Hello everyone. Welcome back to this particular slide.
We'll be taking a look at the next attack work or
Brute Force as a name. Suggest that
occur is going to root for secession, IP
value itself.
In practice, we have seen scenarios where
the session IDs are quite random.
We are taking a look at a scenario where the session
ID is are having a common pattern.
Now. Let's take a small example.
Going back to this particular example, let's
figure out what is the session ID that
is being generated for supplication.
Now as you see the session value is
2 0, 2 0, 1, 2 0, 0
1. This is on the Chrome browser. Now.
I've also initiated a new session
on Firefox as well. Now. Let's try
to figure out what is the actual value that has been generated.
Ask you see this value ends with the digit 6.
In fact, is an attacker can actually figure out
a pattern that has been generated for this program. The
pattern is in the format of yyyy.
Mmm, followed by
a three-digit increment value. So,
an attacker can always understand that
if he can keep the first six digit
as constant based on the particular day.
The calendar year that is this
is December of 2020. So,
in that way, he can ensure that the
first six digits are inconsistent and the,
last three values could be incremented since so work
is generating session IDs in sequence with an increment
of one that could be an assumption. But, however, this
first six digits are being consistent. So,
based on this pattern, there are different ways
of actually creating a
Food. The first and corn method
would be to actually send
manual request to the server, with such an ID
expecting the value to be correct,
so that the session can be granted to
the attacker itself.
In order to automate, there are multiple ways to do so.
One of the common ways that occurs do is to write
some Scripts.
In this demo will actually take a look at one of the tool.
For example. Brute force can be done
by using a tool called Bob sweet. And
there are committee editions are available for free for
anyone to download.
So notice, let's take a look at that.
As you can see, this is the pope sweet window. So
what is burp? Suite were sweet is a
HTTP proxy tool. So that means
any requests flowing through the browser would be
captured in this tool first so that we can understand the
parameters that are being sent to any specific endpoint.
And based on that during the sting, we can tamper
different values and send it to the server and
figure out how the response is going to look. Like. We
will Deep dive into how it works it works but
it is something we will be using in this particular tool. So
what I've done is that I've configured the
verbs, we tool to work with Firefox. So
you need to actually set up the proxy on
the Firefox so that
All traffic is being rerouted to work sweet tool.
So the default values would be the Local Host itself. That
is one 27001 and the
default port on which both sweet runs is 8080.
So we are just going to use some basic settings.
So, the moment I sent a request to the web server. The
particular request has been captured in this particular screen. Now,
the request has not been sent to the server yet.
So as an attacker, what we can do is that you can use multiple
options. So one of the particular module that
will be looking at is the Intruder on
this particular tool. So what I'm going to do, is
that click on action and send it to intruder.
So Intruder is module which can
generate multiple payloads. It could be custom or generated
by the tool itself. And those data can be
sent at bulk to the server.
Now, using Intruder will be taking
a look at the parameters that are being sent. So
as you can see the tool as automatically detected
or numeric value and
it has been highlighted,
So, what we'll be doing is that we'll just change this payload.
So, there are multiple types of payload will
be using a simple one call numbers.
Now, we just need to type in the
values that need to be generated. As we know, the
format is why why? Why why mmm?
And the first value be 0, 0 1.
Now, let's take a scenario where I want to generate
a sequence till 8.
Since we understand this being generated in sequence, maybe
we can just start the attack. And what's
going to happen with that. Is this going to Brute Force for
each session ID, starting on the value 0 0, 1 till
308 with the step of one.
So just it be similar to attack.
We see that each session ID as we generated and
said in sequence. So this is one sort of example, for
Brute Force. There are multiple ways and
multiple scenarios where the tiger can use different tools and scripts to
achieve the same result.
I'm going back and understanding that I on paper. Let's
try to read it. The scenario.
We have a user and a web server, which
the user is trying to access and the
same time, the also have an attacker in picture.
As you can see, the first request is when the user sends
the request Phillips. So in order to
generate a session ID, that is the same thing, which
the attacker is point to do. So in order to understand if
that's a patent on the session ID, then by
doing, so he is going to send multiple requests by
boot forcing the sequence ID of the session and
expecting that, some of
the values may actually be valid on the server side. In
that way, you will be
Be getting access to the account.
That's it for this video. Thank you.