TR | EN
:::    ::: :::   :::  ::::::::  :::::::::: :::::::::::     :::     
:+:    :+: :+:   :+: :+:    :+: :+:            :+:       :+: :+:   
+:+    +:+  +:+ +:+  +:+        +:+            +:+      +:+   +:+  
+#++:++#++   +#++:   :#:        +#++:++#       +#+     +#++:++#++: 
+#+    +#+    +#+    +#+   +#+# +#+            +#+     +#+     +#+ 
#+#    #+#    #+#    #+#    #+# #+#            #+#     #+#     #+# 
###    ###    ###     ########  ########## ########### ###     ###

HYGEIA

Vulnerable Web Application
navigation.exe
project_details.exe
- โ–ก ร—

HYGEIA is a vulnerable web application designed for practice. It contains vulnerabilities from OWASP TOP 10 2017 and 2021. Unlike other vulnerable machines, it is planned as a machine for preparing a pentest report by finding vulnerabilities, rather than simply finding flags. The project is built with SpringBoot for the backend and Thymeleaf for the frontend, with PostgreSQL used as the database. This project was developed as a joint effort between two individuals as our final assignment.

In this vulnerable application, 14 different total of 17 vulnerabilities have been included. So a vulnerability occurs in various locations and in different ways.

An example - SQL Injection

In the HYGIEA application, there are two instances of SQL injection vulnerability. One is located in an area created for users to view and update their own information, while the other is found in the password reset function of the application. In our first example, our information form appears as follows:

User Information Form

Let's examine the request sent by the user to view this information form on the site.

HTTP Request

Now, let's examine the code snippet related to this area to see how the application processes the parameter sent to the backend.

Code Snippet

If we examine the given code snippet, we can see that the query retrieves various information such as email, address, phone number, etc., from the "users" table based on the username parameter sent in the request. The main issue in this query arises from the fact that the "username" parameter is directly inserted into the query without any filtering measures. In this case, if a user intercepts the query using a proxy and changes their input for the given username to 'SaadetElif';SELECT PG_SLEEP(5)โ€”-, the final form of the query executed in the backend would be as follows:

SQL Query
SELECT email, address, phone_number FROM users WHERE username = 'SaadetElif';SELECT PG_SLEEP(5)โ€”-';
SQL Injection Payload
Response Time
Burp Suite Response

This would cause the backend to execute the injected SQL command (SELECT PG_SLEEP(5)) along with the legitimate query, resulting in a delay of 5 seconds before responding.

Following this situation, we can use the SQLMAP tool to obtain all the information from the database.

SQLmap Usage
SQLmap Results
๐Ÿ”— HYGIEA Vulnerable Web App Github
( ใฃโ—”โ—กโ—”)ใฃ ๐Ÿ’ป
CODE WITH CHAOS, HACK WITH LOVE!
โ†ณ lzzaps3c was here ๐Ÿ’œ