Welcome back.
Let's see a different example of broken notification attack, and to present this, we're going to be
using a WASP Motyl day to so open up your Auvers machine, navigate to the metal data.
And under here, we want to go to August 2013 and navigate to broken authentication and session management
right here.
We want to go to your ID bypass and let's go to bypass via cookies.
Click on that.
And this is the page that we want to, let's say hack.
But let's read through this first.
So some sites keep authentication and authorization tokens in the user agent field.
This gives the user large amounts of control over these tokens.
OK, but do we really need to read through all of this?
It just tells us that some different tacks are possible, such as SQL injection, brute force and secret
administrative pages.
But let's read the name of our task again, so it's broken authentication, we want to bypass authentication
and we want to do it via cookies.
OK, to be able to do this, we need to have an account on this page, so let's create a simple account
by going on log in and register.
And we don't have an account, so let's register right here.
We're going to type username, let's type username, test one and password, let's say test one, two,
three, four.
We will confirm the password and the signature is not needed.
So let's just create an account.
OK, it tells us account created.
Now, let's go back and let's go on Log-in and let's log in with our accounts of the username was test
one and the password was test one, two, three, four.
OK, awesome, let's close this window and in the right corner, we should see logged in as user test
one.
Now let's go back to our page and try to bypass and switch the account by changing the value in the
cookies field.
So let's navigate or perhaps it turn on the intercept and let's try to refresh this page.
Let's take a look at the request that we're trying to send.
And if we go down, here is our cookie value.
Now, we can see there are multiple fields to this cookie value, but there are two particular fields
that should be of interest to us.
We got the user name equals test one.
We got user I.D., we got session ID.
But these two right here do seem interesting to us the most.
Let's try to change the user name from test one to, let's say, admin, because there is an admin account
on the page.
And if we forward this request.
Hmm, nothing really happens, we're still logged in as user test one, so maybe we can't do it like
that.
Let's try with the user ID field first.
So let's turn off the intercept, turn it on back again and let's refresh the page.
Now we get the same request, we got the username test one, which is us, and we got the user ID apparently
twenty five is the user I.D. of our test one account.
Let's try changing that to one.
For example, let's forward this go back to the page.
And here it is, we managed to switch the account by changing the values inside of the cookie header.
Now it says logged in as admin.
Here is our account.
And we can do that for any account that we want, if I refresh the page and change the user ID from
twenty five to to forward now, we should get a different account logged in as Adrian.
How cool is that?
And this is a vulnerability in the session management.
It allows us to switch the accounts by changing the user ID in the cookie field.
So this was also a simple example.
And in the next few lectures, we're also going to take a look at different approaches to broken authentication
tech.