OK, let's take a look at another example of broken out in the kitchen with the forgot password.
Now, an example of this, we're going to take a look at our Web, go to introduce ourselves to the
Web code in the previous video, and now we're about to do another challenge using this application.
So let's click on our Web.
Good.
Let's log in with guest and guest.
We can log in with that one.
We know that there is an overseas account and we also know that there is a basic account.
But it doesn't matter for this task.
All we have to do is start our webroot right here and navigate to the authentication floors and then
forgot password.
OK.
Now, let's read through the task Web applications frequently provide their users the ability to retrieve
forgotten passwords.
Unfortunately, many Web applications failed to implement the mechanism properly.
The information required to verify the identity of the user is often overly simplistic.
OK, let's take a look at the general goals.
Users can retrieve their password if they answer the secret question properly.
There is no lockout mechanism on this forgot password page.
OK, and that is the first vulnerability every time a page should block an account or block an IP address.
Once they typed the second question incorrectly for three or five times.
And also once they type the password incorrectly for multiple times, then the page should lock you
out or block you for a certain period of time.
And that is a good practice against brute force attacks that we're going to take a look at in the next
section.
But for now, let's solve this challenge.
So Web good password recovery.
Please input your username city admin if you do not have an account required fields username.
Now, we already know of a couple of user names, but for this video we're going to try to brute force
the username.
We will use a list of most common user names in order to see whether this application has a user name
like that.
So how are we going to do that?
Well, it's rather simple.
Let's type anything right here.
So, for example, it's type test and we are going to intercept our request.
Let's submit this HTTP request, and this is the one that we want to use.
As we can see, we have a field called username and that field we want to send to intruder.
Let's turn off the intercept, of course, we are going to get not a valid username because test account
does not exist on this page.
But inside of our intruder, we can set our payloads accordingly in order to try to get a username.
OK, let's clear out all of the fields and this can be considered a semi brute force attack because
we are going to try to brute force a username as well as the secret question.
OK, first of all, we want to select the username field I selected by clicking on ADD.
And now we want to go to Pilates here.
We want to load a list of most common user names.
And luckily our clinics actually has some wordlist that can help us do this.
All we have to do is click on load.
And navigate to the wireless directory, so make sure that you go first to this large directory, then
to the user right here.
Then let's go to share, then let's try to find wordlist directory, which is right here in the word
lists, I'm going to go to MLO it and from here I can choose the best list that fits this challenge.
And for this, I'm going to go with HTP default users.
Dot, I'm going to double click on that and it will load these user names right here as my paillard
list.
OK, awesome.
All we have to do right now is start the attack.
And.
How are we going to know which username is correct and which isn't?
Well, usually it's rather simple and I'll show you in just a second how we can recognize it, OK?
Our username, Brute Force has finished.
And here are all of the results.
As you can see, for each of these user names, we got status, 200 hundred.
And there's not really anything right here that says which is name is correct.
And if we even found a single correct user name out of these ones.
But if we take a closer look at the length of our response, which is right here, this number is the
length of our response.
You will notice that all user names have the same length except this one, except the admin username.
Usually this is an indication that there is something different with this type of username because it
gave a different response than the rest of these ones.
So the next thing that we can do, we find the username with different lenth.
We right click on it.
We request or show response in browser, then we copy the link.
And navigate to that link inside of our browser.
And here is the secret question since we got the secret question.
That means that we found our existing username and the secret question is, what is your favorite color?
As you can see, this is a really, really bad question for security because there are like 10 colors
in existence and we can easily brute force that the same way that we brute force the username.
So let's do that right here.
We're going to go to our website.
Let's go to our proxy and turn on the intercept.
Right now, we're going to type test once again because we don't really care what we write right here.
All we want is to send this request to the intruder, turn off the intercept and let's navigate to our
positions.
Let's clear all of these fields and let's only double click the color field and click on it.
Now we go to payloads and here we can manually type the colors.
For example, let's go for green, blue, yellow, and let's type every single color that we can think
of.
Let's go.
It's green.
Let's go with black, white and let me see brown, perhaps.
And maybe I forgot something, but let's give it a try with these colors first.
So we loaded nine payloads or nine colors.
And if we start the attack.
We're pretty much looking for the same thing, we're looking for a color with a different response.
But here we actually got more than two lengths, we got callers with this length.
We got callers with this lenth right here, and we got a single color with this length, which is three
one nine seven three.
And usually this is the one that you want to check first because it has a unique length, which usually
means that it's the correct.
So let's right click on Green and let's show Responsive browser this and navigate to our Firefox and
paste the link.
And here it is, we successfully guessed the username as well as the secret question for this account.
So what exactly was a vulnerability here?
Well, there are two things wrong with this.
The first thing is that it doesn't block us after certain incorrect requests.
And the second thing is that the second question is rather easy.
And we guessed it in two seconds.
Now, we could finish this challenge and we have username admin, color green.
And here is the password for the admin account.
OK, awesome.
We have one more challenge or one more example left to do from our own wesp web application.
And after that, we're going to move to the brute forcing Section C, you the next lecture.