Blockchain Exploitation Labs - Part 2 Hacking Blockchain Authorization

Bypassing Blockchain Authorization via Unsecured Functions

Note: Since the first part of this series I have also uploaded some further videos on remediation of reentrancy and dealing with compiler versions when working with this hacking blockchain series.  Head to the console cowboys YouTube account to check those out.  Haha as mentioned before I always forget to post blogs when I get excited making videos and just move on to my next project… So make sure to subscribe to the YouTube if you are waiting for any continuation of a video series.. It may show up there way before here. 

Note 2:  You WILL run into issues when dealing with Ethereum hacking, and you will have to google them as versions and functionality changes often... Be cognizant of versions used hopefully you will not run into to many hard to fix issues. 

In the second part of this lab series we are going to take a look at privacy issues on the blockchain which can result in a vulnerably a traditional system may  not face. Since typically blockchain projects are open source and also sometimes viewable within blockchain explorers but traditional application business logic is not usually available to us. With traditional applications we might not find these issues due to lack of knowledge of internal functionality or inability to read private values on a remote server side script.  After we review some issues we are going to exploit an authorization issues by writing web3.js code to directly bypass vertical authorization restrictions.

Blockchain projects are usually open source projects which allow you to browse their code and see what's going on under the hood.  This is fantastic for a lot of reasons but a developer can run into trouble with this if bad business logic decisions are deployed to the immutable blockchain.  In the first part of this series I mentioned that all uploaded code on the blockchain is immutable. Meaning that if you find a vulnerability it cannot be patched. So let's think about things that can go wrong..

A few things that can go wrong:

• Randomization functions that use values we can predict if we know the algorithm
• Hard-coded values such as passwords and private variables you can't change.
• Publicly called functions which offer hidden functionality
• Race conditions based on how requirements are calculated

Since this will be rather technical, require some setup and a lot of moving parts we will follow this blog via the video series below posting videos for relevant sections with a brief description of each.  I posted these a little bit ago but have not gotten a chance to post the blog associated with it.  Also note this series is turning into a full lab based blockchain exploitation course so keep a lookout for that.

In this first video you will see how data about your project is readily available on the blockchain in multiple formats for example:

• ABI data that allows you to interact with methods.
• Actual application code.
• Byte code and assembly code.
• Contract addresses and other data.

 Lab Video Part 1: Blockchain OSINT: 

Once you have the data you need to interact with a contract on the blockchain via some OSINT how do you actually interface with it? That's the question we are going to answer in this second video. We will take the ABI contract array and use it to interact with methods on the blockchain via Web3.js and then show how this correlates to its usage in an HTML file

Lab Video Part 2: Connecting to a Smart Contract: 

Time to Exploit an Application:

Exploit lab time, I created an vulnerable application you can use to follow along in the next video. Lab files can be downloaded from the same location as the last blog located below. Grab the AuthorizationLab.zip file:

Lab file downloads:

https://github.com/cclabsInc/BlockChainExploitation

Ok so you can see what's running on the blockchain, you can connect to it, now what?   Now we need to find a vulnerability and show how to exploit it. Since we are talking about privacy in this blog and using it to bypass issues. Lets take a look at a simple authorization bypass we can exploit by viewing an authorization coding error and taking advantage of it to bypass restrictions set in the Smart Contract.  You will also learn how to setup a local blockchain for testing purposes and you can download a hackable application to follow along with the exercises in the video..

Lab Video Part 3:  Finding and hacking a Smart Contract Authorization Issue: 

Summary:

In this part of the series you learned a lot, you learned how to transfer your OSINT skills to the blockchain. Leverage the information found to connect to that Smart Contract. You also learned how to interact with methods and search for issues that you can exploit. Finally you used your browsers developer console as a means to attack the blockchain application for privilege escalation.

Continue reading

1. Hacking Tools Software
2. Hacker Tools Windows
3. Hacker Tools Online
4. Pentest Tools Subdomain
5. Hack Apps
6. Hacking Tools Usb
7. Pentest Tools List
8. Pentest Tools Kali Linux
9. Hacking Tools For Windows
10. Hack Tools
11. Hack Tools
12. Hacking Tools And Software
13. Pentest Tools Subdomain
14. Hacking Tools
15. Hacking Tools For Windows
16. Install Pentest Tools Ubuntu
17. Hacking Apps
18. What Are Hacking Tools
19. Hacking Tools For Pc
20. Ethical Hacker Tools
21. Wifi Hacker Tools For Windows
22. Hacker Tools Windows
23. Pentest Tools
24. Hacking App
25. Hack Tools
26. Growth Hacker Tools
27. Hackers Toolbox
28. Pentest Tools Android
29. Hacking Tools For Games
30. Hacking Tools For Pc
31. Computer Hacker
32. Hacker Security Tools
33. Pentest Tools For Android
34. Hacker Tools Online
35. Hacking Tools Name
36. Pentest Tools Bluekeep
37. Hacking Tools For Beginners
38. Hacking Tools Pc
39. Pentest Tools Review
40. Hack Tools Pc
41. Hacker Tools For Ios
42. Usb Pentest Tools
43. Physical Pentest Tools
44. Pentest Tools Port Scanner
45. Hacker Tools Github
46. What Are Hacking Tools
47. Hacker Tools Mac
48. Hacker Hardware Tools
49. Usb Pentest Tools
50. Hacking Tools For Windows Free Download
51. New Hacker Tools
52. Hacking Tools For Games
53. Hacker Tools Online
54. Wifi Hacker Tools For Windows
55. Hak5 Tools
56. Hacker Tools Apk Download
57. Hacking Tools For Windows
58. Hacker Techniques Tools And Incident Handling
59. Hacker Tools 2020
60. Hacking Tools And Software
61. Physical Pentest Tools
62. Install Pentest Tools Ubuntu
63. Hacker Tools For Pc
64. Hacker Techniques Tools And Incident Handling
65. Hacking Tools
66. Hack Apps
67. Pentest Tools Port Scanner
68. Hacking Tools For Windows 7
69. Pentest Tools
70. Hackrf Tools
71. Best Hacking Tools 2019
72. Pentest Tools Url Fuzzer
73. Hacking Tools Windows 10
74. Tools For Hacker
75. Hack Tools
76. Hack And Tools
77. Hack Tools
78. Hacker Tools Windows
79. Hacker Tools Hardware
80. Hack Tool Apk No Root
81. Hackers Toolbox
82. Kik Hack Tools
83. Github Hacking Tools
84. Pentest Automation Tools
85. Hacking Tools Hardware
86. Blackhat Hacker Tools
87. Hacker Tools Hardware
88. Tools Used For Hacking
89. Hack Tools Mac
90. Pentest Tools Kali Linux
91. Hacker Tools List
92. Hacking Tools For Windows
93. Hacker Techniques Tools And Incident Handling
94. Pentest Automation Tools
95. Hack Tools 2019
96. Hack Tools Github
97. Hack Tools Mac
98. Hacker Search Tools
99. Hacks And Tools
100. Hacker Tools List
101. Hacking Tools 2020
102. Hacker Security Tools
103. How To Make Hacking Tools
104. Hacker Tools For Pc
105. Usb Pentest Tools
106. Hacking Tools Online
107. World No 1 Hacker Software
108. Hack Rom Tools
109. Black Hat Hacker Tools
110. Hack Tool Apk
111. Tools 4 Hack
112. What Is Hacking Tools
113. Black Hat Hacker Tools
114. Tools 4 Hack
115. Github Hacking Tools
116. World No 1 Hacker Software
117. Pentest Tools Alternative
118. Usb Pentest Tools
119. Beginner Hacker Tools
120. Pentest Tools Free
121. Hacker Tools 2019
122. Pentest Tools For Windows
123. Hacker Tools 2019
124. Hacking Tools Free Download
125. Hack And Tools
126. Pentest Tools For Windows
127. Pentest Tools For Android
128. Usb Pentest Tools
129. Pentest Tools Alternative
130. Hack Tools Mac
131. Pentest Tools Framework
132. Hacker Tools For Pc
133. Hack Tools Github
134. Hacker Tools
135. Usb Pentest Tools
136. Hacker Tools For Pc
137. Hack Tool Apk
138. Android Hack Tools Github
139. Hack Tools Pc
140. How To Hack
141. Nsa Hack Tools
142. Pentest Tools Find Subdomains
143. Best Hacking Tools 2019
144. Hacking Tools Usb
145. Pentest Tools Tcp Port Scanner
146. Beginner Hacker Tools
147. Hacking Tools For Pc
148. Free Pentest Tools For Windows