Skip to main content

2 posts tagged with "Bugbounty"

View All Tags

· 7 min read
Pankaj Mouriya

The blog talks all about Chrome Dev tools and making its best use in Web Security Assessments and Bug Bounties

Debug function​

It is used to create breakpoints for the function we specify under certain conditions

In the below example, I have specified a function postMessage following a condition where if the postMessage is using * as the target origin which in general, not a good practice as it could potentially leak sensitive information to third parties.

debug(postMessage, 'arguments[1] == "*"')

To use debug function, open chrome developer tools

Under Console, type

debug(postMessage, 'arguments[1] == "*"')

Reload the page and you will see your browser in action setting breakpoints whereever our function's condition is satisfied.

Another similar thing is monitorEvents, it creates breakpoints for DOM events and hence we can use monitorEvents function too to look for postMessage events.

To use monitorEvents, open chrome developer tools

Under Console, type

monitorEvents(window, 'message')

and refresh the page or click on any hyperlink/feature in the application to check for any MessageEvent

About postMessage API -- [Additional information]​

If you do not know about postMessage API, then below points will give enough idea about what is postMessage API

The postMessage API is an alternative to JSONP, XHR with CORS headers and other methods enabling sending data between origins. It was introduced with HTML5 and like many other cross-document features it can be a source of client-side vulnerabilities

How it works​

To send a message, an application simply calls the "postMessage" function on the target window it would like to send the message to:

    targetWindow.postMessage("hello other document!", "*");

And to receive a message, a “message” event handler can be registered on the receiving end:

    window.addEventListener("message", function(message){console.log(message.data)});

What can go wrong, if postMessage function not used properly​

Scenario 1 The first pitfall lies in the second argument of the “postMessage” function. This argument specifies which origin is allowed to receive the message. Using the wildcard “*” means that any origin is allowed to receive the message.

Since the target window is located at a different origin, there is no way for the sender window to know if the target window is at the target origin when sending the message. If the target window has been navigated to another origin, the other origin would receive the data.

Scenario 2 The second pitfall lies on the receiving end. Since the listener listens for any message, an attacker could trick the application by sending a message from the attacker’s origin, which would make the receiver think it received the message from the sender’s window. To avoid this, the receiver must validate the origin of the message with the “message.origin” attribute.

If regex is used to validate the origin, it’s important to escape the “.” character, since this code:

    //Listener on http://www.examplereceiver.com/
    window.addEventListener("message", function(message){
        if(/^http://www.examplesender.com$/.test(message.origin)){
            console.log(message.data);
        }
    });

Would not only allow messages from www.examplesender.com, but also wwwaexamplesender.com, wwwbexamplesender.com etc.

Memory Function/Feature​

The memory tab in the developer tools has been very useful to me in my security assessments. Before digging deep let's understand what memory tab does

Memory Tab -- [Additional information]​

Memory tab helps to learn about the execution time and memory usage of the whole web page loaded in your browser. Memory tab has three profiling types

  • Heap snapshot
  • Allocation instrumentation on timeline
  • Allocation sampling

For our requirement, the Heap snapshot profile is enough and we can ignore the other two.

Heap snapshot can take a snapshot of the memory heap to show the memory distribution of JavaScript objects and related DOM nodes in our loaded webpage. The most interesting thing about this is that the snapshot contains all the possible strings in your websites.

How it can help in security assessments​

We can use the snapshot and can search for all possible APIs in the loaded web page.

For example, I am using OWASP Juice Shop and will look for possible APIs in the application.

Taking Snapshot

Before taking the snapshot you must know that it is highly possible that the loaded page may not have all the APIs available in the application, hence you might need to take multiple snapshots by browsing multiple pages.

Steps​

  1. Load your application into chrome and open developer tools (F12)

  2. Navigate to Memory tab

  3. Select Heap snapshot and click Take Snapshot

  4. Once the snapshot is completed, press ctrl+f to open search bar

  5. Now to search for APIs, search strings like /api or /rest.

Apart from looking for APIs, we can also use it to look for specific strings in JavaScript code. Most of the time, we end up looking for secrets in JavaScript by first collecting the JavaScript files and then looking for hardcoded secrets. It becomes really annoying to load large JavaScript files and search for string. If this method does not help you in finding sensitive keywords, then you can read my blog Finding Gems in JavaScript using Dumpster DiverLink.

Lighthouse​

An open-source tool built to improve the quality of the web pages. You can run it against any web page, public, or requiring authentication. It has audits for performance, accessibility, progressive web apps, SEO and more - This is what lighthouse is actually built for, but how is it helpful in our security assessments

Lighthouse has multiple categories based on which it does audit, the categories are mentioned below

  • Performance
  • Progressive Web App
  • Best Practices
  • Accessibility
  • SEO

For our security assessments, Best Practices is the one which is required.

Best Practices: During audit, Lighthouse does below mentioned checks

  • If the application does not use HTTPS Click Me
  • links to cross-origin destinations are unsafe Click Me
  • Includes front-end JavaScript libraries with known security vulnerabilities Click Me
  • Uses Application Cache Click Me
  • Uses deprecated APIs Click Me
  • Listing all the front-end JavaScript libraries Click Me

Note: Use the click me hyperlinks to read more about the checks mentioned above.

For me this tool saves a lot of time, it becomes really annoying to individually look for basic security issues like not using HTTPS, outdated libraries, use of deprecated APIs, etc.

If you are a Burp Suite fan and thinking about Burp Suite doing this same thing under Issues, I would say yes it does; but lighthouse still beats Burp Suite as it reduces the steps and the UI is really awesome and user friendly.

Have a look how Burp Suite displays the issues

and now look at Lighthouse doing the same thing

You just need to click on the Insecure URLs, or the mentioned libraries. Lighthouse will provide all the additional information you may look for.

Using Lighthouse in security assessment of OWASP Juice Shop application​

Steps

  1. Open OWASP juice in the Chrome Web Browser

  2. Open Chrome Developers tools

  3. Navigate to Lighthouse tab

  4. Uncheck all the categories except Best Practices and because we are on Desktop device, choose Desktop.

  5. Click, Generate report button.

  6. Wait for the Audit to finish and notice the report in response.

Network Tab​

The network tab is another useful element in security assessment, although a lot of things can be done using the network tab, I will mention a few important ones.

Network tab helps us in identifying the kind of resources, pages being used by the application. We can filter the resources using the filter tab.

We can use the Network filter tab to identify all the JavaScript files by choosing JS. You can also use ctrl+shift+f to open the search bar and search for all possible resources loaded in the webpage. For example search for DOM sinks like innerHTML.

I understand reading such a long blog takes time to process and that is why I am ending the blog here. I have few other things which I will be writing sometime soon till then read Healthy, eat healthily and stay healthy.

-------Thank you for reading--------

References​

· 6 min read
Pankaj Mouriya

Although its not new thing to blog about but I am sure, it will help out most of the security analyst and bug bounty people out there looking for authorization issues

Have you ever encountered an application which has different levels of access. When I say levels of access I mean having roles like admin, Supervisor, Agent Where
Admin = Full privileges
Supervisor = With some level of access
Agent = Having least possible access

Now what if you are asked to do authorization checks among these users, how many browser tabs will you be opening or how many incognito tabs do you think one will need to do that. Well if you understood the underlying problem I want to explain here then you are welcome to read the rest of the blog

Talking about Firefox Multi-Account Containers​

Firefox Multi-Account Containers lets you keep parts of your online life separated into color-coded tabs that preserve your privacy. Cookies are separated by container, allowing you to use the web with multiple identities or accounts simultaneously - by Mozilla Firefox

How do I install it?​

Navigate to URL https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ and install it into your firefox browser. For chrome there are some alternatives which I do not like at all. Sorry Google chrome for being judgemental.

What does it do?​

The definition above by firefox almost explains everything but we will see it into action here

Lets say I have three user

Admin
Supervisor
Agent

I want to login into all three at once without having to open new browsers or incognito mode or worrying about the browser cookies and cache storing problem.

I will use Firefox multi-container and create new containers with thier names for my own convenience and will open the application in these containers as shown below

Now I am logged into all three different accounts and I do not need to worry about logging out and logging in for different user accounts.

If you are thinking that the blog title talks about authorization checks and that is not happening here then you need to read the rest of the blog because I am still adding the ingredients into the recipe.

Burp Suite Autorize​

Autorize is an automatic authorization enforcement detection extension for Burp Suite. It was written in Python by Barak Tawily, an application security expert. Autorize was designed to help security testers by performing automatic authorization tests - By Barak Tawily

How shoud I install it?​

Browse to URL https://github.com/Quitten/Autorize or install directly from Burp Suite BApp Store

How to use it?​

Either refer to the User Guide - How to use? mentioned at https://github.com/Quitten/Autorize or follow me step by step

  1. Login using Agent user account into your application[User with least privileges] if not already logged in.

  2. Intercept any request which contains the authorization token or if its cookie with session token

  3. Copy the token with its header and paste it inside Autorize extension

  4. Turn Autorize on Autorize is On and do not forget to check the box with Intercept request from Repeater

  5. Because we already are logged into our juiceshop-admin container with admin user account into another tab, just switch into that tab and start browsing the application. Autorize will automatically flag all the endpoints which are vulnerable to authorization issues as Bypassed! in red color.

  6. You can run the same process to check Authorization issues between user Supervisor and Agent or Supervisor and admin

Note The low privileged user tokens will always be pasted inside the Autorize header input box

Now that we have three different accounts and all three running under same browser which makes it difficult to identify which request belongs to which user inside HTTP history of Burp Suite.

And this is my favorite part in this whole blog. Think what if we are able to highlight the request based on the container tab color which you assigned while creating the container inside Firefox Multi container

Burp Suite Request Highlighter​

Request Highlighter is a simple extension for Burp Suite tool (for both community and professional editions) that provides an automatic way to highlight HTTP requests based on headers content (eg. Host, User-Agent, Cookies, Auth token, custom headers etc.). With Request Highlighter testers can easily identify and point out, within the Proxy history tab, requests belonging to different sessions, hosts, browsers or devices - PortSwigger

The definition explains the work of this extension pretty well but we are going to blend its use with firefox containers and take it to next level

How do I install it?​

Either you install it from the BApp store inside Burp Suite or you browse to URL https://github.com/portswigger/request-highlighter and follow the intructions. Anyways its super easy to install and use.

Remember my containers colour which I assigned to all three different users, if not have a look at below screenshots

Once the Burp Suite Request Highlighter is installed, identify the admin user request inside Burp Suite HTTP history and select the session token or in my case I have selected the authorization token and right click on Request Highlighter - add highlight and then choose the colour based on your container which in my case for admin user is Red

The moment you choose the colour, all upcoming request including all previous request containing the same authorization token will become red. Next I have followed the same process for all the other user based on their container colour. At end it will look like this in HTTP history

Combination of Firefox multi-container and Request highlighter has helped me a lot in saving time while looking for authorization related issues. And I hope you will defintely find it helpful.

Also, there are some Burp Suite plugins created by people over internet which do both the highlighting and container thing in one plugin but those are not reliable. I had lots of issue with these plugins and found this method to work perfect without any glitches.

The URL to one such plugin(PwnFox) is mentioned in references, in case you wanna try using it

References​