Welcome to a video lecture.
Now we are continuing Bub's tools.
We will discuss how to identify and evaluate varied software responses using Butsu comparer when performing
obligacion assessment.
It is often important to be able to easily identify reactions yesterday requests our responses to comparer
features simplifies this process by providing a graphical overview of vacation maps and compare works
by analyzing any two sources of content for differences.
These differences are identified as content that has been modified deleted are added quickly isolating
patients and content can be effective indeed mining the distinct effect that particular actions have
upon the behavior of that location.
Now we now that comparer tools is used for comparing two responses but the question arises.
Why have we used this tool.
Here I am discussing foyers.
Let's assume that Lan looking for username and and conditions you can compare responses to failed Slovenes
using valid and invalid usernames looking for subtle differences in responses.
When an intruder attack has resulted in some very large responses with different lengths and that the
best response you can compare this to quickly see where the differences lie.
When comparing the site maps our proxy history entries generated by different types of users.
You can compare pairs of similar requests to see where the differences lie and that you rise to different
application behavior when testing for blindest good injection.
But using boolean condition injection and other similar tests you can compare two responses to see whether
injecting different conditions has resulted in a relevant difference in responses to yours but so to
perform the occasional letters against a target you will need to have a remote system that is running
on one or more applications.
This lab provided an instance of my desk like table do is used to perform this task Meraz quite able
to hazard preinstalled when there were web applications running on the DCP port 80.
OK let's open up the VW location.
Brute force will never notice.
Let's open up.
But to turn on intercept that random password for capturing post-trade in the proxy hit enter here you
can see that both films capture in previous but intruder to brute force the log in for the blue the
VW A.
Let's send the intruder position one payload in particular engine Rayton and longer response than the
others.
In payload option and tapping password and POS had one to the
hate start Adak button here we can see that repellers brute force response evaluate the variations in
response reichlich on the event and then click on send to compare the same thing should be done for
one of the control examples.
After sending each event to Complera we can evaluate them by selecting the comparer tab at the top of
the screen.
Ensure that one of the previous responses is selected for item 1 and the other is selected for item
2 in the bottom right corner of the screen.
This is an option to choose compared words or compare bytes.
In this particular case select the words option.
By doing this you can see that some of the content modified in the response reveals that the log in
was successful.
Any content that has been modified or deleted are added is highlighted from one response to the next
and make it very easy to visually compare two responses OK that's Orlebar but compared to.
Thanks for watching and see you in next class.
My.