Bypassing Blockchain Authorization via Unsecured Functions
Note: Since the first part of this series I have also uploaded some further videos on remediation of reentrancy and dealing with compiler versions when working with this hacking blockchain series. Head to the console cowboys YouTube account to check those out. Haha as mentioned before I always forget to post blogs when I get excited making videos and just move on to my next project… So make sure to subscribe to the YouTube if you are waiting for any continuation of a video series.. It may show up there way before here.
Note 2: You WILL run into issues when dealing with Ethereum hacking, and you will have to google them as versions and functionality changes often... Be cognizant of versions used hopefully you will not run into to many hard to fix issues.
In the second part of this lab series we are going to take a look at privacy issues on the blockchain which can result in a vulnerably a traditional system may not face. Since typically blockchain projects are open source and also sometimes viewable within blockchain explorers but traditional application business logic is not usually available to us. With traditional applications we might not find these issues due to lack of knowledge of internal functionality or inability to read private values on a remote server side script. After we review some issues we are going to exploit an authorization issues by writing web3.js code to directly bypass vertical authorization restrictions.
Blockchain projects are usually open source projects which allow you to browse their code and see what's going on under the hood. This is fantastic for a lot of reasons but a developer can run into trouble with this if bad business logic decisions are deployed to the immutable blockchain. In the first part of this series I mentioned that all uploaded code on the blockchain is immutable. Meaning that if you find a vulnerability it cannot be patched. So let's think about things that can go wrong..
A few things that can go wrong:
- Randomization functions that use values we can predict if we know the algorithm
- Hard-coded values such as passwords and private variables you can't change.
- Publicly called functions which offer hidden functionality
- Race conditions based on how requirements are calculated
Since this will be rather technical, require some setup and a lot of moving parts we will follow this blog via the video series below posting videos for relevant sections with a brief description of each. I posted these a little bit ago but have not gotten a chance to post the blog associated with it. Also note this series is turning into a full lab based blockchain exploitation course so keep a lookout for that.
In this first video you will see how data about your project is readily available on the blockchain in multiple formats for example:
- ABI data that allows you to interact with methods.
- Actual application code.
- Byte code and assembly code.
- Contract addresses and other data.
Lab Video Part 1: Blockchain OSINT:
Once you have the data you need to interact with a contract on the blockchain via some OSINT how do you actually interface with it? That's the question we are going to answer in this second video. We will take the ABI contract array and use it to interact with methods on the blockchain via Web3.js and then show how this correlates to its usage in an HTML file
Lab Video Part 2: Connecting to a Smart Contract:
Time to Exploit an Application:
Exploit lab time, I created an vulnerable application you can use to follow along in the next video. Lab files can be downloaded from the same location as the last blog located below. Grab the AuthorizationLab.zip file:
Lab file downloads:
Ok so you can see what's running on the blockchain, you can connect to it, now what? Now we need to find a vulnerability and show how to exploit it. Since we are talking about privacy in this blog and using it to bypass issues. Lets take a look at a simple authorization bypass we can exploit by viewing an authorization coding error and taking advantage of it to bypass restrictions set in the Smart Contract. You will also learn how to setup a local blockchain for testing purposes and you can download a hackable application to follow along with the exercises in the video..
Lab Video Part 3: Finding and hacking a Smart Contract Authorization Issue:
Summary:
In this part of the series you learned a lot, you learned how to transfer your OSINT skills to the blockchain. Leverage the information found to connect to that Smart Contract. You also learned how to interact with methods and search for issues that you can exploit. Finally you used your browsers developer console as a means to attack the blockchain application for privilege escalation.
Read more- Best Hacking Tools 2019
- Hacking Tools For Games
- Pentest Tools Port Scanner
- Free Pentest Tools For Windows
- Hacker Tools 2019
- Pentest Tools Subdomain
- Hack Tools For Mac
- Hack Website Online Tool
- Hacking Tools For Windows 7
- Hacking Tools Hardware
- Best Hacking Tools 2019
- Ethical Hacker Tools
- Ethical Hacker Tools
- Hack Tools Github
- Pentest Tools For Ubuntu
- Pentest Tools Apk
- Pentest Tools For Mac
- Hacker Tools
- Game Hacking
- Hack Tools For Games
- Nsa Hack Tools Download
- Hacking Tools Mac
- Hacker Hardware Tools
- Hak5 Tools
- Hacker Tools
- Hack Tool Apk No Root
- Pentest Tools Linux
- Hack Tools Download
- Physical Pentest Tools
- Hacker Tools For Mac
- Pentest Recon Tools
- Hack Tools Online
- Hacking Tools Software
- World No 1 Hacker Software
- Pentest Tools Apk
- Pentest Tools Download
- Hacking Tools Software
- Hacking Tools Usb
- Hacking Tools Windows
- Pentest Tools Tcp Port Scanner
- Pentest Tools Alternative
- Hacks And Tools
- Best Pentesting Tools 2018
- New Hack Tools
- Hacking Tools Pc
- Beginner Hacker Tools
- Hack And Tools
- Hacker Tools Free Download
- Nsa Hack Tools Download
- Pentest Tools Nmap
- Hacking Tools For Pc
- Hacker Tools For Mac
- Hacking App
- What Is Hacking Tools
- Blackhat Hacker Tools
- Free Pentest Tools For Windows
- How To Make Hacking Tools
- Android Hack Tools Github
- Hackers Toolbox
- Pentest Tools List
- Hacking Tools Github
- Hacking Tools Github
- Hacking Tools Pc
- Tools Used For Hacking
- Nsa Hacker Tools
- Nsa Hack Tools Download
- Pentest Tools Github
- Hacking Tools Pc
- Hack Tools Mac
- Hacking Tools For Kali Linux
- Hacking Tools Github
- Pentest Tools For Ubuntu
- Hack App
- Pentest Tools Online
- Pentest Tools Download
- Pentest Tools Windows
- Pentest Recon Tools
- New Hack Tools
- Pentest Tools Url Fuzzer
- Pentest Tools Framework
- Wifi Hacker Tools For Windows
- Underground Hacker Sites
- Pentest Tools Nmap
- Pentest Tools Subdomain
- Pentest Tools Alternative
- Pentest Box Tools Download
- Pentest Tools Linux
- Hacker Tools List
- Kik Hack Tools
- Hacker Security Tools
- Hack Rom Tools
- Pentest Tools Framework
- Hacking Tools For Windows Free Download
- How To Make Hacking Tools
- Hack Tools For Windows
- Hacking Tools For Mac
- Pentest Tools Windows
- Pentest Box Tools Download
- Install Pentest Tools Ubuntu
- Hacker Tools Mac
- Hacker
- Hacking Tools Hardware
- Hacking Tools Github
- Pentest Tools Subdomain
- Black Hat Hacker Tools
- Pentest Tools Url Fuzzer
- Beginner Hacker Tools
- Kik Hack Tools
- Hacker Tools Mac
- Pentest Tools Website Vulnerability
- Hacking Tools Download
- Hacking Tools For Windows Free Download
- Pentest Tools Free
- Top Pentest Tools
- Hacker Tools Online
- Bluetooth Hacking Tools Kali
- Hacker Tools Online
- Hack Tools For Mac
- Physical Pentest Tools
- Wifi Hacker Tools For Windows
- Hack Tools
- Hacker Tools For Mac
- What Is Hacking Tools
- Game Hacking
- Hacking Tools Pc
- Hacker Tools Github
- Pentest Tools Framework
- Hack Tools Download
- Hacking Tools For Beginners
- Nsa Hacker Tools
- Hacking Tools For Games
- Pentest Tools Android
- Hack Tools Pc
- Hacker Techniques Tools And Incident Handling
- Usb Pentest Tools
- Hacking Tools For Games
- Pentest Tools Port Scanner
- New Hacker Tools
- Hacker Tools Mac
- Hacker Tools 2020
- Pentest Tools Kali Linux
- Beginner Hacker Tools
- Hacker Tools Mac
- Hack Tools For Games
- Hacker Tool Kit
- Hacker Tools 2019
- Hacking Tools 2019
- Hak5 Tools
- Hacking Tools Hardware
- Underground Hacker Sites
- Hacking Tools Windows
- Hacker Tools Github
- Pentest Tools Bluekeep
- Wifi Hacker Tools For Windows
- Physical Pentest Tools
- Hack And Tools
- Hack Tools For Pc
- Hack Rom Tools
- Hacking Tools Usb
- Hacker Tools 2020
- Android Hack Tools Github
- Hacker Tools For Mac
- Hacker Tools For Windows
- Black Hat Hacker Tools
- Hacking Tools For Windows
- Pentest Tools Online
- Hacker
- Hacking Tools 2019
- Ethical Hacker Tools
- Pentest Tools
- Pentest Tools Apk
- Nsa Hack Tools
- Hack Tools For Mac
- Best Hacking Tools 2019
No comments:
Post a Comment