As a Developer, I did my first Web Penetration Testing
Tags: php, api, pentester, cyberattack
Published: 2019-10-15 11:21:20

---
title: As a Developer, I did my first Web Penetration Testing
published: true
cover_image : https://thepracticaldev.s3.amazonaws.com/i/2in5gj41p9mlqz1nbczi.jpg
description: Simulate a cyber attack to find vulnerabilities in your web apps.
tags: php, api, pentester, cyberattack
---

Hello Dev peeps,

I was on Facebook, scrolling on my News Feed and I came across an Ads regarding an online music web application that was just released. So I decided to visit the website and explored it. There were some free tracks & some premium tracks.

While exploring, something came across my mind, "**Is this site really secured ?**". This is where my journey started..

## A journey of a thousand miles begins with a single step

I did not know exactly how to proceed but the first step was to examine the website through ***Google Chrome - DevTools***.

So I click on a random premium song to see what is going on in the **Network** tab in the DevTools.

![Music App URL](https://thepracticaldev.s3.amazonaws.com/i/bmlo4wknoo6ocehzim6l.JPG)
<figcaption>Music App URL</figcaption>

When clicking on the play icon, I was checking the **Network** and I found 2 interesting URL, 

![Network tab in DevTools](https://thepracticaldev.s3.amazonaws.com/i/pj8f7ylbuk3y37qdg4nr.JPG)
<figcaption>Network tab in DevTools</figcaption>

- *get-song-info?hash_id=40f65e3dad2b5d1....*
- *get-track.php?id=I6OTPf15O79FuKg&hash=b28ee5...*

Eventually I clicked on both URL, The first one redirect me to a JSON formatted webpage where all the data of the particular song were displayed.

![JSON data](https://thepracticaldev.s3.amazonaws.com/i/nwqewchia5ty39yj9pxm.JPG)
<figcaption>JSON data</figcaption>

Whereas the second URL show only **Access denied**

![Access denied](https://thepracticaldev.s3.amazonaws.com/i/1fx5ouohpm5mh952gfv0.JPG)
<figcaption>Access denied</figcaption>


After spending sometime analyzing the situation, I said let's figure out a way to download one premium song without buying it.

My guess was that the Music App Developer use a call to action that trigger a PHP script via an API, when a user click the play icon and this script was returning a "***content-type: audio/mpeg***". 

In other words, the URL that was showing *Access denied* web page cannot be called directly by copying & pasting the URL in your web browser. It should be called by an API.

I used [API TESTER](https://apitester.com/) to simulate the test and as expected..

![It did not work !](https://thepracticaldev.s3.amazonaws.com/i/rasid2qajds7voryawzw.gif)
<figcaption>Bad news ! It did not work !</figcaption>


I noticed that in the **Network** tab in the DevTools, there were other parameters sent as **Request Header**.

![Request Header](https://thepracticaldev.s3.amazonaws.com/i/1vru4l0gzeou1s0wr1jr.JPG)
<figcaption>Request Header</figcaption>

After many trials and errors, I was able to simulate it by adding some of those **Request Header**

![API TESTER - simulation](https://thepracticaldev.s3.amazonaws.com/i/y1owr9qe7sq2lpkfh2jz.JPG)
<figcaption>API TESTER - simulation</figcaption>

And :boom:, I got the Response.. BUT in an unexpected format :confounded:

![Response Body](https://thepracticaldev.s3.amazonaws.com/i/qomwetddbw055gs6g2zw.JPG)
<figcaption>Response Body</figcaption>


But it was not a big deal, I clicked on the *eye* icon on top-right and the premium song open in another tab in my browser and I was able to listen to it freely without having to buy it.

![Congratulation](https://thepracticaldev.s3.amazonaws.com/i/s3vn1r0imm6zzkgks02q.gif)


**_For your info, I got into contact with the Owner of the Online Music Application to report the issue. I don't know if they fixed it yet_**