Greetings Forumn mentor
I am having so much difficulty answering question number 2. I easily found the answer for number 1
Here is what I have tried so far. Note: I am using AI for help and the AI is not much help =(
You will have to look through the photos as I did not post them in order. It would be great to have a live chat as my skills in using burp are weak.
Yes, you should analyze the PUT request in Burp Suite and then use Burp Repeater to test potential modifications that exploit the BOLA vulnerability.
Here’s a clear breakdown of what to do:
Steps to Follow:
- Analyze the PUT Request:
- In Burp Suite, locate the PUT request that updates your note (
/api/v2/notes/studentnote
). - Look closely at the request and response, particularly the unique identifiers like
_id
, and any patterns that may suggest sequential or predictable values.
- Identify Key Information:
- Note the
_id
or other unique identifiers in the response. - If your current note has an identifier like
studentnote1
or an_id
such as66df372d18861a08847cc6a4
, think about what might be a nearby identifier (likestudentnote0
or an_id
that’s one number lower).
- Use Burp Repeater:
- Send the PUT request from the history to Burp Repeater.
- In Repeater, modify the request to use the guessed identifier that is close to the one observed, such as:
- Adjusting
_id
to one lower or higher value. - Modifying the endpoint to check
/api/v2/notes/studentnote0
if your current is/studentnote1
.
- Adjusting
- Send the modified request to see if it reveals a note of type
"secret"
.
- Look for the Secret Note:
- Continue sending modified requests in Repeater until you successfully access a secret note.
- Check the response for
"type": "secret"
and look for any flags.
- Extract the Flag:
- When you successfully retrieve a secret note, look for the flag in the note’s body or related fields.
- The flag will match the format
{****-***}
.