OK, let's cover our first basic example of broken authentication, and for this, we're going to start
off with try hacking platform.
So make sure everything is started.
You have your Burset, you have your VPN running, and make sure that you also get the IP address for
the VPN.
Once you do all of that, navigate to the tri Hackney platform and go as usual to our Web hacking fundamentals
and navigate to our top 10 from.
Here it is.
Let's go right here.
And we already know right here we got a bunch of different tasks, but for this lecture, we want to
navigate to task number six and task number seven.
Now, if you want to read about broken authentication a little bit, you can read through the task number
six and then navigate to the practical part, which is task number seven.
And this task is rather easy.
So let's take a look and let's read what it asks from us.
But before we read through this task, let's start our machine, because we already know that it takes
about a minute or two in order for it to start properly.
While it's starting, let's read through this task.
For this example, we'll be looking at a logic flaw within the authentication mechanism.
A lot of times what happens is that developers forgets to sanitize the input given by the user in the
code of their application, which can make them vulnerable to the attacks like SQL injection.
OK, we already knew that.
Let's go all the way down.
Let's understand this type with the help of an example.
Say there is an existing user with the name admin, OK?
And now we want to get access to their accounts.
So what we can do is try to reregister that user name, but with a slight modification, we're going
to enter space and then add.
Notice the space in the starting.
OK, now, when you enter that in the username field and enter other required information like email,
ID or password and submit the data, it will actually register a new user.
But that user will have the same rights as normal admin.
That seems to be quite a bit of a problem.
Let's continue reading.
That new user will also be able to see all the content presented under the user admin.
To see this in action, go to this link, so let's visit it straight away and let's go down just to
read until the end and try to register a user named there, Darren, you'll see that user already exists.
So then try to register a user space, Daryn, and you'll see that you are now logged in and will be
able to see the content present only in their account, which in our case is the flag that you need
to retrieve.
Hmm, interesting.
And first question is, what is the flag that you found in their account?
So let's go and take a look.
If we try to log in as they and by typing there and let's say test one, two, three, four and click
on sign in.
We get an error invalid username or password, so let's try to do what the tri Hackney example told
us to do, which is to register a user with slight modification.
So let's type space and then there make sure there is space for it here.
Otherwise it will not work.
And under the email, we can type any email that we want.
I typed test at Gmail dot com, which is probably a non-existent email and password type test.
One, two, three, four.
And will register this user.
OK, so we registered the user successfully.
Now let's try to log in as that user and see whether we will be able to find the flag that should only
be accessible from Darin's real account.
So let's go right here.
Type space and then Daryn.
And test one, two, three, four.
Let's click on Sign In.
And here is the flag, so we successfully performed a broken out that the occasional attack where we
registered the new user with slight modifications, such as adding space at the beginning of the name,
and it allowed us to see the flag that should only be accessible from the real Berent user.
And we would submit this flag right here under this question.
OK, and the other question is try to do the same trick and see if you can log in as ARTA.
So I assume the author account already exists, so pretty much we can do the same thing.
We can go register ad space and then after and for the email, we can type once again anything that
we want.
I typed test to at Gmail dot com and password will be passed.
One, two, three, four, five.
Just to make it different then the difference account.
Now lets go and lock.
So ad space Arthur and test.
One, two, three, four, five.
Click on sign in and here we get the ATA's flag as well.
So we pretty much perform the same thing for two different accounts for Theron's account and for ATA's
account.
And if this type of vulnerability was to exist in a real page, we would pretty much be able to access
any account on that page just by knowing its username.
We would then perform a slight modification register, a new user name, and we will be able to see
all the things that original user can see.
OK, but this was a rather simple example of broken authentication in the next video, we're going to
go back to our overspeed W8 and try to take a look at a different broken authentication attack scene
in the next lecture.