>> Hello everyone and welcome back to the course,
identifying web attacks through logs.
In the last video, we talked about
vulnerability scans and their logs.
In this video, we'll talk about
brute force attacks and their logs.
The objectives of this video are to review
brute force attacks and to identify
the brute force attacks using
web server logs. Let's begin.
What are brute force attacks?
A brute force attack occurs when
someone is trying to get access to your system,
or in our case, to our web page.
It's usually done with multiple login
and password attempts.
The attacker is forcing the authentication.
To perform brute force attacks it's common
to use dictionaries or leaked information.
A dictionary is just a common password list,
and linked information about users and
passwords can obviously make the attack much easier.
If the brute force attacker uses the dictionary,
the attacker will take a lot of
guesses and may use a lot of automation.
The leaked information could have
the username and password that the attacker needs.
The attacker may need to try fewer options.
That's why it's really important to change
your password after some period of time
or when you hear about
leaked information from a website
that you have an account with.
For web applications, the most common targets
are HTTP forms.
Depending on the web application the form
can use GET or POST methods.
You'll see there is a difference between both requests.
If you remember from OWASP,
the brute force attack is related to
A2, the broken authentication.
To see an example of the most common password,
check this web page.
In this attack we'll use our lab.
There is a vulnerable HTTP form.
Some tools will help us to perform the attack.
We'll use the Hydra and Burp Community Edition.
Here we have the logs of the attack.
Notice the username and
>> password information on the log.
>> There are many different usernames and passwords,
checking the date and time it's also possible to
see many requests in a short period of time.
One user sent seven requests in less than 10 seconds.
Here you have more than one username as a target.
If you are thinking that a user forgot his password,
many usernames doesn't make sense.
Also, you have administrator logins.
For more information, here's the detail of one logline.
Here we can see the typical behavior
of a brute force attack.
The first has many requests to log in web page in
a small period of time and
different usernames and passwords sent.
Here's another example.
In this case, only one username is the target.
The username Pablo is the target.
Notice that the behavior is similar in
many requests in a small
>> period of time from the same IP.
>> I said before we can use GET or POST methods.
In the last example, it was easy to identify
the username and the password
>> because of the GET method.
>> Here we have an example of
a request using the POST method.
Notice that we don't have
the username and the password in the request.
This happens because of the request is in the payload.
Later in this course, we'll analyze the HTTP payload.
Since it's a log, let's analyze it.
Check this user agent.
Hydra is a well-known tool
used to perform brute force attacks.
It's also possible to see we have
many requests in a short period
>> of time from the same IP.
>> All these requests are to the login web page.
One more example, check this log.
Here we have a POST,
but the user agent looks normal.
In the real-world things will not be so easy.
You always need to ask,
is this unexpected behavior?
Same IP, small time between
requests and the login web page looks suspicious.
You can see the refer and
the requested page are the same.
This could be someone trying to log in.
The user types the wrong username or password,
and the login page is reloaded.
But could someone type the username or
password in three or four seconds?
Our conclusion is that this is an attack,
specifically a brute force attack.
In this video, we use two tools,
THC-Hydra and Burp Community Edition.
The difference between both is
the number of the requests.
With Hydra, we did many requests
in a small period of time.
There are many other tools we can use to
perform the brute force attacks though.
Now, let me give you
some directions to identify these brute force attacks.
The first is to look for
many requests in a small period
of time to the login pages.
The same IP doing many requests is
a good indicator of a brute force attack as well.
If your web application uses GET,
look for different users or passwords.
For POST requests look for
the number of the requests and the time.
Don't forget to check the user agents.
Post assessment question,
you can always identify
a brute force attack analyzing just the user agent.
Is this information true or false?
This information is false.
The username would help, but an attacker can
change it as we saw in some examples.
For the next question,
analyze the log below and identified the IP source,
type of attack and what the attacker is trying to do.
We can easily identify the source IP address.
The requested page has a login page,
many username and password
combinations IN a small period of time.
Usually administrator is an important username.
Why would someone trying to get
administrator access to this web page?
In summary, we have
the source IP is trying to
>> perform a brute force attack,
>> and the attack is trying to
obtain the administrator password.
Video summary. In today's video,
we discussed the brute force attack.
Analyze the two types of
brute force attacks using both GET and POST methods,
and identified the attack, analyzing the logs.
During the analysis, look for user agents,
many requests in a small period of time request to
the login web pages
and suspicious usernames like administrator.
In the next video, we'll have
a brief review of SQL injections
and we'll analyze the logs to
identify the SQL injections.