So another big problem in authentication is insecure login forms.
There may be hundreds of ways to make a form and secure.
So for these examples, I'm going to be in B WEAP and I'll go to Cali first and log in to be webapp
and from the drop down menu above Chew's insecure login form under the broken authentication section.
And the default level is low.
And it is rare to see the first two levels in the real world, actually, but I think it's a lot of
fun.
So let's try and solve them, OK?
So when I try to log in with the wrong credentials, I'm going to get this warning.
So then we view the page source by right clicking and scroll down to the log informed source.
So see here is taxed with a white font color, you know, the log-in label.
And also another text with the same property near the password label.
So if you mark here and here, you're going to display them.
So I'm going to use these values.
And it is done, we've just logged in.
OK, so that was fun.
Let's choose the medium level.
So I'm going to mark here.
But there is nothing.
OK, so view the page source again, scroll down the login form.
And here there are no hidden values.
But see over here, the submit button.
Have a look, you're going to see it executes a JavaScript function.
Now, I think this is the first function that we've seen opening this horse.
So here's a function.
I don't think it's very hard to guess how it uses some of the characters in the string to create a password.
And again, it's it's really a load of fun.
To get the password from this function, just copy it.
And open developer tools.
Go to settings from here and check.
Scratchpad to enable the tab and go there.
So clear here and paste the function.
I'm going to just zoom in a little bit here.
OK, so we don't need these lines.
And to see the result, I'm going to add here return secret.
And an alert message to view the result.
OK, so let's run it.
And it is done, what's this?
Yes, we get the password.
So in case you think I'm joking that I'm going to use this.
OK, we're done.
We've just logged in.
OK, so.
At last, we were going to do a brute force attack, so let's choose the high level.
So here's your new page and view source, if you scroll down, you won't see anything with the form.
So, OK, let me just log in with some wrong credentials and see what's happening.
OK, you get the same warning message and valid credentials.
So now we're going to do the rest with berp.
So enable Foxe proxy, then open burb.
And I'm going to arrange a windows.
Now log in again.
And captures a login request, so.
Send it to intruder and repeat or to use later.
Then forward the request.
OK, so open intruder tab now there are four sub tabs under intruder and under the target tab, you
can configure the target options.
For example, you may force it to use https and then go to the positions tab.
And here you can can figure out where and what to brute force, so berp heuristically select some parameters
to attack, but we don't need them all.
So you can clear them.
And let's just use only the password and username.
So let's choose cluster bomb as the attack type.
OK, so we're done with this, so now go to the payloads tab.
Now, here's a place that we provide data or dictionary files to attack so we can choose two parameters
to attack at the same time.
And here are two payload sets which are available here, but we don't have any payloads yet.
So let's create some payloads first.
We can use crunch or we can try and other as well.
So, in fact, open up your terminal and type C W.L..
Sewell is another password generator, but it works kind of differently, so it'll crawl a you URL and
extract words to create a word list.
So Type C, W.L. Dash dash help to see options.
OK, then add W as a parameter to say the result.
And the parameters to define the coral depth.
The parameter to define the minimum length of the word that will be extracted and E for including email
addresses and let's include words with numbers.
OK, so I'm going to copy this, your URL and pasted here.
Nothing change and hit enter.
And it executes quickly, so here's a generated wordlist file.
Let's have a look at it.
Now it contains 44 lines, so I'm going to delete some of the entries because it will take time to try
every single one, so I think these ones are going to be enough.
So now go to Berp Intruder, choose the first payload, don't change the payload type.
It's a simple list.
Just come back here and click lowed.
OK, so we load the first payload.
And choose the second payload again, load wordlist.
And Burp automatically calculates the requests that will be sent, and I think if we do this with a
huge list, it's going to slow down our target network in our environment.
So there's nothing change here.
And go to the options tab.
Now, scroll to grip match.
So in this section, we teach Berp to understand when it is going to be successful or not.
So then Berthelsen to each login request, it contains values from our payload list and then analyzes
the associated responses.
And then that way, if it matches something and the response with these strings, it can mark that request
for us.
So the strings are not useful in our scenario, right?
So I'm going to clear them.
And then I'm going to copy this warning on the page and paste to add it here.
And then I'm going to check this box to make berp flag the resulting items containing this warning.
All right.
All right, so, yeah, there's nothing more to configure here, so let's go up.
And start the attack.
So this is the attack window.
And we can wait a little bit for it to finish.
And looky here, berp flags, all the result items containing this warning.
Now, if a result doesn't contain this warning, it means that we're successfully logged in, you get
it?
So let's click this uncheck line.
And below are the details of the request present.
It's rice, bees and bug.
So look at the response.
Here's a successful Log-in message.
OK, so obviously, this is a very basic brute force attack to an insecure login form.
Don't worry, we are going to do a little more advanced ones in the next videos.
But you get the concept right.