load any files
outside of my web root.
But from my notes that I took earlier,
I have something saying
I should test later the admin.php page
because when we loaded this,
we didn't get an error,
we simply just got redirected.
So let's see if I load this page from here,
if it's actually gonna load for me.
So let's just go ahead and type admin.php.
And send it.
And as you can see, I get nothing.
So if you remember in the robots.txt file,
it actually was called admin and not admin.php anyway.
So let's try to load the admin path as is.
And once we do that, this time,
we're actually not getting redirected
but we're getting a page saying we're not allowed
to view it.
So that's really, really good.
So at this stage,
we're getting closer, we're getting better error messages
and at least instead of just getting nothing,
we're getting an error message telling us
we're not allowed to load this page
but we know that there is a page
that is called admin, and I can access it using this URL.
So again, just being curious
and implementing that bug hunter
or researcher or hacker mentality,
I wanna know how is this page knowing
that I am not the admin
and I'm not allowed to see this page?
It's not really asking me to put a username
and a password but somehow it's able to know
that I do not have permissions to view this page.
So I'm gonna try to load it from a browser
instead of loading it from the repeater in here.
So I have my proxy on.
I'm just gonna turn it off to let the flow through.
I'm gonna turn it on again.
Gonna go back to my website here,
and I'm gonna paste the path that we just copied.
So we're simply loading the same file loader.php
and we're trying to go to the /admin.
I'm gonna hit Enter, and that's gonna be intercepted
in here so that is fine.
We're gonna forward.
And as you can see, this time,
there is another request that is being sent
to the admin.php this time.
So initially, the request was being sent to loader.php/admin
as you can see in here.
But right now, after we sent that request,
we have another request being sent to the admin.php.
And this request is sending a parameter called adToken
and the value of this is blank.
So now if I forward this,
and keep forwarding the error the event requests,
you will notice I'm gonna get the same error message
that I got in my repeater,
which is saying I am not allowed to view this page.
So my hunch tells me
that if I send this again and let me show you,
this adToken value that is being set to nothing needs
to be set to some kind of a password
or a token that is supposed
to give me access to the admin.
So if I manage to find a token or a value
to send in here, I will actually be able
to access the admin page.
So in this case,
I would actually again take this
and save it in my notes in here,
so this is actually related to the same thing,
to the admin page .php and this time,
we know that if we give it an adToken in here,
we might actually be able to log in as admin.
Now, we don't know where we're gonna find this,
so usually I would go and continue pen testing the website
until I get more clues about the adToken.
But before I do that,
I would go ahead and run a quick search
to see if the adToken is mentioned anywhere
within the website, within the JavaScript,
or within some hidden elements
that load on the website.
And to do that, I'm simply gonna copy this text, adToken,
and I'm gonna go back.
We're gonna go to the Target tab,
so this is what I said we're gonna use in the future.
And as you can see, this Target tab
has mapped the website,
so it actually has mapped every single link that we clicked
and every request that we sent.
So it basically analyzes every request
and every response that was proxied through Burp.
And that's why it's very, very useful
because I can use the filter functionality
in here to search within all of the data
that was exchanged between my browser and the web server.
So I can search in here for the adToken
'cause I'm interested to see if this was mentioned anywhere
in the code and if I can find any clues for that.
Now, the filter feature in here
is only available for the Pro version of Burp
but it's actually very, very useful.
If you are serious about becoming a bug hunter,
then I highly recommend getting the Pro version.
And if you're working as a pen tester
or if you're working for a company,
all you have to do is simply ask your company
to purchase a license and they will do it without hesitation
because this program is very, very useful
and it will really enhance your bug hunting capabilities.
So we're telling it that we want to search for adToken.
And we want to search in these files.
So you can select more files if you want
but we're keeping it the way it is in here.
We're keeping all these extensions the way they are
and we're gonna click on Apply.
And as you can see,
we have all of the requests and the files
that contain adToken.
And this is just the request
that we are playing with right now
and this is the adToken.
So there's nothing interesting in here.
This is the loader.php file.
So I again, if I am looking for it in the request,
I can put it in here and look for it
and there're zero matches.
If I wanna look for it in the response,
you can see we have one response in here.
And again, nothing that's useful in here.
It's just in the script.
It's mentioned in here.
And the third occurrence in here
is in a file called script.min.js,
so it's a JavaScript file.
And as you can see, we have one match in here
and let's look at the match
and as you can see,
this, even though we don't know what JavaScript is,
you could guess that var means variable.
So they're defining a variable
that is called adToken.
And you can actually just see the value in here
as a string enclosed by two quotation marks.
So that is very, very interesting,
and even if you don't know JavaScript,
your intuition should tell you I should send this
in my request and see if that's actually gonna allow me
to get access.
So let's go back to my proxy
and I'm actually gonna stop intercepting
just to let this flow through
just in case there is an expiry on it.
and we're gonna turn on the interceptor again.
Send it and the first request is okay.
It's just asking for the admin.
So we're gonna let it go the way it is.
And these are just requests outside of our scope.
And we're gonna paste the adToken in here.
And I'm actually gonna copy all of this.
I'm gonna stop the interceptor.
And I'm gonna paste that request in here,
along with the adToken.
Make sure everything is correct.
Hit Enter.
And perfect.
As you can see right now,
you're only getting a message
that is saying there used to be a flag here
but basically this means in a real-life scenario
or in a bug hunt,
you would have been able to access an admin panel
or some kind of admin resources
that normal users are not supposed to access.
The term that just means that there used
to be a flag in here.
This is a normal practice
that is done in capture the flag competitions
and even in job interviews
if you apply for pen testing jobs
where in order to test your skills,
they would put flags in certain locations
within the application and you have to test them.
So the fact that we're seeing
that there used to be a flag in here means
that we actually managed to gain access
to this panel and in a real-life scenario,
you would have been able
to discover a broken access control vulnerability
where you are able to access functions
that normal users should not have.