In this video you're going to learn how to work with requests and beautiful soap modules and Python
to conduct web attacks.
We're going to be using the lab on a tack.
Defense labs which has a platform to exercise and grow your penetration testing and cybersecurity skills.
Now as you can see here we're dealing with a web portal and we need to do some initial recon and then
actually brute force authentication all using Python.
There is everything installed for us in the lab and we will be using Jupiter notebooks.
So I'm going to open up the lab so clicking the lab Link is gonna take me to this location and we can
see three files.
The lab the lab with solutions and a dictionary file containing passwords.
OK so we'll go into the lab.
The simple lab file again we're going to use requests and beautiful suit.
They are already installed so I only have to import them if you will be working with them.
You can simply install them by a bit in a terminal or a command prompt so you can simply do that or
that three install requests
and that or 3 install beautiful soup for and that's it.
Now to get a very similar scenario to the one that I have here you could have you could install a virtual
machine in VM or virtual box and then install a vulnerable CNS on the machine like the one we're attacking
in this scenario.
And that's all for free.
Or like I'm doing in this case you could get a subscription on attack defense whichever you find the
best suitable for you.
Now I'm using a tag defense labs platform for convenience here for no setup and for your better understanding.
All right.
We have a popular CRM and some import 80.
We have the libraries installed and we also have the dictionary file.
All good.
First we need to check if the Web portal is up using a get request and that's as simple as import requests
and then requests that get EDP 1 2 7 0 0 0 1 and I execute this code or this cell using shift and enter
together response two hundred which is the HDTV code or status for.
OK all right let's move on.
So server software being used.
We're going to do something similar and we're going to instantiate the.
In this case we're going to instantiate the request in a variable so let's say rect underscore requests
that get a GDP 1 2 7 0 0 0 0 1.
Now what is great about our request module is that once it's made a request it saved the response in
a very accessible and manner.
In this case we have the response of the request in the rack underscore variable.
And to answer the question we usually find a lot of information in the response fathers.
So which server software is being used.
We can simply say rack underscore dot headers and then shift enter to execute the cell and we can see
engine x.
Okay moving on number three.
We are being asked for the headers and we already did that with the request on their score.
Heather now for the task for we need to get the content or the text content of local host home page.
Also can you tell which CNS is running on local hosts.
Why do we need here is the content.
So we'll say rec underscore dot content.
So as you can see I've hit dot and then hit the tab.
Now in this case we can simply access all the methods available at our disposal like for example we
can get the cookies the encoding the history Jason so there regressed in Jason format next we can see
that raw request and all that stuff.
So in this case we need the text content of local host home page and that's as easy as rack underscore
dot content.
Shift enter and we can see this content.
This also can be done with rack underscore text.
And if I do this as a corner comment we basically get a very similar response.
But anyway this doesn't look pretty nice.
So it says also can you tell which CNS is running on local host.
So if we look into this code we can see title target wordpress so we can safely assume that this is
actually WordPress running as a CNS on the local host.
Now moving on to number five we need to print this ugly response in a pretty form using beautiful soup.
So we start with a variable actually first we start with importing from the as for import.
Beautiful suit.
This is all you import beautiful soup.
Then we need a variable let's call it soup equals beautiful soup and then rack underscore dot text and
we need to specify an HDMI all the answer which is going to be our parser.
So we actually need to tell a beautiful soup to use by phones is built in a standard parser to pass
our request and then we'll use the predefined method to print the content in a more readable way.
So we'll save print soup that pretty fi awesome as you can see this looks much much better.
All right.
Now number six print the title of web portal hosted on local host.
Now similar to requests a beautiful soup has a lot of methods to access the content such as HDMI elements
in this case.
Here we would simply need to actually print the soup that title
now the great thing about Python is that there is at least a library for everything you need for whatever
purpose you may have and you don't have to reinvent the wheel by writing code from scratch.
Now be my guest to do that if you want but it in penetration testing.
I want to automate.
I want to get things done fast and very efficiently.
All right now seven and eight are very similar so I'll just jump right into a scrape.
All your URLs from the home page of local host and print unique URLs so we'll start by creating a variable
let's say home their score and then we'll do requests that get a GDP local host.
OK.
And then we'll create a soup equals Beautiful Soup home page or home underscore that content
and we also need to specify the HDMI parser of course.
Now we need to look for all your URLs and in HD among these are denoted by D A element.
So we'll say images because soon dot find all
a day trip equals truth.
Then we'll create an empty list.
So we'll see images underscore each raft.
We have an empty list and populated with the URLs using a for loop so we'll save for image and images.
We'll say images underscore H ref pan.
So we need to attend to this list.
Image H ref Alright so now we have a list which may contain duplicates and we're required as we can
see to print unique you or else.
So for that we can simply make a set of our lists which will contain no duplicates as this is an inherent
property in sets.
You can check my Python basic source in which I go into more details about sets and lists.
All right so this is as simple as images underscore a draft.
Actually another variable image said it's gonna be images there's gonna be a set of images that each
ref what we're left to do is to print the elements of the sand so again using a for loop we can simply
save for image and images set print.
I AMG All right shift and run that and as we can see we get a nice list of unique elements all right.
Now for the fun part let's do some web attacking so task 9.
Can you access the admin section of the CNS.
We already know how to do that.
So let's say word on their score.
P equals requests that Cath HDD DP local host WP admin.
This is what we're requested to try and access and then let's actually do a soup that word underscore
word underscore P is gonna be a beautiful soup word underscore P text and of course we need to specify
the H and not parser.
Alright and then let's also print the soup underscore word P that pretty fi OK.
Shift ends are to run this.
So if we look a little bit into it we could infer it's a log in form and we'll need this information
in desk number 10.
So over here which says that we need to brute force the WordPress log in for user admin use the given
dictionary so remember that we have a dictionary called Password underscored dictionary a couple of
pointers since we're dealing with a log in form we'll be using a post request instead of a get request.
So if we get the code again we can see input glass IP user log in name log input type text.
We could also see input glass user pass named P.W. WD type password.
We need this information when we create or post requests because we're going to send a post request
to this forum again.
So what we need to do is a post request and send the user name to the field log and a password to the
field BW D This is what our browsers basically do when we authenticate.
Now in this case we'll be brute forcing the password for user name admin as requested and we'll try
all the passwords in the dictionary file by sending them one by one to the P W D field.
This is what we're going to go it here.
So for that first we need to instantiate a variable for our password file.
So let's say fast file equals password underscore
dictionary.
But to extend
and then we'll encapsulate everything in a with construct in Python so we'll say with open fast file
in read mode as f for word in F.
First we need to make sure that each line in the file is clean and only contains the word so we'll strip
the line for trailing spaces otherwise our attack might fails.
So we'll say word equals word that strip.
New Line.
And here's the most important part.
The actual post request.
So let's say trying underscore equals requests that post we're going to make a post request wage TTP
local host WP admin.
Actually we need to make a request not a WP admin but to WP log in that BHP so WP log in but BHP and
then we need to send the data in a dictionary so data is going to we need to send log the user named
Adnan so we need to send to log ad men to log we need to send the username admin because this is what
we've been requested and then for password.
So for the P W D field we need to send our word okay.
Every time you try to log in with a wrong password the response of the request will contain the word
error.
Hence we can infer that if this word error is not in the response or brute force succeeded and we found
the password.
So how do we actually coded this.
We'll say if error not in trying underscore dot text we'll simply say print success the password is
and then the last word.
And then we exit the loop we'll say break or else we'll say print incorrect password.
Last word of course.
All right.
That's just about it.
Now let's run the subways shift enter and it's probably gonna take a while to finish so let's keep forward.
So shift enter you can see all the incorrect passwords
and there you have it.
The password is best 1.
Now this is all you can use requests and beautiful soup and both on to conduct recon enumerate and attack
web servers always only attack on assets you have permission I need to specify this at all times.
OK now we won't be doing desks 11 and 12 because they are not in the scope of this video.
As always there is much more to request and beautiful soup than what I've shown here.
Therefore if you want to get deeper understanding of them start by studying their official documentation
which you can easily find via a browser search.