And we're going to learn about this broken authentication.
I will tell you straight to the point, there is a weak authentication mechanism at the server.
So what you can do is you can brute force the user and the password using the word list.
And we have seen this using the intruder.
But you can use any tool you want.
So the purpose is you need to go for these attacks first to bypass this or find the user name the password
and use all the credentials.
So if there are weaknesses, you can, uh, brute force these credentials also.
And, uh, you can successfully logged in as the user and a week session cookies.
So it does.
So if the server keeps the are generating the session cookies within a week or so, if you can able
to guess or predict the algorithm, then you can get these cookies are going to use the algorithm to
put all the cookies, uh, within one cookie, you will get the session and the response will be different.
So these are the common attacks against this broken authentication.
So to avoid those broken authentication, you need to password getting a text, though.
You need to put a very complex password like eight or 10 characters with the special characters in it.
And you can also use the filter, the XML, to factor out any ODP or some other like that.
So this is about DTT.
You can read in this website.
This room is called, as we have already seen, the commanding the action, uh, which you have seen
in the previous video that is in the action group, which is the same deal applied here.
There is nothing different from this.
So I'm hitting the computer button, not actually practical.
So what they're doing is, uh, let's understand this with the for example.
OK.
So there is an existing user with the name.
So there is a user in the Web server and now we want to get to access to the account so that we can
be used to reregister that user site modification.
So what we're going to do is to register again with admin.
So we need to modify something.
So what we're going to do is we are going to enter space.
So we need to restart the user with the space.
So if you register with the space admin, then this Web server allows me directly to, uh, into the
admin user.
I mean, that means I get the privileges of this admin user.
So what this Jindalee, this Web server is doing is this is generating a session ID with the privileges
of that name.
So it's not considering whether this is the there is a space or the president or any other symbol.
It's just checking that if there is a built in the name, etc. to approve this access according to the
name.
So it does not checking the backspace are a normal space or any other special character.
It's just taking the admin in the same way.
What we can do is we can create the user space admin and then we can log in to this admin account and
I get the privileges of this, uh, actually.
So to see this in action, we need to go to this IP address.
So this is the IP address I have already on this machine and the port is for it.
So I have already opened this one to save some time.
Now let me go and try to login it at.
So let me try this this invalidism Malpaso, let me try to register this one, so before registering,
I will set them down in my bar mitzvah username, username Neki, uh, male or am at their tempora.
And the pastor said, Nikil, 16, like, so click on this register note, we get the request.
Now what we can do is we need to modify some changes and that's what they're going to ask is what is
the fact that you found in the data intercom?
So what is this data to try to register user name data?
And you'll see that you're already so determined to put up space at the starting of this data so that
we put Chindi Sneaky to their.
Let me put this piece and Dara.
Now, I think everything is fine, and this is my e-mail address and this is my password, Nicholas,
so far this.
And for this one.
So I think we have successfully created the user there.
Now, let me log into this.
I don't know whether I need to put this on private normal, Darren.
No, I'm going to say Nicole Sixty-nine.
I think they would deposit Gartree.
I'm sorry.
Communicate.
Well, you know, I don't I don't think so, but this value so I had I would only go sixty nine.
So let me sign signing this.
So Invalides.
So we need to see a space there and then a night and night, six night in the No.
So we need to disperse after this started in the U.S. also, so we got some hash value.
So we need to raise the flag, we need to submit to the, uh, pragma upset question, uh, we're waiting
for this other.
So you can see the similarity to the.
So we can tell you this one on record with this one.
Copy and paste it in here.
So we got the that for that here, the concert piece is the back end of this.
Absaroka is just checking the name on it.
They're not taking any values are spacious enough.
So it's very featuring the name and just given the privileges based on this name.
So what is the flag that you found in the order?
So we need to do the order also.
Let me look at this one.
So I about let's register again on Perceptron, let's
order not after Morgan.
OK, that's a high.
A great hideout come.
And it's a password, password, sixty-nine, sort of MACUGEN is to know I got the I request I can I
only to please put the space in front of Father and let me follow this and follow this.
Now, why the user order has been successfully registered, now it can be used against space after and
password to nine, if I say so, I short-sightedness normal after user.
So we have rockiness order user.
We need to copy this also.
And pasted in here to make sure that we answered the question, so we have successfully impersonated
as done harder and better.
No, let me try to create another account that is for had been so.
To kill.
So now I'm giving the same answer 469.
So now click on this register of Nicole, I'm going to create the userspace.
Space is sort of turn this into something, it will automatically for, you know, the space that has
been created.
Let me try to ruggie space a minute and zip password sixty-nine.
So let me go to this and show you the actual and drink so I can turn this into sort of sorry, just
click the forward.
And no luck.
So this admin user does not have the flags, just you need to log on to find out so you can also impersonate
that as well.
So I hope you understood that Saarbrucken broken authentication so this small Flosse can lead to the
account impersonation.
And you can also steal those sessions like this.
We we have.
So that's all you need to know about this broken authentication.