OK, so now we know some you know how to use some of these tools to gather information.
So now let's actually go ahead and launch some Web application sites.
So the first attack that we're going to do is brute force.
So one one way to break into Web applications is pretty much through brute force.
And typically, this involves using a list of usernames and passwords and, you know, to see if you
can guess the combination to successfully log in.
And we can use a variety of tools to achieve this.
But today we're going to be using burps.
We only show you guys how to use that a little bit extensively to actually brute force into the damn
vulnerable Web application server.
So let's go over to our callisthenics machine and try this out.
OK, so we're back in the kaylin machine.
So what you're going to want to do is actually just type in the IP address of the ATM machine into the
browser.
And then we're going to click on a lot of different links here for different things that you could practice
on an exploit.
But for right now, we're just going to do divi a.
So this is a damnable Web application.
So to get into this, the default username is Ataman and then use it.
The password is password and you can figure that out.
Actually see your first, I guess, unofficial hack.
You can view the page source.
And hey, the developer actually, you know, left the username and password here.
Cool.
So now we know how to get in there.
So it's actually right there at the bottom.
Do so admin password.
So now we're into the vulnerable web application.
So you can kind of look through this and look at the disclaimer, look at some of the instructions.
But for the most part, this is going to be a playground for you.
These are different Web application vulnerabilities that you can try to exploit and then is also different
levels as low, medium and high difficulty.
And you can also sound like an intrusion detection system to make it even a little bit harder.
So the first thing that we're going to want to do is go over here, set up.
We're going to want to create or reset the database so we know the back end database is my school.
So we just reset.
And you want to do that when you you know, when you start a new session to practice and stuff like
that, come in here and reset.
The next thing that you want to do is actually go over to divide up security and make right now is set
high by default.
So you're going to want to put this low for now and we're going to change it for some of the different
attacks that we do just to see, you know, how to bypass specific security measures because each level
is going to add into it.
So we've got to change this to low and we're going to have some.
So let's go over to our brute force section.
So right here we see a login username password.
So each one of these you can look at the source code for the page so we can open up the source code.
And I don't understand what's happening when you submit this form.
So on the back end is Perrone.
Is doing it requests, is getting the log information is getting the username, it's getting the password,
it's hatcheting the password, and then it's doing Enescu Okri and is looking for, you know, in the
user's table is going to look for the user that you passed in and the password.
And if it's right, it's going to allow you to log in and it's going to show you welcome to the password
protected area.
So that's how we know that, you know, we actually logged in successfully.
And if we logged in unsuccessfully, they at the password username was wrong.
It says username and password and correct.
So now we kind of understand, you know, what's going on with it.
So let's like test it out.
So let's say, like, I don't know.
I mean, it's like asdf so as you can see, you know, when you have a failed log in.
He gives you just Arah, like we saw in the south coast, and what you should also know is that in the
euro is passing the stuff to the euro is not is actually not taking this input into, like, sanitising.
It is.
I'm going to save.
It's not doing anything.
It's just passing through the euro.
So do a simple request.
So and it does not seem that there's any measures like, you know, if you if you log in like, you
know, if you fill a log in like a few times within seconds, you know, is going to block the account
and not let you log in, there's no type of security measures like that.
So what we can do, we can actually use berp and actually brute force this.
So before we do that, the first thing that we're going to want to do, you don't want to go to Google
or just open up any time in Firefox and excitement foxy proxy.
And then this is like a Mozilla extension.
I've got to get on the Internet one second.
So Foxy Knoxy and then what are you going to want to do is click on this first link right here.
And this is an extension that is going to allow us to run a proxy in our browser.
And this is going to allow us to use burb suite to actually, you know, brute force into the application
and do a lot of other stuff.
So I need to add it in.
I already have it, so I have to remove it and put it back.
But guess is at added end.
You can see this right here.
You can just click on it and then go to options.
It's going to open up a tab and then what you're going to want to do is actually create a new proxy,
pretty much.
So you could just hit add already have one on here, but I'm going to submit it.
But you're going to keep this is HTP.
You can give it a name.
I just give it burp because I don't want to use it with you Bourbon's Zap or whatever, because you
can use that for the exact same thing.
So the IP address, this is going to be your computer.
So you're going to want to be Lubeck address, which is an address that always goes back to the local
machine, which is one two seven zero zero dot one.
And then the port we're going to do eighty eighty.
That's a good point to use and you need to save so and then you have to see it pop up here.
All you need to do is make sure this is this which is flipped on.
So it's enabled.
So now if we want to use the proxy, we just have to turn it over to this and it's going to send everything
over or eighty, eighty.
And that's going to allow us to go into Berzerk and enable, you know, the interception that's going
to allow us to grab, you know, all the requests and modify them as we need.
So we're going to now.
So now we have that set up.
So now let's go over to burb.
So what we can do is go up here, type in burps.
So Burpengary comes up and let's just give it a second in case like a minute to load.
OK, so when you see this window pop right here, what is going to be temporary produ project next and
start burb.
So once this loads up, we're going to see the interface.
Let's just give it a minute.
OK, so now we have operating this spurt.
So what we're going to want to do is go over to the proxy section and hit options.
As you can see right now, I have mine set up should.
But it should be said it is by default.
But if not, you can sit at and put the interface as the same as the laid back address of one two seven
zero zero one or eighty eighty.
And it's running right now.
So if I were to send any traffic over port eighty eight from my computer, Berte is going to intercept
it.
So let's try this again.
So let's go back over to here and let's do like, you know Test says.
So before you actually hit submit, you're going to want to go over here, turn on your proxy.
So now you see the proxy is running.
So now said log in and now berp is intercepting.
So now we can actually change anything that we want so we can look at the parameters like the we can
see, hey, this is the cookie.
This is the username that we put in the password, I would put it if we wanted to.
We can change these right now if you wanted to.
And then when we're done, we can just head forward.
So that's pretty much how you would use birth to interact with your SCDP request.
So we know what authentication looks like now.
So what we can do is, is actually do this one more time.
Look, let me do something else.
There we go.
It's different now.
OK, so what we can do is actually right click inside of here or we can just do it in the wrong section
to.
Right.
Click it inside of here and send to intruder.
An intruder is a function in burb and also must turn off the servers above because we already have this
intruder intruder allows us to kind of like attack this login form.
So right now, we have a set.
The host is the machine.
We're doing this overreport 80.
And let's look at positions.
So as you can see, this is the request.
So the security, you are on this in the browser for the most part, and you can see that it has the
variables in here.
These are called variables where we would actually put our quote unquote payloads, which is going to
be the next station that we go to.
So first, let's clear everything, clear all the variables that it has in there.
So let's go ahead and head clear.
So now all that's clear.
So what we can do is actually change the tektites cluster bomb.
This is the one that we're going to want for our brute force attempt.
So let's actually highlight right here where we have the username, you know, actually being passed
into the URL.
We're going to hit AD.
So this is going to be, quote unquote, payload one.
And then we're going to go over here where we have this.
Whatever I put in here is the password.
We're going to highlight that we're going to hit.
So now we have two variables.
So this is payload one and this is payload suit.
So the next step, we're going to go over to our payload one, which is right here.
The username we're going to we can put whatever we want.
So right now, we're going to keep it a simple list so you can either, you know, upload a list that
you have or you just added.
So right now, we're going to assume, hey, maybe there's a user.
We're pretty sure that there's a user called admin to add that to our payload.
One of and that's all.
And then we have to have this.
So now when we execute, this is only going to launch it against the admin username.
So now we can change this to payload, too.
And this can be as simple as well.
So we can either upload a list or like a password is like maybe like rakita texte or something like
that to actually brute force.
Or we could just make our own quick little list.
So let's try like password.
One, two, three, password, exclamation point, start capital P.
There we go.
And then let's try just password and see what happens.
So so now we have all of our possible variables set for payload number two.
So all we have to do now is actually just start a tag.
And is going to say, OK, ignore that you're so it's going to pop out of the window and it's actually
going to try and look for, you know, try those password's, try to see you, try to log in so I can
see what's happening.
So if you remember the source code, you remember that it says welcome to the protected password area.
So what we can do is actually look at the responses from these and see like we can just search right
here.
We just haven welcome.
And if it doesn't come up and we know, hey, that password at work and we can do the same right here,
I'm welcome to enter.
And nothing worked.
It didn't work.
So let's see here.
Let's take a walk, then come up there, make sure that you click on a response, of course, and then,
hey, this one right here has a match.
So let's actually go through and see where it says welcome.
There we go.
So welcome to the password protected area.
So now we know that the user name is admin and the password is password.
So that's pretty neat.
So we can actually go over back to the one where application admin password has the password.
We logged in.
We successfully broke forced into this application.
So that's pretty neat.