CMU6XX

Ethical Hacking

Session 8: Web Application Hacking

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Configure and utilize Intercepting Proxies (Burp Suite, OWASP ZAP).
  • Exploit injection flaws (SQLi) to bypass authentication or extract data.
  • Execute client-side attacks via Cross-Site Scripting (XSS).
  • Analyze Broken Access Control and IDOR vulnerabilities.
  • Leverage Server-Side Request Forgery (SSRF) to pivot into internal networks.

Seminar Structure (3 Hours)

Part 1: Interception & Injection (1.5 hrs)
  • Burp Suite Architecture
  • SQLi and XSS Fundamentals
  • Task 1: Intercepting Proxy Manipulation
Part 2: Logic & Architecture Flaws (1.5 hrs)
  • Broken Access Control (IDOR)
  • Server-Side Request Forgery (SSRF)
  • Task 2: Exploiting IDOR in APIs

Part 1: Interception & Injection

Duration: 1.5 Hours

The Intercepting Proxy

Browsers hide the true nature of HTTP. To hack a web app, you must see the raw requests.

  • Burp Suite: The industry standard tool for web app pentesting.
  • It sits between your browser and the server. You can catch an HTTP request, modify its contents (e.g., changing a price=50 parameter to price=1), and forward it to the server.
  • Bypasses all client-side JavaScript validation (because you modify the traffic after it leaves the browser).
Practical Resource: PortSwigger Web Security Academy

SQL Injection (SQLi)

Occurs when untrusted user input is directly concatenated into a database query without parameterization.

  • The Query: SELECT * FROM users WHERE user = '$input';
  • The Payload: admin' OR '1'='1
  • The Result: SELECT * FROM users WHERE user = 'admin' OR '1'='1';
  • Since 1=1 is always true, the database ignores the password requirement and logs the attacker in as the first user in the table (usually the admin).

Cross-Site Scripting (XSS)

Injecting malicious JavaScript into a webpage viewed by other users.

  • Reflected XSS: The payload is in the URL (e.g., a search parameter). The attacker must trick the victim into clicking the link.
  • Stored XSS: The payload is saved in the database (e.g., a forum comment). Anyone who views the page is automatically exploited.
  • Impact: Stealing Session Cookies (Session Hijacking), forcing the user to perform actions, or keylogging the page.

Introduction to Task 1

Client-side controls (like greyed-out buttons or hidden fields) provide exactly zero security. They exist only for UI/UX.

We will use Burp Suite to manipulate an HTTP request and bypass a client-side purchasing restriction.

Task 1: Intercepting Proxy Manipulation

Timing: 45 minutes

You are testing an e-commerce application. You click "Buy" on a laptop. The resulting POST request looks like this:

POST /cart/checkout HTTP/1.1
Host: shop.local
Cookie: session=xyz123

item_id=94&quantity=1&price=1500.00
  1. Identify the vulnerability in this architecture. Why should the server never trust the price parameter?
  2. Write the exact modified POST request you would forward via Burp Suite to purchase the laptop for $1.
  3. Explain how the developer should rewrite the backend logic to remediate this flaw.

15 Minute Break

Please return promptly for Part 2.

Part 2: Logic & Architecture Flaws

Duration: 1.5 Hours

Broken Access Control

Currently the #1 vulnerability on the OWASP Top 10.

  • The application authenticates the user, but fails to check if the user is authorized to perform the requested action.
  • Horizontal Privilege Escalation: User A accessing User B's data (same privilege tier).
  • Vertical Privilege Escalation: A standard user accessing administrative functions (e.g., forcefully browsing to /admin/delete_users.php).

Insecure Direct Object Reference (IDOR)

A specific type of Broken Access Control regarding database identifiers.

  • A user accesses their invoice via: /download.php?invoice_id=405
  • The server checks if the user is logged in, but fails to check if invoice_id=405 actually belongs to them.
  • The attacker changes the URL to invoice_id=406 and downloads another customer's invoice.
  • Mitigation: Use non-sequential UUIDs (e.g., ?invoice=550e8400-e29b-41d4-a716) and enforce strict ownership checks on the backend.

Server-Side Request Forgery (SSRF)

Tricking the web server into making HTTP requests on the attacker's behalf.

  • Often found in features like "Import Profile Picture from URL."
  • Instead of giving the server an image URL, the attacker provides an internal network address (e.g., http://169.254.169.254/latest/meta-data/ - the AWS metadata endpoint).
  • The web server fetches the URL and returns the contents to the attacker. Because the request comes from the server itself, it bypasses internal firewalls.

Introduction to Task 2

APIs are particularly vulnerable to IDOR because developers often assume they will only be interacted with by the official frontend client, forgetting that attackers can query APIs directly.

We will analyze and exploit a vulnerable REST API endpoint.

Task 2: Exploiting IDOR in APIs

Timing: 50 minutes

You intercept traffic from a mobile banking app. When viewing your own profile, the app sends a GET request to: /api/v1/user/account_details/10455.

  1. Define the exact steps you would take to prove this endpoint is vulnerable to IDOR. (Assume you only have one test account).
  2. If the endpoint is vulnerable, how could you automate the extraction of all 10,000 user accounts using Burp Suite Intruder?
  3. Write the conceptual backend pseudo-code required to patch this vulnerability.
Practical Resource: OWASP Top 10 Framework

Summary & Next Steps

  • Never trust the client. Any data originating from the browser can and will be modified.
  • Logic flaws (like IDOR) cannot be detected by automated scanners. They require human intuition to exploit.
Next Week: Wireless & Mobile Security (WiFi & Device Exploitation)