All right, welcome back.
Folks, this is a mission and decision is about the demo, the demo of bypassing the log in.
But Bob Sweet, we have done it with Manuel Manuel Way.
But this is about automatically, you know, on automation, where we be using a wonderful tool box.
Let's get started for this.
Let's log in to our Kelly machine.
Usually as a practice, you can actually do it from your post machine, from your windows or whatever
it is.
You don't need to be in a secure environment like Carly or other stuff.
You don't need that.
But just to make sure we have everything in one place, I'll be using Kelly.
OK, so it started.
And now on the other side, on the other side.
On the other side, we need the target.
The target is still our.
Tara.
OK, so as so far we know, we can launch the browser from here.
So there we go.
Let's keep the intercept off.
Let's go to Altero.
Nuccio.
As a first step, what we need, we need a sample, let's sign in, and now we can put the test and
the test.
OK, and now let's turn on the inducer.
And the moment we click on the login, we should see the post.
Right.
You could see this is the request.
A study report request comes here.
Now we going to send it to OK, so this is OK.
We can send it to the intruder and let's turn off the inducer.
OK, now we can simply go to the intruder.
We are in the interior now and you can see this is the position initially before you can start your
expectation, you have to specify your markers.
So where exactly our market CMOC are supposed to be, if you remember in the manual explanation, we
just need your username and password.
So that's where the magic happens, right?
So the website is a bit smarter so it can, you know, select all the stuff by itself so we can clear
all of them and select only test.
Sorry.
Yeah.
Test as our marker and another one would be the password as a marker.
Earlier it was selected a couple of more fields as a marker one.
So now this is done.
Let's select the attack attack type.
So the Inactine we have got four options we can because we have to freeze.
We can either go for pitchfork or cluster bomb.
Let's go for Pitchfork if you're OK.
We can even go for a cluster bomb.
It might take a bit more than that because it might be taking random operation for two and a bychkov
will be taking one to one mapping Israel would select the payload.
Well, in this case, we just know only very few limited options.
But still, just to show you where you can get the details when you have GitHub repository, I'll take
an example of Stoebe so you can simply even type on the Google.
It's pretty popular.
You can type in the first response first.
The result is positive.
DeVita, you can go to the first DB and from there select the attack.
That's the first repository attack.
And the attacks select the screen injection center.
Yeah.
Oh yeah.
Here.
And in next year's kill injection you have to select the exploit because that's what we are building
and in here we have to select bypass.
OK, yeah.
So it's my squirrel injection by logging bypass.
This is what we are looking for.
Oh we have this too this weekend.
So like many as well.
So for one we we have to balance it.
Right, because we have two markers.
So we have to first define the payload first one first marker so we can insert values like the first
one and so we can have.
This value.
Added, We can have our own, the one we have tried earlier as well, and.
Sorry, this has not been yeah, this is walk's as well.
This is the first option.
This doesn't have one is one, right?
Let's have this.
We already know this is going to work.
We can even have some more random value of let's say we we try to capture some more option so we can
go for that.
One is but there are some union operators as well.
So you can possibly select some more style of making it possible.
But for now, let's keep it as it is.
You can have much more options.
You can go for much more the repository as well to get more detail about it and can get to see if this
really works.
We can even try for some of those style as well.
So maybe or is that equal to one one dash, dash and F-stop?
We are one is equal to one that's Deathstar.
These are options.
We can try it out, but just to keep it simple, let's keep it as it is and let's select the second
pillar.
And here we can have any random but let's say you type test maybe.
And the second one can be Anderman.
Right.
Enter.
And once it has been selected you can actually go ahead and start the attack.
OK, everything has been selected.
The position is said failure has been selected for both the both the mockers.
And let's stop the attack.
This is a community addition, so it probably daytime time if you have a larger payload set and multiple
maybe to mockers in that case.
OK.
So you could see the payload lend itself can give you a better idea about if you see the payload changes,
you know, if you see all the lente is exactly the same.
But if you see a different payload somewhere, discrepencies in the payload, that will give you an
idea if this is a different response or the same response.
What you see on the first 145 length, 145, 145, 145, 140 for this comes to be the incorrect prediction,
because of course it is.
And even the response tell you the same.
But if you see this one, this gives you the successful authentication into the system.
The reason is you get to see and the login page, you get to see the what you have in the responses
about what content and details about the pages, different account details.
So this gives you more information.
That's why the length of the speech limit of this payload is higher.
Is going rid of responses basically higher as well.
Right.
So this is how you can make it successful, do so if you see the rest of the request, number one.
And number three, this is actually similar, isn't it?
But the payload two is different.
But if you remember, payload two are the password can be anything, irrespective of what password you
put at all matter, what payload you have for the username.
As you remember, there's a double dash that means anything after that will be removed, as you know,
as a part of the government.
All right.
So that's why the request No.
One and the request number three has been successful.
And this let you access into the system.
That's why you get the information about the account as well.
Right.
So this is a successful exploitation with Bob.
So I hope you got the idea that there are many more ways of getting access into the system that could
this might not work on many of these situations.
This might work on some of the situation where there's no proper sensitization on skill injection or
the way the greatest goes into the system and come out in those situations which are vulnerable to the
ESKIL injection that are pretty much, you know, that's where this attack is pretty much popular.
All right.
So I hope you got the idea.
We'll get you in the next one.
Thank you.