Hacksmarter Web App Pentesting Capstone

• Add host file hacksmarter.hsm to your /etc/hosts file.
  • Browse to hacksmarter.hsm
• I was a bit to excited so I started trying SQL injection.
  • This is where I realized the labs first finding "User Enumeration". I then decided to take a step back and practice some type of restraing and use methodology.
  • Explore the website see what it does.
  • Register an Account
    • This is where I found out I can use 1 character passwords (Finding number 2)
    • This is where I think

      Findings

• User Enumeration
  • A different error is observed when attempting to login with a known user vs a unknown user
• Insufficient Password Complexity
  • I was able to create a username with one character password
• HTTP and HSTS are not enabled
  • THis is due to a lab setting but finding nonetheless
• MFA Not Enforced
• Information Discloure error message displays Apache version
  • http://hacksmarter.hsm/assets/img/defaul333t.jpg
  • Information Discloure in HTTP Responses
  • X-Powered-By: Leaks PHP Version
• Website Succeptible to CLickjacking
  • used clickjacking-poc to create POC "https://github.com/ADScanPro/clickjacking-poc-generator"
• Stored HTML Injection in Forum
• Stored XSS in Forum
  • Can Steal Cookies
• Directory Traversal
  • http://hacksmarter.hsm/index.php?lang=../../../../../../etc/passwd
  • Http Only flag not set.
  • Same Site Cookie not set.
  • Browser only check when adding Flipper Zero to Cart
  • I was able to go to an available item, switch the item ID to the corresponding Flipper one and buy it.
  • SQL Injection is possible
  • Used sqlmap "sqlmap http://hacksmarter.hsm/store.php?search=frank --dump --drop-set-cookie"
  • Can Post as A different user in the forum.
  • dev.hacksmarter.hsm exposed
  • http://dev.hacksmarter.hsm/config/ Browsing enabled
  • Provides leaked details
  • http://dev.hacksmarter.hsm/info.php exposing stuffs
  • Open Redirect
  • http://hacksmarter.hsm/login.php?next=https://google.com
  • • Sessions do not ask for password before
  • Password Chnage
  • Email Change
  • Sessions do not log you out after
  • Password Chnage
  • Email Change

  • I forgot that I have an admin account, blah, here I am trying to brute force the admin account.

  • File Upload Bypass Allowing PHP to be passed in site logo.
  • Response of upload shows file path
  • Not randomized
• Exposed Unautehnticated API http://hacksmarter.hsm/api/products/all.php
• No Rate Limiting
  • Could lead to DOS
  • Password Brute Forcing
• SSRF Avatar Upload fetches external resources acting as the server
  • http://localhost:80 GOOD
  • http://localhost:81 Error
  • http://localhost:FUZZPORTS
  • http://localhost:80/server-status
  • http://localhost:80/FUZZDIRECTORIES
• Disclosure
  • http://hacksmarter.hsm/test/build_log.txt
  • http://hacksmarter.hsm/assets/js/store.js
• Missing Captchas
• CSRF NOT Validated in GET VS POST
  • GET /update_profile.php?user=admin&action=update&email=frank%40go2com&password=1 HTTP/1.1
  • https://csrfshark.github.io/app/
  • CSRF (Payload in POC)
• HTML Injection in Feedback
• XSS In Feedback
  • XSStrike
  • Can Steal Cookies
• Session does not change after logging in.

Things to Verify

Things to check

• Session

  • Fixation ( session does not change after logging in)

• Orifgin

• Change to is_admin

Setting up Ollama and OpenWebUI

It's been quite a bit since I posted this article https://elmariouribe.blogspot.com/2024/02/setup-privategpt-on-fresh-ubuntu-2204.html.  If I had waited a few more weeks, it would have been two years since. This, in reality, is a continuation of those learnings.  I will focus more on the cybersecurity approach of using AI. As a couple of examples, analysing code and running vulnerability scans. This might quickly get out of proportion, and I may need to break some of these postings up or choose a different channel. 

We'll be using an old Laptop for this with a freshly installed version of Ubuntu 24.04. 

- sudo apt update

- sudo apt upgrade

• Install Ollama 
• curl -fsSL https://ollama.com/install.sh | sh

• # systemctl edit ollama.service

• [Service]
  Environment="OLLAMA_HOST=0.0.0.0"

• Restart Ollama by : 

• # systemctl restart ollama
  

• This will make it so Ollama listens on all IPs
• Pull an LLM
• ollama pull qwen2.5:7b
• ollama pull qwen2.5:7b
• Install Docker
• Run Container;

• docker run -d --network=host --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main
  
• Install Go

I passed my CISA Cert

Solar Things I wish I knew

 -24V is Better

-PWM Not so Great, Go with MPPT

-If the battery is full your CC won't produce