table of Contents
2. Do you still need a brain map for the course? .
One, simply pass a level
Looking at the title, I thought it was something unpredictable, but I didn't expect it to be. . . Unauthorized loopholes. . .
page 2
This page only needs to log in with the user name tom and the password cat for subsequent operations.
Page 3
This question requires finding out the attributes in the response message that are not displayed on the web page.
Just press View Profile and compare the content displayed on the web page with the response message captured by burpsuite.
Page 4
This page requires direct object reference to view your profile.
From the last round of burpsuite capture, the path of the profile is /WebGoat/IDOR/profile, and the userId is 2342384
I tried WebGoat/IDOR/profile?userId=2342384 and WebGoat/IDOR/profile/2342384 and found that the answer is:
WebGoat / IDOR / profile / 2342384
Page 5
There are two tasks on this page:
(1) Look at the profile of other users
(2) Modify the profile of other users (Buffalo Bill)
Let's look at the first task first, and look at the profiles of other users:
Click the first View Profile button in the figure above, burpsuite captures the packet, and find the message shown in the figure below, send to intruder
In intruder, set the highlighted part in the above picture to the payload position, and select sniper for the attack type
The payload is set as shown in the figure below, and the type is Numbers.
Since Tom’s own userId is 2342384, another user may not be too far away. At the beginning, you can set the blasting range to be smaller. For example, set it to 2342370~2342400 as shown in the figure below, with a step size of 1.
The result of the blasting is shown in the figure below. After sorting by Length, the profile of user Buffalo Bill is successfully found
Let's complete the second task:
Send the corresponding request message in the above figure to repeater
Then modify 3 places according to the following figure:
(1) The request method is changed from GET to PUT
(2) Change Content-type to application/json
(3) In the request content, construct the Buffalo Bill profile in json format. According to the requirements of the title, the role should be set to a number smaller than 3, and the color should be set to red.
2. Do you still need a brain map for the course? .
