Lab 16 — FileGate — Authentication Bypass in API Login

hackadvisor

Task: File storage platform with JSON API login endpoint vulnerable to JavaScript type coercion in password comparison. Solution: Send boolean true as password in JSON body to bypass authentication via loose comparison, then access admin config page for the flag.

nodejs javascript authentication_bypass type_coercion express loose_comparison json_api boolean_injection

session_hijackingjavascript_type_coercion_bypassboolean_password_injectionjson_type_abusehoneypot_flag_detection

$ ls tags/ techniques/

nodejs javascript authentication_bypass type_coercion express loose_comparison json_api boolean_injection

session_hijackingjavascript_type_coercion_bypassboolean_password_injectionjson_type_abusehoneypot_flag_detection

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor
[web][Pro]Lab 159 — ShareVault — Path Traversal via Filter Bypass in File Download— hackadvisor
[web][Pro]Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection— hackadvisor
[web][Pro]Lab 12 — NewsGrid — JWT Algorithm Confusion— hackadvisor
[web][Pro]Lab 326 — PulseBoard — NoSQL Injection in Authentication— hackadvisor