Challenge:
Name: Extra Language
Description: Retrieve the language file that never made it into production.
Difficulty: 5 star
Category: Broken Anti-Automation
Expanded Description: https://pwning.owasp-juice.shop/part2/broken-anti-automation.html
Tools used:
Burp Suite, FoxyProxy
Resources used:
Methodology:
In the expanded description for this challenge it is suggested that I figure out how the language changes take place, then either find the correct language code via either brute force (which is implied to take significant time), or to investigate what languages are available in this format.
Fair enough. I began by changing the language from English to Spanish (because I’d like to use the three quarters of Spanish I took at some point) and intercepted the packet to see how the server both received that update, and how it applied that update.
Then, to be thorough, I changed the language several more times to see if a pattern emerged in the language codes.
Sure enough, they were primarily in two formats: xx_XX.json or xx.json.
When the server responded to these requests, it sent a large JSON object back containing 30k+ bits of text.
Knowing that my task was to find an unlisted language, I sought out a list of i18n formatted language file names, eventually finding a very long list of file names in a GitHub repository.
From there, I used Burp Suite’s Intruder tool to execute a “Sniper” attack, spamming the server with requests for every language file listed within the repository.
Lots of languages returned properly, but judging by the fact that I wasn’t greeted with a green banner, I knew that the correct code hadn’t been requested. With over 300 language files tested (using Burp’s painfully throttled mechanism instead of my currently broken wfuzz application), and still no luck, I gave in and read the Solution Guide entry, learning that I should have read the Companion Guide’s Translation page, where I could have linked to another page listing all of the available languages, one of which was Klingon using the code “tlh_AA”. Boy am I glad I didn’t opt for brute force, because I still wouldn’t have found it.
Curiosity Kills Colby 