0

I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a password related to a username is stored in the server in a folder with the following path:

/userdata/passwords/<username>

with credentials that will log me into the system, without knowing any legitimate usernames or passwords?

Furthermore, in the question it's specified that the login system is installed on a computer running an OS, and that this operating system is known to have a file with its version (in this case, 1.0.3) in /system/version.txt.

Honestly, I do not know how this last thing can be related to the question, but I hope that someone can help me to understand what could be the right answer and if and how this thing about the system version is related to the answer.

Here is the screenshot of the question of the online test I'm doing:

enter image description here

Improve this question
15
  • This question boils down to "can you please hack this system for me?" and unfortunately for you that is not why we are here. This question will most likely be closed soon. If you had a clear, specific question we would be happy to help, but as-is this question is too broad and off topic.
    – Conor Mancone
    Jul 3, 2020 at 10:24
  • I do not want anything to be hacked, it's a specific question of a test I'm doing for a lesson of Internet Security course! And this is the first question of the test, as it's related to design vulnerabilities. Btw what I'd like to know is how can i embed the password local path in the credentials and which credentials I should use in order to get access to a system where both usernames and passwords are not known. Beyond that I'd like to have some clarifications wether the file containing OS version can be related to it or not.
    – Dodoytis
    Jul 3, 2020 at 10:30
  • To clarify, the other issue is that there simply aren't nearly enough details to answer this. The questions you are asking are very specific to the application. There is no generic "this is how to override the password local path in the credentials" answer. In fact, that question hardly makes sense.
    – Conor Mancone
    Jul 3, 2020 at 10:38
  • To try to help you understand, your statement at the beginning that "this magic string let's you log in on old services" is completely false. That is a common SQLi payload but would only work on specific services using specific software in a specific (and incorrect) way. Perhaps this misconception leads you to believe that someone here can give you a string that will let you in? Fortunately it just doesn't work like that
    – Conor Mancone
    Jul 3, 2020 at 10:41
  • 2
    Further, there was really no way to answer your question as originally stated. Now with the actual question at hand it is more answerable (although it is not a very good question, and homework/test questions typically get closed here too). However I can get you moving tin the right direction. You're interested in a directory traversal attack and you want to consider this perspective: you want the username to cause the auth system to read a file with contents which you know (which will be the password to use)
    – Conor Mancone
    Jul 3, 2020 at 18:44

1 Answer 1

Reset to default
1

Judging from the information that you have been provided with, the question relates to LFI (local file inclusion).
Apparently the credentails are stored on the filesystem (/userdata/passwords/).

The question seems to be unrelated to the topic that you have been researching, which is SQL injection. The latter would only be an option if the credentials were stored in a DB, which is obviously not the case.

In order to proceed, I'd recommend you to gather all the information that you can get from your question, and research LFI.
Once you have found the LFI vulnerability, read /system/version.txt (as part of your enumeration, this might give you more insight into further attack vectors) and try to read /userdata/passwords/ (or bruteforce files within that folder) and you'll have a chance to get user credentials.

Improve this answer
2
  • thanks for your help, i'm sorry if I tagged it in the wrong way. I read soemthing about LFI, and what I realized is that for example instead of writing something like: example-site.com/?module=contact.php, I could write example-site.com/?module=/userdata/passwords, and get the list of passwords... but the question is, if I'm in front of a module that asks me for a username and a password, how can I embed these paths in the credentials in a way that using such credentials I can access the reserved area?
    – Dodoytis
    Jul 3, 2020 at 10:06
  • I'd suggest that you have a look at the html source of the page. There, find all input tags within the form (even the hidden ones). Use their name and value attributes for potential LFI attacks. For example, if you have the input attribute names username, password and language, each of these will be a candidate for LFI.
    – lab9
    Jul 3, 2020 at 10:26

Not the answer you're looking for? Browse other questions tagged .