~/tutorials/033-a-box-built-to-be-broken.md

033: A box built to be broken

The fastest way to learn what a bug looks like from the outside is to attack one that was put there on purpose. Then read the source and see how small the fix was.

The standard here is a deliberately vulnerable image. Metasploitable 2 if you want a whole broken server. DVWA, Damn Vulnerable Web Application, if you want the web tier specifically. Both are legal to attack everywhere, because the entire point of their existence is to be attacked by their owner.

This lesson uses DVWA. The shape transfers.

The loop

Attack it blind. Find one flaw with recon and patience.
Stop. Open the source.
Find the line that made it possible.
Fix it. One line if you can.
Attack again and watch the fix hold.

Most people run step one and skip the rest. The rest is where engineers are made.

The first flaw

DVWA's pages reflect what you send them, and the first flaw is visible in minutes to eyes that know what reflection means. Find it, use it, and then stop using it. The source is where the lesson actually is:

$ grep -rn '\$_GET' /var/www/dvwa | head

A scanner would have named the class in seconds. Cross site scripting, reflected. What the scanner cannot tell you is which line, which parameter, and which fix closes it. Those live in the source, and reading them is the difference between running a scan and understanding a bug.

The fix

Reflected input becomes safe when it stops being interpreted. Escape it on the way out, and the script a reader types becomes text a page displays. In DVWA's PHP that is one call on one echo, and the vulnerability is gone.

Reveal the answer

The call is htmlentities, and the line it belongs on is in vulnerabilities/xss_r/source/low.php, where the page builds its greeting from $_GET[ 'name' ] without asking what is in it. Wrap that one input:

$ docker exec dvwa grep -n 'Hello' /var/www/html/vulnerabilities/xss_r/source/low.php

Edit the line so the input passes through htmlentities before it is concatenated. Ask for the page with the same script. The greeting now shows the literal string, angle brackets and all, and nothing runs. The impossible.php file beside it ships this same fix, so you can check your one line against the answer key the box carries.

One line. That ratio is the most important fact in this tier. The finding that took an evening of probing is closed by a change smaller than this sentence, and every report you ever write is an argument that the line is worth changing.

Why the source comes second

You attacked first because that is the skill you are building. You read the source second because that is what makes the skill repeatable. Blind luck scales badly. A person who found the flaw by understanding the page finds the same flaw in the next page, and the one after that.

Try it

Get one flaw from the outside, unaided.
Find its line in the source.
Write the fix. Watch it hold.

Do that five times and you will never read a vulnerability report the same way again.