Blockchain Exploitation Labs - Part 2 Hacking Blockchain Authorization

Bypassing Blockchain Authorization via Unsecured Functions

Note: Since the first part of this series I have also uploaded some further videos on remediation of reentrancy and dealing with compiler versions when working with this hacking blockchain series.  Head to the console cowboys YouTube account to check those out.  Haha as mentioned before I always forget to post blogs when I get excited making videos and just move on to my next project… So make sure to subscribe to the YouTube if you are waiting for any continuation of a video series.. It may show up there way before here. 

Note 2:  You WILL run into issues when dealing with Ethereum hacking, and you will have to google them as versions and functionality changes often... Be cognizant of versions used hopefully you will not run into to many hard to fix issues. 

In the second part of this lab series we are going to take a look at privacy issues on the blockchain which can result in a vulnerably a traditional system may  not face. Since typically blockchain projects are open source and also sometimes viewable within blockchain explorers but traditional application business logic is not usually available to us. With traditional applications we might not find these issues due to lack of knowledge of internal functionality or inability to read private values on a remote server side script.  After we review some issues we are going to exploit an authorization issues by writing web3.js code to directly bypass vertical authorization restrictions.

Blockchain projects are usually open source projects which allow you to browse their code and see what's going on under the hood.  This is fantastic for a lot of reasons but a developer can run into trouble with this if bad business logic decisions are deployed to the immutable blockchain.  In the first part of this series I mentioned that all uploaded code on the blockchain is immutable. Meaning that if you find a vulnerability it cannot be patched. So let's think about things that can go wrong..

A few things that can go wrong:

• Randomization functions that use values we can predict if we know the algorithm
• Hard-coded values such as passwords and private variables you can't change.
• Publicly called functions which offer hidden functionality
• Race conditions based on how requirements are calculated

Since this will be rather technical, require some setup and a lot of moving parts we will follow this blog via the video series below posting videos for relevant sections with a brief description of each.  I posted these a little bit ago but have not gotten a chance to post the blog associated with it.  Also note this series is turning into a full lab based blockchain exploitation course so keep a lookout for that.

In this first video you will see how data about your project is readily available on the blockchain in multiple formats for example:

• ABI data that allows you to interact with methods.
• Actual application code.
• Byte code and assembly code.
• Contract addresses and other data.

 Lab Video Part 1: Blockchain OSINT: 

Once you have the data you need to interact with a contract on the blockchain via some OSINT how do you actually interface with it? That's the question we are going to answer in this second video. We will take the ABI contract array and use it to interact with methods on the blockchain via Web3.js and then show how this correlates to its usage in an HTML file

Lab Video Part 2: Connecting to a Smart Contract: 

Time to Exploit an Application:

Exploit lab time, I created an vulnerable application you can use to follow along in the next video. Lab files can be downloaded from the same location as the last blog located below. Grab the AuthorizationLab.zip file:

Lab file downloads:

https://github.com/cclabsInc/BlockChainExploitation

Ok so you can see what's running on the blockchain, you can connect to it, now what?   Now we need to find a vulnerability and show how to exploit it. Since we are talking about privacy in this blog and using it to bypass issues. Lets take a look at a simple authorization bypass we can exploit by viewing an authorization coding error and taking advantage of it to bypass restrictions set in the Smart Contract.  You will also learn how to setup a local blockchain for testing purposes and you can download a hackable application to follow along with the exercises in the video..

Lab Video Part 3:  Finding and hacking a Smart Contract Authorization Issue: 

Summary:

In this part of the series you learned a lot, you learned how to transfer your OSINT skills to the blockchain. Leverage the information found to connect to that Smart Contract. You also learned how to interact with methods and search for issues that you can exploit. Finally you used your browsers developer console as a means to attack the blockchain application for privilege escalation.

Related links

1. Computer Hacker
2. Android Hack Tools Github
3. Hacker Tools For Windows
4. Hacker Tools For Pc
5. Best Pentesting Tools 2018
6. Nsa Hacker Tools
7. Pentest Tools Alternative
8. Nsa Hack Tools Download
9. Pentest Tools Windows
10. Hacking Tools For Games
11. Beginner Hacker Tools
12. Wifi Hacker Tools For Windows
13. Pentest Tools Online
14. Top Pentest Tools
15. Hack Apps
16. Hack Rom Tools
17. Top Pentest Tools
18. Hack Tools For Ubuntu
19. Hacking Tools Online
20. New Hacker Tools
21. Ethical Hacker Tools
22. Hack App
23. Install Pentest Tools Ubuntu
24. Hacking Tools For Pc
25. Hack Tools Online
26. Pentest Recon Tools
27. Hacker Tools For Mac
28. Hacker Tools Free
29. Ethical Hacker Tools
30. Hack Tool Apk
31. Nsa Hack Tools
32. Hack App
33. Hack Tools Pc
34. Wifi Hacker Tools For Windows
35. Hacking Tools For Mac
36. Pentest Tools Kali Linux
37. Hack Tools Online
38. Hack Tools Github
39. Hacking Tools 2019
40. Hacker
41. Tools Used For Hacking
42. Black Hat Hacker Tools
43. Pentest Tools For Ubuntu
44. Hack Tools
45. Hack Tools For Pc
46. Hack Tools Online
47. Underground Hacker Sites
48. Best Hacking Tools 2019
49. Hack Tools Mac
50. Hack Tools
51. Pentest Tools Website Vulnerability
52. Pentest Tools Alternative
53. Tools 4 Hack
54. Hacker Tools For Mac
55. Hack Tools 2019
56. Hackers Toolbox
57. Pentest Reporting Tools
58. Hacker Tools For Pc
59. Computer Hacker
60. Growth Hacker Tools
61. Hack Tools For Windows
62. Hacker Tools Apk
63. Pentest Tools For Ubuntu
64. How To Install Pentest Tools In Ubuntu
65. Hacker Tools For Pc
66. Hacking Tools Github
67. Hacking Tools For Windows 7
68. Hacking Tools Online
69. Hacking Apps
70. Hack Tools For Mac
71. Hacker Tools List
72. Kik Hack Tools
73. Hacking Tools Windows 10
74. Hacking Tools Software
75. Hacking Tools Windows
76. Nsa Hacker Tools
77. Pentest Tools Github
78. New Hack Tools
79. Hacking Tools For Windows Free Download
80. Hack Tools For Pc
81. Hacker Tools Free
82. Physical Pentest Tools
83. Underground Hacker Sites
84. Hacks And Tools
85. Hacking Tools Free Download
86. Hacking Tools For Windows
87. Nsa Hack Tools Download
88. Hacker Tools 2019
89. Pentest Tools Url Fuzzer
90. Hacker Tools Free Download
91. Hacking Tools Mac
92. Hacking Tools Github
93. Hacking Apps
94. Hacking Tools Pc
95. Pentest Recon Tools
96. Hacking Tools Name
97. Hacking Tools Windows
98. Hack Tools For Windows
99. Usb Pentest Tools
100. Pentest Tools
101. Install Pentest Tools Ubuntu
102. Hacker Hardware Tools
103. Hack Tools For Pc
104. Termux Hacking Tools 2019
105. Pentest Tools Url Fuzzer
106. Termux Hacking Tools 2019