Web Attack Lab
Due: November 21, 2016 at 5pm
You may work individually or in groups of up to 3 people. If you haven’t already, please use the Google Form sent out in email to sign up. If you don’t get a response from Bo within 24 hours, feel free to send him a friendly reminder.
http://codered.cs.washington.edu/lab2
In addition to successfully completing the exploits on our server, please submit a document (txt, word, or pdf) to the Catalyst dropbox that, for each exploit:
Please note that there is an opportunity for partial credit here: if you can’t get an exploit to work, please still submit what you tried and why you thought it might work.
The goal of this lab is to gain hands-on experience with penetration testing of web applications.
For this part of the lab, you are presented with three different scenarios. Each scenario asks you to perform a task you would not otherwise be able to complete as a regular, benign user. You'll have to figure out what vulnerability exists in each challenge, apply what you've learned in class, and craft a special payload to achieve your goal.
Note that protection tools that are built into the browser may interfere with this assignment. We advise that you turn off tools like Chrome's XSSAuditor and IE's XSS Filter.
Scenarios 1-3 are listed below. They add up to a total of 27 points and 15 extra credit points.
Everyone likes cookies, and Pikachu and Meowth are no exception. As Team Rocket's 4294967296th evil plan, Meowth is going to purchase all the cookies within Pikachu's reach so Pikachu would eventually surrender and give himself in, but of course Team Rocket cannot win.
Having eavesdropped on their conversation, you learned that Team Rocket keeps the cookies they bought in 8 different safes and store the combinations to each of the safes in 8 different cookies Meowth carries with him. You also learned that Meowth set up a website to facilitate communications with his fans (if any). With these in mind, you want to find a way get Pikachu some cookies back before he faints from a lack of cookies... but how?
You have been put in jail due to a wrongful conviction. You have no one to depend on, and the only way you can eat that University Teriyaki again is to jailbreak. Physical locks are for the weak; as a former Jedi, you can easily break them with the Force. What bothers you are the digital locks that are connected to a central database. But then, some materials you've learned from CSE 564 flashes before you…
Having joined CSE 484, you realized a sad truth: there's no way you can get a 4.0 for the class. You've learned that the seemingly nice and friendly CSE 484 TA has no mercy and routinely fails students as a hobby, and that the only way to get a good grade is to surreptitiously hack into the gradebook and change your own grade.
However, your CSE 484 TA is like no other; there's no way his web site can be vulnerable to any attacks, or so he/she says…
The following is a breakdown of the points for each problem.
Problem #
Problem #
Problem #
Now that you have read the motivational backstory, let’s get started!
During the course of this lab, we strongly recommend that you use Firefox with the browser add-on Firebug. The server uses Firefox (IceWeasel) and your exploit might exhibit different behavior with another browser like Chrome (i.e. your code might work on Chrome but not on Firefox). Also, disable plug-ins that may change how your browser handles cookies like ad blockers.
When doing XSS attacks, you will need to exfiltrate the cookie from the victim’s browser to a location where you can retrieve the cookie. One easy way to do this is to setup a webpage that takes GET requests with parameters. The goal is to have a page such that when you navigate to homes.cs.washington.edu/~adrsham/cookieEater.php?cookie=secretCookieValue, your page will record secretCookieValue so you can read it later. We will go through the steps to help you get set up.
If your script does not work, you might want to check whether your PHP script can be run by the apache server, so you might need to set the file permissions to 777. Read Random Notes for possible security issues.
In this scenario, you will mount a cross-site scripting attack against all versions of the link sharing website, stealing the the bot’s (Meowth) login cookies, and using it to unlock the next level.
Helpful links for XSS:
As you progress through the problems, the filtering will get more challenging and you will have to think of more creative ways to evade the filters.
1. No filter
2. Filters 'script'
3. Filters 'script', 'style', 'on', and ' ' (space)
4. Filters 'document', '(', ')', '<', '>'
5. Filters '<', '>'
6. Filters s/[()<>+]//g (that's a regular expression that removes all the characters in the square brackets from the input string)
7. Filters s/[bcdfihzjrst<>]//ig (similar to above, but ignores case for letters as well)
8. Filters s/[0-9a-z]//gi (removes all numbers and all letters from input string)
For this scenario, you will need to perform a SQL Injection attack.
Note: Some attempted SQL injection attacks may be blocked by CSE’s web application firewall (WAF). If it take a long time to load the page, you probably hit the WAF. You can try adding spaces or similar characters where possible, and when in serious doubt, check with the course staff if you’re on the right track. The correct solution can bypass the WAF.
Some helpful links:
For this scenario, you will need to perform a Cross-Site Request Forgery attack.
Some helpful links: