Hasura

dj4m

6 min readSep 12, 2025

Nmap Scan

Foothold

port 80 redirects to hasura.offsec so I start by adding that to my /etc/hosts

the I revisit the page, trying the login I got a network error, this usually means that some resource is not reachable

checking the page source did not show much and this make sens since the app is actually a react app

so I used gospider to find any URL in the sourceode/js files on the website and this way I discovered a subdomain

so I add that also to my /etc/hosts

and now I get invalid credentials instead of network error

since this is a react app any js file will contain a wealth of information so I just downloaded the javascript file http://hasura.offsec/static/js/main.da5ddccf.js

then passing that file to grep I was able to find some hidden endpoints

knowing that I go also for a bruteforce with ffuf and was able to find another endpoint that was not directly exposed in javascript

I tried POST request to registration but that did not work so I used OPTIONS instead to figure out which methods it takes

since it takes PUT I try that now and this shows me which parameter I need to submit

with this request I was already able to identify the existing admin user

but I try to create another user to see where I could get specially with that activation endpoint I might be able to create and activate the user the see where login takes me

hmm I found user also has parameter role I tried injecting that also but that did not work, it just created another guest user so I moved to activation phase

it’s another PUT request

and now just feed it the token but this time it only worked with the token as url parameter

and now I was able to login

now while logged in I check the profile page and I sse this in my burp history

so I can use that api endpoint to update my user now even tho I can’t do that on UI, but before I also check the GET request which showed that the request is authenticated and it also showed the user object structure

so I pass this to repeater, turn in into PUT and copy the get response body into the PUT body, changing the role to admin, but that did not work. After multiple trials I was eventually able to get it working setting the metadata field

I logout then log back again and I was able to see administration tab

then I tried editing an event an took the request to repeater

Initial Access

Editing the request I was able to identify a potential SQL injection just adding a single quote to the name input which triggered an internal server error

using the payload bellow the I could confirm the SQL injection since it resulted in a 5 seconds delay

how can I exploit this now ? here the || is used for string concatenation so I can just use that to select values from other tables, I just need to guess/find the right tables and columns names(I already know it’s a postgresql database since the delay worked with pg_sleep and concatenation with || )

Get dj4m’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I confirmed this method this way select the username of user admin

then I fetch the password

next all I did was replicate the 2 steps for the other users with ids 2 and 3 (id 4 is for the user dj4m I created )

with that I had these credentials

admin : $2b$10$Qj.u1YXo5lPCiHSJBnby5uKhhq0IVB/EXAMPLEaF7/ef3NfWq5dYbm
dev : $2b$10$YH2R2cXpIUExK8WZVX0dCuH8IXDZHx4yJe0i7/L5ip8BhgHDGlG9y
sarah : $2b$10$uX9k1pXYEoT3JHvdEifwV.4tQpQom5JBgD98Z9yUO0sB.vYK4ZlJS

I try to crack these hashes but they were taking forever so I started enumerating the users table further and was able to get the columns of the tables as showing bellow

so knowing there is note column I try to get that and I was able to get this for user dev (id=2)

so I drop that into .passes file and spray with the usernames on ssh to finally get shell access

with that I got local.txt flag

Privilege Escalation

checking passwd file I find postgres user have a shell permission this looks unusual so I try to move laterally to that user, this was easy as I was ble to find the password here