Let us start with the last practical off Web application penetration testing throughout this section,
you have to learn a lot of different concepts, and I hope you'll understand it very clearly because
we have tried to explain it in simple language.
We tried our best to tell you how these concepts work.
And now in the last practical that is a brute force attack, I will show you a simple reworking of how
hackers use brute force attacks to actually hack a system.
But let me tell you one thing, that these brute force attacks are very time consuming.
If you try to brute force a login page of a very well-known application like Flipkart or Gmail or any
other website, these won't work because at the end in the database, the password is stored in the
form of hash and also let's say, ah, ah ah.
Constructor Yeshe keeps a password of let's say my name is Yaish as his password.
Now the brute force attack and gets the password, but he can't guess it like my name is Uche.
So that is really very crucial.
And it migues if you use brute force, but it really takes a lot of time.
So without wasting any much time, I will just show you a simple demonstration of a brute force attack
example.
So for this, you will just need to login to your coffee machine.
And for this practical, since you are going to use.
But it will require metastable.
Now, why do the requirement as multiple here and why can't we just use the DeVita already present in
Akali?
Because if you have observed the address of our Kalima machine that is debatably, which is installed
in Caleigh machine is one twenty seven point zero point zero point one.
And the proxy that we have set in Boxwood is also the same.
So the request won't be intercepted and that is why we need metastable machine.
I will again tell you why do we use metastable?
So make sure you turn on your card machine and you keep all metastable also on.
So let us get started.
So here I am in my coffee machine and first I will connect to my DV w e that is as portable machine.
I have already explained to you, why are we using table?
Because whenever you require to capture the intercept using BOPE suite, you should use them at a small
table in a plural lecture in which you know you can use the baby in Linux because we need to change
the back IP address there.
So we just typed the IP address, ten point zero point two point six, and I will connect to my metastable.
There you go.
And we log in to my DV w.
They will have logged into my DVD player.
Now, the first thing that you need to do is change the TV security to law and here you can see brute
force.
This is the page where we are going to enter the login and password and then we are going to try the
brute forcing it.
Not for this.
We need to first turn on our Bob Sweet.
So go to applications and then turn on your Bob Sweet.
Now let us give it some time to get load.
There you go, overboard suit has been launched and now you can see what I was talking about is here
the proxy.
You can see this address is seen as a TV address.
So in our case of a missing, when a browser sends a request now, what browser is located at ten point
zero point two point sixteen, thirteen point zero point two point sixteen will send a request to Bob.
That is this address and then this will again get reflected in here.
That is why we require Bob Street now in a Bob Sweet introduction, like we have seen the different
rules of intruder and repeat sequencer, decoder, etc. And for this particular brute force attack,
we need the intruder to act as a man in the middle and then perform the brute force attacks.
So what you have to do is first if to to configure to send request, we have seen that we need to go
to preferences, then we need to change the network settings and set our proxy to manually proxy that
is one twenty seven point zero point one click.
OK, go to Bob's suite, go to the proxy and intercept queries on that.
It be on.
Now what you have to do is we have to just give a random username and password here and then they will
try to crack by giving a dictionary or a list of different passwords and usernames and the suite will
do a brute force thing for us.
So just in the random username and password.
One, two, three, four, five.
Now if you click login, it will the password will capture the request.
There you go.
And now we do not have to forward the request.
What we have to do is we have to copy the request or you can just send to the intruder.
And if you send the intruder, it becomes orange.
If you click here, the host does this because we want to again send the request to host and now positions.
Now you can see these all places.
Our fields are highlighted with a blue color.
Right, because intruders, whatever we will insert in the dictionary in the payload here, OK, you
can see the payload.
It will try to insert those values at the marked fields.
But right now we're interested in username and password.
So what we'll do is we'll select everything and click clear.
And now we just want to target two positions.
That is username and password.
So we'll select Jeanne-Marie.
That is a username which we had supplied click add and then we will select password.
Like the password and click add, so now nascence attacked by snipers on what a sniper does is sniper
basically targets only one position at a time.
But in our case, we're interested in targeting two positions at a time.
So we will use cluster bombs, which basically tries all the combinations and then performs attacks
on two different positions.
Now, just go to payload step now your payload.
Now, since we are going to use two payloads, one is for the user name and the next one is for the
password to just go to payloads.
So you can see two options.
OK, if we select Sniper here, we will have only one option.
So we're going to select cluster bomb, go to payloads.
The first the first payload will target all the fields at username only.
So whatever we supply here in this payload options symbolist will get inserted into the username feel
and then it will try that password.
So I will show you how to insert.
Now just add here AGYEMAN.
I will.
Since we are going to add the first payload for use in here, we will try to insert six or seven random
usernames which are most commonly deployed, will just click admin, then another one is full admin
in.
Caps lock.
Another common user name is a root.
OK.
Or our capital, Beirut, or in case or another common name is E, Capital D and admin.
Or let's say I want to give as admin at the rate one to three, so these are all the names of what boops
it will do, is it will take admin, it will go to position and replace the name here, and then it
will take another admin and then tried all these options with the remaining passwords.
Now we have added the user names here.
We will add for the passwords of a password.
I will enter password.
Let's look at another common factor is capital s s w r d you can see or D who are.
Or everything in capital.
Or let's say Adnen, at the rate one to three, is also on three four, it's also password, common
password or admin.
At the rate one, two, three, four, OK, so I will try these six passwords against these six usernames.
So what in will do enterable.
Take first admin and it will try the password, this password, this password, this password, this
password and password.
If it successfully gets a valid username and password, how do we come to know?
So you have to go down here in options and you can see grappler grep extract or you can see grep match.
So if the result matches to the value username and password, we will have to get notified.
Right.
So what is the common message that you get when you have a successful login, you get success or login
successful?
I will just click clear and I will enter a new item.
I will just click right success and click and select this.
So what it is saying flag result items with the responses matching these expressions.
So whenever a user name and password will get validated by the backend application, we will get a success
message in the Internet.
I will show you how it is.
So I hope you must have understood why do we use payloads and where do we use Peeler's?
Now you are saying that you have manually added.
So now what if there are hundreds and thousands of usernames now that you have here is an option.
You can see ad from list.
Now that option is only available in the professional version.
So what attackers do is they have common dictionaries with them through dark web or, you know, through
collecting.
They have thousands and one lacks of passwords that just enter the dictionary there and then Popescu
takes.
But since we're using the community word and here we have to manually enter so either you can enter
hundreds and thousands of passwords manually or you can buy the provision and get it done by itself.
I'm going to just show you about six usernames and passwords and you can see the request count in the
payload.
That option is thirty six six passwords, six usernames.
Combinations are six to six.
Thirty six.
And you do not have to change anything into options now let us so I guess you might have taken the suit
so admin will come here and this password will come here.
Then it will send the request to the server.
If server, it will get a message success.
So after all this is said, click Startrek.
And Anokhi.
And it will start the attack.
There you go.
Now, before we do that, if you can see the content length here, uh, if you can see the content learned,
I guess there's not a visible right now or it will it will be visible.
I will show you.
So the length is four nine four, which is the highest probably, and if you can see the success types
of whatever is success will get automatically ticked.
So right now, it is performing attacks, different types of attacks.
So let's wait till it finally completes everything.
And yes, it has finished the attack.
So if you check the length and check the length, you can see a root password route, admin, password,
admin, admin, admin, password, admin password.
So these are the values of which might be the values of this.
I will, uh, just see what is the value for nine for it.
And the payload is admin and this is password.
So I just turn off the intercept.
We have the results here will go to David, U.S. ambassador in Cairo, it will try admen.
And password.
And they go, welcome to Password-Protected area, Egmont, which means this is correct, now I will
try this one, the admin and the password.
Let's see if we have got the correct answer.
There you go.
Welcome to the password protected area admin.
So these two values were correct.
So if you sort if you see the content length four nine four eight, all the values with and for it must
be correct.
We have got three possible choices.
So these are the three possible correct answers.
And in this way, if you let us check this admin and capital P password, it should show it is not the
correct answer or just I will give the password as P or R.
And username and password is incorrect in this way, basically, brute force attack is carried out.
Now, you might guess that, you know, you are and you can see it is admin and it is password.
You can just change it here.
And we have seen how this attack is used in Kiselev.
Now, in this case, the request or the URL is not protected because it is using HTP protocol in case
if it if it is using GPS protocols, you can see in the request and the target dashboard or intruder,
the repeater, the request, we do not clearly we can't clearly see the username and password.
In that case, the username and password is encrypted.
That is why cookies then encryption htp SSL encryption is all used to avoid such kind of brute force
attacks.
Now an attacker can also try to hack or brute force or T.P that is one time password, a four digit
one and password can be easily brute force.
But if you carefully observe the digits are four and the number of combinations are for at least two,
I guess four or for every time it is three.
So it takes around a lot of time to crack a one time password.
And hence the validity of a one time password is generally two to three minutes because brute force
cannot get the result between two to three minutes.
Right now for this video, I would actually fast forwarded the 36.
It actually took five minutes for me to actually take the old account.
And that is why brute force attacks are time-Consuming attacks and hackers do not prefer them.
And nowadays all the passwords are also hashed out, encrypted and therefore becomes more difficult.
In the next lecture, we will probably see the most important step of application penetration testing,
which is how to perform the web application penetration testing in a very detailed manner.
We will demonstrate what are the steps required, how you should approach to perform overapplication
test.
If you have if you are applying for a testing role, which steps you should perform in order to generate
a report and everything.
So make sure you watch the next video.
And please do not skip these lectures as these are very helpful.
I will see you in the next lecture.