Hacksmarter Web App Pentesting Capstone

• Add host file hacksmarter.hsm to your /etc/hosts file.
  • Browse to hacksmarter.hsm
• I was a bit to excited so I started trying SQL injection.
  • This is where I realized the labs first finding "User Enumeration". I then decided to take a step back and practice some type of restraing and use methodology.
  • Explore the website see what it does.
  • Register an Account
    • This is where I found out I can use 1 character passwords (Finding number 2)
    • This is where I think

      Findings

• User Enumeration
  • A different error is observed when attempting to login with a known user vs a unknown user
• Insufficient Password Complexity
  • I was able to create a username with one character password
• HTTP and HSTS are not enabled
  • THis is due to a lab setting but finding nonetheless
• MFA Not Enforced
• Information Discloure error message displays Apache version
  • http://hacksmarter.hsm/assets/img/defaul333t.jpg
  • Information Discloure in HTTP Responses
  • X-Powered-By: Leaks PHP Version
• Website Succeptible to CLickjacking
  • used clickjacking-poc to create POC "https://github.com/ADScanPro/clickjacking-poc-generator"
• Stored HTML Injection in Forum
• Stored XSS in Forum
  • Can Steal Cookies
• Directory Traversal
  • http://hacksmarter.hsm/index.php?lang=../../../../../../etc/passwd
  • Http Only flag not set.
  • Same Site Cookie not set.
  • Browser only check when adding Flipper Zero to Cart
  • I was able to go to an available item, switch the item ID to the corresponding Flipper one and buy it.
  • SQL Injection is possible
  • Used sqlmap "sqlmap http://hacksmarter.hsm/store.php?search=frank --dump --drop-set-cookie"
  • Can Post as A different user in the forum.
  • dev.hacksmarter.hsm exposed
  • http://dev.hacksmarter.hsm/config/ Browsing enabled
  • Provides leaked details
  • http://dev.hacksmarter.hsm/info.php exposing stuffs
  • Open Redirect
  • http://hacksmarter.hsm/login.php?next=https://google.com
  • • Sessions do not ask for password before
  • Password Chnage
  • Email Change
  • Sessions do not log you out after
  • Password Chnage
  • Email Change

  • I forgot that I have an admin account, blah, here I am trying to brute force the admin account.

  • File Upload Bypass Allowing PHP to be passed in site logo.
  • Response of upload shows file path
  • Not randomized
• Exposed Unautehnticated API http://hacksmarter.hsm/api/products/all.php
• No Rate Limiting
  • Could lead to DOS
  • Password Brute Forcing
• SSRF Avatar Upload fetches external resources acting as the server
  • http://localhost:80 GOOD
  • http://localhost:81 Error
  • http://localhost:FUZZPORTS
  • http://localhost:80/server-status
  • http://localhost:80/FUZZDIRECTORIES
• Disclosure
  • http://hacksmarter.hsm/test/build_log.txt
  • http://hacksmarter.hsm/assets/js/store.js
• Missing Captchas
• CSRF NOT Validated in GET VS POST
  • GET /update_profile.php?user=admin&action=update&email=frank%40go2com&password=1 HTTP/1.1
  • https://csrfshark.github.io/app/
  • CSRF (Payload in POC)
• HTML Injection in Feedback
• XSS In Feedback
  • XSStrike
  • Can Steal Cookies
• Session does not change after logging in.

Things to Verify

Things to check

• Session

  • Fixation ( session does not change after logging in)

• Orifgin

• Change to is_admin