Mostafa Ashraf

1-Web_PenTesting
- Basics
- Vulnerabilities
  - CSRF
  - IDOR
  - Insecure Deserlization
  - OPEN_REDIRECT
  - SQLI
  - SSRF
  - XSS
  - XXE
2-Network_PenTesting
- Basics-1
- Basics-2
3-API_PenTesting
4-Machines
5-Labs
- BePractical
  - Lab1
  - Lab2
  - Lab3
  - Lab4
  - Lab6
- RootMe
  - Sqli_Numeric
  - Sqli_Routed
6-Bug_Bounty
Home

Contact

Copyright © 2024 | Yankos

Home > 5-Labs > BePractical

Now Loading ...

BePractical

Account TakeOver Lab6
Description As usual, try logging in with admin@bepractical.tech. sign-up first register new account and login nothing new Go back and let’s check the reset password function. But this time, there is nothing vulnerable in the reset password function, so what should I do now? I decided to check the signup page, so I went to my notes in Notion about this and found this tip if the weebsite has no email verification when sign up try to regeister using existing email by adding \n at the end example {"email":"mostafa.nada1221@gmail.com"} | {"email":"mostafa.nada1221@gmail.com\n"} it could sign you into someone's account/overwrite his account Register two accounts But here, it worked for me with the same email. Let’s thread the steps: Created the first account with these credentials email: mostafa123 (as shown in the above photo). Created another account with the same email but with a different password email: 123456 When I went back to log in with the second account, it logged me into the first account with the password mostafa123. So, Let’s go to signup page and register a new account with admin email admin@bepractical.tech:123456 Login as admin Go back to the login, then enter these credentials. It will log you into the admin account. Admin account …. Hacked gg
5-Labs · 2024-06-20
Account TakeOver Lab4
Description As usual, try logging in with admin@bepractical.tech. first register new account and login nothing new. So, let’s check reset password function Reset Password type the email and click send ok now check the email to see the otp But this time, there is a reset link instead of an OTP like in previous labs. So, let’s copy the link to check it Crack The Hash I noticed the term Secret_key followed by a value. I think this is some kind of hash. At first, I considered cracking this hash on the CrackStation website, but I didn’t get the value. Since it’s 32-bit, I thought it might be MD5. To be sure, I took this value to a hash analyzer, and yes, it’s MD5. I think this hash is something related to the user. So, we can try various strings like name, username, email address, phone number, password, etc. By trying the email address used to log in, I got a match We now go back to the Forgot Password functionality, type in the admin account email, and click send “So now, let’s get the hash for the admin account email address we are trying to take over.” let’s take the admin hash as secret_key then copy the link and paste it in firefox Admin account …. Hacked gg
5-Labs · 2024-06-20
Account TakeOver Lab3
Description As usual, try logging in with admin@bepractical.tech. Starting from the login page, we can sign in as in Lab 2, so I created a new account. Then, I played around with BurpSuite, trying various ideas learned from Lab 1 and Lab 2, but with no success. Let’s go directly to the reset password function. Reset Password Turn on interception and click send to see the request. Notice the format used is JSON , while hunting take these notes when reset password GET /passwordreset #Double parameter - email=victim@xyz.tld&email=hacker@xyz.tld - email=victim@xyz.tld,email=hacker@xyz.tld - email=victim@xyz.tld&bcc:hacker@xyz.tld - email=victim@xyz.tld%0a%0dcc:=hacker@xyz.tld - email=victim@xyz.tld,hacker@xyz.tld - email=victim@xyz.tld%20hacker@xyz.tld - email=victim@xyz.tld|hacker@xyz.tld - {"email":["victim@xyz.tld","hacker@xyz.tld"]} The last one worked for me by entering both emails like this. { "email":["admin@practical.tech", "730bbbfd32@emailcbox.pro" ] } press forward to see the response. it’s a 200 ok now go to firefox Admin account …. Hacked gg
5-Labs · 2024-06-20
Account TakeOver Lab2
Description In this lab, they want me to take over the admin account but didn’t provide any credentials for logging in Sign up there is a singup button ,I am using a temporary email address mohmal.com Let’s register an account . Login After creating an account, let’s go back to the login page to enter the account that we created. Okay, nice. What should I do now? I tried response manipulation like in the first lab, but it didn’t work here. Reset Password So,let’s test the reset password function I entered the temporary email address to receive the OTP on it and then clicked send (BurpSuite fired in the background). The OTP has been sent, so I checked my email to get it So, I entered the code and intercepted the request with BurpSuite. change the emailforOtp parameter to admin@bepractical.tech and forward the request now go to firefox Admin account …. Hacked gg
5-Labs · 2024-06-20
Account TakeOver Lab1
Description bepractical.tech. It’s a platform that offers various challenges and labs for cybersecurity enthusiasts and bug hunters to practice their skills. The site provides hands-on experience with real-world scenarios, allowing users to test and improve their abilities in finding and exploiting vulnerabilities. — Login First we will login with the credentials given john@bepractical.tech:john@123 As you can see, we were logged in as John. Now, let’s go back to the login page, intercept the same request with BurpSuite, and send it to the Repeater. When we logged in with the given credentials, the response was MQ==, which is Base64 for 1. If we change the email parameter to admin@bepractical.tech, the response will be ZmFsc2U=, which means false. Response Manipulation Immediately, I thought about response manipulation. So, I went back and intercepted the request. I changed the email to admin@bepractical.tech, right-clicked, selected Do intercept, chose response to this request, and then forwarded it. After that, I changed ZmFsc2U= to MQ== and forwarded the request again Now, turn intercept off, then go back to Firefox. GG lab is solved.
5-Labs · 2024-06-20

Touch background to close