Challenge 1: 

Name: Poison Null Byte

Description: Bypass a security control with a Poison Null Byte to access a file not meant for your eyes.

Difficulty: 4 star

Category: Improper Input Validation

Expanded Description: https://pwning.owasp-juice.shop/part2/improper-input-validation.html

Challenges 2-5: 

Name: Easter Egg, Forgotten Developer Backup, Forgotten Sales Backup, and Misplaced Signature File

Tools used:

Burp, FoxyProxy

Resources used:

URL Encoding Table

Methodology:

The Poison Null Byte challenge is one of my favorites, because it’s such a simple trick that opens up so many seemingly closed doors on the FTP page. First, we need to know what the restrictions are on what we can and can’t download.

<img src="https://curiositykillscolby.files.wordpress.com/2020/11/image-144.jpeg?w=392&quot; alt="Response Headers Raw Render Pretty Actions V H-rrp/l.1 403 Forbidden Access-Cont rol -Allow-Origin: T -Type-options: nosniff SAMEORIGIN Feature-policy: payment 'self' Content -Type: text 'html; charset=utf-8 7 Vary: Accept -Encoding Date: Thu, OS Nov 2020 GMT Connection: close _O Content -Length: 19 <meta charset='utf-8 > Error: Only . md and .pdf files are allowed!

OK, so only .md and .pdf files can be downloaded. Fair enough. But by using a URL encoded null byte (%2500), it’s possible to bypass this restriction. Basically what we’re doing here is saying “I want file X.gg”, and letting the null byte do two things. First, it allows you to add new file extensions to GET requests to bypass the filetype restriction. Second, it serves as a break between the intended filename and any added file extension so that the correct file is downloaded.

The key is to put that URL encoded null byte at the end of the file extension, then add “.md” after it. Then, download all of the things! Seriously, download everything but the quarantined malware. The rest of the images in this post will be which files lead to challenge solutions.

<img src="https://curiositykillscolby.files.wordpress.com/2020/11/image-146.jpeg?w=341&quot; alt="Response Headers P retty Render 200 0K Actions Access-Cont rol -Allow-Origin: X-Content -Type-options: nosniff 4 OX-Frame-options: SAMEORIGIN Feature-policy: payment 'self' Accept -Ranges: bytes Cache-Cont rot: public, max-age=O Last -Modified: Mon, 14 sep 2020 08:01 GMT n,' '83-1748ba27d20 Content -Type: application/ octet -st ream Content -Length: 131 Date: Thu, OS Nov 2020 Gt•rr 12 Connection: close n <MibgC7sn 16 mWS#gC7sn 011VigC7sn 17 k#pDI gC7sn 18 oil] pgC7sn 19 n ( XRvgC7sn 20 n ( XLt gC7sn 21 q:

Prevention and Mitigation Strategies:

OWASP Input Validation Cheat Sheet

Lessons Learned: 

Nothing. I’ve always liked the poison null byte, ever since I looked up why the YouTube channel Null Byte (where I spent/spend a lot of time) chose its name.