Let's cover yet another attack for broken authentication, and this one will be aimed at authorization
within the page.
To demonstrate this, we're going to go to a page called a WASP Web code.
It's right here.
Let's click on it, make sure that intercept is turned off and it'll open a window like this that will
require us to login and remember this window because it will be important for us in this lecture.
So we got this Pop-Up window and to log in, we can type guest and then password, also guest.
So username and password guest.
Click on OK.
Let's not save the password and it will open a page like this from here, we want to start our web.
Good.
And let me just assume this in a little bit, and here we will have different attacks that we can perform.
Of course, not all of these attacks have to do with broken authentication.
Most of them actually are different vulnerabilities.
But the attack that we are interested at the moment is authentication.
Flosse.
So click on that.
And from here, we want to go to basic authentication.
OK, it will open up task like this, so it says basically notification is used to protect silverside
resources.
The Web server will send up for one authentication request with the response for the requested resource.
The client side browser will then prompt the user for a username and password using a browser supplied
dialog box.
And that is the dialog box that we saw once we logged into Web code.
The browser will base64 encode the username and password and send those credentials back to the web
server.
The web server will then validate the credentials and return the requested resource.
If the credentials are correct, these credentials are automatically present for each page protected
with this mechanism without requiring the user to enter their credentials again.
So essentially what this says is that our basic authentication credentials that we inputted wants to
log into to our Web code will be processed to every page within the request without us having to log
in every time we switch a page.
But the problem here is that it's encoded with base64.
So here we will have a vulnerability of weak encryption and weak encoding.
Base64 is something that we can easily decode.
So let's give it a try for this lesson.
Your goal is to understand basic education and answer the questions below.
What is the name of the authentication header and what is the decoded value for the authentication header?
OK, let's go right here.
Turn on the intercept and this is also rather simple example.
If we go to our beheader, we get this field that's called authorization and it says basic and then
some random letters.
Now, we got our answer to our first question.
Authorization is the answer to what is the name of authentication header so we can type it in authorization,
even though it doesn't matter since we are in the middle of refreshing the page.
But nonetheless, let's take a look at this more interesting part that says basic and then some random
letters.
Now, we already know that this is base64 and you can usually recognize base64 by this equals sign at
the end right here.
It also tells that its basic authentication.
So what we can do if we were to, for example, intercept this request by using something like a man
in the middle attack on a wireless network, and we were to get this request from some other user that's
trying to visit a page within the Web code.
We will be able to decode their username and password and then log in to their page.
Let me show you how we can do that.
We copied the value that's encoded right here.
And then we go to something called Decoder here, you can turn off the intercept and navigate to the
decoder.
Now, the code is something that we didn't cover in the basics, but it's rather simple to use.
All we have to do is paste right here what we've done to the code and let me see if I even copied it.
OK, I copied it successfully and fight here on the right side.
We want to click on the code as and we want to decode it as base64.
Let's click on that.
Well, here it is, here's our username and password in plain text, and that is all it took for us
to get the username and password of a certain user.
Now, of course, for us to be able to get this HTP request that we intercepted, as I mentioned, we
would have to do something like man in the middle attack.
But that's really easy to perform.
The problem right here is that the page has a weak encoding and then we can easily reverse the encoded
username and password back to the plaintext.
And now we can copy this because this is the decoded value, since that is the answer to our second
question on the page.
And let's face it right here and submit, and it will tell us congratulations, you can figure out the
mechanism of basic authentication.
Now you must try to make Web code free, authenticate you as username basic, password basic.
Use the basic authentication menu, start at the login page.
Now, all we have to do right here is simply just to close the Web code and then we would re authenticate
with basic and basic username and password.
So this is something really easy to do.
We're not going to cover that.
Just next time at the login screen, you can use this username and password to enter a different account.
And you can also try to intercept a request on a certain page and try to change the encoded value of
basic and basic in the authorization header in order to switch the account that might work to you never
know.
OK, awesome.
This was yet another simple example.
And in the next video, we're going to take a look at the example of broken authentication once a user
forgets a password.
Nonetheless, thank you for watching and I will see you in the next lecture.