‫-: Hi.
‫Within this lecture we're gonna take a look
‫at the API four, challenge four.
‫So if you come over here to API four
‫it says lack of resources and rate limiting.
‫Okay, there is no rate limiting.
‫So I immediately think that
‫we are gonna be doing some kind of brute forcing
‫or dictionary attack or something like that.
‫But also it says that we believe OTPs are great.
‫So which means that this is going to be something about OTP.
‫So let's see what an OTP is.
‫Over here, we are gonna give some mobile application
‫or mobile number.
‫It's just a phone number, okay, mobile number.
‫And then we are going to do a post
‫which will verify the OTP.
‫So OTP stands for One Time Password.
‫So it's kind of multi authentication thingy.
‫So you log in and you get an SMS message
‫or a message from a service to your phone.
‫And you give that number, give that four digit,
‫six digit number to the login system
‫so that you can log in, okay?
‫So this is multifactor authentication or one time password.
‫Over here, after we do the OTP, we can get the user.
‫So this is pretty obvious,
‫of course we are gonna have to take a look
‫at the postman as well
‫to see what kind of things that we are going to do.
‫But over here we have the clue, we have the hint,
‫it says that we believe OTPs are great,
‫but let's see what we can find about OTP.
‫So over here we are already done with the API three and two.
‫I'm gonna go ahead and try to log in to this phone number.
‫Of course, this is not my phone number,
‫this is just a regular example that is given to us.
‫But anyway, even if we give the regular
‫or or our own phone number
‫I don't think we are going to receive any message
‫and that is not the case.
‫As you can see, if you send something,
‫if you send a request like this, you get a message,
‫you get a response saying that okay, everything is okay.
‫But your four digit OTP sent on mobile number.
‫So of course this doesn't belong to us.
‫And the idea over here is that can we find the OTP
‫or can we find one time password of another phone number
‫so that we can hack them, right?
‫So if you come over here to verify OTP
‫as you can see we already have this, okay?
‫We already have this headers and bodies,
‫we don't have to change anything over here.
‫Just we need to find the four digit number.
‫If you find it,
‫then we're gonna get an authentication key back.
‫So easy, I'm just gonna send this and here you go.
‫It says that invalid OTP.
‫So what I'm going to do, I'm going to try and see
‫if this is actually wrong OTP, wrong password
‫or this is invalid.
‫I'm gonna send something like 8,000, 7,000.
‫I'm gonna see if we get any different response like this.
‫Okay?
‫So can it be any four digit number or it goes up to 2000.
‫Something like that, okay?
‫But as you can see, we don't get any different thingy.
‫We already have seen this.
‫We always get invalid OTP, which means
‫that we are not getting the authentication token.
‫And also, which means that it can be anything four digits.
‫So I'm taking a look at the logs as well
‫to see if there is something new,
‫or if there is something wrong
‫with each request that I have sent.
‫But it doesn't seem so.
‫Since we cannot find any more clues or hints,
‫I believe what we have to do,
‫we have to try and change the OTP
‫starting from 1000, ending in 9,999
‫and just brute force the whole possibilities, right?
‫So what I'm going to do, as you might guess,
‫is to send this request to the Burp Suite Intruder, right?
‫If we manage to do that, then it's okay.
‫We are gonna get the OTP eventually.
‫So I'm going to come over here to settings
‫and change the proxy one more time.
‫So remember, we have to configure this proxy
‫and the Burp Suite proxy in the same way.
‫So I'm gonna open the Burp Suite,
‫I'm gonna turn the intercept on
‫and I'm just going to send the OTP one more time.
‫So once I send that, I will just get this over here.
‫And of course I'm going to send this to Intruder
‫as we have done before.
‫And we already have the host import.
‫Now in the positions, if this is not labeled for you
‫then you're gonna have to clear and edit yourself
‫and make sure that this this is added
‫as a parameter to be changed.
‫Okay, and by the way,
‫right now I'm using the Attack Tab type Sniper.
‫We have used Pitchfork before, but remember I said
‫that if we had only one parameter, then we would use Sniper.
‫Now this is the time we can use the Sniper.
‫We already have chosen it.
‫We only have one parameter, so we only have one payload list
‫and I'm not even going to create that list.
‫I can just come over here and choose numbers, for example,
‫and just state that indicate that it will start from 1000
‫and it will go up to 9,000 or nine times 999, okay?
‫So it'll just step one at a time and here you go.
‫Now it will actually try 8,999 times, which is a lot, okay?
‫And the idea over here is that,
‫oh we can leave this by the way,
‫we don't have that kind of thingy right now.
‫The idea over here, I'm gonna start the attack.
‫Of course, it's gonna take a lot of time.
‫It will just try and try and try.
‫But the idea over here is that the backend
‫or the API should have anticipated this
‫and should have rate limiting
‫or some kind of protection mechanism against this.
‫So over here it appears that it doesn't have that
‫and we are not getting any kind of 500
‫or any other error messages.
‫We are trying and trying,
‫of course I believe we couldn't find it yet,
‫but we will eventually.
‫So what I'm going to do, I'm gonna pause the video
‫because it's gonna take so much time.
‫After I find the relevant OTP,
‫I'm gonna show it to you guys.
‫Here you go.
‫Now I found the OTP in here
‫which is the request number 872.
‫And it appears that the OTP should be 1872, okay?
‫So I really suggest that you don't wait
‫until this is done in your computer as well.
‫Since this is just an example,
‫if you have understood why we are doing this
‫then it's okay, you can try with this number.
‫But if we come over here in the response
‫I already have the key, as you can see.
‫Now I can send this to Repeater
‫in order not to lose the packet, okay?
‫So right click it and just send it to Repeater.
‫And here you go.
‫Again, I can just send it over here
‫and I can get the success through over there.
‫So what I'm going to do,
‫I'm going to take that number and use it in my Postman.
‫So let me come back and of course, yeah, here you go.
‫It's still sending the request.
‫So I'm just gonna turn off the proxy over here,
‫turn off the intercept.
‫I'm going to bring this down and here you go.
‫So we can just send this from here as well,
‫or we can go to get details
‫and change the authentication token,
‫whatever you want.
‫I'm just gonna send this and here you go.
‫We already have the key, so we can copy this key
‫and use it in the get details,
‫but I believe it's already saved in the Postman
‫because of these tests.
‫So I'm gonna come over here
‫and just go to headers and here you go.
‫Yeah, it's saved.
‫If it wasn't, I can just delete it
‫and just paste it over there.
‫But here you go.
‫Once I send this request
‫I get the flag because now I'm able to reach it.
‫So the idea over here is that
‫even though the phone number is not mine,
‫I brute force the OTP, since it was four digits
‫it was possible to brute force because why not?
‫Even though we had the community version, okay
‫we had the community version, we waited a little bit
‫but we got it done.
‫If we had the perversion of brute, the Burp Suite,
‫then it will take so less time, okay?
‫So over here we managed to get the OTP
‫and we managed to get the authentication token
‫so that I can reach the ID one
‫the json or something like that.
‫We don't even know the json,
‫we don't even have that phone number.
‫So if you don't have rate limiting over here,
‫if you don't have rate limiting, as you can see,
‫someone can easily grab the API key
‫or the authentication token for any user
‫and can reach their data
‫or use the system as if they were that person.
‫So that was it.
‫That was the challenge of API four.
‫And it's a good case to understand
‫the multi authentication factors, the OTP factors,
‫they are considered to be safe
‫if they are implemented in appropriate way.
‫Unless they have this kind of vulnerability, they are safe.
‫So far, so good.
‫Now we are going to stop here
‫and continue within the next lecture
‫to solve the API five challenge.