Does anyone know what programming language/web framework parse parameter like this? - exploit

While doing bug bounty. There is a website with a feature like follow
GET example.com/lookup?users=["username1", "username2"], then it return users data as JSON.
The users parameter looks really fishy. Its behaviors are as follow:
users=["username"] => 200
users=['username'] => 500
users=[username] => 500
users="username" => 200
users='username' => 500
users=username => 500
users= => 500
users=[] => 200
I suspect that it using eval to parse parameter value in backend. The problem is that I don't know what programming language it is using in backend.
Do you have any suggestions for this case?

Related

How to get response from a SOAP request using zend-soap?

I've been spending sometime with problem. I have a endpoint I want to send some data and receive a response.
I've look online and I've seen that Zend\Soap\Server is used to build methods, and Zend\Soap\Client can than use those methods. I would like for someone to explain what to write in those methods, and how that helps with getting a response.
$client = new Client($this->wsdl, array('soap_version' => SOAP_1_1));
Now we can $client->SOMEMETHOD();
My questions are: 'Where do I get this method from?', 'what will method do?', and 'how do I use it?'
SOAP short base
SOAP allows to request an online service. (use as a client code) for example you can query AMAZON on a product, know its price, etc.
SOAP works in 2 different ways:
way 1: wdsl mode
when you create a connection to a SOAP client, you must provide a link that will provide an XML file: the wdsl
example: type in your browser:
http://webservices.amazon.com/AWSECommerceService/AWSECommerceService.wsdl
congratulation : you see (discover) the way to query AMAZON !
this XML file tells you what you can ask for: a price, a product info, a search, etc ..: these are the routes.
for each route (each possible query) the parameters you must provide, the validity check of these parameters: example: route = search article, param1 = article name, type of parameter = string, etc...
$client = new Client($this->wsdl, array( 'soap_version' => SOAP_1_1 ) )
create a client object :
$this->wsdl a link to xml file (the discovery part)
it's a URI string : example : "http://webservices.amazon.com/AWSECommerceService/AWSECommerceService.wsdl"
array( 'soap_version' => SOAP_1_1 ) = i use SOAP version xx, you can add more options in this array.
way 2: non wdsl mode
you do not provide a wsdl link or file...
but you must know how to handle request and responses
deep learning
search on google a tutorial for SOAP,
there are online requester for test purpose, etc...
then use it in zend
I solved my problem, so I'll post it here for anyone to understand.
$client = new Client($wsdl, ['soap_version' => SOAP_1_1]);
$params = [
'args0' => [
'_PRCODASSOC' => null,
'_PRCODDELEG' => null,
'_PRCODFISCALE' => 'BRSLSN312213TY',
'_PRCODFSDDIRI' => null,
'_PRTIPOOPERAWS' => 'REPFAM'
]
];
$client->ws_fam_sgf($params);
$result = $client->getLastResponse();
die($result);
All I did was add 'args' => [] and added all my parameters inside that key.

Testing a JSON PUT request in mojolicious

I am creating test cases for my app developed using Mojolicious framework. I am testing the routes for appropriate responses for the REST calls that are made. I use JSON as a means of communication between the server and client. To test GET, POST and DELETE requests I use the following functions
GET : get_ok()POST: post_json_ok() DELETE: delete_ok()
but for PUT I am not able to use put_ok(). And example of my usage of put_ok() would be my $t = Test::Mojo->new;$t->put_ok('this/is/url/to/resource'=>{ "element" => "modified value"})->status_is(204)
I get a bad request status every time(400) and so the test fails. I use Test::Mojo for testing my application.
Additional information:
$t->put_ok('http://localhost:3000/application/instances/system/test'=>{"model" => "testing put"})->status_is(204);
This is the exact test for PUT request that is attempted. model is a property of resource test that is being attempted to be changed to testing put and the expected status response is 204.
The mapping to the controller is done by
$r->route('/application/instances/system/:id, id => qr/[A-Za-z0-9 ]+/ -> via('put')
->to(controller => 'system', action => 'update_sys');
This route calls the update_sys method in the system controller and that is how the resource is located.
Actually, after discussions with SRI on IRC, he pointed me to an example almost identical you your needs in the documentation.
# Test custom transaction
my $tx = $t->ua->build_json_tx('/user/99' => {name => 'sri'});
$tx->req->method('PUT');
$t->tx($t->ua->start($tx))
->status_is(200)
->json_is('/message' => 'User has been replaced.');
So this should work for you!
Postscript:
You might be interested to know that this discussion has brought some progress: the next release of Mojolicious (version 3.66) will now have a cleaner syntax for this purpose, the new request_ok method. The above example can then be rewritten as
my $tx = $t->ua->build_json_tx('/user/99' => {name => 'sri'});
$tx->req->method('PUT');
$t->request_ok($tx)
->status_is(200)
->json_is('/message' => 'User has been replaced.');
Can you share the definition of your route for 'this/is/url/to/resource' ? the server is returning 400, so it appears Mojo::Controller in your app does not understand what you are sending ...

Caller ID in Asterisk for user identification

I am new to Asterisk, so forgive me if this question has an obvious answer that I have simply overlooked.
I am making a mix between a personal ads and a voicemail service, where I want each user to be able to submit an ad that others can respond to by recording messages that go into this users inbox. My original thought was to base this purely on the CALLERID(num) value, but quickly discovered that this is a bit unreliable. Sometimes when I would call in it'd say anonymous, other times it would give me a bunch of zero's, other times it would show me my real phone number, and once it actually gave me just random digits. I do have a wait call after answering but before my first soundf ile is triggered, in my pickup context. I am wondering what the best way to approach this is? Do I ask the user to enter their phone number, and then generate a code based upon this that will then serve as a password when you call back? Do I attempt to use CALLERID(num) to detect returning users, or is this not adviseable from a security perspective?
Preferably, I would like to avoid using a code altogether but I am told that it is relatively easy to spoof phone numbers to hack into someone else's inbox. Note that I do not plan to allow direct SIP calls, only through a PSTN/SIP provider where the IP address is on a whitelist. Any tips on how to approach this would be highly appreciated. Basically I want to make it as easy as possible for my users, but maintain high security.
I also wanted to know whether there is a function to check if a string contains only digits? This would be useful as a sanity check before I look up the phone number in the MySql database, if I do decide to use CALLERID(num) in this way.
My very basic, and unfinished dialplan is below:
[verify]
exten => blastbay,1,Answer(1000)
; A few simple sanity checks, but not very good ones.
same => n,GotoIf($["${CALLERID(num)}" != "0000000000"]?nextcheck)
; If we have only zero's, try waiting another second.
same => n,Wait(1)
same => n,GotoIf($["${CALLERID(num)}" = "0000000000"]?rejected)
same => n(nextcheck),GotoIf($["${CALLERID(num)}" = ""]?rejected)
same => n,GotoIf($["${CALLERID(num)}" = "anonymous"]?rejected)
same => n,GotoIf($["${CALLERID(num)}" = "unavailable"]?rejected)
same => n,GotoIf($["${CALLERID(num)}" = "protected"]?rejected)
same => n,GotoIf($[${LEN(${CALLERID(num)})}<5]?rejected)
same => n,Goto(welcome,welcomespeech,1)
same => n(rejected),Playback(/usr/phone/rejected)
same => n,Hangup()
[welcome]
include => mainmenu
exten => welcomespeech,1,BackGround(/usr/phone/welcome)
same => n,Goto(mainmenu,menuspeech,1)
[mainmenu]
exten => menuspeech,1,BackGround(/usr/phone/mainmenu)
same => n,WaitExten(5)
exten => 1,1,Goto(information,infospeech,1)
exten => i,1,Goto(menuspeech,1)
exten => t,1,Goto(menuspeech,1)
[information]
exten => infospeech,1,BackGround(/usr/phone/information)
same => n,Goto(mainmenu,menuspeech,1)
exten => #,1,Goto(mainmenu,menuspeech,1)
exten => i,1,Goto(mainmenu,menuspeech,1)
One command that is often overlooked is the "Authenticate" command... so you could build a mechanism that assigns a user a number-based UID, and then a PIN. Drop the PIN into a file where the name is the UID, and then when they call in, READ their UID, Authenticate(uid_file_name), and if they enter the correct PIN via Authenticate, let them have access.
I am making a mix between a personal ads and a voicemail service, where I want each user to be able to submit an ad that others can respond to by recording messages that go into this users inbox.
Therefore you could use Record(), Playback() and Voicemail().
Record() to record the Ad,
Playback() the Ad,
Voicemail() for the Users to record their Voicemail
If you want more Access Control, i would recommend to use PHP AGI or
use the AstDB.
Yes, it's easy to spoof a Number, for access control, something like an Access Code,
with Read you read DTMF Input as a Variable, maybe combined with a CallerID Number based filter, sounds like an good idea.
I also wanted to know whether there is a function to check if a string contains only digits?
You could use REGEX for this, ie. in a macro:
; Arg1: CALLERID(num)
[macro-dblookup]
exten => s,1,Set(isnumber=${REGEX("[0-9]" ${ARG1})})
exten => s,2,GotoIf($["${isnumber}" = "1"]?4)
exten => s,3,MacroExit()
exten => s,4,NoOp("Do something with number here")
exten => s,5,NoOp("...Db Lookup...")
In the Dialpan you can call the macro-dblookup like this:
exten => 012345678,1,Noop("...")
exten => 012345678,n,Macro(dblookup,${CALLERID(num)})

Register new memer for vBulletin via Mobile API

I'm trying to use the vBulletin REST Mobile API to simply register.
The sourced are installed on my local machine and according the documentation https://www.vbulletin.com/forum/content.php/393-User-Registration-Process-Mobile-API
This procedure should not be so hard, especially without humanity and COPPA authentication.
However I've stacked!
The method definition describes "addnewmember" clear, so I've generated a test link, which should do the job.
https://www.vbulletin.com/forum/content.php/365-User-Related-Methods
The link is:
.../forum/api.php?&api_m=register_addmember&api_c=1&api_s=76ec9eec61e7fdfef2f3feee28d5f392&api_sig=8fe54313b333cc0fef4ddd8e398b5c80&api_v=6&agree=1&username=testuser&email=XXXXXX%40gmail.com&emailconfirm=XXXXX%40gmail.com&password=12345678&passwordconfirm=12345678
As a response I get: register_not_agreed
The Docs: register_not_agreed
The agree parameter should be set to 1.
Which is also clear - agree parameter was not there.
Here comes the funny part - In the API-Log I can see that the 'agree' parameter is correctly passed
*1 test_client Gast 13:23, 18.06.2012 register_addmember Array ( [api_m] => register_addmember [api_c] => 1 [api_s] => 76ec9eec61e7fdfef2f3feee28d5f392 [api_sig] => 8fe54313b333cc0fef4ddd8e398b5c80 [api_v] => 6 [agree] => 1 [username] => testuser [email] => ....*
Is there anybody with experience with the Mobile API that could help?
I don't know why it does not work with a pure GET call but I'm sure it will work (because I'm working on a vBulletin API client in Python and I did it this way) if you:
use GET parameters to send api_c, api_sm, api_m, and api_sig
use POST data for all the rest (username, email, agree, etc)

Magento soap v2 error: Attribute "available_sort_by" is required

I'm trying to create category with magento soap v2 api call. I'm getting the error:
Attribute "available_sort_by" is required.
Code for calling the Api:
$category_data = array( "name" => "testcategory", "is_active" => "1", "include_in_menu" => "1","available_sort_by" => "","default_sort_by" => "");
$result = $client->catalogCategoryCreate($session,2,$category_data,1);
echo $result;
I have tried also with "available_sort_by" => array("name", "price", ...)
Is this the right way for calling the v2 soap api.
Thanks for any advice.
The WSDL does define what data you need for your call and exposes it for you to look at if you put 'trace' on your API SOAP calls.
After your call, with trace on, you can get your last XML, but it will be tidied up by the SOAP to be shoehorned into what the WSDL thinks you need for that call. The data will be different to what you submitted and show fields you never knew were in existence - it kind of reveals the documentation that you wish you had to start with.