OWASP Security Shepherd Project - Session Management Challenge 3 (Session Management Challenge)

Challenge

Solution

    The same as Challenge 2, our task is to login as admin. As always, let's try to use our favorite string 'or'1'='1 with User Name: admin to see what response we could get.


     OK... We now know that there is a username admin, but this form isn't vulnerable to simple SQLi and we don't get further information. Next, let's see what is in the user functions and what kind of user privileges we are granted.


    I input the password as 12345678. (if you input a short password, there will be an alert as password too short. ) and open my BurpSuite to see the HTTP packets.


    It seems that the cookie current is suspicious. Also, after we forward this request, the result is only "Password change request success". We still don't know whose password is changed successfully.

     Let's also check the response of the request to see if there is any further information.

    
    Well... This don't provide us any hint... We could only go back to the cookie current and see if we could get something interesting with Decoder.


    Great! Now, we know that we have user privilege as guest12 and the cookie current is encode as base64 twice.
    Let's login as guest12 with the password 12345678.

    OK, we successfully login as guest12, but there is nothing we can do.
    That's see if we could leverage the password reset feature by changing the cookie current to reset password of admin.
    To begin with, let's encode admin with base64 twice. (admin -> YWRtaW4= -> WVdSdGFXND0=) Then, let's reset password to 12345678 and change the current to be WVdSdGFXND0=.


     Finally, let's login as admin with credential admin/12345678!

    Gotcha!!