‫So in brute force attacks, it's better to determine some of the rules first.
‫For example, the password length will be between three and eight.
‫It will contain just number and capital letters, etc..
‫Suppose that we don't determine any rule.
‫The brute force tool will try every possibility, starting with one character length, password possibilities
‫and then two character length password possibilities, etc. In most cases, dictionary attack is chosen
‫to crack a password because users have to remember their password.
‫They generally choose passwords that are easily digestible and not complex enough.
‫There are dictionaries that you can find online, which contain the most frequently used passwords.
‫There are a lot of tools that can be used in password cracking, and some of them can also be used in
‫online password cracking attacks.
‫So let's see, an online dictionary attack here will use Burp Suite and -- vulnerable web applications
‫for this example.
‫Go to log in of DVD.
‫Suppose that we don't know any credential to log in to the application.
‫Run Burp Suite and turn off interception.
‫We just collect the login requests at the beginning.
‫Modify the browser proxy settings to use Burp as the proxy server.
‫Make a few unsuccessful login attempts.
‫Now, go back to Burp Suite, find a log in request.
‫Right click on it and choose Send to intruder, go to Intruder tab, go to Positions tab.
‫Clear pointers.
‫Point to the fields that we want to crack.
‫Choose cluster bomb as attack type in this type of attack, it iterates through each payload set in
‫turn, so that all permutations of payload combinations are tested.
‫Go to Payloads tab choose simple list as the payload type.
‫Since we use the free version of Burp Suite, the tries are slowed down.
‫So on this demo, we use handmade dictionaries, which have a few words.
‫Enter a few words for payload set one.
‫Admin administrator.
‫User.
‫User1.
‫And a few words for payloads at two one two three four five six Q, W, E R, T Y User Admin, etc.
‫Go to the Options tab.
‫Now let me bring your attention back to here.
‫Since the first response of login attempt is a redirection.
‫We choose always in redirection, in grep, match frame and a string, which shows the login attempt
‫is failed, so it is login failed.
‫And don't forget to tick flag result items, go to intruder menu and select start attack and see what
‫we have here.
‫Admin, admin and user user credentials are not ticked as log in failed because they are valid credentials.
‫Now we can go to the login page and log in one of the credentials.
‫Capture.
‫A back room for completely automated public Turing test to tell computers and humans apart.
‫It's a type of challenge response test used in computing to determine whether or not the user is human.
‫It's used in log in pages and in forms which have to be filled in by people, not by machines.
‫CAPTCHA implementations are often vulnerable to various kinds of attacks, even if the generated CAPTCHA
‫is unbreakable.
‫The following vulnerabilities are quite common in many CAPTCHA implementations when the generated image
‫captcha is weak.
‫It can be identified by only a simple comparison with an already broken captcha.
‫Another weakness occurs when the generated CAPTCHA questions have a very limited set of possible answers.
‫When the value of decoded CAPTCHA is sent by the client, it is often encrypted by a simple algorithm
‫and can easily be decrypted by the observation of multiple decoded captcha values, or the value is
‫hashed by a weak hash function that can be broken using a rainbow table.
‫Now, in two cases, you can be successful in reply attacks.
‫First, the application does not keep track of which idea of CAPTCHA image is sent to the user.
‫Therefore, the attacker can simply obtain an appropriate capture image and its ID, solve it and send
‫the value of the decoded capture with its corresponding match.
‫Second, the application does not destroy the session when the correct phrases entered by reusing the
‫session idea of a known catch.
‫It is possible to bypass a CAPTCHA protected page.