Hello everybody and welcome back.
And in this editorial we will cover some of the burps with attacks that could be useful for us.
So let us start off by turning up our burp suit on so you can turn your Nuremberg suit from the applications
I will just turn my on from the terminal and also if you answered the proxy as me in the previous video
let us just set burp suits to be our proxy so we can intercept our packets.
So just go here on these preferences.
We already covered all of this.
Scroll down to the network settings.
Let me just click here on next for the purple suit and start Burt's suit.
And here go on net for proxy.
And then on settings and just check your manual proxy configuration so click here.
Okay.
And now your burp suit is set as a proxy now as we already know.
Burps it is already set to intercept our packets.
So if we try to for example go on Google dot com we won't be able to connect.
So let us first of all turn that off.
And now we should be able to access the Google page waiting for Google.
Now the Internet is a little bit slow so we will wait for that.
The first thing I want to show you is the burp spider now the spider.
Basically they're active and passive spider tangled web page.
The passive spider ring the burps it dies does by default.
So if we for example visit Google if you go on this arrow it will show you the sub directories of the
Google and you can also go as much as you want as we can see there are a bunch of these files that it
already found in the Google.
Now how does the scanning work or the spy during it basically the watch is the HDMI out page the e-mail
page and here it has a bunch of these links and it clicks on each of these links.
So for example the spider basically just scan through this the email code and found for example this
link and it clicked on it and then it added it to this spider ring folder where it shows all of the
links that are connected on that page.
Now
in order for you to spider web page of course your intercept has to be turned off now.
And if you wanted to scan the page actively you need to right click for example at us right click on
the on the net on the.
Let us choose right here so we can go.
But this is first of all visit the our Oh I swear to machine so we will sit at that and let us see what
it gave for it right here.
It didn't print it out yet.
So let me just reload this page and right now we share it right here.
And for now on it doesn't have anything there but if we go on to be for example this one let me just
see it found the sub directly that we clicked on.
But let's say we want to Spider only this cyber directory actively just click here on yes and you can
see you can read it at the time.
So the one by proxy to stop sending out the scope items that just go here on the spider and we can see
that the requests made and the bytes transferred it is still running as we can see use these settings
to monitor and controls.
Burps Spider to begin spider in both the target application and right click on one or more nodes in
the target site map and to Spider this host branch.
Now this is the active spider ring as we can see the D has a bunch of sub directories itself and you
can find some of the interesting things with just searching those sub directories
now that isn't really that important to us.
So we won't be giving too much of our time to that.
But we want to do is we want to perform our first attack on the old Westport machine.
So uh the first thing we will do will be rather simple.
Let me just open the Firefox and go one step back.
And what you want to do is you want to go on to the.
You're always uh IP address.
And then once you go to this page just click here on the OS web code.
Now it will prompt you with the username and password the user name and password will be web code.
So could the user name that code and put the password.
Also web code.
So just type that and you should be able to log in right here.
We do not want to say password since we will be brute forcing the same log in later on it will ask you.
It will basically prompt you with the welcome screen.
So just click here on start Web goat and here we can have a bunch of attacks that we can perform on
the OSP web code.
Now for the first attack and the rather easy one we want to go on to on to the authentication flaws.
So basically let me just find where that is.
Here it is.
And we want to go on to the.
Forgot password.
So if you go onto the forgot password it will basically ask you for the user name of your own account
in order to change the passport.
Now what.
The problem with this is.
Well first of all we do not know any user name for this specific page.
So if we type here for example g g g g g and submit it will say not a valid user name.
Please try again.
Now the concept of this attack is that we sent a bunch of user names right here and hope that we get
a different response from the server for some of those user names which will basically tell us that
that username exists.
So let me just explain that a little bit better.
For example let's say we send 10 user names into this.
We just typed here 10 different user names and one of them happens to exist on this web page for that
specific one.
It will not print us this error which says not a valid user name.
Please try again.
Which means that our HDP response for the server in its HD AML code won't have this string which will
make the ETP response basically smaller or bigger in terms of bytes.
And we will be able to determine the difference between the HDP response from the not valid user name
and from the valid user name.
Now in order for you to understand this better let us do that in practice so what we want to do is first
of all turn our intercept on for this.
So just go on to intercept on and so our goal right now is to find out a valid username.
So if I hear anything.
So just type here and a thing
here we will receive that packet that we sent which is a post requests since we are posting in this
form right here on this page as we can see and our user name that we're posting is anything.
Now you can just forward this or turn the intercept off and we want to find this packet.
We want to find this packet in the in our brb search.
So let us just find it posts.
What we are looking at the responses.
This is not it.
HOST And so here it is.
This is our post request that we send a few seconds ago which says user name anything.
And we got a not valid user name for that.
So what we want to do with this packet is we want to send it to an intruder.
Now the intruder is basically a brute force for the burps.
So here you can have if you right click on the packet so find your post packet with the user name right
click on it and go send it to intruder.
Once you do that you will see this section right here will turn orange.
So just click on it and you will see these four options right here.
What you want to do is go on to the positions and you will see your packet
now.
The next thing you want to do here you will see that bunch of is that some of these things right here
are selected for example the user name the submit button the our cookie the session IDP HP session the
Jason session HD screen menu.
So what you want to do is click here on clear in order to remove all of that selection and right here
what we want to do is only select our user name.
So just select anything and click here on ad and you will see that out of all of these things only our
user name is selected.
Now why do we do this.
Well we do it basically suburbs it knows which part of the packet to change with the certain list that
we will provide it with different user names.
So if we left it on all of those things before selected it would change all of those things to different
user names and it will make page not load since it would change the link.
The cookie and it would all crash basically but then we cleared it and added on the user name and selected
it and now it will only change the user name.
Now under the attack type you will have four options what you want to select is the sniper option the
sniper option basically uses one list and selects each input position one by one.
So we provide for example the list of five user names which we created on in our terminal or wherever.
You can use the use of the user list basically from the calendar itself since it comes in stock with
bunch of these lists and it will send packets one by one with changing this value right here with a
different user name from the list.
So let us do that.
Once you perform all of this.
So once you select your user name and the you click here on ADD select these sniper attack type option
you want to go onto the payload.
Now the payload sets for now and you want to leave unchanged and in the payload options the same police
you want to click on load in order for us to load list and what we want to go right here we want to
find a list that already comes pre installed in the clinics.
So just go where I go.
So go to this slash directory and go to the user just find it user then go to the share then go to the
word lists to just find the order lists should be somewhere here or lists here.
So click on the word lists click on metal split and from here we want to find the HDP.
Default users dot the 60
HDP default user dot the extent you want to select this user list and click here on open.
And as you can see this is a smaller user listed basic has like 15 passwords or something like that.
And once you click that you want to go on to the start attack.
Now what this will do.
It will exchange our user name input with all of these different users from the list.
So here it will say the community edition the burps it contains a demo version of brb intruder.
Basically this says that the free version of brb should will run slower than the provision birth suit
and in order for you to run this uh brute force faster you need to buy the provision but from now on
we'll just click here on the okay.
Since we don't need it and as you can see it is running all of these user names in the form right here.
So it is sending packets with different user names and as we can see it finished there were 14 user
names and all had status code two hundred but what we want to search right now is the difference in
the length of the response of the server.
That's what I was saying basically as you can see all of these are thirty thousand six hundred six except
one which is thirty thousand five hundred and sixteen.
What does that mean.
That means that it got a different response from the server than all of these others which is a good
thing since it possibly means that this username is a valid username.
As we can see in the any other user name so let's pick this one for example which has this length and
go on to the response and we can try to find they're not a valid user name.
Please try again it will be there it's just very hard to find since this is a huge HDMI file
it doesn't change it doesn't even matter so just find the user name that has different length and if
we paste the eggman right here.
Since we can see that this is the admin is the only one with different lights and we click on the submit
we can see that we proceed to the next step since that username was a valid username and now it says
the what is your favorite color for that account now you can use basically brute force this as well
with the same method.
So just find and create a list with bunch of different colors and brute force this feel the same way
we put forth the user name in it but we wont be doing that right now.
What we want to do next with and by next I mean in the next video is we want to brute force our log
in.
So basically we will be brute forcing the username and password at the same time so we will do that
in the next video.
And until then I hope you have a great day and I will see you later.
Bye.