A web app is like a program used without any installation, inside a browser, accessed through the internet (usually). This program runs on a remote server, which use computing power and storage to serve customers, just like our own computers, just that all that is in vast quantities and better quality.
Q. What do you need to access a web application?
A. browser
Eg.: A shopping website:
- you login
- search for item
- add item to cart
- add address and other personal info for shipping
- provide payment details
Main steps from the above when an attacker can attack:
- login: attacker can try to get creds
- search: attacker can manipulate the search and make the response something it shouldn’t be
- payment details: if not encrypted, the details can go into hands of attacker
To protect from the above and more, OWASP Top10 exists. Ofc, there are other standards to follow and this list is not an exhaustive one, so you can check out others by yourselves.
I have already done the walkthroughs of all OWASP Top10 room from TryHackMe, you can check them out if you want!
Get eXpl017’s stories in your inbox
Join Medium for free to get updates from this writer.
Few of OWASP Top10 are:
- Identification and Authentication Failure — the login system should authenticate the user and identify if its really him, but this is subject to:
— brute force guessing of creds
— allowing user to set simple passwords
— storing the pass in plain text
- Broken Access Control — people access data which they aren’t supposed to be able to:
— failing to apply principle of least privilege
— being able to modify/view other users data using their UID
— being able to see pages which require login, without loging in
- Injection — using vuln in app, attacker can inject code to run as part of their input, for eg: if input sanitation is bad
- Cryptographic Failures — encrypt/decrypt failure:
— using http instead of https
— relying on weak crypto algos
— using weak keys for crypto func
Q. You discovered that the login page allows an unlimited number of login attempts without trying to slow down the user or lock the account. What is the category of this security risk?
A → Identification and Authentication Failure
Q. You noticed that the username and password are sent in cleartext without encryption. What is the category of this security risk?
A → Cryptographic Failures
Insecure Direct Object Reference (IDOR) falls under Broken Access Control
Imagine a file or object on a website named F100.txt which belongs to me, and the link to it is http://something.lol/F100.txt. As a user if i try to search for a file using the link http://something.lol/F101.txt, i shouldn’t be allowed to view it is its not mine.
Similarly, for uid=001, uid=002 shouldn’t be accessible, otherwise he would be able to see other user’s data.
Q. Check the other users to discover which user account was used to make the malicious changes and revert them. After reverting the changes, what is the flag that you have received?
A → THM{IDOR_EXPLORED}
We need to check other users by simply changing the uid. At uid=9, we find the users who made changes and there is an option to revert those. Once you do those, you get the above flag.
That’s all for now!
Thankyou!!
