‫-: Hi. Within this lecture
‫we are gonna take a look at the API9.
‫So, over here it says that Improper assets management.
‫Okay, so over here we got another hint.
‫It says that good news
‫we just launched our v2 second version of our API
‫and for the second version we have a post request
‫in order to log in.
‫Okay, and that's about it.
‫We don't have anything else, I believe.
‫No, we have a GET request
‫about API 10, not a API 9
‫So, for API9 we only have one endpoint
‫which is post requests, which is to log in.
‫So, let's take a look at what
‫is Improper assets management.
‫So, if I just Google it out.
‫I can find the meaning of it
‫and I can find the vulnerabilities
‫and some possible exploits as well.
‫As you can see, it says that attackers
‫find non-production versions of the API.
‫Great. So for example staging, testing, beta
‫or early versions.
‫So ,this is a very common one.
‫So, it says that, yeah,
‫we moved on to the version two
‫but maybe version one is still in progress
‫or is still functioning, right?
‫So, let's come over here to Buddy.
‫As you can see, I can send some requests
‫okay, the Richard Branson
‫and the pin is given to me by default.
‫So, I'm just gonna change them like test
‫and test 1, 2, 3 ,I don't know
‫maybe it's a really pin number with four digits.
‫I don't know about it.
‫But if I do that, if I just send a request to v2
‫as you can see, I cannot log in
‫because I don't know the username
‫and the password or the pin number, right?
‫So, the thing over here is that
‫we are sending this to v2.
‫Maybe, there is a v1 as well.
‫Let's find out about it.
‫So, I'm gonna turn the intercept on as usual
‫and I'm gonna send this request to Burp suite.
‫I'm gonna come over here and
‫I'm gonna send this to Intruder
‫since we don't have any kind of usernames
‫and passwords, I'm just gonna clear everything over here.
‫I'm going to add the username
‫and add the password as well
‫or the pin number as well.
‫I'm assuming that we have something
‫like a SQL injection again.
‫So, I'm going to use the previous list
‫that we have been using or previous payload, okay
‫that worked for this.
‫So, since we don't have any kind of other usernames
‫and passwords, I'm just gonna take the whole list
‫and put it over here and try it from scratch.
‫I didn't think anything else.
‫And by the way, I'm just gonna change this
‫to battering ram as we did in the previous lecture.
‫And I'm gonna deselect this URL
‫in quote these characters and start the attack.
‫I don't know whether this has the SQL injection
‫or not but I do know, as you can see
‫after the fifth trial it gave me a 500.
‫It says that rate limit exceeded.
‫Okay, so there is a rate limit with five trials
‫and this is doing the right thing
‫because after the fifth trial, it gave me an error
‫or the status changed from 200 to 500
‫which means that we are not getting any response now.
‫So, API is working in a correct way
‫it doesn't let me brute force,
‫it doesn't let me try everything.
‫But what happens?
‫What happens if I change this version two to version one?
‫Maybe it's still functioning.
‫And by the way, over here when I look at this
‫maybe the username is actually Richard Branson
‫and maybe it's asking for us
‫to try all the pin numbers ,four digit numbers starting
‫from 1000 ending in 9999.
‫But we did that before and it takes a lot of time.
‫The point over here is that
‫it has a rate limit, right?
‫We cannot even try more than five alternatives.
‫It blocks us in the sixth one.
‫So, it doesn't even matter
‫if it has a SQL injection vulnerability
‫or pin number vulnerability brute force thingies.
‫Because, if we cannot do brute force it doesn't matter
‫what happens when I change it to v1.
‫Let's try that.
‫I changed the version to v1
‫and I don't know whether this v1 exists
‫or not at this point.
‫Okay? I just assume since there is a v2
‫there should be a V1 as well.
‫And here you go.
‫As you can see, I'm getting all 200's right now.
‫If I go to the response, I'm not logged in, Okay?
‫I don't know whether I'm even ever going
‫to be logged in or not because I don't know
‫if this has a SQL injection vulnerability.
‫But what I do know is that
‫I got to bypass this rate limit.
‫Right now I'm not getting 500's.
‫I'm still getting a response and it means that
‫it has the improper asset management vulnerability.
‫They upgraded the API to v2
‫and they had implemented the rate limiting
‫but they forgot to close down the version one
‫or maybe they didn't forget but,
‫they just left it open for some test purposes,
‫for some development purposes, okay.
‫Maybe they thought that, yeah
‫nobody knows about this version one
‫but as you can see a hacker can try it
‫and find out about the versions and then just try
‫to do what they're supposed to do to hack in.
‫And we have seen many hacks in the previous years
‫using that kind of improper asset management vulnerability.
‫Great, so I'm going to wait until this is finished.
‫I don't know even if this is going to work or not
‫but we have bypassed the rate limit.
‫That's what it counts.
‫Here we go, right now this is finished
‫and as long as I can see, we all get 200's
‫But I didn't get a response back
‫like I didn't get a success response back.
‫I don't know whether this has a SQL injection.
‫Maybe as we have talked about before
‫maybe the username is actually the Richard Branson.
‫Okay? And we are supposed to try starting
‫from 1000 all ending in 9999.
‫Maybe that's the case but it's gonna take
‫so much time, right?
‫It's gonna take hours and hours
‫but the community version of the Burp Suite.
‫So, you may actually try it yourself.
‫Okay? You can just come over here
‫and change this simple list of numbers
‫and start from 1000 ending in 9999 step size 1
‫and here we go,
‫you're gonna try like 9,000 thingies.
‫And of course you're gonna have
‫to change the user name to something Richard Bronson.
‫And for the pin you may want to start
‫with something like that.
‫Okay? And obviously you can go
‫for the attacker type sniper.
‫So, let me copy and paste the username
‫so that we won't forget about it
‫and here you go.
‫Maybe you may want to try this yourself
‫but I'm not even going to bother with it
‫because it's gonna take so much time
‫with the 9000 request.
‫The idea over here is that we managed
‫to bypass the rate limiting.
‫As you can see we're still getting 200's.
‫Great, now the idea over here
‫if you find a test version or like a version
‫that has not been maintained for a long time
‫there is still a chance that
‫you may not find vulnerability
‫and actually there is a higher chance that
‫you may find a vulnerability in a version like that.
‫So, it doesn't hurt to try with different versions.
‫Okay, pentest with different versions
‫and actually aim for that versions.
‫I know many cases that senior developers
‫just wanted to keep the APIs open,
‫the previous APIs open just for having a backup.
‫Like if they want to check something else
‫they can come back and look at it.
‫They said that, yeah, just leave the things open.
‫We are gonna figure it out later on.
‫But then it caused some serious vulnerability
‫in the API, serious vulnerability in the platforms.
‫Great, Now we have completed nine challenges.
‫Now it's time for the last one.