Welcome back.
Let's discuss another either example inside of our own SPW, a machine.
So in the previous lecture, we took a look at the Idol challenge where we changed the file that we
want to you to slash ETSI testability.
And that way we displayed the file that we shouldn't have been able to access.
Now let's take a look at the different type of either challenge inside of our B Web application.
Click on that.
And as usual, let's log in with our credentials, which are B and Bug and click on Log In.
We have our current security levels set low and we are going to leave it on low for now.
And let's choose our bug.
So navigate to either challenges which are right here.
And out of these three, we're going to go onto this one which says, Insecure door order tickets click
on Hack.
And it will lead us to this challenge, so it's a simple application, it asks how many movie tickets
would you like to order, 15 euros per ticket.
And here we can type in how many tickets we want to order.
For example, if I want to order 10 of them and click and confirm, it will tell me that I have ordered
10 movie tickets and that the total amount charged from your account is one hundred and fifty euro or
simply 10 times 15 euro per ticket.
OK, let's see whether we can manipulate this and perhaps change the price.
So first thing that we are going to do is we are going to turn on our intercept.
And here let's go with ten tickets.
Once again, our click on Confirm.
And this is the request that we get down here.
We can see all of the parameters that are being submitted with this request.
So we have the ticket quantity equals 10, we have ticket price equals 15, and the action equals to
all.
Now, this is a constant we know that the price of a ticket is 15.
So perhaps with the either vulnerability, we can try to change the price of this ticket.
So instead of 15.
Let's just leave it on one.
Let's make the price to be only one euro and let's see whether this will work if we forward this request,
go back to our page.
Well, here it is.
It worked successfully, reordered 10 movie tickets and the total amount that was charged was ten euro.
So we pretty much ordered 10 tickets for the price of one euro per ticket.
Let's also see how this would look on medium security level.
Let's click on Medium and let's click on set ups.
We still have our intercept turned on.
Let's turn it off and let's go back to page.
And now let's see how our application is acting.
So if we once again specify ten tickets and we click on Confirm.
Well, it doesn't really appear that anything changes from the low security level, which we had previously,
was to get the output.
You ordered 10 movie tickets and the total amount charged is one hundred and fifty euro.
But let's see, are there any differences in the HTP request once we intercepted.
So let's turn on the intercept.
Let's once again try to buy 10 tickets and let's confirm it, and this is our request, you will notice
that we no longer have the ticket price parameter inside of our request.
So how are we going to change the price?
Well, we can take a look at this ticket quantity.
The ticket underscore quantity is a parameter for how many tickets we want to buy.
And we can assume that perhaps there could be a ticket underscore price parameter that could be set
to the price of a single ticket.
So maybe we can try to input it ourselves right here and see whether that would work.
As we can see, these parameters are being separated by this sign.
And let's give it a try.
If we type that sign and then ticket underscore price equals one, let's try to set it to be equal to
one.
Let's see if us injecting the parameter manually will make any changes on the page.
If we forward this go back.
And there it is.
We made this work successfully.
We ordered ten movie tickets for the price of ten euro.
And once again we managed to perform the either vulnerability on medium level.
Now, on a high level, I believe all of these applications actually show the secure code, so I'm not
sure if it's possible in high level, but let's give it a try.
Let's confirm with one ticket and the price for one ticket is 15 euro.
Now, if we intercept that.
Well, we get pretty much the same response as from the previous medium security level, so if we tried
the same thing, ticket price equals to one and we forward this, well, it won't really work.
And this is because high level is usually a secure version of these applications, but we can always
do something like this if we have intercept turned on and we go on confirm.
What we can do is we can try something like this, so let's inject ticket price to be equal to one and
let's change the security level to be equal to zero.
Now, if we forward this.
Well, now we once again changed the price to one, but we cheated a little bit.
We exploited a different parameter inside of our request, which changes the security level.
Nonetheless, this is another example of either challenge.
And in the next lecture, we're going to take a look at a security misconfiguration vulnerability.