Hey, guys, welcome back to another episode on How to Hack.
So here we have web good running.
So we've got as a deliberate, vulnerable Web application system that we can try our hands on to break
into the system.
So today we're going to explore on broken authentication as part of our Web application penetration
testing series so we can go in and click on authentication bypasses.
So authentication bypasses is pretty straightforward.
The whole idea is you are going to log in page and you need to access into different segments of the
website.
But what you need is actually to authenticate yourself into the site.
So you may not have to use a name, you may not have the password, you may not have any form of data
or details for you to access different parts of the website.
So here again, we have different ways of bypassing authentication.
So firstly, we can try to look out for hidden inputs and we can remove certain parameters or change
certain parameters and what kind of data we are sending into the site.
Or we can look at some of the false browsing to look at different parts of the site that could have
been opened up, but it's not available directly as a link into other parts of the site.
So, again, we have seen this earlier during the or waps juice shop where we look into all these authentication
bypasses and we follow demonstrative page in part of the Web site.
So here we can go in and go to lesson number two, which is two factor authentication bypass.
All right.
So over here, what happened is that whenever you try to login into a website, they could actually
challenge you even though you got a username and password.
So you could a username, you get a password and a asthmas.
One time password is sent to the person's device in order for us to get six digit pin or four digit
pin in order to access Innosight.
So multifactor authentication can be very, very challenging to bypass.
So over here we have an example over here on the PayPal two factor authentication bypass.
And what happened is that a hacker actually moved to what's the security questions rather than supplying
the SMS one time password.
So.
All right.
So this is, of course, a case of logical error.
It is happening in the system.
So we have multiple steps.
And, of course, we can look at the proxy.
All right, when we can remove certain questions or update certain questions as we submit them into
the system.
So the first thing in a scenario where resetting our password, but we have no idea, OK, what we can
do in order to reset it and of course, we have these security questions has really been set up.
And of course, we have no idea what is the password.
And we're trying to gain access into the site again.
So you ask, what is the name of your favorite teacher?
So we have no idea what is the name of the street you grew up on?
OK, so we can enter test and enter test again.
So what we are doing here is what we call the normal journey map.
So we're trying to find out what happens, what kind of feedback is provided from the website when we
provide normal inputs as expected.
All right.
So go ahead and click on Submit and you see.
Not quite.
Please try again.
So let's go to the top right corner, OK?
And we can go ahead and go on to the web developer, Tepp, and we can look under network.
So we want to see what kind of data is being sent into the site.
So go ahead and click submit.
And over here we have a verify account.
All right.
So go ahead and click on it.
So this is a JSON and we can see over here we have to request you here.
And this is the request method of post.
We have to respond.
Hate is OK.
We have all this different data and we can click under parameters, parameters.
So we can see over here we have security questions, zero security question, one J as an able one,
verify Medhat security question and a user ID.
So else we got the user ID as part of understanding what's going on.
So we also have the response from the site.
So we have the feedback.
Not quite and we have the assignment is verifying income and it was made is true.
So we have all these different details.
So what we can do next is to actually go back.
All right.
And we can actually go ahead and write, click, click on edit and recent.
So we are going to edit what we want to send system.
And over here we have to request body.
So what we are trying to find out and understand here is look for some kind of structure or logical
structure of how it works and think about what's happening behind the scenes as part of the database
as we do the verification process, as they pull records from the database table and trying to validate
on those columns that has already been heart set into the database table.
So in this case, we have security questions, zero equal tests and security question equal one is test
and then we have dogs and able and so on, so forth.
So we can see this information here from the request body and we can from here identify a few important
areas to look out for.
Firstly, there is incremental, this incremental.
Just in question.
So we are moving from security questions zero to security question one, so there is a plus one is going
on.
So think of it as a follow up as to those programs and systems that would indicate multiple security
questions that a user can choose from.
In this case, the user chose security questions zero as well.
Security question one as part of their recovery efforts when it comes to assessing the economy.
So in this case, whenever you have such ways of structuring the security questions, it makes it very
easy for hackers to guess how they could actually bypass the security questions so there could be more
security questions.
For example, security questions, two security questions, three, four or five.
And likewise, if we look at user ID.
All right, just to change a little bit of our topics is that whenever you assessing a website, you're
assigned a user ID.
And again, a lot of use ideas could be incremental.
They could be just purely on digits.
And it's incremental.
There could be ways for us to access other people's shopping cart.
Your personal information by changing the user ID.
OK, so going back into the tutorial, we can easily change the security question.
So I can change this to security question too, and I can change the second one security question tree.
And in these cases there could be empty.
These security questions could be empty in a sense that they have not been set as part of the card recovery
process.
So once you have the details in place, you can go ahead and click on send.
And once you said, all right, we can go to the end, all right.
And we can go ahead and play the information.
All right.
And we'll be able to send the details and we can actually complete the progress of this so I can go
in and reset.
OK, so go in and change it again.
OK, so now let's go ahead and click on CNN.
All right, so once it said, all right, we can see the details.
All right.
To see what kind of responses we can get from the system.
All right, so let's see what kind of results we get from the system and you see over here, congrats,
you have successfully verified your account without actually verifying it.
You can now change your password easily.
So that's how we can actually manipulate what is being sent into the database system by amending the
kind of perimeters to kind of options that we have.
And of course, one of those fundamentally is in terms of incremental changes, which is why when you
say security questions, range settings and in columns in a system, they should also be hidden from
the users who are assessing into your site.
So once again, I hope you've learned something valuable.
And if you like, what if just watch remotely like share and subscribe to the channel so that you can
be kept abreast of the latest cyber security tutorial.
Thank you so much once again for watching.