All right now we're on to the attack now unfortunately this attack is going to be theoretical.
I'm going to walk you through every single step that we would take all the way through the exploit but
the exploit is not going to trigger or fire because we're running in Docker.
Now the issue here if we scroll down and you can see it says please note exec see challenges described
or not available in docker container or Heroku.
So the other methods that are available for installing are incredibly complex especially on a killing
machine.
And it's just not worth setting everything up for a course and going through all the trouble just for
one demonstration.
So I'd rather just show you kind of how it's done.
Walk me through it and then show you the picture of what it would look like if it triggered.
I think the methodology here is important.
So looking at our exploit all I've done is saved it.
I put it on my desktop.
You could put it wherever you want.
You can call it whatever you want minus called Test to excel.
And again we're calling out this file Etsy password and we're going to do it for the.
And x x e here.
So from here let's go ahead and go over to our juice shop application.
So go ahead and go to account and log in and let's make a new account.
So we'll go ahead and just not yet a customer.
Let's go ahead and do that and we'll just call this test pilot testing at test dot com and we'll just
say Test one two three.
Test one two three.
And then our eldest sibling's name is Bob.
Our middle name is Bob.
So log in there or register there and then let's come in and log in
and then we're gonna go ahead and take a look at the application.
Now this is what is called authenticated testing we are at a middle user or a regular user between here
from an authenticated to an admin.
So we're kind of in between right on this account.
We should navigate around and see what we have access to.
That is my first methodology when I get access to a user account.
And if you're doing web application pen testing again you're gonna be given two accounts usually two
roles one is going to be admin one's going to be non admin and you're probably gonna test on authenticated.
Now I've seen a bunch of roles before given as well but typically it's two.
Sometimes there'll be more.
But what you want to do is go around and see what you might have access to.
Right where where are your pages what what screens do you have.
What can you do.
And I like to go through and just click on anything and everything that I see a link for.
The nice thing about burps WI is with burps we can come in here and we can go right click and scan if
we had the pro version which if you're doing pen testing you will your job should pay for it.
And so you would do a scan you would crawl the Web site and it would find a lot of these links for you.
So it doesn't hurt to navigate around.
It doesn't hurt to understand the application how it's running what it's doing.
That way you have a good feel for it.
Right.
So from here we're just going to abuse and upload feature.
So if we go to the Complaint Section over on the left side we see that there's a file upload feature.
Now anytime I see a file upload feature I kind of drool a little bit because I get really excited about
it and file uploads can be very devastating if they're not handled properly for a web application on
top of things that we've already seen before when it comes to file uploads in executing malicious content
on Web sites through the middle capstone of the course.
Right.
We here can also upload Excel files and we can upload malicious documents and try to dump sensitive
information get a shell.
There's a lot of things that we can do at a bare minimum we should see if the upload feature is functioning
the way it is even if we can't get a shell or get anything out of it.
Can we bypass what it's trying to do.
So here you're going to see that this is going to be trying to only allow for zip files and PDA files
but we're going to upload maximal file and it should blacklist it but it doesn't.
OK.
So let's go ahead and go to browse and we're going to go to route or desktop for me and then we're going
to see here it says all supportive types will all support types of PDA F and zip by using to go all
files and say I want to do the test X well anyway and all the say test and what's going to happen here
is I'm going to go ahead and intercept this request and I'm doing this because I want to see the response
in case I need to tinker with this.
So it's go ahead and submit and then I'm going to send this to repeater and we can take a quick look
at it so in repeater here you can see that we have our test X email being uploaded and the X AML version
1.0 same thing.
We have our execs e entity and we're just saying hey I want to call system and I want to call this file
from Etsy password because we are attacking a Linux machine.
So here we see the call of the X XY.
We would execute this and if this were a real web page that was vulnerable you would see some sort of
printout of the Etsy password file.
Now I have a video of this on my channel on YouTube.
I'm just going to show you a quick picture of me show you a stopped image.
So if we see here we cover execs e you can see that right here in the juice shop look what came through.
You see this part X sexy system quote file.
And then guess what.
Once it calls that ampersand X XY you see here a route you see user s been and it's it's cut off.
It only allows for so much we'd have to finagle this a little bit but this right here you could submit
to a client you could submit to a bug mining program.
You can say look you are vulnerable to X XY.
This is what it is.
So what's going on here are these DDD are being allowed these external entities are being allowed.
And through this parser and we're able to just push this through.
So what is the solution here.
How do we defend against this.
Well we need to disable completely these DDD these external entities.
Once we disable that you're not going to see this come through at all and it's going to look almost
similar to what you're seeing here we just don't have the ability in Docker to do it.
OK.
So we would never know if I saw this when I tested it.
I'd be like well OK.
That that exploit didn't work.
I might go more through those payload lists that I showed you and see if we can't get that to work or
try different things to see why it's why it's not working.
You should never give up on the first go but at the same time you know this isn't showing me that it
is exploitable where if we looked at the other image it did seem like it was.
So hopefully that is a good example for you understanding how and why we did this.
We're taking and abusing the Excel feature the Excel passing feature of a Web site.
So because of that we're able to upload a malicious excel file and bypass by the way.
So this bypass is a finding regardless if we had X axis here or any sort of a malicious ability.
This is a finding in itself and this is a pretty big one because we're bypassing what white listed extensions
they had originally.
So I would mark this up as a finding and this would actually be even something that you could submit
on a bug bounty program to to get a bug or money from it.
So that is it for this lesson.
So we're going to go ahead and move on to the next one which talks about broken access control.
I'll catch you over in that video.