Lab: Exploiting a mass assignment vulnerability
After starting the exercise, log in to the application with the user name wiener and the password peter. You can access the login form by clicking on the link My account.
Enter your username and password in the login form and click on the Log in button.
After successfully logging in, we see our user account within the application. We now go to the shop by clicking on the Home link.
In the shop, we search for the product Lightweight ‘l33t’ Leather Jacket. This should usually be the first product in the shop. We click on the View details button to go to the product description.
If we scroll down in the product description, we see the Add to cart button. We click this to add the product to our shopping cart.
We get to the shopping basket by clicking on the shopping basket symbol.
In the shopping cart, click on the Place order button to complete the order.
We receive the message ‘Not enough store credit for this purchase’. This means that we cannot afford this product.
Now let's open the HTTP history tab in Burp Proxy and search for the two requests GET /api/checkout and POST /api/checkout. If we take a closer look at these two requests, we can see that the response to the GET request (GET /api/checkout) is the body of the POST request (POST /api/checkout). The two requests and their responses are listed below.
Request: GET /api/checkout
Response: GET /api/checkout
Request: POST /api/checkout
Response: POST /api/checkout
We send the request POST /api/checkout to the Burp Repeater. To do this, we move the mouse over the request and press the right mouse button. In the context menu, we select the option Send to Repeater.
In the repeater, we add the parameter chosen_discount to our request. It should now look like this (lines 21 and 22).
When we send this request, we receive the same message as before. So there seems to be no problem with the chosen_discount parameter in our request.
If we change the value of the parameter chosen_discount to x and send the request, we receive the response HTTP/2 400 Bad Request. This tells us that x is not a valid character (line 9).
Now we enter 100 as the value for the parameter chosen_discount, because we want to receive the product Lightweight ‘l33t’ Leather Jacket for free. The request should now look like this.
We now send the request and have successfully completed the exercise.
Video solution
Last updated