Transparency Myanmar

transparency.myanmar@gmail.com


Bypassing Blockchain Authorization via Unsecured Functions


Note: Since the first part of this series I have also uploaded some further videos on remediation of reentrancy and dealing with compiler versions when working with this hacking blockchain series.  Head to the console cowboys YouTube account to check those out.  Haha as mentioned before I always forget to post blogs when I get excited making videos and just move on to my next project… So make sure to subscribe to the YouTube if you are waiting for any continuation of a video series.. It may show up there way before here. 

Note 2:  You WILL run into issues when dealing with Ethereum hacking, and you will have to google them as versions and functionality changes often... Be cognizant of versions used hopefully you will not run into to many hard to fix issues. 

In the second part of this lab series we are going to take a look at privacy issues on the blockchain which can result in a vulnerably a traditional system may  not face. Since typically blockchain projects are open source and also sometimes viewable within blockchain explorers but traditional application business logic is not usually available to us. With traditional applications we might not find these issues due to lack of knowledge of internal functionality or inability to read private values on a remote server side script.  After we review some issues we are going to exploit an authorization issues by writing web3.js code to directly bypass vertical authorization restrictions.

Blockchain projects are usually open source projects which allow you to browse their code and see what's going on under the hood.  This is fantastic for a lot of reasons but a developer can run into trouble with this if bad business logic decisions are deployed to the immutable blockchain.  In the first part of this series I mentioned that all uploaded code on the blockchain is immutable. Meaning that if you find a vulnerability it cannot be patched. So let's think about things that can go wrong..

A few things that can go wrong:
  • Randomization functions that use values we can predict if we know the algorithm
  • Hard-coded values such as passwords and private variables you can't change.
  • Publicly called functions which offer hidden functionality
  • Race conditions based on how requirements are calculated

Since this will be rather technical, require some setup and a lot of moving parts we will follow this blog via the video series below posting videos for relevant sections with a brief description of each.  I posted these a little bit ago but have not gotten a chance to post the blog associated with it.  Also note this series is turning into a full lab based blockchain exploitation course so keep a lookout for that.

In this first video you will see how data about your project is readily available on the blockchain in multiple formats for example:
  • ABI data that allows you to interact with methods.
  • Actual application code.
  • Byte code and assembly code.
  • Contract addresses and other data.

 Lab Video Part 1: Blockchain OSINT: 



Once you have the data you need to interact with a contract on the blockchain via some OSINT how do you actually interface with it? That's the question we are going to answer in this second video. We will take the ABI contract array and use it to interact with methods on the blockchain via Web3.js and then show how this correlates to its usage in an HTML file

Lab Video Part 2: Connecting to a Smart Contract: 




Time to Exploit an Application:

Exploit lab time, I created an vulnerable application you can use to follow along in the next video. Lab files can be downloaded from the same location as the last blog located below. Grab the AuthorizationLab.zip file:

Lab file downloads:



Ok so you can see what's running on the blockchain, you can connect to it, now what?   Now we need to find a vulnerability and show how to exploit it. Since we are talking about privacy in this blog and using it to bypass issues. Lets take a look at a simple authorization bypass we can exploit by viewing an authorization coding error and taking advantage of it to bypass restrictions set in the Smart Contract.  You will also learn how to setup a local blockchain for testing purposes and you can download a hackable application to follow along with the exercises in the video..

Lab Video Part 3:  Finding and hacking a Smart Contract Authorization Issue: 





Summary:

In this part of the series you learned a lot, you learned how to transfer your OSINT skills to the blockchain. Leverage the information found to connect to that Smart Contract. You also learned how to interact with methods and search for issues that you can exploit. Finally you used your browsers developer console as a means to attack the blockchain application for privilege escalation.

More info


  1. Pentest Tools Windows
  2. Pentest Box Tools Download
  3. Pentest Tools Bluekeep
  4. Hack App
  5. Ethical Hacker Tools
  6. Pentest Box Tools Download
  7. Hacking Tools Usb
  8. Hacker Tools 2019
  9. Pentest Tools Nmap
  10. Hacking App
  11. Growth Hacker Tools
  12. Hacking Tools For Windows Free Download
  13. Hack Tools Online
  14. Bluetooth Hacking Tools Kali
  15. Pentest Tools For Mac
  16. Hacking Tools For Windows
  17. Hackers Toolbox
  18. Nsa Hack Tools
  19. Usb Pentest Tools
  20. Hackers Toolbox
  21. Pentest Recon Tools
  22. Hacking Tools Kit
  23. Pentest Tools Apk
  24. Hacks And Tools
  25. Hacking Tools Hardware
  26. Pentest Recon Tools
  27. Hack Tool Apk No Root
  28. Hack And Tools
  29. Hacker
  30. Best Pentesting Tools 2018
  31. Hack Tools For Games
  32. Hacker Tools For Mac
  33. Hack Tool Apk No Root
  34. Nsa Hack Tools Download
  35. Hack Tools Pc
  36. Hacking Tools Free Download
  37. Beginner Hacker Tools
  38. Hacking Tools Github
  39. Hacking Tools For Pc
  40. Hacking Tools For Games
  41. Hacking Tools For Kali Linux
  42. Hack Tools Download
  43. Physical Pentest Tools
  44. Hacking Tools Software
  45. Pentest Tools Tcp Port Scanner
  46. Blackhat Hacker Tools
  47. Hack Tools Github
  48. Black Hat Hacker Tools
  49. Pentest Recon Tools
  50. Hacking App
  51. Pentest Tools Find Subdomains
  52. Pentest Tools Windows
  53. Hacking Apps
  54. Pentest Tools Android
  55. Pentest Tools Open Source
  56. Best Hacking Tools 2020
  57. Hack Website Online Tool
  58. New Hacker Tools
  59. Hacking Tools Usb
  60. Hack And Tools
  61. Hacker Tools 2019
  62. Pentest Tools Linux
  63. Pentest Tools Port Scanner
  64. Pentest Tools Find Subdomains
  65. Hacker Tools Hardware
  66. Hacking Tools Kit
  67. Hacking Tools For Windows
  68. Hacking Tools For Windows Free Download
  69. Hacker Tools 2019
  70. Pentest Tools Website Vulnerability
  71. Tools 4 Hack
  72. Hacker Tools Apk Download
  73. Hacking Apps
  74. Hacker Tools For Ios
  75. Hacker Tools For Pc
  76. Hack Tools
  77. Hacking Tools For Windows
  78. Computer Hacker
  79. World No 1 Hacker Software
  80. Hacking Tools For Games
  81. Hacking Tools For Windows Free Download
  82. Hack Tool Apk
  83. How To Make Hacking Tools
  84. Hacking Tools Kit
  85. What Is Hacking Tools
  86. Hacking Tools For Windows 7
  87. Hacker Tools For Pc
  88. Hacking Tools For Games
  89. Pentest Tools Download
  90. Hacker Security Tools
  91. Hacking Tools Pc
  92. Hacking Tools Github
  93. Hacking Tools 2019
  94. Hacker Tools Hardware
  95. Pentest Tools Url Fuzzer
  96. Pentest Reporting Tools
  97. Hacking Tools
  98. Pentest Tools Download
  99. Tools For Hacker
  100. Hack Tools For Games
  101. Best Hacking Tools 2019
  102. Pentest Tools Subdomain
  103. Pentest Automation Tools
  104. Hacking Tools
  105. Computer Hacker
  106. Hacker Tool Kit
  107. Pentest Automation Tools
  108. Pentest Recon Tools
  109. Pentest Tools Download
  110. Pentest Tools Website
  111. Hack Rom Tools
  112. Hacking Tools Hardware
  113. Hack And Tools
  114. Hacking Tools Windows 10
  115. Pentest Tools Open Source
  116. Hacking Tools Kit
  117. Pentest Tools For Mac
  118. World No 1 Hacker Software
  119. Hacking Tools For Windows
  120. Pentest Tools Online
  121. Pentest Tools Bluekeep
  122. Hacker Tools Apk Download
  123. Hacker Hardware Tools
  124. Blackhat Hacker Tools
  125. Pentest Tools Open Source
  126. Nsa Hacker Tools
  127. Kik Hack Tools
  128. Pentest Tools For Ubuntu
  129. Hacker Tools Software
  130. Pentest Tools
  131. Hacking Tools 2019
  132. Hacking Tools Windows 10
  133. Blackhat Hacker Tools
  134. Hack Tool Apk
  135. Pentest Tools For Android
  136. Tools Used For Hacking
  137. Pentest Tools Online
  138. Computer Hacker
  139. Pentest Tools For Mac
  140. Pentest Tools Android
  141. Hacker Tool Kit
  142. Pentest Tools Linux
  143. Growth Hacker Tools
  144. Hack Tools Github
  145. Best Hacking Tools 2019
  146. Hacking Tools Pc
  147. Growth Hacker Tools
  148. Hacker Security Tools
  149. New Hack Tools
  150. Hack Tool Apk
  151. Easy Hack Tools
  152. Hacking Tools For Pc
  153. Hack Tools For Mac
  154. Hacker Tools Windows
  155. Ethical Hacker Tools
  156. Hacking Tools For Windows Free Download
  157. Hack Tools For Pc
  158. Pentest Tools Apk
  159. Hacker Tools Linux
  160. Hack And Tools
  161. Best Pentesting Tools 2018
  162. Hacker Tools Mac
  163. Usb Pentest Tools
  164. Hacker Tools Free Download

0 comments:

Post a Comment