GitHub/quartz
1
0
Fork 2
mirror of https://github.com/jackyzha0/quartz.git synced 2025-12-27 14:54:05 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

vault backup: 2022-09-09 09:52:39

Browse Source
This commit is contained in:
Jet Hughes 2022-09-09 09:52:39 +12:00
parent b6690cc968
commit 4ce86af935
1 changed files with 2 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
content/notes/ass01-security-audit.md
View File

@ -73,55 +73,10 @@ CWE: 22
### Cleartext Transmission of Sensitive Information
CWE: 319
When a user logs in, their username and unhashed password are transmitted in a cleartext post request to the server. This informaiton is susceptible to a man in the middle attack and other kinds of interception.
When a user logs in, their username and unhashed password are transmitted in a cleartext post request to the server. This information is susceptible to a man in the middle attack and other kinds of interception.
#### Example payload:
![example payload](https://i.imgur.com/9Tn6gx1.png)
## Conclusion
## SQL Injection
- can log in to admin using username: " 'or 1=1;--"
- we are able to extract data which is displayed as the users username
- we can extract the data from the data base using this "username"
- ' union select group_concat(username||':'||password||':'||name||':'||credit_card_number||':'||credit_card_expiry||':'||credit_card_cvv) from user as name;--
- I was able to crack 48 of the 101 passwords using the rockyou wordlist. I'm sure It would not be difficult to crack more.
- you cant also update the data. E.g., set the price of all products to zero using this as a username in the login box
- '; update PRODUCT set UNIT_PRICE = 0 where 1=1;--
## Javascript Injection
- It ispossible to perform a javascript injection as the users name is displayed in the website. and prodcut information is displayed in the view catalogue page
- I was able to create an account and log in using the username ''<script>alert("hello")</script>''. However when I did log in the username wasn't displayed in the browser, and alert didn't show. I also repeated the process with the user name ''<script>console.log("hello")</script>'' which also didn't run
- You was able to update a product name to be a script which would then run on others systems
- e.g. '; update PRODUCT set DESCRIPTION = '<script>alert("hello")</script>' where PRODUCT_ID = 67696;--
- this could be used to export JSESSIONIDs of other users. Which would allow the attack to access their account (while the other user is logged in).
- It could also be used to present the user with a legitamate seeming message encouraging them to open a malicious link.
## Other
This system is not secure. I was able to identify multiple vulnerabilities, and successfully carry out attacks to exploit these vulnerabilities. The most damaging of these was a simple SQL Injection attack. I was able to extract the credit card information of all the users, and crack the passwords of nearly 50% of the accounts. This is a major security issue.