Showing posts with label Beebox. Show all posts

Friday, December 30, 2016

[High] HTML Injection - Stored (Blog)

Posted by Unknown 4:59:00 PM

# Introduction

: BWAPP → High → HTML Injection - Stored (blog)

# Training

: I put the value I used in the low step, As a result, output is as follows.

I check at /var/www/bWAPP/htmli_stored.php to see how it works.

I check functions_external.php to see the xss_check_3 function.

The htmlspecialchars function has been mentioned previously, so it is omitted.

Unknown

0 Comments

Monday, December 26, 2016

Beebox Hacking Study Web

[low] HTML Injection - Stored (Blog)

Posted by Unknown 5:59:00 PM

# Introduction

: BWAPP → Low→ HTML Injection - Stored (blog)

# Training

: The ''htmli_stored.php'' page is a blog format.

Therefore, It is possible to save HTML tags so that the administrator can output unintended contents. Or When type in the text field on the blog and click [Go], Transfer the input and move to another page.

The contents of the exercise are as follows.

: Moving from htmli_stored.php to htmli_post.php using a text field.

First, copy the page format from htmli_post.php to use the htmli_post.php page format.

When fetching page formates, It's easy to import using the web developer tools in browser.

Put this code in the textfield and click [submint] to add it.

When user enter data in both fields and press [Go], the user moves to the page.

Unknown

0 Comments

Friday, December 23, 2016

Beebox Hacking Study Web

[High] HTML Injection - Reflected (POST)

Posted by Unknown 11:00:00 AM

# Introduction

:BWAPP → High → HTML Injection - reflected (POST)

# Training

: At the high level, It use the function used in the previous level and htmlspecialchars function. So, Encode the characters used in the tag with UTF-8 so that they are not recognized as HTML Tag.

Unknown

0 Comments

Beebox Hacking Study Web

[Medium] HTML Injection - Reflected (POST)

Posted by Unknown 10:33:00 AM

# Introduction

:BWAPP → Medium→ HTML Injection - reflected (POST)

# Training

:As before, I did the exercises without reference to the source code. When I input the value used in the previous step, It will be output as plain text as follows.

So, I checked the input values to the server using the buff suite.

I found that the value passed to the server is encoded( <, > encoded to %3C, %3E).If I input this values, I thought that the specific function of html_post.php encode it once and pass it to the server. If I visualize what I think, it is as follows.

When I input the value, It was passed to the server as follows.

When I forward values, I could use the html tags.

Unknown

0 Comments

Beebox Hacking Study Web

[low] HTML Injection - Reflected (POST)

Posted by Unknown 9:38:00 AM

# Introduction

:BWAPP → Low→ HTML Injection - reflected (POST)

# Training

: htmli_post.php uses POST Method to transfer data. So, Variable values sent to the server are not exposed to the URL. You can check the '/var/www/bWAPP/htmli_post.php' for practice, but I used a proxy tool(Burp suite).

First, When I enter a value into a variable, I confirmed that the output is the same as html_get.php.

One difference is that the variable values are not exposed to the URL, as described above.

I set the proxy settings and modified the variable values using the buff suite.

The modified values are the same as the html tags used in html_get.php

Unknown

0 Comments

Thursday, December 22, 2016

Beebox Hacking Study Web

[High] HTML Injection - Reflected (GET)

Posted by Unknown 7:29:00 PM

# Introduction

:BWAPP → Medium→ HTML Injection - reflected (GET)

# Training

: At this level, all of the previous level values are output as plain text as shown below.

I checked the source code as well as the medium level. First, I checked the source code of htmli_get.php. At the htmli_get.php, I found that using the xss_check_3 function at high level.

Next, At the Functions_external.php, I could see what this function is.

I found that the htmlspecialchars function bypass the input value. This function is a basic function provided by php. It returns special characters used in HTML as UTF-8.

So, If you want to prevent HTML injections, you can use this function to make the characters used in HTML tags recognizes as text.

Unknown

4 Comments

Beebox Hacking Study Web

[medium] HTML Injection - Reflected (GET)

Posted by Unknown 6:56:00 PM

# Introduction.

: BWAPP → Medium→ HTML Injection - reflected (GET)

# Training

: If we enter the input value in the middle step like the low step, the output is as follows.

I wondered why this is so I checked the source code. The source code is located in /var/www/bWAPP. The contents of the source code are as follows.

I could see that the function xss_check_1 is used at the medium level. The xss_check_1 could be found in functions_external.php.

I could see that < & > convert to another character. Therefore, I typed URL encoding of the character used in the tag.

%3Ch1%3ESuccess%3C%2Fh1%3E
%3Cimg src=http://192.168.10.119/bWAPP/images/bee_1.png%3E

The results were as follows.

Unknown

0 Comments

Beebox Hacking Study Web

HTML Injection - Reflected (GET)

Posted by Unknown 2:32:00 PM

# Introduction.

: BWAPP → Low → HTML Injection - reflected (GET)

# Training.

This 'html_get.php' is a page that prints the user's input value as follows.

And If you check the URL, you can see that the input value and variable name are exposed in the URL. Because it is the GET method.

In order to test the input items, I inserted HTML tags in the First name and Last name.

<h1> Success</h1>
<img src=http://192.168.10.119/bWAPP/images/bee_1.png>

The input result is as follows.

Unknown

0 Comments

Beebox Hacking Study Web

What is "HTML Injection"

Posted by Unknown 1:56:00 PM

# HTML Injection

: HTML Injection is a subclass of code injection attack. An attack that inserts malicious HTML Code into vulnerable parameters. Using this, the attacker inserts the HTML Tag on the page that the user requested to link and connects to the unintended content or the malicious site.

# Reflection technique.

: It is an attack that inserts a malicious HTML tag in the URL and causes the HTML tag to be executed on the user's PC Who clicked the link. ( In particular, when data is transmitted by the GET Method, the variable name & input value are exposed in the URL.

# Storage technique.

: It is an attack that causes malicious HTML tag to be stored in DB so that the HTML Tags are executed on the PC of the users who has confirmed the stored tags. If attacker upload a malicious HTML tag to a public domain, attacker can attack multiple users.

Unknown