Input Form Validation Bypass Using the Browser Console

Disclaimer: The techniques described in this post are intended for educational purposes only, and specific details have been intentionally omitted.

These methods should only be used on systems you own, manage, or have explicit permission to access. Unauthorized access to computer systems is illegal and unethical. Always obtain proper authorization before performing intrusive or manipulative actions on a web application. I assume no responsibility for any misuse of the information provided!

Background

Recently, as part of my client’s periodic password change activities, they encountered a problem where the Password field on the web interface’s login screen supported fewer characters than what the password was set to, locking them out of the device.

To make matters worse (for reasons I can’t get into here), the web browser and a text editor were the only tools available to investigate, troubleshoot, and bypass the interface’s limitations.

Investigation and Troubleshooting

Using the web browser’s Developer Tools, I was able to inspect the Password input field to better understand what was happening:

<input name="pass" type="Password" size="16" maxlength="16" value="">

Looking at the last password vault entry, I saw that the password was 29 characters long, so I tried entering the same password truncated to 16 characters, but it wasn’t accepted.

Luckily, there were other identical devices in the environment, so I logged into another one and inspected the Change Password field on a hunch. Sure enough, it was longer!

<input name="passChange" type="Password" size="20" maxlength="20" value="***">

This told me that when the password was changed, it was truncated to 20 characters, not 16!

Getting Warmer…

Now that I had a clear[er] understanding of the problem and the correct password, I tried to manipulate the client-side HTTP by increasing the size and maxlength values to 20, but encountered server-side code calling a form validation function, preventing me from submitting password greater than 16 characters:

if (pass.value.length > 16) err.addError (pass, "Invalid or Missing Password"); 
    err.showError(); 
    return !err.hasError();

In order to get around the script, I tried bypassing the form using the browser’s console to manually set the user name and password and then submit the form without clicking on the submit button, triggering the validation function:

document.getElementsByName("user")[0].value = "[myUsername]";
document.getElementsByName("pwd")[0].value = "[myTruncatedPassword]";
document.forms["[myLogonForm]"].submit();

…and…

It Worked!

This got me back into the device, so I first navigated to the password change setting and reset it to an acceptable length, then verified that I could get back in using the new password.

Lastly, I wrote a detailed summary for the client to share with the device’s manufacturer so [hopefully] they’ll update future revisions to use consistent password lengths.

Becoming a CISSP, Part II: Getting Certified

The CISSP Application

After provisionally passing the CISSP, I contacted a coworker who’d agreed to endorse me. For those who are unaware, passing the CISSP Exam does not automatically grant you the certification; you’re also required to:

  1. Meet ISC2’s CISSP experience requirements
  2. An existing CISSP member in good standing has to endorse you

Note: If you pass the exam but don’t possess the relevant experience, you will NOT be granted certification! Instead, you’ll become an “Associate of ISC2” and have 6 years to meet the experience requirements.

This entailed going through my resume and correlating my experience to their applicable CISSP Domains.  My application was submitted for endorsement within a couple of days, and the wait began…

I couldn’t help but feel deflated. I’d worked so hard to prepare for the exam and aced it, yet I still couldn’t call myself a CISSP! When faced with the inevitable, I did what I always do: I tried to put it out of my mind and move on.

Acceptance

About 4 weeks later, I received an email from ISC2 indicating that my application had been accepted and asking for my $125 annual maintenance fee. Upon payment, I received a follow-up email with my CISSP certification number.

I could at last breathe easy, knowing that it was finally over, and I could now celebrate my achievement in earnest! I did not yet have my physical certificate. It would be another 4 weeks before I arrived, and with it, disappointment…

The Card

While preparing for my CISSP, I stumbled on a couple of videos from a group called “Host Uknown”:

  1. Host Unkown presents: I’m a C I Double S P
  2. Benefits of being a CISSP

I found these to be a hilarious and welcome distraction amidst the stress of preparing for the CISSP exam. In particular, the second video led me to expect a card in addition to my physical certificate.

When the envelope containing my certificate arrived, I was disappointed to find that it didn’t include a card! Instead, I got a cheesy little pin… My disappointment was immeasurable. So much so that I actually reached out to ISC2, and was told this was something they discontinued due to COVID. While I can’t see why that would matter, I was powerless to do anything about it… save for maybe scanning my certificate and converting it to an SVG, then shrinking it down to business card-size, printing off and laminating it…

To be continued…

Becoming a CISSP, Part I: E-Day

Introduction

My previous post was intended to be a no-nonsense walkthrough of how I prepared for and ultimately passed the CISSP. I wanted to document how I felt then, and this is my attempt to capture that experience as well as I can describe it.

The Night Before…

It started snowing the night before my CISSP exam. After work, I replaced my windshield wiper blades and topped off my gas tank. To save time, I laid out my clothes for the following day and set my alarm for 6 AM. I was leaving nothing to chance and wanted no distractions.

At around 8:30 PM, I took an over-the-counter sleep aid and watched a CISSP Practice Question video. I answered the questions until my eyelids told me it was time to pass out.

Exam Day

I awoke at about 5:11 AM on Wednesday. I couldn’t get back to sleep, so I got up. While I got ready, I listened to a review video on cryptography and then drank my coffee while watching a review of Domain 4.

At 6:35 AM, I set out for the testing center. It was dark out, and snow further impaired visibility. Thankfully, the water on the roads wasn’t quite cold enough to freeze, but I took my time anyway, much to the annoyance of drivers behind me.

I arrived at the test center at 7:05 AM, parked my car, and spent another 15 minutes finishing my review. At this point, I was as prepared as I was ever going to get; no point putting it off any longer! I got out and made my way inside.

The testing center was on the 7th floor, and I was the first inside. I took a number, was handed some paperwork to read, and waited while others filed in. I was instructed to turn off my phone, so I had nothing to do but read notices posted on the walls while I waited to be processed.

After verifying my two forms of identification, palm vein scans were taken of both hands, and I was escorted to the testing area. I was briefed again on the rules, provided ear plugs and a dry-erase board, and seated in a cubicle.

I re-read the (ISC)2 NDA, accepted, and began the test.

The first question appeared on the screen. I studied the text, looking for clues as to what it was asking, and after one reading, I was stumped! I had no idea what they were on about… So I read the question again, slowly… no good!

I read through the answers, hoping for some insight. After what must have been 5 or 6 minutes, I clicked on what I thought was the best answer based on the scenario and clicked “Next”…

About 50 minutes in, the corner of the screen indicated that I’d only answered 35 questions (~1.5 minutes per question). Each question was just as confusing and difficult as the last one, indicating that I was either doing very well or poorly. In either case, I needed to pick up the pace.

At about an hour and a half in, I was up to question 70, averaging about 45 seconds per question. I was beginning to get the hang of the format, and neither hurried nor took my time – I focused only on what was in front of me, answered carefully, and then moved on to the next question.

For the next 35 minutes, my entire reality collapsed into the particular question in front of me. The question I’d just answered no longer existed, nor did the next question. My attention was focused solely on the fuzzy monitor, with no attention paid to anything outside its bezel’s boundaries. Before I knew it, I’d reached the dreaded Question 125

About the Computerized Adaptive Test (CAT)

When I sat for the exam in December of 2023, it was done via their Computerized Adaptive Test (CAT) format. The way (ISC)2 explains this is as follows:

CISSP CAT is a variable-length computerized adaptive examination. Each candidate will be presented with a minimum of 125 items and a maximum of 175 items. To receive a pass or fail result, a candidate must answer a minimum of 75 operational, or scored, items and may not answer more than 125 operational items. Each exam will contain 50 pre-test, or unscored items, as part of the minimum length examination. Pre-test items are items being evaluated for inclusion in future exams. A candidate will not be able to distinguish between operational and pre-test items; consequently, a candidate should consider each item carefully and provide the best possible response based on the information presented.

The CISSP exam has eight weighted domains, as mentioned in the exam outline. As an adaptive exam, exam items adjust to the candidate to allow for demonstration of minimal level level of mastery of concepts within each domain.

Candidates who pass the exam at 125 items have mastered enough concepts throughout all domains to prove proficiency. Candidates who do not pass the exam at 125 items have not shown the proficiency required throughout enough domains to achieve the minimal passing score. Candidates who exceed 125 items could be proficient in some domains, however, the presentation of additional items allows the candidate the opportunity to continue to prove proficiency in other domains so that they may achieve the minimal passing score.

Source: https://www.isc2.org/certifications/cissp/cissp-cat

Note: On April 15, 2024, the number of questions will be lowered from 125-175 to 100-150, and the time allotted will be reduced from four hours to three.

As such, “125” is the magic number; as soon as you click “Next,” you can expect one of three outcomes:

  1. You answered the minimum number of questions to provisionally pass the exam
  2. You answered below proficiency in so many questions that you could not pass, even if you were given another 50 to try to raise your average.
  3. The test continues at question 126 and gives you additional questions until one of the two conditions above is met. It ends at question 175, pass or fail, provided you don’t run out of time beforehand.

Just over two hours in, my test ended at question 125. The screen indicated it was over, so I raised my hand and waited for the test administrator to escort me out of the testing area.

I remember having mixed feelings just then; while I was relieved that it was over, I didn’t yet know if I’d passed or failed. If what I’d read was to be believed, getting lots of hard questions indicated that you were doing well. To me, the test started at an 11/10 difficulty (compared to the 2,500-3,000ish practice questions I’d taken) and never let up!

Once she noticed me, the test administrator quietly escorted me out of the test area. Then I noticed a handful of other people still taking various other exams; I had not previously noticed them, being so engrossed in my own test. She had me sign out with a second palm vein scan and then instructed me to return to the front desk to collect my results.

Three or four other testers were in line in front of me, so I got into the queue and patiently waited my turn. When I reached the front, I presented my ID again, and a few keystrokes later, my test results spat out of the printer. The employee collected a single sheet and presented it to me face down.

I quickly turned it over, and as my eyes scanned across the page, they settled on the word “Congratulations!”

I let out a deep yelp, gave the test administrator a high five, and then returned to my vehicle. Before setting off for home, I notified a friend, my wife, and my manager, then set the page on the passenger seat and made the journey home.

I celebrated with a couple of breakfast burritos (I elected not to eat breakfast that morning) and reached out to a co-worker for endorsement.

To be continued…

I Passed the CISSP Exam!

“…The people who pass are those that simply start and keep going. They have grit and determination. They show up. Then there is everyone else. They don’t.”
– Nathan House, CEO, StationX

Preface

On December 27th, 2023, I passed the Certified Information Systems Security Professional (CISSP) exam on my first attempt at question 125, roughly 2 hours and 5 minutes in. This post is to share how I managed it, what helped me, and what didn’t.

About the CISSP Exam

At the time of writing, the English-language CISSP exam is only offered in CAT (Computerized Adaptive Testing) format and is between 125 and 175 [multiple-choice] questions long.

For those who are taking the exam on or after April 15, 2024, be aware of the following changes:

  • Domain 1’s weight increases by 1%, and Domain 8’s weight decreases by 1%
  • The total number of questions will be reduced from 125-175 to 100-150
  • The time limit will be reduced from 4 hours to 3 hours

Preparation Strategy

Beginning in August, I committed to spending 5-7 hours a week on CISSP study, which included books (physical and digital), video courses, and practice questions.

Courses and videos:

  • Derek Fisher’s Ultimate Cybersecurity Course & CISSP Exam Prep (StationX, August-October 2023)
  • Thor Pedersen’s CISSP Video Bootcamp series (StationX, October-December 2023)
  • Peter Zerger’s CISSP Exam Cram (YouTube, December 2023)

Derek Fisher’s course is a good introduction to the CISSP material but doesn’t go into much detail. I object to using the word “ultimate” in the title because this implies that it’s the final word when it should be the first.

Thor Pedersen’s course goes into much more detail and includes other goodies such as external links, downloadable study notes, and practice quizzes for each domain.

Peter Zerger’s CISSP Exam Cram was the best of both worlds, concise and complete.

Books:

  • The Official (ISC)2 CISSP CBK Reference 6th Edition
  • (ISC)2 CISSP Official Study Guide (both 8th and 9th editions)
  • All-In-One CISSP Exam Guide 8th Edition
  • How to Think Like a Manager for the CISSP Exam

I didn’t read any of these books cover-to-cover. Instead, I used them as reference material and for their practice questions.

Practice Questions:

  • End-of-domain course quizzes
  • Peter Zerger’s CISSP practice test
  • CISSP Official Practice Tests
  • TotalTester CISSP practice exams (came with All-In-One CISSP Exam Guide)
  • WannaPractice CISSP practice exams
  • Boson CISSP practice exams

Altogether, I completed about 3,000 practice questions. This helped me develop my time management, question analysis, and answer evaluation skills. It also helped me to identify which areas I was weakest in so I could focus my study efforts.

In the last week leading up to my test date, I averaged 80-84% across multiple sources on my complete practice exams.

Additional Activities:

  • I actively participated in an online study group hosted on StationX. I posted a summary of my weekly progress and screenshots of quiz/test results and articulated my intentions for the following week. This helped me stay on track and accountable.
  • I explained the CISSP concepts I was learning to friends and family members. Thor Pedersen is a big advocate of this, and I can attest that if you can’t teach it, you don’t understand it.
  • I invented mnemonics to memorize concepts I struggled with but was unlikely to ever use in my day-to-day work.
  • I researched topics from sources that were not CISSP-specific/centric (e.g., cryptographic systems, networking concepts, security models, etc.). The CBK doesn’t always provide detailed information, so having additional sources of information helped me contextualize what I was learning.

Afterthoughts

In a conversation with Nathan House, CEO of StationX, shortly after passing the exam, he said to me:

“I knew you would pass. If not the first time then the next. Because I see it all the time. The people who pass are those that simply start and keep going. They have grit and determination. They show up. Then there is everyone else. They don’t.”

There’s a lot of truth to that. Passing the CISSP exam has been a professional goal of mine for years, and I wasn’t entirely sure I could do it until I did. It’s also important to understand who it’s for and what it’s supposed to represent.

This is not an entry-level certification, despite many job postings that would elude to the contrary. It’s intended for experienced professionals with 5 years of experience (or 4 years of experience and a four-year degree or one of a handful of certifications).

That’s not to say that you couldn’t study hard and pass it with little to no preparation or experience; some have, but why would you want to? What would this prove other than to suggest that you’re a good test taker? Waiting until I had the requisite experience, desire, and incentives made the process all the more worthwhile.

My best advice to anyone considering taking the CISSP is to ensure you have as much time as you need. Think of it as a marathon rather than a sprint. For me, this took about four and a half months. As you work your way through the process, test your knowledge often and focus your time on the areas you’re weakest in.

Above all, try to learn, retain, and apply something new every day.

Parameter Hunting: Part II

In my last post on the subject, I discussed the concept of using Process Explorer to discover switches you can use for unattended installs/uninstalls used in enterprise software deployment.

Like before, I have a pesky setup.exe package that wants to guide me through an installation GUI, and would not respond to the usual setup.exe /s /q etc. and so forth…

This particular installer was for a very obscure serial hub manufacturer so there was Googling my way out of this; instead I needed to figure out what was used to build the installer, then work backward from there.

Once against, I launched my trusty Process Explorer (as Administrator) and inspected the setup.exe’s process…to my delight, scrolling down the “Strings” tab I came across this:

Note the string, “This installation was built with Inno Setup.” With that in mind, I was able to look up the documentation associated with the package builder to discover the built-in parameters I needed for silent installation.

While this specific technique might not work for every situation, it never hurts to have another tool in your toolbox!