‫Instructor: Hi.
‫Within this lecture,
‫we're gonna solve the second challenge in our API.
‫So I'm gonna close down all this tabs, okay?
‫So far, we have solved only the first one.
‫Now, we are down to the second one.
‫So in the second one, we have a new challenge
‫called broken authentication
‫and we have two endpoints over here.
‫One of them is post, so we are logging in, I believe,
‫and it will ask us for an email and password,
‫and then we can get something which is the user details.
‫So when we get something,
‫we need to give an authorization token,
‫and we get that authorization token by simply logging in.
‫So let's see the challenge over here
‫because there is no additional information over there.
‫So I'm gonna go into the Postman
‫and just go to the user login, okay?
‫So right now, I'm inside of my Postman.
‫Of course, I'm using the same old collection
‫that we have been using so far.
‫And if we click on the user login,
‫then we can see the headers,
‫and I believe we don't need to change any headers right now.
‫And for the body, it'll ask for an email and password
‫and there is a test as well once we log in,
‫again, it'll give us some kind of authentication token
‫and it will save that token inside of the get request, okay?
‫It is not saved right now.
‫It says unresolved variable as we expect.
‫And there is nobody in the get request,
‫so if we can log in, then we can get the details
‫if we can get the user details.
‫Okay, that's simple.
‫So let's look for hints.
‫It says that we don't have to see the credentials for this.
‫How do we log in?
‫Yeah, that's a good question.
‫So there is something in the resources folder.
‫Okay, so we have another supportive instrument over here.
‫I'm gonna go into the resources folder and here you go.
‫In the API2, we have something called creds csv.
‫So this is credentials, I believe.
‫So let me open it and see what it is.
‫Okay, so if you exit on your computer, then it's great.
‫And open it and just see what's inside of it.
‫So here you go.
‫As you can see, we have some kind of email
‫and password combinations over here.
‫So Brown Grimes,
‫and it goes up to 1,000 users and passwords.
‫So okay, we're gonna try them,
‫but I believe the scenario over here
‫is that there is a leak like that.
‫So we are just trying to log in with any of this.
‫So I grabbed the first one,
‫I just pasted the email from here,
‫and I'm gonna go and get the password as well.
‫So let's get the password for this Brown.
‫So I'm gonna copy this, get back to the Postman,
‫and just paste the password.
‫I'm gonna send this request and see what happens.
‫Here you go.
‫We are not successful.
‫For the success, we get a false.
‫And because of this, username or password incorrect.
‫Okay, so what we need to do,
‫we need to try 1,000 users and passwords obviously.
‫Okay?
‫So one of them should be working
‫and the scenario over here is that we found a data leak
‫on the internet, on the dark web,
‫on some forums, and we are trying to see
‫if we can log into the system
‫with one of those credentials, right?
‫Of course, we can try one-by-one,
‫but it will take a lot of time.
‫So we need to find a way to brute force.
‫We need to find a way to try them automatically.
‫There isn't any way to do that with the Postman
‫because this is not a penetration testing tool
‫but of course there is a way to do this with Burp Suite.
‫So we need to find a way to connect Postman
‫with the Burp Suite, okay?
‫So all you need to do is just open the Burp Suite
‫and make sure you have this proxy that we have given
‫before 127.0.0.1, port 8080,
‫and we're gonna give the exact same number
‫exact same proxy to the Postman.
‫In order to do that
‫we need to find the proxy settings of the Postman.
‫So over here we have the capture request and cookies.
‫That is not what we are looking for, I believe.
‫Let me see, what was this?
‫Yeah, here we go.
‫This is to capture the request in the Postman.
‫This is not what we are looking for.
‫We need to capture the request in Burp Suite.
‫We are Postman.
‫So I'm gonna go to the settings
‫and I'm going to just open the settings and let's see,
‫yeah, here we go, we have the proxy tab over here.
‫So inside of the proxy tab
‫you can find this, add a custom proxy configuration,
‫and make sure you choose http and https as well.
‫So for the proxy server, I'm gonna give 127.0.0.1.
‫And for the port make sure you give the exact same port
‫you have given inside of the Burp Suite.
‫So remember this was the credential
‫that we have given local host and port ad 8080.
‫So if this was approved here
‫then we would just open the foxy proxy
‫or just change the proxy settings.
‫This is exactly what we are doing over here, right?
‫So we are giving the same proxy to the Postman
‫and the Burp Suite as well.
‫So let's try it.
‫I'm just gonna come over here and turn the intercept on.
‫Let's see.
‫The options are the same as you can see.
‫Now intercept is on,
‫now I'm going to try to send this one more time
‫and here you go.
‫It's not going through
‫because we captured it in the Burp Suite.
‫Here we go.
‫That's great.
‫Now we have the request over here.
‫Now let me try to find the font settings
‫of the Burp Suite because it's a little bit small right now
‫so I believe it's inside of the preferences
‫or maybe we can come over here
‫to user options and display.
‫Yeah, here you go.
‫Of course, you can do that if you want
‫but if you don't want you can just leave it on.
‫So I'm going to change this to be 16,
‫and yeah, I believe that's not the thing
‫that we are looking for because it's not bigger right now.
‫So I'm gonna go back and yeah, here you go.
‫This is the one that I'm looking for.
‫I'm going to make this something like 17 or 18.
‫Let's go back and change this to 15,
‫and yeah, here you go, now it's much better.
‫As you can see this is the request
‫that we are trying to send.
‫If I look over here, I can see the Post.
‫So it's going to log in and if I forward this
‫this will just go through, but I don't want that.
‫What I wanna do is to change this email
‫and password repeatedly
‫so that I can try to see which credential works.
‫So for right now I have this packet.
‫If I forward this packet by clicking on this left button
‫on the top side, okay, this one,
‫it'll just forward this to the server.
‫If I drop this, it won't get to the server.
‫If I turn the intercept off, it will just go to the server.
‫But I don't wanna do that, I want to change this email.
‫How do I do that?
‫I can right click and just send this to the Intruder
‫or Repeater.
‫For right now, I'm just gonna go to the Repeater
‫because I want to show you something.
‫I can come to the Repeater and just send this request
‫as many as I want and I can change the email and password
‫from here, okay?
‫As you can see, this is still in the proxy section,
‫but in the Repeater, I can just try this one-by-one
‫by changing the email and password.
‫And if I get the success response then it's okay,
‫but of course that is not what I wanna do, right?
‫So if I copy this and paste this over here, let me show you,
‫this actually works.
‫I'm just gonna copy the password as well.
‫Paste this over here and send this request.
‫And here you go.
‫Again, we get the false as a success.
‫So it's not successful.
‫So this is a way, but of course it doesn't make sense
‫because it will just take as many time as we would have
‫by just changing the email and password
‫in the original request, right?
‫So there is another module inside of the Burp Suite
‫called Intruder.
‫If I send this to the Intruder by right clicking,
‫now I can actually brute force.
‫So the first thing on the Intruder is the target.
‫So host and port should be by default correct.
‫Okay?
‫This is the IP address and this is the port, the http port.
‫What we are interested in is the positions.
‫So if you go to positions,
‫as you can see email and password are highlighted.
‫So Burp Suite understood
‫that we are going to brute force this email and password.
‫If we want to change the parameters
‫that we are going to be brute forcing,
‫of course, we can do that.
‫We can just come over here and say, clear.
‫It will clear all the selections
‫and then we can add some new parameters again.
‫Okay, that is a possibility.
‫But in this case, email and password are highlighted for me.
‫So it means that we are good to go.
‫What we are going to do,
‫we are going to give some values to replace the email
‫and password automatically.
‫In order to do that, I'm going to change the attack type.
‫So far we have sniper over here,
‫and sniper is good for one parameter only, okay?
‫Pitchfork is actually good for two parameters
‫so that we can change the email and the password.
‫And there is some other options like battering ram,
‫we are gonna see them later on.
‫Right now I have chosen Pitchfork
‫and in the payload section
‫we are going to give the values that we want to try.
‫As you can see in the payload options
‫it asks for a list and we can just copy and paste the list
‫or we can just insert them one-by-one.
‫Whatever you wanna do.
‫However, of course we are just gonna copy and paste them.
‫So let me try to delete the hyperlink from here.
‫Yap, here you go.
‫Right now, as you can see we have the username and password
‫on the same section,
‫but over here we have to give the first and second list
‫one-by-one because we are going to be using first list
‫for the email and second list for the password.
‫We can just select the first list and second list from here.
‫For the first list, we are gonna copy and paste the emails.
‫And for the second list
‫we are just gonna copy and paste the passwords.
‫So I'm going to be using something called text columns.
‫So go to the data and use text columns.
‫So maybe you know how to use Excel, maybe not.
‫I'm just gonna go for the limited and choose the comma.
‫So what it does that it actually finds everything splitting
‫with comma and just split it into two columns, okay?
‫Everything separated with a comma
‫and they split it into two columns.
‫Right now I have one column as user names
‫and other column for passwords.
‫So I can just paste the usernames over here
‫and choose the second list,
‫and just select copy A and paste the password here.
‫As you see right now I have the first list
‫and the second list as well.
‫So we have chosen the Pitchfork,
‫what Pitchfork will do is to choose the first list
‫for the first parameter
‫and the second list for the second parameter
‫as we start the attack, you can see it's working.
‫So for the first payload, we can see emails coming in,
‫for the second payload, we can see the passwords coming in.
‫That is very good.
‫But right now we are gonna have to wait a little bit
‫because we are using the community edition
‫which is the free version of the Burp Suite.
‫And in the free version it actually throttles us.
‫It actually speeds down things, okay?
‫So if you pay for it, then it's going to be very fast,
‫but if you don't pay for it, you're gonna have to wait,
‫and it can take like an hour or maybe two hours.
‫I don't know.
‫It's going to take a lot of time, trust me.
‫So as you can see, if you click on any of these trials
‫you can see the response from here, okay?
‫And also you can see the state's numbers
‫which is 401 right now
‫if you get something like 200, then it's okay.
‫200 means that everything is okay.
‫If we get 500, for example
‫it's called internal server error.
‫If we get a 404, it means that it couldn't find
‫the thing that we are looking for.
‫Right now we're getting the response,
‫but it's not a success, okay?
‫So we can filter this status out,
‫once it's done, obviously,
‫and we can just select the 200
‫and see the working credentials.
‫In order to do that, I'm gonna pause the video
‫and once it's done, or once I see the 200,
‫I will come back and I will actually show you the result.
‫Don't worry about it.
‫So here you go.
‫Now it's down for me.
‫Obviously I have paused the video and now I'm resuming it.
‫I found that in the 455th trial, okay?
‫Since we are using the same credentials
‫it's going to be the same for you I believe.
‫But if you just order this by status
‫you can see this status is 200
‫and if you double click on it, you can see the request.
‫So this is Savanna.
‫Savanna user is the thing that we are looking for
‫and we can see the success and also token as well.
‫So what we need to do, we need to first store this, okay?
‫So I'm going to send this to Repeater by right clicking it.
‫So I'm going to go back to the Intruder
‫and I'm just going to stop this, okay?
‫If you click on this,
‫it will ask if you want to continue in the background.
‫I'm just gonna discard it because I don't wanna continue.
‫I already found what I'm looking for.
‫So I'm gonna open the Burp Suite one more time.
‫Go to Repeater.
‫By the way, before going into the Repeater,
‫you may want to uncheck this URL in code,
‫these characters for both lists, okay?
‫If you encountered any problem.
‫So that may be the problem for you.
‫But right now I'm just going to send this request
‫and see the token one more time.
‫And by the way, you don't need to wait
‫until your brute force has been finished
‫or something like that.
‫You can just use this email and password.
‫If you understood what's going on, then it's okay.
‫So I'm going to turn the intercept off
‫and go back to the Postman
‫and just use that information, okay?
‫I'm gonna go to the Repeater.
‫We can just use this email and password
‫or we can just grab the token
‫and set it as a variable inside of the Postman.
‫But I'm just gonna go for this, okay?
‫I'm gonna copy this and paste over here.
‫And then I'm just gonna send this and here you go.
‫Again, we get the success true, and we get the token.
‫Right now this token should have been set as a variable
‫inside of the Postman.
‫If not, you can just copy it from here
‫and give it to the get details and point over here
‫as a header.
‫So you can just copy this from here
‫or from the Burp Suite like this and come over there,
‫and just give it as the authorization token over here,
‫delete this variable and just paste it.
‫That will be okay.
‫So right now I have this.
‫So what I wanna do, I'm just going to come over here
‫and just send this request because there's nothing inside
‫of the body.
‫And once I send it, as you can see,
‫we get something back like this.
‫So we get some IDs, we get some tokens,
‫and addresses, and stuff, and here you go.
‫So we have all of those things.
‫And I believe inside of this we have a flag.
‫Yeah, here you go.
‫We have a flag.
‫That means that we have solved this challenge.
‫And the challenge over here, the vulnerability over here
‫is that they do not have rate limiting, right?
‫They do not have rate limiting.
‫So that we found some data leak from the internet,
‫from the dark web or somewhere.
‫We tried every credential with the help of Burp Suite
‫and paid off.
‫We found a credential that is working.
‫If they had implemented rate limit
‫maybe after fifth trial or sixth trial
‫then it would've stopped us,
‫but they didn't and we managed to get something.
‫So I'm going to turn off the proxy before I forget it, okay?
‫And I'm going to stop here
‫and continue within the next lecture
‫for the challenge three.