Let's see if we can do the same when we increase the security level, so as you can see here, the security
level is set to zero.
So it's the least secure right now.
So what I'm going to do is I'm going to click on talk of security and that will increase our security
level to number one, which will basically make the website more secure so that the attacks will not
work the same way that it used to be.
So, again, we're still on the same page at the login page and we're going to try to bypass the log
in using the exact same way that we did in the previous lecture.
So I'm going to put admin.
Followed by a comment, and then we can put any password we want right here.
I'm going to hit enter and as you can see, we get an error message saying that some illegal characters
got detected.
So let's try the other exploit exploit that we found, which was we put the username normally and then
we put the password as anything, we close the quote and we use Erwin's equal to one, which is correct.
So, again, I'm going to just keep the username as admin normally and then I'll post this exploit right
here.
Hit enter, and again, we get the same error saying that some illegal characters got detected.
Now this filtering could be happening at the client side or it could be happening at the server side.
What I mean is if it's happening at the client side, it's the stuff is being filtered before it gets
sent to the server the other way at the server side, as these characters are being detected and filtered
at the server side after they get sent to the server.
Now, if it's happening on the client side, then it's very easy to bypass using proxy.
Verb can also help us identify whether this is happening at our site, at the client site or if it's
happening at the server site.
So, as usual, we're going to go to the proxy and I'm going to set up the proxy settings again for
Firefox, just like we did in previous videos, so that it uses berp.
So we're going to go on advanced settings and we're going to use manual configuration and said two point
eighty eight.
So that's all good.
Now, everything we do, as we said before, should go through berp.
So if we go to home, you'll see that packets are coming here.
If we forward them, they go to the server.
So again, when I go to the log in, the packets come here, we forward them from berp and then they
go here.
Now, watch this.
Now I'm going to try to put in the username as admin and I'm going to put this exploitation right here.
And when I did notice that the package will not be sent, so I'm going to click on login.
And see that nothing was sent to burp.
So this request was stopped before it even reaches the Internet, before it even reached the server.
So it was stopped by some code loaded on the browser or in this Web page itself.
So the filtering is happening on the client side, on our side before it even goes to the website.
And it's telling us that some dangerous characters were detected.
So let's go back to our diagram here.
So we have our hash tag, my website with Clydeside filtering.
So when it detects special characters, the client side code will remove these characters or it will
display an error.
So what we are doing is we're going to write username and password without any special dangerous characters.
Was just going to write it normally send the request, which will bypass the filtering that's happening
on the same page on the client side.
It's going to go to better proxy then right here.
When it comes to here, we're going to modify it and add our dangerous special characters that will
allow us to bypass authentication or write code on the target website.
Once we do that, we're going to send it to the server.
The server will execute and send it to us.
So using burb, we're going to be able to bypass Clydeside filtering.
So let's go back and see how we're going to do this.
So we're going to use a normal username as admin and I'm going to I'm going to put a random password
so it doesn't have to be right.
I'm just going to put a doesn't really matter and I'm going to click on login.
Now, this is a valid request, so it will be sent to the Internet.
It won't be stopped by the filter, which works on the client side.
So I'm going to click on login.
And as you can see, the request has come here and requests.
And here we can see that the username is a is admin and the password is AAA.
So we're going to do now we're going to actually modify the username and password values right here
instead of modifying them are the Web browser, because at this stage we've bypassed the filter.
So the username and password were valid at the client site.
They got sent to the Internet before they got into the Internet.
We captured them by proxy.
And we're going to modify this password exactly the same way that we wrote our exploitation in the previous
video.
So this is going to be.
A or one is equal to one, and then we close it with the comment here.
OK, so I'm just going to repeat this, so the filtering is happening at the client side by JavaScript
code, which gets executed on the page itself.
So the request is being stopped before it even reaches the server when we run berp.
We actually used a good username and password that are not considered to be dangerous.
They pass through the filter and before they go to the Internet, we have our proxy working, which
captured that.
We're going to modify it in here because we've already bypassed the filter.
And when I click on Forward.
You'll see that I managed to log in as the admin.