Introduction: In this write-up, we embark on an exploration of a significant security discovery within the web application &quot;Trustline&#39;s Maintenance Parachute.&quot; This revelation exposes a series of intricate steps that led to the acquisition of a hidden flag, emphasizing the importance of comprehensive security measures in the digital realm.

Vulnerability Unveiled: Trustline&#39;s Maintenance Parachute is a web application housing a maintenance message. However, beneath the surface, a vulnerability lies, allowing for unauthorized access and manipulation. By navigating through specific actions, the challenge presents an avenue to uncover sensitive data, making evident the necessity of robust security protocols.

Step-by-Step Exploitation:

Step 1: Source Code Examination Upon reaching Trustline&#39;s main page, a message hints at maintenance activities. The provided JavaScript source code, referencing &quot;new-functions.js,&quot; unveils a set of API endpoints.

Step 2: Registration API Exploitation

<ul>
	<li>Initiate a POST request to &quot;/register-api&quot; without parameters.</li>
	<li>Receive a response indicating missing &quot;username&quot; and &quot;password&quot; fields in JSON format.</li>
</ul>

<img alt="" src="/media/blog/2023/08/23/register-api-1_uaNLpzJ.png" />

Step 3: Cracking the Registration

<ul>
	<li>Send a POST request to &quot;/register-api&quot; with &quot;username=TEST&amp;password=TEST.&quot;</li>
	<li>Attain a 200 OK response, including a JSON object with a token.</li>
</ul>

<img alt="" src="/media/blog/2023/08/23/register-api_XVBmoQa.png" />

Step 4: Decoding the Token

<ul>
	<li>Employ a JWT tool to decode the token and reveal its contents, including the role and username.&nbsp;</li>
	<li>note: i used https://jwt.io/&nbsp;</li>
</ul>

<img alt="" src="/media/blog/2023/08/23/jwt.png" />

Step 5: Token Cracking

<ul>
	<li>Employ the &quot;rockyou&quot; method to decipher the token, leading to the revelation of the secret key: &quot;secretkey.&quot;</li>
	<li>note :&nbsp;&quot;&nbsp;<code>john file --wordlist=rockyou.txt &quot;</code></li>
	<li><code>you have to make 2 txt file one of the wordlist another for your user role token.</code></li>
</ul>

&nbsp;

Step 6: Token Manipulation for Admin Privileges

<ul>
	<li>Alter the token&#39;s contents to transform the role to &quot;admin,&quot; generating a fresh token.</li>
</ul>

Step 7: Authorization and Access

<ul>
	<li>Make a POST request to &quot;/login-api&quot; with the new token provided in the &quot;Authorization&quot; header.</li>
	<li>Receive a 200 OK response containing another token.</li>
</ul>

<img alt="" src="/media/blog/2023/08/23/login-api_E7EhkrT.png" />

Step 8: Accessing the Dashboard

<ul>
	<li>Submit a GET request to &quot;/maintenance-parachute/dashboard/&quot; using the newly acquired token.</li>
	<li>Witness the long-awaited flag as part of the response.</li>
</ul>

<img alt="" src="/media/blog/2023/08/23/flag.png" />

Impact and Mitigation:

The revelation of this complex vulnerability within Trustline&#39;s Maintenance Parachute underscores the significance of robust security frameworks. Through a series of strategic actions, unauthorized access to sensitive information was achieved. This discovery highlights the potential consequences of insufficient security measures in web applications.

Mitigation entails:

<ul>
	<li>Implementing stringent server-side validation to prevent unauthorized access.</li>
	<li>Relying on server-side checks rather than solely on client-side validations.</li>
	<li>Ensuring proper session management to deter unauthorized actions.</li>
	<li>Regularly evaluating and fortifying security measures to protect against emerging threats.</li>
</ul>

By dissecting this challenge, we gain insights into the intricate world of web application security, emphasizing the imperative nature of constant vigilance and proactive measures to thwart potential vulnerabilities.

michael seibel

اقرأ التالي