This lesson is to teach the directory traversal vulnerability. Basically it is due to the failure of sanitizing of the user input file name that allows user to traverse to other directories.
It will start to be very lag, try to click the icon for Terminal / bash service
Type "top"
Try to look for "artsd", should be easy to find since it uses around 90+% CPU
Key "k", enter the pid (e.g. 5528)
Once you kill the process "artsd", Backtrack 4 Final should return to normal
To prevent such thing to happen again, you can follow the step or watch the YouTube video as shown. Kmenu > system > settings > sound & multimedia > sound system
Actually it is also known as HTTP response splitting. Basically it is due to the failure of sanitizing the carriage return (CR or hex representation: %0d or “\r”) and line feed (LF or hex representation: %0a or “\n”) during a 302 redirect, in the Location or Set-Cookie header.
For this exercise, Webgoat has split the lesson into 2 stages: HTTP Splitting & Cache Poisoning. For the Cache Poisoning, it is almost same as HTTP Splitting. The only difference is included “Last Modified” in the header. (e.g. Last Modified: Mon, 27 Oct 2012 14:50:18 GMT). No worries just follow thru the steps first.
Start your Webgoat -> Click on HTTP Splitting -> Key the value as “en” for Search by Country field -> Click on Search! button
(Note: Ensure that you have checked your Webgoat to Intercept requests before you click on the Search! button)
Webscarab will intercept your request as shown below.
Check on Intercept responses -> Click on Accept changes
Webscarab will intercept your response as shown below.
Change the highlight text (en) to below value -> Click on Accept changes
(Note: The above value is for unix system as unix recognizes LF only. For windows system, please replace all “%0a” to “%0d%0a”. It is equivalent to CRLR.)
Before changing the response:
After changing the response:
Click on Accept changes
Click on Accept changes
You will be able to see a page contains “Hacked J” as shown below:
(Note: The above value is for unix system as unix recognizes LF only. For windows system, please replace all “%0a” to “%0d%0a”. It is equivalent to CRLR.)
Before changing the response:
After changing the response:
The rest of the screens are similar as HTTP Splitting. Just keep Click on Accept changes. Until you see the below screen:
