Ever thought how you are implementing and passing data from the form to your queries? You are doing it dynamically?
Summary: In this writeup, I will explain how I was able to change the user account password without providing the old password. This writeup will be short. I will not take much time.
About Target: Target was From a private program. So, let’s assume the target is site.com
Now, you will see a form which allows you to edit your account details and there is also another option to change your current password which requires your old password but this can be bypassed easily.
Now, for bypassing this change password feature. Just edit your account details and then submit this request and meanwhile intercept it.
Now you will notice some $_POST fields which will be like
user[first_name] // For changing first name user[last_name] // For changing last name
This post request is making an array of the user which is having some key values (first_name,last_name). That means it is making a dynamic SQL query at the backend.
For changing the password just add a new key here user[password] and pass your value.
One of the most interesting (and sometimes scary!) parts of my job at Mozilla is dealing with security bugs. We don't always ship perfect code – nobody does – but I'm privileged to work with a great team of engineers and security folks who know how to deal effectively with security issues when they arise. I'm also privileged to be able to work in the open, and I want to start taking more advantage of that to share some of my experiences. One of the best ways to learn how to write more secure code is to get experience watching code fail in practice. With that in mind, I'm planning to write about some of the security-bug stories that I've been involved in during my time at Mozilla. Let's start with a recent one: Bug 1447452 , in which some mishandling of unicode characters by the Firefox Accounts API server could have allowed an attacker to make arbitrary requests to its backend data store. The bug: corruption of unicode characters in HTTP request path It
Heading: Object name Or Internal Architecture Getting Exposed because Of Deserialisation Error NOTE: Usually i only copy/paste my conversation in medium am not having enough time to write these blog posts properly i am sharing this only for learning purpose not for earning my followers. 😐 👊 Hi, I am Rohit Kumar a Security Researcher and Bug Hunter from India. Vulnerability: Information Disclosure & Internal Architecture Disclosure — — — — — — — — — — — — — — — - Reproduction Steps — — — — — — — — — — — — — — — - 1. Login into => https://developer.ing.com 2. Now go to your Profile for Updating it 3. Edit your name and save it (At this step intercept your request using burp suite) 4. Now, At this endpoint PATCH /individuals/791345bc-9444–4edc-9955–1b78e86fddfd/individualNames/EifQPFiEYfMiU- 3FODj3sT736QkPuGe4nigpckH2fEqkaitoTfuLjGG3Lu9UDN84DDCkrGf0y8Lx89HLHcUrFfcb HTTP/1.1 Host: api.developer.ing.com You will notice a json text in request body
Comments
Post a Comment