Authorization

Url Parameter

You can start accessing information and see the pattern used: /infos/1, /infos/2.

You can access the information using a method similar to the one seen previously.

You cannot just directly access the information, however you can see that you are now able to edit information. You can use this feature to access information from other users just by incrementing the number in the URL.

Adding Extention

Here, most of the code is generated automatically and access to different formats (HTML, JSON) for the same database record, is also done automatically.

For example, by accessing /users/1, you will see a HTML page with the first user's details. However, the scoring key has been masked. You can add /users/1.js or /users/1.json

Fortunately, you should be able to access the JSON representation of this user's details by modifying the URL.

Mass Assignment

When people started building websites with databases to store information, they had to do write a lot of SQL manually. However, some people realized that this was not the best solution and started working on smarter alternatives, building Object-Relational Mapping (ORM) to easily query the database without any SQL knowledge.

For example, in Ruby (using ActiveRecord), you can do things like:

@user = User.find_by_name('pentesterlab')

This will automatically generate and execute the query, then retrieve the result in a User object.

Another really handy usage is to automatically create and update an object from a hash:

@user = User.create(myhash) 
[...]
@user.update_attributes(anotherhash)

Unfortunately, this useful feature comes with a security price.

If a developer did not correctly ensure that attributes of the object @user were protected, an attacker could arbitrarily overwrite any of these attributes. In this section, we will see some common examples of these types of issues: Mass-Assignment.

In this example, you can register a user. The application has two levels of privileges:

• User.

• Admin.

The admin privilege is set using the attribute admin on the object user. If you look closely at the format used by the web application: user[username] and user[password], you should be able to find a way to get admin access. Three methods can be used:

• Modify the page directly using a browser extension.

• Save the page and modify offline to create a page that will send the right payload to the right URL.

• Use a proxy to intercept the legitimate request and add your parameter (the fastest option).

// Example
user[username]=admin&user[password]=admin&submit=Submit

user[username]=admin&user[password]=admin&submit=Submit&user[admin]=true

To set your organisation using mass-assignment.

By convention (can be changed programmatically) when a developer uses ActiveRecord (Ruby-on-Rails' most common data mapper), and a class Organisation has multiple User's, the relation is managed using a field organisation_id inside the User class.

The following code is used in Ruby:

class User < ActiveRecord::Base
  belongs_to :organisation
end

class Organisation < ActiveRecord::Base
  has_many :users
end

You can guess the fact that organisation is used by visiting the organisation page and looking at the URL. You will see that the class is probably named Organisation. And therefore the key in the users table is likely to be organisation_id.