Friday, May 26, 2023

Blockchain Exploitation Labs - Part 2 Hacking Blockchain Authorization


Bypassing Blockchain Authorization via Unsecured Functions


Note: Since the first part of this series I have also uploaded some further videos on remediation of reentrancy and dealing with compiler versions when working with this hacking blockchain series.  Head to the console cowboys YouTube account to check those out.  Haha as mentioned before I always forget to post blogs when I get excited making videos and just move on to my next project… So make sure to subscribe to the YouTube if you are waiting for any continuation of a video series.. It may show up there way before here. 

Note 2:  You WILL run into issues when dealing with Ethereum hacking, and you will have to google them as versions and functionality changes often... Be cognizant of versions used hopefully you will not run into to many hard to fix issues. 

In the second part of this lab series we are going to take a look at privacy issues on the blockchain which can result in a vulnerably a traditional system may  not face. Since typically blockchain projects are open source and also sometimes viewable within blockchain explorers but traditional application business logic is not usually available to us. With traditional applications we might not find these issues due to lack of knowledge of internal functionality or inability to read private values on a remote server side script.  After we review some issues we are going to exploit an authorization issues by writing web3.js code to directly bypass vertical authorization restrictions.

Blockchain projects are usually open source projects which allow you to browse their code and see what's going on under the hood.  This is fantastic for a lot of reasons but a developer can run into trouble with this if bad business logic decisions are deployed to the immutable blockchain.  In the first part of this series I mentioned that all uploaded code on the blockchain is immutable. Meaning that if you find a vulnerability it cannot be patched. So let's think about things that can go wrong..

A few things that can go wrong:
  • Randomization functions that use values we can predict if we know the algorithm
  • Hard-coded values such as passwords and private variables you can't change.
  • Publicly called functions which offer hidden functionality
  • Race conditions based on how requirements are calculated

Since this will be rather technical, require some setup and a lot of moving parts we will follow this blog via the video series below posting videos for relevant sections with a brief description of each.  I posted these a little bit ago but have not gotten a chance to post the blog associated with it.  Also note this series is turning into a full lab based blockchain exploitation course so keep a lookout for that.

In this first video you will see how data about your project is readily available on the blockchain in multiple formats for example:
  • ABI data that allows you to interact with methods.
  • Actual application code.
  • Byte code and assembly code.
  • Contract addresses and other data.

 Lab Video Part 1: Blockchain OSINT: 



Once you have the data you need to interact with a contract on the blockchain via some OSINT how do you actually interface with it? That's the question we are going to answer in this second video. We will take the ABI contract array and use it to interact with methods on the blockchain via Web3.js and then show how this correlates to its usage in an HTML file

Lab Video Part 2: Connecting to a Smart Contract: 




Time to Exploit an Application:

Exploit lab time, I created an vulnerable application you can use to follow along in the next video. Lab files can be downloaded from the same location as the last blog located below. Grab the AuthorizationLab.zip file:

Lab file downloads:



Ok so you can see what's running on the blockchain, you can connect to it, now what?   Now we need to find a vulnerability and show how to exploit it. Since we are talking about privacy in this blog and using it to bypass issues. Lets take a look at a simple authorization bypass we can exploit by viewing an authorization coding error and taking advantage of it to bypass restrictions set in the Smart Contract.  You will also learn how to setup a local blockchain for testing purposes and you can download a hackable application to follow along with the exercises in the video..

Lab Video Part 3:  Finding and hacking a Smart Contract Authorization Issue: 





Summary:

In this part of the series you learned a lot, you learned how to transfer your OSINT skills to the blockchain. Leverage the information found to connect to that Smart Contract. You also learned how to interact with methods and search for issues that you can exploit. Finally you used your browsers developer console as a means to attack the blockchain application for privilege escalation.
Related word
  1. Hacking Tools For Windows
  2. Pentest Tools Subdomain
  3. Pentest Tools Open Source
  4. Hacking Tools And Software
  5. Hacker Tools For Pc
  6. Hacking Tools For Windows
  7. Hacker Security Tools
  8. Hacker
  9. Hacker Tools 2020
  10. Hack Tools
  11. Hack Tools
  12. Ethical Hacker Tools
  13. Hacking Tools Windows
  14. Hacker Tools Free
  15. Beginner Hacker Tools
  16. Hacker Tools Software
  17. Pentest Reporting Tools
  18. What Is Hacking Tools
  19. Physical Pentest Tools
  20. Top Pentest Tools
  21. Hack Tool Apk
  22. New Hack Tools
  23. Hacker Search Tools
  24. Growth Hacker Tools
  25. Hacker Tools Apk Download
  26. Hacking Tools Windows
  27. Hackrf Tools
  28. Github Hacking Tools
  29. Hack Tools For Mac
  30. Pentest Tools Website
  31. Tools 4 Hack
  32. Bluetooth Hacking Tools Kali
  33. New Hacker Tools
  34. New Hacker Tools
  35. Pentest Tools Linux
  36. Hacker Search Tools
  37. Kik Hack Tools
  38. How To Install Pentest Tools In Ubuntu
  39. Underground Hacker Sites
  40. Pentest Tools For Android
  41. Hack And Tools
  42. Bluetooth Hacking Tools Kali
  43. Pentest Tools Android
  44. What Are Hacking Tools
  45. Pentest Tools Tcp Port Scanner
  46. Pentest Tools For Windows
  47. Hacking Tools Online
  48. Pentest Tools Download
  49. Hacker
  50. Free Pentest Tools For Windows
  51. Termux Hacking Tools 2019
  52. Easy Hack Tools
  53. Pentest Automation Tools
  54. Top Pentest Tools
  55. Hacker Tools List
  56. Pentest Tools Tcp Port Scanner
  57. Hack Tools Pc
  58. Hack Tools
  59. Game Hacking
  60. Pentest Tools Android
  61. Best Hacking Tools 2019
  62. Hacking Tools For Windows 7
  63. Pentest Tools Android
  64. Kik Hack Tools
  65. Pentest Tools Port Scanner
  66. Nsa Hacker Tools
  67. Top Pentest Tools
  68. Black Hat Hacker Tools
  69. Hacker Tools Software
  70. How To Hack
  71. Pentest Tools Port Scanner
  72. Hacking Tools For Windows
  73. Hacking Tools Online
  74. Pentest Tools Tcp Port Scanner
  75. Hacker Tools Apk Download
  76. Hacker Tools 2019
  77. Free Pentest Tools For Windows
  78. Hacker Tools List
  79. Pentest Tools Find Subdomains
  80. Hacker Tools Apk
  81. Pentest Tools Windows
  82. Hacking Tools For Mac
  83. Hacker Tool Kit
  84. Pentest Tools Find Subdomains
  85. Hack And Tools
  86. Pentest Tools Free
  87. Hack Website Online Tool
  88. Hacking Tools Download
  89. Physical Pentest Tools
  90. Hack Tools Download
  91. Install Pentest Tools Ubuntu
  92. Hacking Apps
  93. Hacking Tools For Pc
  94. Hacking Tools For Mac
  95. Wifi Hacker Tools For Windows
  96. Hacker Tools For Windows
  97. Pentest Tools Bluekeep
  98. Beginner Hacker Tools
  99. Nsa Hack Tools Download
  100. Hacking Tools For Beginners
  101. Hacking Tools Kit
  102. Hack Tools
  103. Wifi Hacker Tools For Windows
  104. Hacker Hardware Tools
  105. Tools 4 Hack
  106. World No 1 Hacker Software
  107. Pentest Box Tools Download
  108. Pentest Box Tools Download
  109. How To Hack
  110. Hack Tools For Pc
  111. World No 1 Hacker Software
  112. Hacking Tools For Kali Linux
  113. Nsa Hacker Tools
  114. Hacking Tools For Windows 7
  115. Pentest Tools Review
  116. Android Hack Tools Github
  117. Pentest Tools Apk
  118. Free Pentest Tools For Windows
  119. Hacking Tools Usb
  120. Pentest Tools Website
  121. Hacker Tools 2019
  122. Hack Tools
  123. Hack Tools Mac
  124. Hacking Tools Free Download
  125. Hack Tools Pc
  126. Github Hacking Tools
  127. Hacker Tools 2020
  128. Hacking Tools Usb
  129. Nsa Hack Tools
  130. Pentest Tools Android
  131. New Hack Tools
  132. Pentest Box Tools Download
  133. Pentest Tools Open Source
  134. Beginner Hacker Tools
  135. Pentest Tools Online
  136. Hacking Tools Free Download
  137. Hacker Hardware Tools
  138. Hacking Tools For Beginners
  139. Pentest Tools Review
  140. Pentest Recon Tools
  141. Hack Rom Tools