All labs

Web security 2

Six harder holes, server-side this time: an unsigned admin token, a profile save that writes any field, a stored script that hits a moderator, a URL preview that reaches the internal network, a logger that runs your lookups, and a search that hands over a whole secret table.

Briefing

Same browser, a harder site: this time the mistakes are on the server, in what it trusts after it has checked. You forge a token it believes, add a field it saves, make it fetch a URL from inside its own network, and pull a whole secret table out through one search box.

You'll learn to

  • Forge a token by turning its signature off, and set a field you were never shown
  • Land a stored script in a moderator's browser
  • Reach an internal service with SSRF, and run a lookup through a logger
  • Read a hidden table with a UNION — and give the server-side fix for each
0 of 9 steps done0%
Start: Now the server is the target
Before you attack the serverOptional warm-upSigned tokens, how a query is built from parts, server-side fetches, and why the server must not trust what it handled. Ten minutes.

  1. Now the server is the target

    Up next

    What changes when the data is trusted deeper in

  2. Forge the token

    An algorithm of “none” checks nothing

  3. One extra field

    The save that writes whatever you send

  4. A script that waits

    Stored XSS fires in the moderator’s browser

  5. Fetch it for me

    Borrowing the server’s place in the network

  6. The logger obeys

    The bug behind Log4Shell

  7. The whole table

    UNION: read data the query never meant to

  8. Know the stack, know the bug

    Four real CVEs, and the signal that gave each one away

  9. Defence in depth

    Fixing the server-side six, and where to go next