THM Burp Suite: Repeater - grunt92/IT-Sec-WriteUps GitHub Wiki
Deploy the machine (and the AttackBox if you are not using your own attack VM), and let's get started!
No answer needed
No answer needed
No answer needed
No answer needed
Render
Get comfortable with Inspector and practice adding/removing items from the various request sections.
No answer needed
Capture a request to http://10.10.102.69/ in the Proxy and send it to Repeater.
No answer needed
Send the request once from Repeater -- you should see the HTML source code for the page you requested in the response tab.
Try viewing this in one of the other view options (e.g. Rendered).
No answer needed
Using Inspector (or manually, if you prefer), add a header called FlagAuthorised and set it to have a value of True.
Send the request. What is the flag you receive?
THM{Yzg2MWI2ZDhlYzdlNGFiZTUzZTIzMzVi}
Capture a request to one of the numeric products endpoints in the Proxy, then forward it to Repeater.
No answer needed
See if you can get the server to error out with a "500 Internal Server Error" code by changing the number at the end of the request to extreme inputs.
What is the flag you receive when you cause a 500 error in the endpoint?
Enter "-1" as the product number and you get the error and the flag. THM{N2MzMzFhMTA1MmZiYjA2YWQ4M2ZmMzhl}
We know that there is a vulnerability, and we know where it is. Now we just need to exploit it!
Let's start by capturing a request to http://10.10.102.69/about/2 in the Burp Proxy. Once you have captured the request, send it to Repeater with Ctrl + R or by right-clicking and choosing "Send to Repeater".
No answer needed
You should see that the server responds with a "500 Internal Server Error", indicating that we successfully broke the query:
No answer needed
No answer needed
Looking through the returned response, we can see that the first column name (id) has been inserted into the page title:
No answer needed
##Fortunately, we can use our SQLi to group the results. We can still only retrieve one result at a time, but by using the group_concat() function, we can amalgamate all of the column names into a single output:
/about/0 UNION ALL SELECT group_concat(column_name),null,null,null,null FROM information_schema.columns WHERE table_name="people"
No answer needed
No answer needed
THM{ZGE3OTUyZGMyMzkwNjJmZjg3Mzk1NjJh}
No answer needed