Reveal ALL Solution

Worksheet 10: Web and Browser

Worksheets are self-guided activities that reinforce lectures. They are not graded for accuracy, only for completion. Worksheets are due by the start of the next lecture via Blackboard link as a single PDF document. Be sure to properly label each question.

For the following URL, explain each part
```
https://cs.engineering.gwu.edu/adam-aviv
```
Reveal Solution
- https : retrieval protocol
- cs : unqualified hostname
- cs.engineering : subdomain
- gwu.edu : second-level domain
- /adam-aviv : file on host macine

Modify the above URL such that you make a HTTP (not HTTPS) request on port 8888 with the query parameters foo=bar and baz=10

Reveal Solution
```
http://cs.engineering.gwu.edu:8888/adam-aviv?foo=bar&baz=10
```

There is no way we can do a whole course on Javascript within the confines of this class, but fortunately, Javascript (JS) is relatively easy to learn and use. To make sure you have some background, go through the W3 school tutorial on JS through JS Strings. There are lots of examples and built in places you can test your code.

To show you understand a little bit of javascript, add some code to the sample html page below that switches the text back and from “RED” to “BLUE” every time the button is pressed and changes the color:
```
<span id="color" style="color:red">RED</span>
<button id="mybutton">Click Me</button>
```
Like below.

RED

Reveal Solution
```
<script>
    function colorswap(){
        let elem = document.getElementById('color');
        if(elem.innerHTML === "RED"){
            elem.innerHTML = "BLUE";
            elem.style.color="blue";
        }else{
            elem.innerHTML = "RED";
            elem.style.color="red";
        }
    }    
</script>


<span id="color" style="color:red">RED</span>
<button id="mybutton" onclick="colorswap()">Click Me</button>
```
FWIW – you could have looked at the source of this page to get this answer 🙃

What is the purpose of the Host: header in an HTTP request and why is it needed?

Reveal Solution

The Host: header indicates which domain or host you are asking the webserver for. The reason why it is needed is that webservers can host multiple domains on the same hosting or act like a proxy/gateway sending requests to the appropriate webserver based on the Host: header.

The DOM (or document object model) is how a website represents a webpage and what you reference using the object variable document in JS. If you wanted to change/redirect the current page using javascript, what property of the DOM would you change?

Reveal Solution

You would reassign window.location.href, the URL of the document, which would cause the page to reload.

What are cookies (not the kind you eat) and what purpose do they serve?

Reveal Solution

HTTP is a stateless protocol. It doesn’t include any mechanism for a client to indicate past interactions. Every request is as if it was new. As a result, servers who want to maintain state, such as associate information with a given client, need to ask the browser to store and send some form of identifying information in each request. That’s a cookie.

Read this article on third-party cookies on Wikipedia. In your own words, explain how third-party cookies can be used for tracking.

Reveal Solution

Web pages are made up of many requests to many pages, not just the main domain you are visiting. If you visit a page with an embedded request (such as with advertisers), then advertising domain could set a cookie with a unique identifier. Your browser, every time it goes to a webpage also sends the cookies associated with that webpage, including for embedded requests. And more so, it sends the referrer domain, which would be the page you visited. So if another website has the same advertiser, the advertiser would learn you went to the other page because of the cookie with a unique identifier and what page you visited – effectively tracking you around the web.

What is cookie theft, how could it occur, and how can it be used to perform unauthorized access?

Reveal Solution

When you log into a website, the server typically issues you a session ID so that you do not have to reauthenticate for every page. A valid session id, stored in a cookie, acts as an authentication token. However, if malicious code exists on the page, or the requeest is over HTTP with a malicious proxy, or client side malware, or any number of ways that leaks the hat cookie’s contents, it could be used to authenticate on that website while the session is still active.

When you complete a web form, that content is POST‘ed to a URL, such as performing a bank transaction. Suppose that a victim is already logged into a banking website and has an authentication cookie in their browser, if the attacker were to somehow (say through social engineering) get the victim to click on a link that issued a POST to the bank, the victim’s cookie would authenticate that request despite the fact that the victim didn’t directly authorize the request.

What is the name of this attack? And what mechanism could be used to mitigate it?

Reveal Solution

This is a cross-site request forgery attack. The mitigation is to include a CSRF token in any forms that is secret, and could be linked to the authentication information. The attacker that does not have knowledge of the CSRF secret token would not be able to make valid requests.

In this, final, worksheet activity for the year, you will be attacking a website provided by OWASP. OWASP (Open Worldwide Application Security Project) as an organization aims to promote knowledge about web vulnerabilities and mitigation’s. This website, the Juice Shop, is a teaching tool for gaining hands-on experience with a wide range of web vulnerabilities. In this project, you will only be completing a small fraction of the challenges available for this website, and after this class this will remain an excellent source to sharpen your web hacking skills.

To start, visit the Juice Shop information website. You should read the preface and skim over Section 1. You will need to follow the instructions in Part 1: Running OWASP Juice Shop to get this setup and running. Personally, I recommend that you run Juice Shop using docker. This can be done with a single command.
```
docker run --rm -p 3000:3000 -e NODE_ENV=unsafe bkimminich/juice-shop
```
After you have downloaded these files, you are ready to start the project. Your
first task will be to find the scoreboard – see Part 2 of the website,
Finding the Scoreboard.

There are many, many challenges, but try to focus on the following:
1. DOM XSS
2. Reflected XSS
3. Forged Review
4. Login Admin
5. Admin Section
6. Admin Registration
7. API-Only XSS
In your worksheet writeup, describe how many you did, and why your attack on each worked and how you might patch the code.

Reveal Solution

Student Dependent