Altoro Mutual Walkthrough

Altoro Mutual is a deliberately vulnerable web banking application created originally by IBM Security AppScan (now associated with HCL). It is designed specifically for learning and demonstrating web application security vulnerabilities

The application can be accesed on http://demo.testfire.net/ or you can use docker to deploy it following the instruction on https://github.com/jrocia/AltoroMutual-Dockerfile

Scope

Url: http://demo.testfire.net/* Credentials: jsmith:demo1234

Recon

The vulnerabilities in a web application usually reside in interactions between the client-side and the server-side, so our first objective is to map the surface that we can touch in the app. Before using gobuster to enumerate files and directories it'is good to navigate the application, check the technologies it uses with wappalyzer and inspect the source code.

Two extensions that we should add to our enumeration are .jsp and .htm for example.

• I added some extensions that may appear on the app
• I used the option -k to avoid certificate errors

Besides that web apps have links to themselves so another tool we can use is gospider, it crawls these links and give us a list like below.

• Every URL parameter (?variable_name=) is a point of injection

Now that we know what we're dealing with let's execute some manual test in the pages found.

SQL Injection

After testing some bad chars in the login page we receive SQL errors that indicate that our input is being passed to the back-end without proper sanitization and it's getting inside the SQL query.

• The payload above explores the SQLI and allows me to login as admin

The query was modified to something like:

• The query only validates that the username admin exists

Reflected XSS (Cross-Site Scripting)

Whenever we see an input that returns to the page what was written in it we can think about reflected XSS because it may not sanitize the input and it's possible to inject HTML and javascript. The search bar is a perfect example of this, look at how the word "test" becomes part of the HTML.

So we can try a simple payload like in the search bar.

• This vulnerability can be used to steal cookies from other users using social engineering and a link (depending on the security headers configured)

CSRF (Cross-Site Request Forgery)

This vulnerability occurs when we can make another user send a request just by navigating to the page or clicking a link.

Navigate to the page http://demo.testfire.net/bank/transfer.jsp (you must be authenticated), execute a transfer and check the POST request

You can use AI to generate a simple HTML code to execute this POST automaticaly (remember that browsers take care of the cookies)

After that save this HTML file in a folder and deploy a simple python HTTP server with the command python3 -m http.server 80

After navigating to http://localhost/csrf.html the POST is automaticaly sent and the transfer is executed

Continue …