Hackademic Challenge One 1

In our Previous post we talk about hackademic Challenges and how to set it up, if you didnt read that ?, I Highly recomend that you read it here . while now we are going to solve Hackademic Challenge One 1. So in order to start the challenge, we need to click on any hyperlink we found in the challenge column. in this case challenge one,which is Logistic Company in order start.

This is the Description of hackademic Challenge One 1

Our agents (hackers) informed us that there reasonable suspicion that the site of this Logistics Company is a blind for a human organs’ smuggling organization.

This organization attracts its victims through advertisements for jobs with very high salaries. They choose those ones who do not have many relatives, they assassinate them and then sell their organs to very rich clients, at very high prices.

These employees are registered in the secret files of the company as “special clients”!

One of our agents has been hired as by the particular company. Unfortunately, since 01/01/2019 he has gone missing.

We know that our agent is alive, but we cannot contact him. Last time he communicated with us, he mentioned that we could contact him at the e-mail address the company has supplied him with, should there a problem arise.

The problem is that when we last talked to him, he had not a company e-mail address yet, but he told us that his e-mail can be found through the company’s site.

The only thing we remember is that he was hired on Friday the 13th!

You have to find his e-mail address and send it to us by using the central communication panel of the company’s site.
Good luck!!!

Solving Hackademic Challenge one 1

Our duty here is to gain access to the site and find one of Hackademic agent email from the website and send him a message by using the central communication panel of the company’s site. This is the login page of the GREEK LOGISTICS COMPANY.

As a result of we did not have the user name and password of the site we have to try some attack to gain access to the home page. I first view the page source to see if I can find something.

I saw a text with white color HTML tag which i think is the username and password but it’s hidden in white color because the website background is white.

 Now when I look back into the website login page I click Ctrl + A to highlight all the text on the page

The first vulnerability we found here is Source Code Disclosure. Source code intended to be kept server-side can sometimes end up being disclosed to users. Such code may contain sensitive information such as database username and passwords and secret keys, which may help malicious users formulate attacks against the application.

Now According to the scenario above we to send mail to the the agent, so I navigate to a section called mailbox Special Client`s Mailbox which I guess is where the mails a stored, but unfortunately I didn’t see them there.

So now we are going to use a hacking tool called burpsuit it is pre-installed in Kali Linux, but if you are using any Operating system Windows or mac? you can download the community edition for free here

https://portswigger.net/burp/communitydownload

I Try to intercept the traffic from my from home page to the Mailbox. Using my  burpsuite and see what happens between there. to do that? after installing burpsuit open up it and create burpsuite temporary project and navigate to proxy in the menu bar, as shown below.

After that turn up intercept

The open burp suit browser

Then enter the address of the webpage the challenge one main page after putting password and username. in the search bar of your burpsuit chrome browser that you just open as shown below.

if it takes you back to login page enter the user name and password that you just find above

When it takes you to main page go to burp suit and turn interception on

it will take you back to burpsuit with the interception data

Now turn Off the interception, and click on target

In the proxy expand the website directory you can see a gray directory secret_area_ which is probably the directory they store the mails

Now go to your burosuit browser and follow the tree from main page, add secret_area_ in the URL it will take you here.

And then go back to the main page and click on send e-mail

Congratulations you have successfully finished you hackademic Challenge one 1

What we have Learn in Hackademic Challenge one 1

Even though the code and password were obscured by setting the text to white, this still didn’t stop us from gaining entry to the portal. Once I gained access into the secret portal. I see a page Mailbox Special Client which seems empty, but when I intercept the request from the main page I found out a hidden directory and the directory contain two files the first one is gif so I ignore it but the second one is text file and I open it and it’s the one that contains the mails, Opening this file and re-reading the scenario I realize that the email address we wanted was from Jason.  

How to prevent Hackademic Challenge One Vulnerability in Your Website

The first thing to take care of is, do not keep any sensitive information clearly in the source code of a website like username and password, it`s better to use register then login in the site instead of using single login details.           

Other ways to avoid that are: –

• Environment variables: – You can define environment variables per user on your development machine. So, in the code, you just need to know the name of the variable, not its value. This way, your secrets stay out of the code. However, the value of the environment variables is not encrypted and is easily accessible from other applications. Therefore, this solution may be sufficient for development, but not for production.
• ASP.NET Core – User secrets: – In ASP.NET Core, you can set your configuration from different locations: JSON files, XML files, environment variables, or whatever you want. During development, you may need to store sensitive data in these configuration files. To avoid doing that, you can use the Secret Manager. The Secret Manager tool stores sensitive data in a JSON file under %appdata%, so you are sure to not commit them. It works the same as the appsettings.json file at the root of your project. A configuration provider allows us to read these values and merge them with the project configuration files.
• Avoid using passwords: – The best way to avoid storing passwords in the code is to remove the need for passwords. This doesn’t mean it isn’t secure, it just uses another way to authenticate. Setting up a Single Sign-On (SSO) solution like the Windows authentication may help you reduce the number of passwords needed. For instance, you can use the Windows authentication to access a SQL Server database, or internal web services. This way, you do not need to configure anything on your machine. Everything works as soon as you clone the repository and it is secured.