Cyber Security | Web Development

Lab 1:   SQL injection UNION attack, determining the number of columns returned by the query Introduction      This lab contains an SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables. The first step of such an attack is to determine the number of columns that are being returned by the query. You will then use this technique in subsequent labs to construct the full attack.      To solve the lab, determine the number of columns returned by the query by performing an  SQL injection UNION  attack that returns an additional row containing null values. Solutions: Use Burp Suite to intercept and modify the request that sets the product category filter. Modify the  category  parameter, giving it the value  '+UNION+SELECT+NULL-- . Observe that an error occurs. Modify the  ...

Lab 7: Reflected DOM XSS      Description: Reflected DOM vulnerabilities occur when the server-side application processes data from a request and echoes the data in the response.      Tool required: Burp Suite Step 1: UI View Step 2: In burp suite tool find a JSON file  Step 3: We have a JSON file restricted with eval() function. Step 4: To bypass eval() function using payload       \"-alert(1)}// Step 5: Result Lab 8: Stored DOM XSS      Description: In an attempt to prevent XSS , the website uses the JavaScript replace() function to encode angle brackets. However, when the first argument is a string, the function only replaces the first occurrence. We exploit this vulnerability by simply including an extra set of angle brackets at the beginning of the comment. These angle brackets will be encoded, but any subsequent angle brackets will be unaffected, enabling us to effectively bypass the filter and inje...

  Lab 1: Reflected XSS into HTML context with nothing encoded           Description:  This lab contains a simple  reflected cross-site scripting  vulnerability in the search function it reflected on the client-side. Step 1: UI view Step 2: Query pass in URL Step 3: Inject payload to get attack   Payload :   <script>alert(1)</script> Step 4: Result Lab 2: Stored XSS into HTML context with nothing encoded      Description:  This lab contains a  stored cross-site scripting  vulnerability in the comment functionality it is reflected on the server-side. Step 1: UI view Step 2: Inject payload in the Comment section and to get attack  Step 3: Go back to comment section   Lab 3: DOM XSS in document.write sink using source location.search      Description: This lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality. ...