PortSwiggerlabs: Modifying serialized data types

Information :

This lab uses a serialization-based session mechanism and is vulnerable to authentication bypass as a result. To solve the lab, edit the serialized object in the session cookie to access the administrator account. Then, delete the user carlos.

You can log in to your own account using the following credentials: wiener:peter

Solution :

First we start by logging in as wiener :

Once logged in , we see that we have 3 bottons , home, Myaccount and Log out , now if we check Burp’s Site map :

We see that once we’re logged in, we’re given a cookie , if we had Burp Pro , it will automatically detect that we have a serialized object , but my case i didn’t have that , but we can see from Inspector that the value of that cookie once decoded is :

O:4:"User":2:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"ly9g32nbnilkfzgmphe3u4nqm68jay1l";}

This is a standard PHP serialized object format : We see that user has 4 characters and 2 attributes , username and access token , before each one of them we have the lenght for each one of these attributes .

Now one way to abuse this is by changing the user we got to someone else , in this case the administrator :

O:4:"User":2:{s:8:"username";s:6:"administrator";s:12:"access_token";s:32:"ly9g32nbnilkfzgmphe3u4nqm68jay1l";}

This won’t work since we need to make sure we specify the lenght of the word right before it , which will be 13 rather than 6 :

O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";s:32:"ly9g32nbnilkfzgmphe3u4nqm68jay1l";}

Now back to our burp , either intercept each request and modify the cookie , or just copy the modified cookie from inspector and paste it inside the browser tool .

Now back to our browser :

We just change the value of the cookie :

Here we have a problem with the access token , a way around this would be to replace the entire value with 0 , and replacing the type from s (String) to i for Inetger :

O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";i:0;}

Now we replace the old cookie on our dev tools :

We see that now we can see the Admin panel , which we will use to delete the user carlos :

Now once we delete it , we should solve the lab :

That was all for this lab, see you in the next one :)