★★★★ Ephemeral Accountant (SQL-Injection)
ฝัง
- เผยแพร่เมื่อ 7 ก.พ. 2025
- Log in with the (non-existing) accountant acc0unt4nt@juice-sh.op without ever registering that user.
🤴 Credits to Bjoern Kimminich for providing this excellent vulnerable web app. Download here: github.com/bki...
📃 This video is part of the OWASP Juice Shop solutions & walkthrough playlist ( • ★ Zero Stars (Improper... .
📓 Make sure to check out all the other videos in this playlist as well to get a full tutorial.
💡 If you have any questions or want to request a new video about a special topic, feel free to leave me a comment. You can also contact me on all of my social medias below.
💖 I need your help. Subscribe to this channel, link and retweet my videos and share them with your friends. This going to help make this project more sustainable in the long-run.
💙 Last but not least: Subscribe to my Twitter channels / hacksplained & / pascalsec , and support me on Patreon / hacksplained or www.buymeacoff...
keep going! after OSCP, i will come here to learn web security
Best of luck with your OSCP :) Come back at any time :D
Hey @Hacksplained first of all thank you very much for the great videos. I am writing my Bachelor Thesis about open source Web Scanners and I am dependent on those detailed explanations, so I am very glad that you uploaded them. My question is why did u skip Christmas Special and Easter Egg?
Greetings from Germany
What is the whole purpose of ephemeral account, I mean what could be the impact in the application because the given query (payload) will not add the values in database so you cannot login.
It's just a POC in Juice Shop, but I'm sure you could imagine other scenarios where it might be useful to completely fabricate an entry used in a query without having to create a real entry in a table. Creating a real entry leaves artifacts and might not even be possible if the table is read-only (eg. it contains security descriptors the query verifies but can't alter) or you can't use INSERT in the injection.
You can also construct altered versions of existing entries that you couldn't insert/update without propagating effects to everyone else using the database, like an existing user's id and isAdmin=1, which again doesn't offer any benefit in Juice Shop, but you can surely imagine other scenarios where creating completely arbitrary states could lead to further exploitation somehow. Maybe a null createdAt date would cause a problem in a different app. It's an invalid value to insert in the actual table because it specifies NOT NULL for the field, but you're generating name/value pairs out of thin air here and aren't subject to the same constraints.
Great content! Is there any chance I can find payload to copy and paste? (I have burp comunity ver so no json beautyfier)
No, I have not provided the payload on purpose, so that each watcher really needs to dig into the challenge a little more :) If you really just wanna copy paste it, you would have to type it off the video! I would recommend you to try it out by yourself though!
thanks but app asked me for 2 factor auth key and im getting totp_token_required error
Could you please comment the minute and second in the mm:ss format where you face your poblem?
This payload is very hard to catch up.
Would you mind give it to comment section please...
Sorry, I don't have the payload at hand anymore. But try build it by yourself. That's the best way to learn.
hi bro. Where do I find the json beutifier plugin. please can u help me
If you download the latest version of Burp Suite, you don't need the plugin anymore. There is already a beautifier included.
Otherwise go to the extender tab.
@NoYaN NyN.
I am running an older version of burp v2020.4. This version has a "pretty" button on the bottom right of the repeater. Be aware that Hacksplained already has the repeater view in "pretty" mode which is already parsing the json response in the repeater tab. Also be aware the JSON Beautifier only pretty formats JSON. What you see on his JSON Beautifier tab is the table creation sql command for the Users table. The JSON Beautifier does not convert sql table create commands to JSON. I believe he is only using the JSON Beautifier as an open area to spread out the data to be more readable in a JSON format to see its structure. I am sure there are a variety of ways to convert sql CREATE commands to JSON, but the JSON Beautifier extension is not one of them.
If interested in getting the JSON Beautifier for testing, be aware in the version I am running, there is no JSON Beautifier extension in the BApp store. Looks like it was removed. You can however clone the older git repo here (github.com/PortSwigger/json-beautifier). Then apt install gradel, and build the jar file. Then you can import by going to Extender > Extensions, and "Add" your jar file.
Nice one
Thanks!
Hi Team, I am facing the below mentioned problem
{
"error": {
"message": "SQLITE_CONSTRAINT: FOREIGN KEY constraint failed",
"stack": "SequelizeForeignKeyConstraintError: SQLITE_CONSTRAINT: FOREIGN KEY constraint failed
at Query.formatError (/app/node_modules/sequelize/lib/dialects/sqlite/query.js:354:18)
at Query._handleQueryResponse (/app/node_modules/sequelize/lib/dialects/sqlite/query.js:72:18)
at Statement.afterExecute (/app/node_modules/sequelize/lib/dialects/sqlite/query.js:238:27)",
"name": "SequelizeForeignKeyConstraintError",
"parent": {
"errno": 19,
"code": "SQLITE_CONSTRAINT",
"sql": "INSERT INTO `Baskets` (`id`,`createdAt`,`updatedAt`,`UserId`) VALUES (NULL,$1,$2,$3);"
},
"original": {
"errno": 19,
"code": "SQLITE_CONSTRAINT",
"sql": "INSERT INTO `Baskets` (`id`,`createdAt`,`updatedAt`,`UserId`) VALUES (NULL,$1,$2,$3);"
},
"sql": "INSERT INTO `Baskets` (`id`,`createdAt`,`updatedAt`,`UserId`) VALUES (NULL,$1,$2,$3);"
}
}
You need to try a little harder! Go over the video again and check if you missed something!
I check the code same as you, but it couldn't not work ah.
The best
yep!
Muchas gracias amigo...
De nada!!
the payload work no more
In which minute do you have a problem. Please post the mm:ss mark.
@@Hacksplained I typed this: {"email":"'UNION SELECT * FROM (SELECT 1000 as 'id',"as 'username','acc0unt4nt@juice-sh.op'as'email','asdfasdf'as'password','accounting'as'role',"as'deluxeToken','127.0.0.1'as'lastLoginIp','default.svg'as'profileImage',"as'totpSecret',1 as 'isActive','2020-08-30 11:12:13.456 +00:00' as'updatedAt', null as 'deletedAt')--","password":""}
I get an Internal Server Error and the part from UNION to 'id' is in red.
@@ITZDABOSSTV Please post the mm:ss (minutes second) video mark in which you need help.
@@Hacksplained 5:40
@@ITZDABOSSTV Change the 1000 to 20, then can work le
Hii i have an issue how can i contact you
Put down your question in the comments! Then also others apart from me can help you :)