Getting Zapped
Intro
Bug Bounty Boot Camp has an entire chapter devoted to setting up a Bug Hunting environment. The chapter focuses on Burp Suite. I gained some degree of familiarity with Burp Suite while studying for my OSCP as well as doing some of the Challenges on the PortSwigger Academy.
By many people Burp Suite is considered the Web Application Hacker tool of choice. It comes in 2 flavors, the community version and the paid version. The community version is good for most things that you would do in Bug Bounty but it has its limitations.
ZED Attack Proxy
ZED Attack Proxy was created by the Open Worldwide Application Security Project (OWASP) starting in 2010. In 2024 ZAP was taken over by Checkmarx. ZAP offers features that would normally require the paid version of Burp Suite such as Web Application vulnerability scanning.
Taking ZAP for a Spin
To give ZAP a try I started with a simple Lab from PortSwigger Academy that involved Simple Path Traversal. A Path Traversal Vulnerability allows a remote attacker to manipulate the web server to display sensitive files such as the password file on a Linux system.
Doing The Lab With Burp
Starting at PortSwigger Academy I navigated to the File Path Traversal section and chose the File Path traversal, simple case lab. When you enter the lab you are presented with this standard looking shopping site.
Once the browser is set to proxy through Burp suite there are 2 options. The first is to intercept all the connections until the one where the product image is requested.
The Get request looks like thisGET /image?filename=9.jpg HTTP/2
By right clicking this request we can send the request to the Repeater function and modify it to send to the web site.
If we edit the filename to be ../../../etc/passwd and send it forward to the web site we get a copy of the /etc/passwd .
The second option which I will not cover here is to look through the HTTP History and find the image file GET request and send that to the Repeater Module, then follow the same steps.
A roundabout way to the Solution
In order to familiarize myself with ZAP I watched some introductory videos. One of those videos pointed to a feature called Breakpoints and gave an illustration. I decided to try and use that as a way to solve this lab using ZED.
Starting the same way I did with Burp I found where the Browser requested the image file. This was actually easier in ZED proxy because the proxied data was separated into folders. I just looked in the folder for the lab.
Once there I set a Break Point and reloaded the page
The page reloaded and ZED stopped at the break point pausing the loading of the page
The request is shown below
GET https://0a2d005b03f88ee3830005c1002600a8.web-security-academy.net/image?filename=20.jpg HTTP/1.1
Host: 0a2d005b03f88ee3830005c1002600a8.web-security-academy.net
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Referer: https://0a2d005b03f88ee3830005c1002600a8.web-security-academy.net/product?productId=1
Cookie: session=eKe5RLMDgtx011sKwEOfpMxlfl3Qn8yo
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=5
Here is the edited file name that will be sent to the server to do the path Traversal
GET https://0a2d005b03f88ee3830005c1002600a8.web-security-academy.net/image?filename=../../../etc HTTP/1.1
Host: 0a2d005b03f88ee3830005c1002600a8.web-security-academy.net
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Referer: https://0a2d005b03f88ee3830005c1002600a8.web-security-academy.net/product?productId=1
Cookie: session=eKe5RLMDgtx011sKwEOfpMxlfl3Qn8yo
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=5
Once the edits are done, it is simply a matter of continuing. According to the lab I successfully solved the lab despite never seeing the password file.
Getting it done the right way
While the lab is marked as solved I wasn't able to see the password file and in a real bug hunting situation that would not be a valid finding. I needed to treat this like a real bug bounty so I needed the proof. POC || GTFO !
This sent me back to YouTube and looking for the right solution. I found that solution in a video that did this exact lab using ZAP.
Like the previous example it all starts with finding the request for the image file. This time we skip the idea of a breakpoint and right click on the request to pull up a menu. On that menu there is an option to Open/Resend With Request Editor
This is what I needed. By choosing this option on the menu another window will open that will allow me to edit the request and send it to the server. Once sent I can see the Response in the Response Tab
Going to the Response tab shows no results. This is due to the Body Type setting being an image. It must be changed to Text.
Now there is the proof that the lab was solved.
One other option
There was a second option offered called Open In Requester Tab. Requester Tab is an optional add-on that acts like the Request Editor dialog but supports as many sub-tabs as you need.
This opens up a Requester tab in the main window instead of a new window and shows the current request and response
Once the Request is edited it can be sent and the Response can be viewed in the same window.
The Conclusion
Once I was more familiar with what ZAP had to offer and I got a better sense of the features it was time to make a decision. The decision is obviously not to make a decision. These are tools and when looking at tools you pick the one best for the job. I have always been fond of saying "If the only tool you have is a hammer then you treat every problem like a nail".
ZAP is a tool in my tool box and I will use it where it works best. The same with Burp Suite and any other tool that comes across my radar. A good concrete example: ZAP's built-in Web Application vulnerability scanner, which normally costs extra with Burp, is exactly the kind of gap I'll reach for ZAP to fill.
Until Next Time
With this post behind me I will be starting my recon of the Fiserv bug bounty program. My next post will talk a little about recon and give examples of some of the tools I decided to use when enumerating this target.