Implementing Advanced Topic Attacks

This chapter covers intermediate to advanced topics such as working with XML External Entity (XXE) injection, JSON Web Token (JWT) attacks, Server-Side Request Forgery (SSRF), Cross-Origin Resource Sharing (CORS) findings, and Java deserialization attacks, as well as testing GraphQL in Burp Suite. We’ll learn how to use Burp Suite and Burp Suite extensions to assist in making each of these types of test easier.

In this chapter, we will cover the following recipes:

• Performing XXE attacks
• Working with JWT
• Using Burp Suite Collaborator to determine SSRF
• Testing CORS
• Performing Java deserialization attacks
• Hacking GraphQL with Burp Suite

Technical requirements

To complete the recipes in this chapter, you will need the following:

• A PortSwigger account (https://portswigger.net/)
• PortSwigger Web Security Academy Labs (https://portswigger.net/web-security/all-labs) access, which requires a PortSwigger account
• Burp Suite Proxy Community or Professional (https://portswigger.net/burp/)

Performing XXE attacks

XXE is a vulnerability that targets applications parsing XML. Attackers can manipulate the XML input with arbitrary commands and send those commands as external entity references within the XML structure. The XML is then executed by a weakly configured parser, giving the attacker the requested resource.

Getting ready

Log in to your PortSwigger account. We will be using a PortSwigger lab – Lab: Exploiting XXE using external entities to retrieve files (https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-retrieve-files) – to exploit an XML parser vulnerability in our target application.

How to do it...

1. Log in, go to Lab: Exploiting XXE using external entities to retrieve files, and click the Access the lab button to start your instance.

Figure 11.1 – Lab lesson

2. After your instance of the lab loads, use the Burp Suite browser to capture your traffic. Click around the site and...

Working with JWTs

As more sites provide client API access, JWTs are commonly used for authentication. These tokens hold identity and claim information tied to the resources the user is granted access to on the target site. Web-penetration testers need to read these tokens and determine their strength. Fortunately, there are some handy plugins that make working with JWTs inside Burp Suite much easier. We will learn about these plugins in this recipe.

Getting ready

Log in to your PortSwigger account. We will be using Lab: JWT authentication bypass via flawed signature verification (https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-flawed-signature-verification) and the JWT Editor extension to exploit a signature vulnerability in our target application.

How to do it...

1. Switch to Burp Suite Extensions | BApp Store and install the JWT Editor plugin:

Figure 11.7 – The JWT Editor extension

2. After you install...

Using Burp Suite Collaborator to determine SSRF

SSRF is a vulnerability that allows an attacker to force applications to make unauthorized requests on the attacker’s behalf. These requests can be as simple as DNS queries or as maniacal as commands from an attacker-controlled server.

In this recipe, we will use Burp Suite Collaborator to check open ports available for SSRF requests, and then we will use Burp Intruder to determine whether the application will perform DNS queries to the public Burp Suite Collaborator server through an SSRF vulnerability.

Getting ready

Log in to your PortSwigger account. Using PortSwigger Lab: Blind SSRF with out-of-band detection (https://portswigger.net/web-security/ssrf/blind/lab-out-of-band-detection), we will see how to use Burp Suite Collaborator to identify an SSRF vulnerability in our target application.

How to do it...

1. Switch to the Burp Suite Collaborator tab. Click the Get started button:

...

Testing CORS

An application implementing HTML5 Cross-Origin Resource Sharing (CORS) means the application will share browser information with another domain that resides at a different origin. By design, browser protections prevent external scripts from accessing information in the browser. This protection is known as Same-Origin Policy (SOP). However, CORS is a means of bypassing SOP permissively. If an application wants to share browser information with a completely different domain, it may do so with properly configured CORS headers.

Web-penetration testers must ensure applications that handle AJAX calls (for example, HTML5) do not have misconfigured CORS headers. Let’s see how Burp Suite can help us identify such misconfigurations.

Getting ready

Log in to your PortSwigger account. Using Lab: CORS vulnerability with basic origin reflection (https://portswigger.net/web-security/cors/lab-basic-origin-reflection-attack), we will see how to identify a CORS vulnerability...

Performing Java deserialization attacks

Serialization is a mechanism provided in various languages that allows the saving of an object’s state in binary format. It is used for speed and obfuscation. The turning of an object back from binary into an object is deserialization. In cases where user input is used within an object and that object is later serialized, it creates an attack vector for arbitrary code injection and possible remote code execution. We will look at a Burp Suite extension that will assist web-penetration testers in assessing applications for Java deserialization vulnerabilities.

Getting ready

Login to your PortSwigger account. Using Lab: Exploiting Java deserialization with Apache Commons (https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-java-deserialization-with-apache-commons) and a hand-crafted serialized code snippet, we will demonstrate how to use the Java Deserialization Scanner to assist in performing...

Hacking GraphQL using Burp Suite

GraphQL is a very commonly used API query language. The main difference between using REST APIs and GraphQL is the structure of the call. REST API calls require multiple calls to accomplish a task, whereas GraphQL makes a single call containing the entire schema structure. The GraphQL parser determines which components of the schema require lookups or changes. In this recipe, we will learn how to leverage a Burp Suite extension called GraphQL Raider to read, mutate, and attack GraphQL schemas.

Getting ready

The GraphQL Raider extension can be found in BApp Store. We will download and install the extension within our Burp Suite instance. Then, we’ll see how to use the extension against GraphQL endpoints.

How to do it...

1. Inside Burp Suite Extensions | BApp Store, select GraphQL Raider and click the Install button.

Figure 11.62 – The GraphQL Raider extension

2. We will use the free GraphQL...