0x00SEC CTF - Exercise #6
Tags: security, ctf, codenewbie, 0x00sec
Published: 2020-05-04 21:28:25

This weekend I took a dive into 0x00Sec's new bi-monthly CTF. 

Note::: NO, I won't be posting the found flag{}, but I will be posting the methods I used. 

<hr>

- CTF Name: Exercise #6
- Resource: [0x00SEC](https://ctf.0x00sec.org/)
- Difficulty: Easyish
- Number of Flags: 1


### Flag1
- Hint:
 1. Note in the Source Code of 
```<!-- TODO: -->
  <!--  * Test IP whitelisting security -->```

- Acquired By: 
 - Step 1: Is to see the hint in the code and look at the site. There really isn't much to this site.![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/1ju67vegurtlcbc7pley.png)
 - Step 2: So I need to figure out how to get on their whitelist. "IP whitelisting is a security feature often used for limiting and controlling access only to trusted users." (2) So, if we look at the response we can see that it is a "Server: nginx/1.17.5" and "X-Powered-By: PHP/7.3.14" in the header. php 7.3.14 has a whitelist but as I was looking at this and trying different URL parameters I found information about the X-Forwarded-For header and how it "is a de-facto standard header for identifying the originating IP address of a client connecting to a web server" (3) and if I make a request with this in the header then I can change the IP address that is displayed at the rejected one. How to exploit this though?
 - Step 3: I started sending different requests in the X-Forwarded-For header and a lot of the simple things like quotes and slashes did nothing. I did find that a payload of `X-Forwarded-For: "XOR(if(now()=sysdate(),sleep(6),0))OR”` produced an interesting output that was missing information. ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/sqpbixcrp7ktbpm55qms.png)
 - Step 4: Now that I have a point of change I can see what else I can do. I did notice that there was no sleeping so this isn't going to work, but what will happen if I change this to something else? It seems like maybe it wants a few inputs that maybe I can leverage. To do this I take a while and over think it. 

Originally, I was assuming that this was something more complicated as I was not getting anything back. I thought that I was working with some blind injection but after 2 hours I realized I just needed to try a few local IP addresses.  I did Fuzz a few of the local 192.x.x.x ip range but forgot about the 127.x.x.x range. Eh. Once I tried a "127.0.0.1" I got access to the flag. ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/8fikpw20ujp7dezp906p.png)







### Learned
This CTF taught me about a common security misconfiguration, header spoofing, and that there are a lot of other ways that this header misconfiguration can be used to exploit a system.
I find it interesting that this header could be used to exploit a database if the database is logging it. I did not find out if it can be used if the host is not doing anything with it but that will be an interesting new research point for me.









<hr>

Happy Hacking
![](https://media.giphy.com/media/l3vRmVv5P01I5NDAA/giphy.gif)

### Resources
1. https://ctf.0x00sec.org/
2. https://help.gooddata.com/doc/en/building-on-gooddata-platform/gooddata-architecture/ip-whitelisting
3. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For


###### Please Note that I am still learning. If something that I have stated is incorrect please let me know. I would love to learn more about what I may not understand fully.