How to Discover Hidden HTTP Parameters to Find Weaknesses in Web Apps « Null Byte :: WonderHowTo

Hackingweb applicationscan sometimes be challenging due to the sheer amount of moving parts they possess. At the core of these apps are HTTP requests and parameters, but these things are often concealed from the user, due to security reasons, convenience, or both. However, a tool called Arjun can be used to discover hidden HTTP parameters in web apps.HTTP parameters, sometimes called query strings, are the part of a URL that takes user input and relays it to theweb app. A typical example will look something like:http://example.com/name?id=1When theserverreceives therequest, it will process the query and return a name with the ID of 1. Sometimes, such as inweb forms, multiple fields will be submitted as the query string. Typically, it will look something like:http://example.com/form?field1=v1&field2=v2In certain cases, some of these parameters might be hidden from view. For example, if a hidden parameter ofadminwas set toTrue, there might be different functionality than that of aregular user.Arjunis a command-line tool that finds hidden HTTP parameters using awordlistof parameter names. It features multi-threading, rate limit handling, and allows custom headers to be added to requests. It also supports GET, POST, and JSON methods, making it a valuable resource forprobing web applications.Download & SetupWe will useMetasploitable 2as the target andKali Linuxas our local machine, but you can use whatever you're comfortable with when following along.The first thing we need to do is download Arjun from GitHub. We can easily clone a copy of the repository using thegit clonecommand:~# git clone https://github.com/s0md3v/Arjun

Cloning into 'Arjun'...
remote: Enumerating objects: 226, done.
remote: Total 226 (delta 0), reused 0 (delta 0), pack-reused 226
Receiving objects: 100% (226/226), 159.03 KiB | 1024.00 KiB/s, done.
Resolving deltas: 100% (104/104), done.Now justchange into the new directoryusingcd:~# cd Arjun/And we can list the contents with thelscommand:~/Arjun# ls

arjun.py  CHANGELOG.md  core  db  LICENSE  README.mdArjun needsPythonversion 3.4 or higher to work properly, and we can see if it's installed on our system using thewhichcommand:~/Arjun# which python3

/usr/bin/python3And we can check the version number with the-Vswitch:~/Arjun# python3 -V

Python 3.7.5rc1If Python 3.4 or above isn't on our system, we can install it through the package manager:~/Arjun# apt-get install python3That should be all we need to get started.Arjun in ActionIt's always a good idea to check the help menu when confronted with a new tool. Use the-hflag to view Arjun's help and optional arguments:~/Arjun# python3 arjun.py -h
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

usage: arjun.py [-h] [-u URL] [-o OUTPUT_FILE] [-d DELAY] [-t THREADS]
                [-f WORDLIST] [--urls URL_FILE] [--get] [--post]
                [--headers [HEADERS]] [--json] [--stable] [--include INCLUDE]

optional arguments:
  -h, --help           show this help message and exit
  -u URL               target url
  -o OUTPUT_FILE       path for the output file
  -d DELAY             request delay
  -t THREADS           number of threads
  -f WORDLIST          wordlist path
  --urls URL_FILE      file containing target urls
  --get                use get method
  --post               use post method
  --headers [HEADERS]  add headers
  --json               treat post data as json
  --stable             prefer stability over speed
  --include INCLUDE    include this data in every requestThe most basic way to run the tool is by supplying a valid URL — use the-uflag to do so:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters
[+] Heuristic found a potential post parameter: phpMyAdmin
[!] Prioritizing it
[+] Heuristic found a potential post parameter: db
[!] Prioritizing it
[+] Heuristic found a potential post parameter: table
[!] Prioritizing it
[+] Heuristic found a potential post parameter: lang
[!] Prioritizing it
[+] Heuristic found a potential post parameter: convcharset
[!] Prioritizing it
[+] Heuristic found a potential post parameter: token
[!] Prioritizing it
[+] Heuristic found a potential post parameter: pma_username
[!] Prioritizing it
[+] Heuristic found a potential post parameter: pma_password
[!] Prioritizing it
[+] Heuristic found a potential post parameter: server
[!] Prioritizing it
[~] Performing heuristic level checks
[!] Scan Completed
[+] Valid parameter found: db
[+] Valid parameter found: phpMyAdmin
[+] Valid parameter found: table
[+] Valid parameter found: target
[+] Valid parameter found: GLOBALS
[+] Valid parameter found: pma_usernameWe can see it starts analyzing the page, looking for any potential HTTP parameters that might be hidden. It finds a few valid ones and gives us the results at the bottom.We can also specify which type of request data to use. For example, to search for GET parameters, simply add the--getoption:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ --get
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...To search for POST parameters, use the--postoption:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ --post
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...And to search for JSON parameters, use the--jsonoption:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ --json
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...We can also supply Arjun with a list of multiple URLs to use instead of just a single one. Use the--urlsflag followed by the name of the file containing the list of URLs:~/Arjun# python3 arjun.py --urls urls.txt
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Scanning: http://10.10.0.50/phpMyAdmin/
[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...In the same vein, we can useour own wordlistcontaining custom parameter names instead of the default one Arjun uses. Use the-fflag followed by the name of the custom wordlist:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ -f parameters.txt
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...Arjun allows us to set the number of threads to use as well, the default being two. Use the-tswitch followed by the number of desired threads:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ -t 16
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...We can also set the delay between requests with the-dflag:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ -d 5
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...For particularly tricky targets, we can use the--stableoption, which will set the number of threads to 1 and the delay to a random number of seconds between 6 and 12:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ --stable
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...Arjun makes it easy to save the results in JSON format — just use the-oswitch followed by the name of the output file:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ -o results.json
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters
[+] Heuristic found a potential post parameter: phpMyAdmin
[!] Prioritizing it
[+] Heuristic found a potential post parameter: db
[!] Prioritizing it
[+] Heuristic found a potential post parameter: table
[!] Prioritizing it
[+] Heuristic found a potential post parameter: lang
[!] Prioritizing it
[+] Heuristic found a potential post parameter: convcharset
[!] Prioritizing it
[+] Heuristic found a potential post parameter: token
[!] Prioritizing it
[+] Heuristic found a potential post parameter: pma_username
[!] Prioritizing it
[+] Heuristic found a potential post parameter: pma_password
[!] Prioritizing it
[+] Heuristic found a potential post parameter: server
[!] Prioritizing it
[~] Performing heuristic level checks
[!] Scan Completed
[+] Valid parameter found: GLOBALS
[+] Valid parameter found: db
[+] Valid parameter found: phpMyAdmin
[+] Valid parameter found: table
[+] Valid parameter found: target
[+] Valid parameter found: pma_username
[!] Saving output to JSON file in results.jsonAnother handy feature is the ability to include specific data to be sent with every request. Use the--includeoption with the data string to be sent in quotes:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ --include 'data=test'
    _
   /_| _ '
  (  |/ /(//) v1.6
      _/

[~] Analysing the content of the webpage
[~] Analysing behaviour for a non-existent parameter
[!] Reflections: 0
[!] Response Code: 200
[!] Content Length: 4145
[!] Plain-text Length: 474
[~] Parsing webpage for potential parameters

...We can also use the--headersoption, which will allow us to send header information with the request:~/Arjun# python3 arjun.py -u http://10.10.0.50/phpMyAdmin/ --headersThat will open up atext editor(nano by default), allowing us to paste any headers right in:GNU nano 4.5                                                                                      /tmp/tmptvwpv4kd
Host: EXAMPLE
Accept: TEST
Referer: https://www.google.comThe default editor can be changed in/core/prompt.pyto an editor of choice.Wrapping UpToday, we learned a bit about HTTP parameters and how sometimes they can be hidden from plain view. Arjun is a tool that can be used to expose these hidden parameters, leading to increased visibility of a web app's attack surface. We explored the tool and some of its options, including the ability to use different request methods, custom threading and delay, persistent request data, and more. Arjun is a nice little tool that anyone serious about attacking web applications can benefit from.Recommended Book:Learning HTTP/2: A Practical Guide for BeginnersWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by drd_/Null ByteRelatedHow To:Remove Stock iOS App, Without Jailbreak (iOS 6)How To:Weakness in Boingo Hotspots Can Be Exploited for Free Wi-Fi Access at AirportsHow To:SQL Injection Finding Vulnerable Websites..Hack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteHow To:Break into Router Gateways with PatatorHow To:Lock Your Photos, Videos, Files, & Passwords in a Digital Safe for iOSHow To:Use export plug-ins in ApertureHow To:Discover & Attack Services on Web Apps or Networks with SpartaHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionHack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)How To:Access Deep WebEditor Picks:The Top 10 Secret Resources Hiding in the Tor NetworkNews:Proposition 25News:Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden ServicesNews:Easy Skype iPhone Exploit Exposes Your Phone Book & MoreHow To:Subscribe to Google+ Users with Google ReaderNews:"Desktop, PC, Online Experience, ALL Enhanced Ten-Fold..."News:Links for Gifts and Building RequestsNews:Paradise City Documentary TrailerNews:FarmVille Orchard and Tree Gifting LinksNews:Anonymity, Darknets and Staying Out of Federal Custody, Part One: Deep WebNews:Why do teens do crazy things?News:Nursery Barn ExpansionHow To:10+ Time Saving Menu Bar Applications for MacNews:LA Live on PBS July 31stNews:Oceania Palace - hidden light trickNews:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateCircle Sunday:Anti-Theft Lunch Bags, London Riots Cleanup & Eureka CancelledNews:Hex (hexidecimal) ExplainedNews:Security Flaw in HTC Smartphones Leaks Your Personal Data to Certain Android AppsAtomic Web:The BEST Web Browser for iOS DevicesNews:Invite for CommentsNews:Welcome to the world of Whidbey IslandNews:Version 1.01 FarmVille iPhone App ReleasedNews:Weekly Staff Challenge entryNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and DaggersHow To:Make Minecraft PotionsIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:The Basics Of Website Marketing