OWASP Security Shepherd Project - CSRF 7 (CSRF Challenge)

Challenge

Solution

     This challenge provides a link for us to retrieve the CSRF token, so let's try to capture the HTTP request of it and see if there is any clues.




     It seems that the link will return csrfToken corresponding to the userId provided.
     Now, our challenge would be how could we know the userId of other users. If the userId parameter passed to the server allows SQL wild card characters? (Ref: SQL Wildcard)
     Let's try '%' character first!


    Unfortunately, no matter 1 '%', 10 '%'s, 20 '%'s, or 40'%'s are inputted, we always get "An Error Occurred!...".
    As a result, we need to try '_' character instead.
 

    Yes! With 40 '_'s we could get a reponse!
    However, we don't know this csrfToken is belong to which user. Maybe it would belong to current user? Let's replace the first '_' character to any number other than 6(because current user with first digit of userId = 6).


    I try to use 3 as first digit and it turns out that there is no user with userId first digit = 3.
(I check another user's userId by login as another user and notice that the first two digit of it is 6c, so we could do _c______________________________________ to get the csrfToken! If we are not cheating, in the worst case we would need to try (10+26-1)*40 -1 times.) (10 for [0-9], 26 for [a-z], former -1 because we should try different value than current user, *40 for 40 digit, latter -1 for the two userId should never be identical.)


    This makes our form to be:
<form name="evilForm" action="https://192.168.1.5/user/csrfchallengeseven/plusplus" method="POST">
    <input type="hidden" name="userId" value="637e8d2e65542fe82fe6da3b0356bc0865b0b791" />
    <input type="hidden" name="csrfToken" value="-86138519888349041734643336257165977572"/>
    <input type="submit"/>
</form>
<script> document.evilForm.submit(); </script>   

    Now, We can just wait until the corresponding user click this challenge.

p.s. Please note the csrfToken refresh every time the user login or click at the retrieval link. As a result, when play with this challenge on your own. You must login as second user and then resend the request of retrieve csrfToken with '_'s via repeater of BurpSuite to simulate the real situation : ) 

Reference

SQL Wildcard Characters - W3Schools:
https://www.w3schools.com/sql/sql_wildcards.asp