Hi, welcome back to Section 8
web application attack.
In this video you are going to learn how to exploit cryptographic
failures with any web application.
I hope you excited. So let's dive on and
Cryptographic Filius on a web application simply defines
a security weaknesses the phone
with any web app that allows a traductor unethical hacker
or even a penetration tester to gain
or notice access to confidential data such
as users credentials data stored on
the silver or that is transmitted over Network.
When deploying a web application It's always important
to ensure best practices are being used
and especially those practices are
focuses on cryptographic Solutions such as
whether you should use much more secure
encryption algorithms to ensure that
data motion data in rests and even data
in use are always kept safe from all authorized
users such as hackers.
If a developer implements a web application using
a week or let's say an insecure
encryption algorithm the thread actor
can simply discover the type of encryption
algorithm being used and discover whether
there are any sort of security flows that exist
with encryption algorithm.
Once a vulnerabilities found it is simply
matter of time for that security flow to
be exploited by a real hacker therefore as
an ethical hacker or a penetration tester. It's
really important to understand how to test for
cryptographic failures only web application as it
provides valuable skills and knowledge.
To get started simply boot up your Kali Linux
virtual machine like so let's open the terminal.
next we will actually execute the docker commands
to run the OS Juice
Shop like so
simply it enter and this will take
a few seconds to complete and once it's listening we
can then proceed by opening our web browser
like so
When you open the web browser, simply click
on a foxy proxy web application like so and ensure
that a proxy settings. It is currently tuned off
and it is using the default settings on
Firefox.
For this exercise. We are not required to
intercept the communication between the web
browser and the actual web application
server.
However, we do need to visit OAS to shop
like so.
Once you are on Oasis shop, simply
click this side menu like so let's select
a scoreboard.
Once you selected a scoreboard simply select
cryptographic issues. This will simply show
us all the challenges that are available that are
related to any sort of data encryption exercises. We
are going to solve this one, which
says nested e-stag.
The description is apply some Advanced crypto
analysis techniques to find the real estate.
I can see that it is some more challenging for
us.
Firstly let's try to find any sort of
hidden directories within our web application.
If you recall.
The URL it's the loopback IP
address of 127.0.0.1 followed
by the port number 3000.
so let's minimize this and we can
open another terminal like so
now we are going to use a tool called the dirb
derb allows us
to actually perform.
Active scrolling on a particular website or
a URL with octave crawling we
can discover any sort of hidden directories on our
Target side to get started. We are going to use the
command dirb followed by
the URL as you can see. It is HTTP localhost
colon 3000. Are we
are going to specify you would list the word
lists. It's common that exe but it
is located in the user share with less slash turb
directory, then we'll specify
- common R to indicate to Durban
do not perform any weekly lookup and dash
capital and simply says to
ignore any responses.
Well that has an HTTP code of 403 which
is forbidden.
When you are ready simply hit enter.
This research should take just a few minutes to complete
as you can see durb is actually testing each
word from the woodless against our Target.
Currently it has identify that there's a hidden
URL which is slash assets.
Let's see what else it will find.
I'm going to moment early stop the scan and let's
take a look at some of these URLs that we have
found.
Notice that it has found assets FTP profile
promotion redirect and
you want a robots.txt file.
What we can do next is visit these directories manually.
So let's head over back to our web browser like
so
let's change these directories.
The slash FTP URL usually this URL
or this location or paths directory will
contain some sensitive files or even
data. Let's see what exists
and notice we have a lot of files that I
found here.
We have an acquisition file. We have
an encrypted file and it seems to be that we
have the Easter egg file here.
Firstly let's take a look at the acquisition plants.
To do this. Let's click on the
acquisition dot MD file.
This was simply allow us a download, but we
could download on even open with mouse pad.
simply click on OK
and notice we have obtained some type
of confidential data.
It says our company plans to acquire several
competitors over the next few years.
This is quite interesting.
So as you have seen we are able to find a hidden directory and
we're able to actually look into the
contents of these files.
But let's try to solve the e-cig.
If we were to download the e-cig file, which is
a GG file, we may not be able to
actually read the contents.
So let's try something unique.
Let's right click on the Easter egg file like so
let's copy link.
We'll open a new tab like so
and PC URL
However, let's make it modification.
To be able to read the contents of this file. We
need to convert it into a DOT MD file.
To do this. Let's type percent to 500
dot MD.
Now let's hit enter.
And here we can see we can download the file.
So let's actually see if the files list. Let's click on
OK.
The file should be saved within our downloads. Hula.
As you can see we have the e-cig file
that we have downloaded.
Let's right click. Let's open with model spot.
And notice we have found the seg, but
this isn't all we actually have found
some type of cryptographic message like
this.
So what should we do? Well, definitely we have found
these egg, but we need to solve line 12
since line 12 ends with these two
equal sign. This indicates that line
12 is actually a b64
encoding
so we can simply decode it.
Let's copy the entire line 12 like so
and we can head over to both sweep has
a decoder.
simply open boob Suite
let's click on decoder.
like so we can paste the message like
so
And great.
Once you have peace a message.
The next thing we need to do.
Is we set the code value as b64?
To decode this simply click the code as
like so and select b64.
And if you look closely it has converted it.
However
The result looks like some type of URL
or an extension or a path to a web
address.
But this web address seems to look a bit unusual.
What we can do next is that we can try
to decipher.
this URL
to do this
Let's copy this and save this within our
clipboard.
Let's open a new terminal like so
we need to download a very important tool.
Which is called who?
So we'll type sudo up update like
so.
to update our packages Repository
great.
Next let's type sudo up install
who?
I actually spell installing correctly. So let
me fix that.
Great, so who is actually installed?
Let's execute it and see what happens.
To put simply who allows us to actually
perform raw to 18 decoding on other
various types of decoding as well. For instance. We
could have used Hull to actually decode the b64 message
actually got the result.
To use who let's type each.
URL
Like so Dash it.
followed by open quotations Mark like
so
and we'll specify the actual message
that we want to decode.
followed by a close quotation marks like
so
when you're ready simply enter.
And notice the original string didn't me too much sense, but
now the corded string.
Is telling us hey, we actually have
a URL. So let's copy this
like so.
We'll head over back to our web browser.
and let's enter this new URL or
this part like so
when you're ready simply hit enter.
And great.
We have solved the challenge and found the e-cig.
Let's head over back to our main directory on
wasp.
Great, we all solve multiple challenges. But a
mean one that we wanted to solve was cryptographic and
security by finding to actually say
During a course of this video you have learned how to discover anyone
exploit cryptographic vulnerabilities of
the phone within a web application.
In the next video, you'll learn how to automate SQL injection
using a tool known as SQL map.
I hope this video has been informative for you and I
will see you in the next one.