This One Skill Will Change How You Hunt Broken Access Controls

[00:00:00]Hey everyone, I hope you all are doing good and having a wonderful day. In this video, we are going to talk about one of the most interesting authorization bypass that I have ever encountered in this particular year. This is one of the case where you really need to understand how your application is working to the to its core so that you can understand that what are the functionalities which are uh allowing you to access certain files, how they are uh understanding whether you are not authorized or whether you are authorized and things like that, right? And I'm going to cover all of this in this particular video.

[00:00:30]So, but as always before diving deep into this video, if you haven't checked out my previous video, then go ahead and check it out. In that video to learn more about insecure decalization, how it works and how we can exploit it, right?

[00:00:42]So, if you're interested, then go ahead and check it out. The link is given in the description as well as you can see it at the right side of the screen. And now with that being said, let us get started.

[00:00:53]Okay. Okay. So for the sake of demonstration, I have created this very small lab that's going to show you exactly what I did actually you know and this is based on the real world scenario and everything which I'm going to do over here is the same thing which I did on the real world application to identify this kind of vulnerability.

[00:01:10]Okay, first thing first just to let you know guys we have like two rules here which is administrator and user. We'll try to login as administrator first and let's try to see what is the what are the functionalities that they can handle. Okay, so we can login with admin. Let me just do a quick login here. Paste it here.

[00:01:29]Let's copy it and paste it right here.

[00:01:33]Successfully logged in. And as you can see, as an administrator, we can see users, roles, API keys, and we can see the profile settings, right? Perfect.

[00:01:42]Let's try to do one thing. We'll try to intercept one of the requests. For example, I'm going to turn on the intercept here. And we'll just going to click on users. And here is the request which is getting sent. Okay. So you can clearly see that the request is getting sent in a get parameter sorry in a get request method with uh the token is getting sent directly to the parameter.

[00:02:03]Right. So this itself was a medium severity finding in appentis but we are going to focus more on the other things.

[00:02:09]So we have just sent this request to repeater. Okay. And I'm just going to name this as check users. Okay.

[00:02:16]Something like that. And then we'll just log out. Let's try to do like a log out from here. Okay. Don't know why it's not working. Okay. So, click on log out. Log out successful. And let's try to go ahead and log in as a normal user. So, I'm going to copy this user detail, the email address as well as the password.

[00:02:38]Let's log in. And as you can see once we are logged in, we can see the difference between user and admin pretty clearly, right? Because as a normal user, there are certain things that you cannot access. Definitely not the APIs nor the the user and rules and all those details, right? So generally like to simplify it as a normal user, you can only access everything related to your account only. But as an administrator, you can pretty much access everything, right? Now how we usually test for authorization issues, what we try to do is we try to capture a request from a high privilege user and then we try to like swap the tokens, swap the cookies and we'll try to see if the request can be still accessible or not. If it is accessible then obviously yes it's a it's an issue right so let's try to do that over here I'm going [snorts] to turn on the intercept again from here and let's try to click on my profile for example because I just wanted to copy this thing okay and I'm going to send this to repeater as well because we'll be playing with it again and then we are going to copy this token okay which is like the normal users token and then we're going to paste it right over here Right. So let's try to paste it here.

[00:03:52]Okay. Good to go. Let's click on send.

[00:03:56]As you can see the moment we send the request it is responding with 401 unauthorized. Right. And it says even the message says that this resource requires administrator privileges. Now most of the beginners you know those who are relatively new into cyber security and web application apprentice they when they see this kind of of information they generally assume that the application is secure right but let me tell you that this cannot be the case for uh every scenario. Okay, the reason is that even if you're seeing that uh this endpoint is resulting in 401, there can be other ways through which the application might be fetching the data.

[00:04:36]Right? So for that thing you need to really understand how the application is fetching each kind of data and whether you will you can like try to access something from an endpoint which is not allow which is not supposed to give you that particular access. Let me explain what I mean. So yeah and before that uh if you guys think that at this point you know where the vulnerability is you can let me know in the comment section and I'll be more than happy to see that okay but yeah coming back to the video you can check right over here okay so let's try to understand the application a bit so we'll turn on the intercept again fine and then we are going to click on let's say notifications okay and you see the moment I click on notification we've got this request let's send this to uh repeater and let's try to understand what it is doing. Okay, so here it is.

[00:05:25]We can send the request and you can see we're getting the output from notification. But if you take a closer look at the request body, you will see something very interesting which is this NQL parameter, right? Which says select plus my notifications, right? This is something very interesting because if you remember when we tried to access the users from the administrator, the endpoint was very different. The endpoint was API/ data and then the column is users along with the token, right? Which resulted in the user details uh of the people who are registered on the application. Correct?

[00:06:05]But if you take a closer look over here, we can clearly see that this request is somewhat different because here it is using something known as NQL, right?

[00:06:14]which is basically a query which is used to you know retrieve analytical data smoothly something like that you know and it is using over here. So this is one example like you see to access users as an administrator there is a different endpoint and to access certain things as a normal user there is a different endpoint right for example accessing notification and so on right however is it possible that maybe through this particular endpoint we can possibly trick it or we can possibly manipulate it to show the data of this particular endpoint. It could be possible you know and to understand that what I simply did is I simply first thing which I did was simply removing this my notification from here and just adding users over here. Why users you say you may say because I I have seen that in the columns they are fetching a column uh columns user right. So maybe the NQL is having access to users column as well but the application is not sending it like that. So let's try to do that. So we'll go back to three. Okay. And right now what we'll try to do is we'll try to simply go ahead and click on send because we already set the users here.

[00:07:23]Click on send. And as you can see we were successfully able to retrieve the user data even though we are not supposed to access it. Right? So what I try to did over here is I try to first understand how many endpoints are there which is actually responsible for retrieving the data. Then I try to understand that whether there's a possibility that we might retrieve data from uh some of the endpoints like a different data not the data which is uh actually doing or actually fetching right and then I tried to manipulate that using this NQL and I was able to do that successfully without any issues.

[00:07:58]Not only that in in the actual application there was some u functionalities some parameters additional parameters like order by and something okay which was retrieving parts of the JSON data for example let me just show you what I mean ID name email something like that so it had something like that in the NQL okay what I try to did over there is I just removed everything okay and I put an asterk over And the moment I did that, I was not able to only just get the user data but also data which is including credentials, right? Encrypted credentials. So that was actually a very sensitive vulnerability because then we can as a normal user retrieve all the users details and that particular vulnerability was affecting the whole application because now I cannot only just access users, I can access API keys and all sort of things, right? So this is how you need to think when are actually doing some kind of pentest or basically when you are testing for authorization issues. Right now this might not be the case in your functionalities or your application. But the main takeaway from this video is not to replicate this finding but to understand what we did over here which led us to this particular finding. I hope you guys have understood that. If you have any issues, if you have any doubts, feel free to let me know your doubts or issues in the comment section.

[00:09:18]And now with that being said, keep learning, keep hacking, and thank you so much for watching this