Introduction to the Web Security Academy Seriesw

Broken Access Control

Lab #1 Unprotected admin functionality

Lab #2 Unprotected admin functionality with unpredictable URL

Lab #3 User role controlled by request parameter

Lab #4 User role can be modified in user profile

Lab #5 URL-based access control can be circumvented

Lab #6 Method-based access control can be circumvented

Lab #9 User ID controlled by request parameter with data leakage in title

Lab #8 User ID controlled by request parameter, with unpredictable title

Lab #10 User ID controlled by request parameter with password title

Lab #12 Multi-step process with no access control on one step

Lab #13 Referer-based access control

Lab #11 Insecure direct object references

Agenda

How to Prevent Authentication Vulnerabilities

Lab #1 Username enumeration via different responses

How to Find & Exploit Authentication Vulnerabilities

Lab #2 2FA simple bypass

Lab #4 Username enumeration via subtly different responses

Lab #3 Password reset broken logic

Lab #5 Username enumeration via response timing

Lab #6 Broken brute-force protection, IP block

Lab #7 Username enumeration via account lock

Lab #8 2FA broken logic

Lab #11 Password reset poisoning via middleware

Lab #9 Brute-forcing a stay-logged-in cookie

Lab #10 Offline password cracking

Lab #12 Password brute-force via password change

What are Authentication Vulnerabilities

Lab #14 2FA bypass using a brute-force attack

Lab #13 Broken brute-force protection, multiple credentials per request

How to Prevent Business Logic Vulnerabilities

How to Find & Exploit Business Logic Vulnerabilities

Lab #3 Inconsistent security controls

Lab #2 High-level logic vulnerability

Lab #1 Excessive trust in client-side controls

Lab #5 Low-level logic flaw

Lab #4 Flawed enforcement of business rules

Lab #6 Inconsistent handling of exceptional input

Lab #7 Weak isolation on dual-use endpoint

Lab #9 Authentication bypass via flawed state machine

Lab #8 Insufficient workflow validation

What is a Business Logic Vulnerability

Lab #10 Infinite money logic flaw

Lab #11 Authentication bypass via encryption oracle

How to Exploit Clickjacking Vulnerabilities

How to Find Clickjacking Vulnerabilities

How to Prevent Clickjacking Vulnerabilities

Lab #1 Basic clickjacking with CSRF token protection

Lab #3 Clickjacking with a frame buster script

Lab #2 Clickjacking with form input data prefilled from a URL parameter

Lab #4 Exploiting clickjacking vulnerability to trigger DOM-based XSS

Lab #5 Multistep clickjacking

What is Clickjacking

Lab #1 OS command injection, simple case

Command Injection

Lab #2 Blind OS command injection with time delays

Lab #3 Blind OS command injection with output redirection

Lab #4 Blind OS command injection with out-of-band interaction

Lab #5 Blind OS command injection with out-of-band data exfiltration title

Lab #1 CORS vulnerability with basic origin reflection

Lab #2 CORS vulnerability with trusted null origin

Cross-Origin Resource Sharing (CORS)

Lab #3 CORS vulnerability with trusted insecure protocols

Lab #4 CORS vulnerability with internal network pivot attack

Lab #1 CSRF vulnerability with no defenses

Cross-Site Request Forgery (CSRF)

Lab #2 CSRF where token validation depends on request method

Lab #3 CSRF where token validation depends on token being present

Lab #4 CSRF where token is not tied to user session

Lab #7 CSRF where Referer validation depends on header being present title

Lab #6 CSRF where token is duplicated in cookie

Lab #5 CSRF where token is tied to non-session cookie

Lab #8 CSRF with broken Referer validation

Lab #9 SameSite Lax bypass via method override

Lab #10 SameSite Strict bypass via client-side redirect

Lab #12 SameSite Lax bypass via cookie refresh

Lab #11 SameSite Strict bypass via sibling domain

How to Prevent XSS Vulnerabilities

How to Find & Exploit XSS Vulnerabilities

Lab #1 Reflected XSS into HTML context with nothing encoded

Lab #2 Stored XSS into HTML context with nothing encoded

Lab #3 DOM XSS in document.write sink using source location.search

Lab #4 DOM XSS in innerHTML sink using source location.search

Lab #5 DOM XSS in jQuery anchor href attribute sink using location.search source

Lab #8 Stored XSS into anchor href attribute with double quotes HTML-encoded

Lab #7 Reflected XSS into attribute with angle brackets HTML-encoded

Lab #6 DOM XSS in jQuery selector sink using a hashchange event

Lab #9 Reflected XSS into a JavaScript string with angle brackets HTML encoded

Lab #11 DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded

Lab #10 DOM XSS in document.write sink using source location.search inside a select element

Lab #13 Stored DOM XSS

Lab #12 Reflected DOM XSS

Lab #14 Exploiting cross-site scripting to steal cookies

Lab #15 Exploiting cross-site scripting to capture passwords

Lab #17 Reflected XSS into HTML context with most tags and attributes blocked

Lab #16 Exploiting XSS to perform CSRF

Lab #19 Reflected XSS with some SVG markup allowed

Lab #18 Reflected XSS into HTML context with all tags blocked except custom ones

Lab #21 Reflected XSS into a JavaScript string with single quote and backslash escaped

Lab #20 Reflected XSS in canonical link tag

Lab #22 Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped

Lab #23 Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

Lab #24 Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

What is XSS

How to Exploit Directory Traversal Vulnerabilities

How to Find Directory Traversal Vulnerabilities

How to Prevent Directory Traversal Vulnerabilities

Lab #2 File path traversal, traversal sequences blocked with absolute path bypass

Lab #3 File path traversal, traversal sequences stripped non-recursively

Lab #4 File path traversal, traversal sequences stripped with superfluous URL-decode

Lab #1 File path traversal, simple case

Lab #5 File path traversal, validation of start of path

What is Directory Traversal

Lab #6 File path traversal, validation of file extension with null byte bypass

How to Prevent DOM-Based Vulnerabilities

Lab #2 DOM XSS using web messages and a JavaScript URL

Lab #1 DOM XSS using web messages

How to Find & Exploit DOM-Based Vulnerabilities

Lab #3 DOM XSS using web messages and JSON.parse

Lab #5 DOM-based cookie manipulation

Lab #4 DOM-based open redirection

What are DOM-Based Vulnerabilities

What is the DOM

Lab #7 Clobbering DOM attributes to bypass HTML filters

Lab #6 Exploiting DOM clobbering to enable XSS

Additional Resources

Agenda

How to Prevent XXE Injection

How to Find XXE Injection

How to Exploit XXE Injection

Lab #1 Exploiting XXE using external entities to retrieve files

Lab #3 Blind XXE with out-of-band interaction

Lab #2 Exploiting XXE to perform SSRF attacks

Lab #4 Blind XXE with out-of-band interaction via XML parameter entities

Lab #6 Exploiting blind XXE to retrieve data via error messages

Lab #5 Exploiting blind XXE to exfiltrate data using a malicious external DTD

Lab #7 Exploiting XInclude to retrieve files

Lab #8 Exploiting XXE via image file upload

What is XXE Injection

Lab #9 Exploiting XXE to retrieve data by repurposing a local DTD

How to Exploit File Upload Vulnerabilities

How to Find File Upload Vulnerabilities

How to Prevent File Upload Vulnerabilities

Lab #1 Remote code execution via web shell upload

Lab #2 Web shell upload via Content-Type restriction bypass

Lab #3 Web shell upload via path traversal

Lab #6 Remote code execution via polyglot web shell upload

Lab #4 Web shell upload via extension blacklist bypass

Lab #5 Web shell upload via obfuscated file extension

What is a File Upload Vulnerability

Lab #7 Web shell upload via race condition

How to Exploit Information Disclosure Vulnerabilities

How to Prevent Information Disclosure Vulnerabilities

How to Find Information Disclosure Vulnerabilities

Lab #1 Information disclosure in error messages

Lab #2 Information disclosure on debug page

Lab #4 Authentication bypass via information disclosure

Lab #5 Information disclosure in version control history

Lab #3 Source code disclosure via backup files

What is Information Disclosure

Server-Side Request Forgery (SSRF)

Lab #1 Basic SSRF against the local server

Lab #3 SSRF with blacklist-based input filter

Lab #2 Basic SSRF against another back-end system

Lab #4 SSRF with whitelist-based input filter

Lab #6 Blind SSRF with out-of-band detection

Lab #5 SSRF with filter bypass via open redirection vulnerability

Lab #7 Blind SSRF with Shellshock exploitation

Lab #1 SQL injection vulnerability in WHERE clause allowing retrieval title

Lab #2 SQL injection vulnerability allowing login bypass

SQL Injection

Lab #3 SQLi UNION attack determining the number of columns returned by title

Lab #5 SQL injection UNION attack, retrieving data from other tables title

Lab #7 SQL injection attack, querying the database type and version on title w

Lab #6 SQL injection UNION attack, retrieving multiple values in a title

Lab #4 SQL injection UNION attack, finding a column containing text title

Lab #8 SQLi attack, querying the database type and version on MySQL & title w

Lab #8 SQLi attack, querying the database type and version on MySQL & title

Lab #10 SQL injection attack, listing the database contents on Oracle title

Lab #9 SQL injection attack, listing the database contents on non title

Lab #11 Blind SQL injection with conditional responses

Lab #13 Blind SQL injection with time delays

Lab #15 Blind SQL injection with out-of-band interaction

Lab #12 Blind SQL injection with conditional errors

Lab #17 SQL injection with filter bypass via XML encoding

Lab #16 Blind SQL injection with out of band data exfiltration

Lab #14 Blind SQL injection with time delays and information retrieval title

Lab #18 Visible error-based SQL injection

How to Prevent WebSocket Vulnerabilities

Lab #1 Manipulating WebSocket messages to exploit vulnerabilities

Introduction to WebSockets

How to Find & Exploit WebSocket Vulnerabilities

Lab #2 Manipulating the WebSocket handshake to exploit vulnerabilities

What are WebSocket Vulnerabilities

Lab #3 Cross-site WebSocket hijacking