Part 2: Hacking Web Apps (Verbose - Hack Smarter)

[BLUF]
This video demonstrates web application penetration testing techniques on the "Verbose" lab, highlighting critical vulnerabilities such as username enumeration, client-side restriction bypasses, and stored Cross-Site Scripting (XSS) in messaging features 1:50. The presenter emphasizes that user input must never be trusted and illustrates how seemingly minor findings can chain into severe account takeovers 7:55.

Key Takeaways:
• Username Enumeration: The registration endpoint lacks rate limiting and returns distinct responses for existing vs. new users, allowing attackers to enumerate valid usernames via mass registration attempts 2:00.
• Client-Side Restriction Bypass: The "update profile" interface disables the username field via HTML attributes, which can be easily bypassed by removing the disabled tag in the browser inspector, allowing users to change their username to an existing one 12:30.
• Missing Reauthentication: The application allows sensitive updates, such as changing passwords or emails, without requiring the user to re-enter their current password or complete MFA, posing a risk if a session is hijacked 16:25.
• Stored XSS in Messages: The messaging system fails to sanitize input, allowing users to inject HTML and JavaScript. Sending a message with a script tag results in execution when viewed, which could be weaponized to steal session cookies or escalate privileges 19:40.
• Real-World Context: The presenter shares a real-world CVE found in "Silver Peas" where stored XSS in a messaging feature was chained with other vulnerabilities to grant immediate administrative access, illustrating the high impact of such flaws 22:40.

Closing Statement:
By treating client-side restrictions as non-existent and rigorously testing input reflection, pentesters can uncover critical paths to account compromise. These findings underscore the necessity of validating user input on the server side and enforcing reauthentication for sensitive actions.

Sources:

• 1:50 Explanation of username enumeration risks during registration.
• 7:55 Discussion on trusting user input and testing reflected data.
• 12:30 Demonstration of bypassing client-side disabled attributes.
• 16:25 Identification of missing reauthentication for sensitive updates.
• 19:40 Proof of Stored XSS vulnerability in the messaging feature.
• 22:40 Case study of a real-world CVE involving stored XSS and privilege escalation.