Hey everyone. Hopefully you had a chance to play with this and exploit this vulnerability based on the explanations on
the first two pages of this. So I'm going to go through this step-by-step for those of you who weren't able to exploit this, and we'll talk about where the functionality and
the weakness comes from. So just to get some traffic
so we can look at it, I'm going to go ahead and try
to vote as the guest user. Going to vote as the Tom user, and then maybe I'll do
a delete as the Jerry user, and a vote and a delete
as the Sylvester user. So you can see we're
not admin in any of those and it's not letting
us to go through this. Go to our Burp proxy, pick one of the posts. So in this case, I'm going to pick the reset
because I want to go through the specific challenge
of deleting something, and it looks like when
I hit the delete, it sends a reset for me. So to solve this challenge, we need to send the reset. I'm going to send
this to the repeater. So this is the individual post
where it failed, and in the repeater,
we can hit go, and see that only admins
can do this. So I'm going to take
the access token, and put it in
our little staging area just so that we have
something to work with. So this is our access token, and we know from
the previous specification that it's separated by dots. So we're going to break
that up into three parts. We know that the first
part is our header, we know that the second
part is our claim, and we know the third
part is our signature. So I'll indent those
in a little bit. So we want to understand
what the header is, what the claim is, and
what the signature is. So I'm going to take the header, just copy it, and there's
a decoder built into burp. So I'm going to erase that, put that in its decoder. Now, if you don't have
the second option here, all you do is you click decode as Base64 and you
get your answer. So we know that decoded access token has a header
of that algorithm, and let's see what the claim is. We copy the claim,
paste it in here. You'll notice that the paste
doesn't do a great job here because this null terminator
is messing up the hash. Sometimes you can validate it
using a different decoder. Let's see if that works,
Base64, no, that doesn't work. So I'm going to use
a different decoder, CyberChef is a great tool. You can just Google CyberChef, and it's the first link
that comes up. I'm going to put
my Base64 string in here and convert
it from a Base64, and CyberChef did
a better job decoding it. So I will paste that in here. Our claim is this. So it looks like we can probably just replace admin
false with true, but we're not there
yet, and we know that we can't decode the signature. It's going to be a signature. It's an encrypted blurb. So if I even try, comes up as gibberish,
so I won't. So let's modify these things. I'm going to just copy
and paste it for now. So we can probably just
make this a true statement, and we can put this back through our decoder so we can
essentially re-encode it. So I'll just paste this
here and encode as Base64, and we get that. So here is admin is
True re-encoded, so now we have this value. Then, we need to get a header. So the thought process
here is, well, what other headers are possible? So to get that answer, we're going to go
back to our WebGoat, and if you look here, there is a specification
listed for the algorithms. Let's just open both those up, and let's see if there's anything interesting in any of them. So I don't see header algorithm
parameters on page 10. I don't see anything
interesting in there. So let's go in here
and see if there is a better cryptographic
algorithm management for keys. Let's see if there's
anything interesting there. So what are all the possible
keys that I can use? There's a lot of keys
in here, there we go. So header parameters
for values of JWS. So it looks like we
are using the 512, the HS512, so this one, and it seems to be
a pretty optimal key. So it doesn't feel
like we can change it, but I wonder if we can use none. So let's go back to this header
and modify that to none, and let's go ahead and get a encoded version of
that, put it here. Finally, we know from the
specification because they told us on Page 2 that the format
as header.claim.signature. I'm going to paste that in there. For the header, I'm just going to copy this text and
replace it with the header. The claim, I'm going
to copy this text, put it here, and I
don't have a signature, so I'm just going
to leave it empty, but I'm going to
leave a dot there just because that's part
of the specification. So I'm going to leave it as is. I'm going to copy this new
access token that I assemble, I'm going to go back
here, go to my repeater. I'm going to replace
this access token, leaving in place
the semicolon there. I'm just going to hit Go. So last time we did this, we got False, hit
Go, and we get True. So we were able to essentially
tell the server that, we're not going to
sign this next thing, and here's the access token
that I'm going to send you.