All right, so in the last lecture, we talked about it, for now we're digging into cross site scripting.
And boy, do I have a treat for you guys today.
And this is going to be awesome.
I've got a way to put this.
It's going to be absolutely amazing because you're going to see the entire process from beginning to
end.
We're not just going to pop an alert box.
Right.
You can understand the impact behind the alert that you typically see in the SS p.l.c. or proof of concept.
So let's get down to this.
Let's just look at how last defines crosshatch.
Good thing.
So you can see here the most automated tools can detect accessors, and it's one of the most prevalent
issues found in the OOS.
And when you get to the impact, I think this is the part that confounds most new security researchers
and even managers, because for the impact, it says you can still credential sessions, things like
that.
How do you actually do that?
Right.
Nobody really.
I mean, yeah, there are articles online that show you how to do that.
But today I'm going to show you how to do it so you can see the true impact behind us.
And you also see there are different types of access.
That's right.
Stored Dom reflected.
And some people have confusion over this.
Just think of damage using JavaScript so that the document object model.
So all the elements on its Web page or on all Web pages are defined in a hierarchical structure and
you can manipulate and interact with those elements through JavaScript.
Well, Dom, access, there's nothing bad about that.
But Dom Access allows an attacker to manipulate the DOM to coerce the victim user into performing an
unintended action.
But right now, we're just going to get into reflected.
Stewart is usually the highest severity.
But I want to keep it simple because this is complicated enough.
All right.
So let's just jump right into this.
I can barely hold my breath any longer.
So here's what we're going to do right now.
We are playing the role of the attacker and the attacker has public access to this website.
Right.
To use that Kadenbach.
Darkon, if you haven't seen how we did this in earlier lectures, we set this up so that this is running
entirely from our cyber range.
This is not a publicly accessible website.
OK, and our attacker is Mark Ruffino.
All right.
This is Mark Ruffino email address.
He's just using Outlook dot com.
Now, what are we going to do with Mark Ruffino?
Well, first, we want to see if this Web application is vulnerable to crosshatch scripting.
And one of the easiest ways to do that is to look for potentially vulnerable sources like input boxes
that are not sanitized.
So as an attacker, the first thing I might do is type, you know, type B, common alert, get the
box, the the classic exercise payload.
Right.
And you see nothing happens.
And you can see here, you know, what's basically happening to it just being your encoded.
But clearly, at least it appears to be clear that it doesn't it doesn't appear to be vulnerable to
access or does it?
Right.
Because if these script actually blacklisted, that might be why this is failing.
So we need to think outside the box, you know, as the attacker, how can we bypass any excess filters?
Right.
You know, maybe we can try embedding access payloads into an iFrame attack.
Let's try that.
So let's go ahead and take this.
Ice cream sauce equals what we'll put in here is JavaScript, and we'll just make it pop the alert,
right?
Of course, we need to make sure we have our syntax right.
I close up, close it out, and then close out the iFrame tag and look at that.
We just popped up.
Now, most people see this.
This is what you usually see.
It stops here.
It's like, oh, you guys are vulnerable to access, all right.
And then you write the report and everything's over.
No, no, no, no, no, no, no.
We're not doing that here.
I want you to see why this is bad, why it's really, really, really bad.
So check this out, guys.
This is working.
I do remember where the attacker.
So now we know that this computer, that this Web app is vulnerable to access.
What we can do is play with this.
OK, so let's go to the attackers computer real quick.
This is actually my host machine, but we're going to do
is we're going to SFH into our digital ocean droplet.
We set this up in earlier lectures, OK?
And this is running Calli in the cloud.
And we're going to a and then what we're gonna do is we're going to see if we have Apache listening.
And it is running and you can probably see.
But it is listening.
Yes, it looks like it is right here, too.
All right.
So that's a good sign.
Now we're going to do is we're going to become route.
And we're going to find any files that were modified today, Apache to in time is equal to the last
day and we're going to run against it.
So these files were modified the last day.
Let's just hit this domain up real quick, because if you look you can see the IP address or droplet
is one sixty five twenty two to twenty three.
And you can see this IP maps to road by X.com.
Right.
Let's see if we can go to road bikes dot com and trigger an event.
So if we go to road bikes dot com you can see the Diffa page and now if we go back to the log directory,
we still don't see.
I was hoping to see an access log.
That's where we might need to restart a party.
Let's do that zero system, CDL restart party to state as a party to.
All right.
Let's go back into the.
Access like, right, to have access to nothing there, so.
We need to get some input in there.
Let's go back to this page and see if we can force a request against it.
Let me try a different browser in case this is cached now I'm on edge.
I was in Chrome.
Let's see if I did something.
Yes.
Now we can see it's three point nine K, and if we tell it, we got some input.
Awesome, awesome, awesome, awesome, awesome.
OK, so now we want to do is we want to see if we can we want to basically watch this log, OK, because
we're going to try to steal Randy's cookies.
We don't know Randy right now where the attacker, but we're just eating up our infrastructure.
So if we do this, we can say watch.
And this will just basically watch or constantly pull a particular file over and over again so we can
see the changes.
So if we type watch color interval, see the interval, we'll set that to zero point one seconds.
And what do we want to do every zero point one seconds var log Pache to access to.
All right.
So we're going to tell this suite now.
Let's go back here.
Let's see if we can weaponize the payload, right, what we want to do is we want to modify this a little
bit.
So let's take this out of here and let's open it in mousepad
so we can build out our malicious payload.
We need to modify essentially this right here.
We don't want to do an alert, instead, we want to send the cookie to us.
So what we could do is we could say, all right, we want the window, that location to be the following
HDB, road bikes, dot com, and they want to put in a fake file.
This file does not exist.
It doesn't matter such that it does not exist on my server.
But I'm putting it here anyway.
To make it look legitimate to the victim.
Doesn't matter if it exists or not.
Server can return for, for but it's going to send the cookie in this document, that cookie javascript
parameter.
Right.
That looks good.
Copy that.
Sandroff, do we get anything?
No, we didn't, and we may need to like, encode it in some way.
All right.
You can see up here what we're sending, but let's see if we can call this.
What we'll do is we'll grab the malicious payload.
And Google like access encoder.
Sure, that looks good.
Based in a string, and that's all we care about and code.
And we'll grab the hex to get rid of that me to pass it and send it up now.
Look at that.
Interesting, this not found is from our server.
The thing wasn't found, resource wasn't found.
OK, so you can see we did get the request and it came in.
Now all we need to do is weaponize a file like a word document, send it to a victim, get them to execute
it, and we should get their cookies if they're logged into the Web app as an administrator, which
is exactly what we're going to do.
So now that we have this in place, let's go and create a document.
Write.
Libra office download, and when we want, we want not the bleeding edge, we just want something that
will work.
LENNIX Yes, we'll get the Debian version since we're running Debian callisthenics is based on Debian.
So we'll click, download and let's get this guy going.
All right, save.
All right, so let's let this run and then we will install it.
All right.
The download is done.
Should be able to tower this thing out.
X extract the zip, be verbose, and the file we want is LibreOffice.
Katie LibreOffice.
And I think we can just go into this Debs Folder zero deed package TICC minus I to install start Deb,
will that work?
Basically telling it to install all of it, the dead files, which is what we want.
Right.
We want everything.
So it looks like it's installed like I wasn't sure if that was going to work.
So we'll let this install and then we'll come back and once offices installed.
All right.
So we've got LibreOffice.
Bibra office still red to show up here.
There we go.
All right, so let's open up writer.
This is kind of like Microsoft Word.
All right, cool.
Don't care about that.
Say hi, Randi.
Please see the below link to activate give you the latest juice shop budgets for twenty twenty one.
Thanks.
Mark, right.
And what will half of the budget's.
There's a link, right, so right click this guy will say, can we insert a link and let's see insert.
Eyeblink, All right, so this year will be our accessors payload and we'll just put it like twenty,
twenty one budget budget.
Apply.
OK, that looks good to me.
Let's save this guy and I'll just name it budgets and we'll save it as a Doc X. if possible.
Can we do that?
That Doc ex?
No, I don't want to go there if I want to use a word.
All right.
So it looks like it's made it very cool.
Now we can close it out, close this out, go back to Mark and we'll compile our email to Randy.
All right, Randy.
Um, juice shop, twenty twenty one twenty twenty two budgets oh, Mandy, I've compiled the latest
budget data for your review.
Please see attached.
Thanks.
All right.
So we're going to go ahead and attach it.
Budget, there it is, more clicks and.
All right, so it is in our Sint folder that looks good.
Let's pivot over to Randy now as the victim right now.
Randy and you can see Randy is log into the app as.
An administrator, OK, this is why it's dangerous to do all of your work in a super context.
You can see now we've got this e-mail that just came in right from Mark Ruffino.
Take a look at it.
All right.
So what do we have?
Hello.
You have compiled the latest batch of data for your review suite.
It's going to open this guy up.
OK, and we're going to click enable editing, you know, because we're just going to Trustmark Rovito
and we'll just click Jaisha budget and you can see that is our payload right there.
Right.
So control click to activate.
Let's see what happens.
It automatically brings up our browser and it should immediately invoke the exercise payload and send
us Randy's cookie.
Right.
You can see the not found.
So that is a good sign for us.
Now, Randi might look at this and be like the site looks kind of broken.
I'm not sure what happened.
Right.
So he's going to write back.
Mark.
The link seems to be broken, to be broken.
Can you.
Thanks.
All right, so we're going to send it out.
And in the meantime, look what happened to the attacker, so step over to the attackers.
You can see now what do we have here?
It's juicy.
It's delicious.
We have his cookies.
Look at this cookie consent status, dismiss token.
We have his token.
We've got to can only deduce paste this into our browser and send it out and we will become.
Randee, we've essentially hijacked this session.
Right.
So we can literally grab this entire thing right here.
Right.
Click copy.
As an attacker, we can essentially go here.
Did you shop?
And we can just go and look at these storage.
Inspector.
See the cookies and see this token, see that these values down here, all we need to do is update the
continue code and the token with what we received from the victim.
And we basically walk in as him in a way to do that would be to use a tool like Cookie Ed Cookie.
Ed Firefox's.
Right, so you would grab this tool added to Firefox?
All right.
And then you would go to your shop.
You would basically just add these values and right continue code, but what is the continued code?
Well, we have it right.
Everything is in here.
Language is in the percentages of space.
It's just you are all encoded so we can actually break this down so we can see how the cookie values
quite easily.
You can see here's a token, we could simply grab that token and put it in here.
Right, take it out, piece said, and save it.
And then we're basically on our way.
That's all I have for this guy.
I really want to show you how dangerous exercise can be.
And, you know, obviously, it's really important to sanitize your logs, properly, escape the fields,
you know, make sure that you're not just blindly accepting untrusted user input and then processing
it in an unsafe way, because if you do crosshatch, good thing can become a reality, which you don't
want, obviously.
Right.
So I hope you guys enjoyed this lecture.
The next one.
We're going to dig into the next option here, which is insecurity serialisation.
So I will see you guys in the next lecture when we jump into this scene a little bit by.