OWASP Security Shepherd Project - Session Management Challenge 4 (Session Management Challenge)

Challenge

Solution

    This time we are going to trick the web application to believe we're admin when clicking the Admin Only Button. It's time to bring out our best friend as usual - Mr.BurpSuite. Let's click the button directly and check the request/response in BurpSuite.


    The response result is

 
    From challenge 1 & challenge 3, we know that checksum is base64 encoded "userRole=user" and current is twice base64 encoded "guest12". Let's change it to dXNlclJvbGU9YWRtaW4= (base64 encoded "userRole=admin") and WVdSdGFXND0= (twice base64 encoded "admin") and see if we could pass the challenge.


    No luck... Let's calm down and rethink the whole process... It seems that the userId and the SubSessionID is suspicious! Maybe userId 000..01 is not a admin, so that we are caught. We could try to use Intruder of BurpSuite to automatically increase the userId to see if we could pass this. (About the usage of Intruder, you could refer to Poor Data Validation 2)
    Try using Intruder on userId for 000..001 to 000..999, but not getting any useful information.


    Start to check SubSessionID and we could find that the SubSessionID is actually the userId with twice base64 encoded.


    Although the best idea is to use Intruder with 2 payloads(userId, SubSessionID), unfortunately we could only use 1 payload with BurpSuite Community Edition. Let's try to use Intruder on SubSessionID this time.


      Now, we can wait for the Intruder to try possible payloads and check the length of response to see if there is any interesting thing we could find.


    Great! It seems that with Request#21(using 0000000000000021 twice base64 encoded as payload), we could login successfully as admin! This complete the challenge : -)
p.s. It is quite lucky that the application only check SubSessionID field this time. We will need to use other stronger tool in the future if there is a need to manipulate multiple payloads. (Maybe commercial edition of BurpSuite or OWASP ZAP?)

Reference

BurpSuite - Payload Types
https://portswigger.net/burp/help/intruder_payloads_types