Welcome back to Brooklyn authentication session.
In this second part, we will exploit several syndication flaws. In
our intentionally vulnerable application to get the
access is that mean we will jump straight to
the Hands-On exploitation at the end. We
will wrap up exploit to the issues, which we will discuss
in more detail in the third. And last part of the session. Let's
hack.
Let's start creating a regular user account.
Before submitting, the request, let's pop up
developer tools so that we can monitor the network traffic.
This should be the sign up request. Let's have a
look into the request details.
The request body includes our Account Details where you
can see our weak passwords.
We can now login.
Next, we will try to recover our one password.
Again, let's first pop-up developer tools.
While we were typing, several requests were made
to the security Dash question and Point. Let's
inspect the last one which has our complete email address.
Our email address was sent in the request.
And the server returned our security question.
How does the server response looks like for an email
address which does not belong to a Jewish shop account?
This time, the response is empty based
on this binary responses. We can check whether there's an
admin account.
Comparing this response with the one with god with
our won't email address. We know that such account exists
and we can try to login.
We don't know the password, but at least you can try to guess it.
Of course, it's wrong, but we can do better. Let's
search for common web admin passwords.
Let's try the first ones with at least five characters since
we saw that this is the minimum required in the sign up.
Doing this one by one. We'll take long. But
this is exactly the type of task computers are great doing.
The simple bash script. This concurrent requests to the login in point
based on the given email address in the list of passwords. It
will stop on a successful login, attempt, or at
the end of the passwords list.
Let's move the passwords list into a text file and do some cleanup.
It's time to run our script with Joyce drop admins, email address and
our password list file.
Two seconds was the time. Needed to find the
password on a simple workstation. Let's
now see whether it really works.
In fact, it does, and we are now logged in
as admin.
We said that before and now you have seen it in practice, although
there's a password strength calculator in the sign up
form. Strong. Password policies are not enforced, allowing
five single class characters, long passwords.
The recover password mechanism can be used as an
oracle to enumerate valid user accounts based on
its response. And finally, the
login does not Implement a lockout feature based on
failed. Login attempts. Meaning that we can test as many
passwords as we want for a single email address until
you get the right one.
In our next video, we will discuss what makes the application vulnerable
and how to prevent it.