Posts

How to join HackTheBox challenge

Image
Hack The Box (https://www.hackthebox.eu/) is an excellent collection of vulnerable vms, which are online to test/ hack them to upgrade the hacking skills.

To join the HTB, you need to have an invite code which needs to be entered while signing up. This invite code is not something someone will forward you. You have to generate one using your hacking skills and enter it to register to the site.

'View source' will not work, so we use developer tools and carefully going through we find a file called:
/js/inviteapi.min.js

Now go the browser and type: https://www.hackthebox.eu/js/inviteapi.min.js whose contents can be pasted to an online JavaScript interpreter but does not give any result:
But we can see makeInviteCode, which seems interesting. Let's search this in the console for this code. Executing makeInviteCode() gives a we see a data which seems to be ROT13 encoded: Decoding it gives some instructions: We use CURL to fire the above request, to get another Base64 encoded …

Good case for avoiding sensitive information in url

Nothing extraordinary here, just an interesting case I came across today. This can be one of the examples we can give to app teams too.



Someone posted a link from well known forum about some discussions on my WhatsApp group today. Upon clicking, it opened in the browser, after a while it prompted me to post something then I noticed that it wasn’t my name. :D Instead it was addressing me as ‘Ronnie’.



We both were surprised and amused. Then I searched all my emails and WhatsApp chats to find that once, long time back Ronnie had posted a link from the same forum to me, which was very long and contained probably session information, token etc.



Now this would have happened in background:

·         The long link (URL), from Ronnie, contained session information/ token in the URL

·         The session token has been persistent and active for a pretty long duration (almost 6 months)

·         I clicked a new unrelated link today from another group and Ronnie’s session token was replayed, logging me…

Malicious file upload with embedded codes- countermeasures

Acting against a malicious file upload is not an easy task. We need to maintain fine balance between security and user experience.
We can still use the traditional ways such as checking content type, file headers, extensions etc. but what about in cases where a code is appended to a file jpg/ png files. The above traditional countermeasures will not work.

So a few countermeasures for such scenarios:

Similar to how WAF (Web Application Firewalls) work, the application should analyze each part of the file. The file needs to be parsed and look for any malicious hints/ contents such as executable codes containing dangerous functions - system, exec, kill etc. Also, check for existence of encoders such as base64 etc. There's no point of their presence in an innocent image file.Another effective method is to crop the image before saving it. Check the code here in Case 3 section of Sanitizing image files. What it basically does is, before saving the file, it does some resizing and then sa…

So how do you steal credential in memory in mobile?

It's not a technical question, it's a question when a few people argue (devil's advocate) that even if their app has an issue of storing the 'Login Credentials' in memory, what's the risk? Their arguments are:

They have jailbreak/ root detection implemented. So the app cannot be installed on a rooted device.>>Counter argument: The JB/ root detection are completely by-passable as they are client side protections. Scenarios, a user can intentionally/ unintentionally bypass this check and install at his own device to enjoy banking and other apps also, which require a root. Second scenario, a security researcher can do the same thing to do a research and learn how this app works. If this app belongs to a reputed firm and he/ she makes this finding public, it would be reputation loss.If you try to root the device which has the app already installed, the device will reboot and in this order kills the app's process and consequently clears the memory which ho…

Touch ID auth - a boon or bane?

With advancement of technology, applications are moving towards modern way of authentication from a traditional one. More and more biometric based authentication are being used apart from the password based. One of such example would be- Touch ID. Touch ID uses users' fingerprint to authenticate the user to device/ app.
How does it work- On a high level, when a user registers to choose to authenticate to his phone using his/ her fingerprints, the fingerprints are gets stored on the device in form of hashes. Next time when user tries authenticate self and submits his/ her fingerprints, the device matches the submitted fingerprint hash with the ones with already stored and takes decision whether to authenticate him/ her or not.
Sounds good, but what's the issue- It's a very convenient technology to open the phone with just a mild touch of your fingerprint. No need to remember/ change/ maintain PIN or passwords. It's more secure because it's completely unique, and it…

Certificate Pinning in mobile apps

What is certificate pinning:
Certificate pinning is an countermeasure to any attempt of MITM (Man in the middle) attacks where an attacker tries to inject his own certificate to sniff the traffic between the client and the server.

Why cert pinning is required:
The question here is why it's required for mobile apps, why not for browsers? The reason is mobile apps are very obscure and very difficult to get about what's going behind the scene. The end user does not get any warning from the app about any possible malicious activities going on. However in case of a browsers on desktops the user is presented with various warnings about TLS such as domain name not matching etc. This alerts the user to sense that something is not right there. And he has option to accept/ reject it , while in mobile apps it's not the case.

How to do it:
Generally it's done on code level, where the developer binds (pins) a certificate with the app. It's sort of hard coding the cert name, CA…

When authentication is not really an authentication

When authentication is not really an authentication- just identity. We'll talk about a design flaw.
Identity is just identification of entities such as a person, object etc- who they are. But when it comes to prove that who they are, the entities must supply some sort of credentials, such as passwords, certificates etc to prove their identity claim.
Let's consider a hypothetical app which is thick client and 2-tier (which is never a good idea), but let's think about it. It has got following design:

1.The UI is protected by a login screen which requires AD (Windows) authentication of logged in user. The login screen is a separate exe.
2. Once the user is authenticated, a separate UI exe is launched with the logged in user's privilege.
3. The same login screen also provides details of the DB to be connected by this app once the authentication is successful.

What risks we see here apart from the traditional 2-tier risks such as decompiling, business logic at client side,…