Hack Like a Pro: How to Hack Web Apps, Part 3 (Web-Based Authentication) « Null Byte :: WonderHowTo

Welcome back, my novice hackers!In this third installment of myHacking Web Appsseries, we will look at the authentication of web applications. Remember, there are many ways to hack web applications (as I pointed out inmy first article), and cracking authentication is just one method.To be able to crack authentication of web applications, we first need to understand a bit about how web applications manage authentication. In order to do this, we will be using the Damn Vulnerable Web Application andBurp Suiteto practice our attack methods.I hope it goes without saying that you shouldalways do reconnaissance firstbefore attempting any authentication attack. Know you enemy!Step 1: Install Damn Vulnerable Web ApplicationFor the rest of this series, we will be working with the Damn Vulnerable Web Application (DVWA). Although most of the vulnerabilities in this application are rather old and patched in modern applications, we need to start with this application to do the following.Demonstrate the principles of web app hackingHave a safe environment to practice inOnce we have demonstrated web app hacking principles here on the DVWA, we will progress to show how those principles can be applied to more modern and less vulnerable web applications in later tutorials.You can either installDVWAin any Linux operating system or, probably more simply, installthe Metasploitable operating system, which has DVWA installed by default.If we are using Metasploitable, simply browse to the IP address of your Metasploitable OS with the Iceweasel web browser inKali. Here, mine is 192.168.181.128 on my internal network, but if you have Metasplotable on a public IP, it will work just as well. You should see a webpage like this below. Click on the DVWA link.Step 2: Open DVWAOnce we have clicked on the DVWA link, it will open a login screen like that below. Do not try to log in just yet. Be patient.Step 3: Open Burp SuiteWe will be using Burp Suite in many of these web-based attacks. It is built into Kali, so no need to install anything. Simply open Burp Suite by going to Applications -> Kali Linux -> Web Applications -> Web Application Proxies -> burpsuite.When you do so, you should be greeted with Burp Suite opening a GUI, as seen below.You must configure Burp Suite as your proxy. If you need more information on setting up a proxy,see this article on THC-Hydrawhere we also used Burp Suite as a proxy.Step 4: Authentication TypesBefore we begin to attack authentication, let's pause a minute to examine the types of web-based authentication.Basic Access AuthenticationBasic authentication, as the name implies, is the simplest and most basic form of authentication for a web application. It uses Base64 encoding, which is a weak encoding scheme and easily broken. The Base64 encoding (not encrypting) scheme translates binary data to textual data. Although the underlying plaintext is obfuscated, it is easily decoded.Basic authentication is often used to authenticate against routers, webcams, etc. If we can intercept the credentials by sniffing or using a proxy like Burp Suite, there are a number of tools available that can decode this simple Base64 encoding.Digest Access AuthenticationA step up in security is digest authentication which was described by RFC 2617. Digest authentication relies upon a challenge-response authentication model. The user is usually expected to prove they have some secret without sharing it across an insecure communication channel.Digest authentication is a bit more secure, but it vulnerable to replay attack. It creates a one-way hash (MD5) that is sent to the server for authentication. To prevent the use of rainbow tables to break this form of authentication, the server sends a nonce which acts like a salt. This MD5 hash cannot be decrypted, but can be captured and replayed by the attacker.Digest authentication is stronger than basic authentication because the credentials are not sent over the insecure channel, just the MD5 hash of the credentials. Even though it is difficult to crack this MD5 hash, the hash can be captured enroute to the server. Once captured, it will provide anyone access to the account when it is replayed.Form-Based AuthenticationForm-based authentication is the more common form of authentication in HTTP. Unlike basic and digest authentication, form-based authentication does not rely upon basic web protocols. It is a highly customizable format that usually has HTML FORM and INPUT tags.Generally, the form has both username and password fields where the user enters this information which is included in a GET or POST request over either HTTP or HTTPS. This is the form we often see on modern web applications. When the server receives the username and password and they are correct, the user is allowed entry to the application.Form -based authentication uses a variety of encrypting and coding schemes. As a result, no one type of attack will work in all cases. We need to decipher the type of encoding or encryption before we select an attack method. If TLS or SSL is not enabled, though, the credential will be sent in plaintext.Step 5: Form-Based Web Authentication in DVWALet's begin by logging in to DVWA with a username and password combination of admin/password. Now, near the bottom of the left hand buttons, you will see a "DVWA Security" option.Let's make it a bit more challenging by setting the Security to "high."Next, Let's go back to the login screen and look at the source code.As you can see in the source code below, the PHP GETs the username and then validates the input by stripping out special characters that might be used in an SQL injection (' -- ;). Next, it GETs the password and does the same validation on it to remove the possibility of an easy SQL injection. Then, it takes the two strings and puts them into an SQL query string to run against the authentication database. (For more on the basics of SQL,check out this article.)$qry = "SELECT * FROM 'users' WHERE user = '$user' AND password = '$pass';"Ifbothof the conditions in the WHERE clause evaluate to true, then the user is authenticated to the web application.Now that we have the basics of web application down, in my next tutorial in this series, we will examine ways to crack this authentication process. So keep coming back, my novice hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)Hack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)How to Hack Wi-Fi:Evading an Authentication Proxy Using ICMPTXHack Like a Pro:How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities)Hack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)How To:Hack Your Firefox User Agent to Spoof Your OS and BrowserHow To:Hack with Hacme ShippingNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Lock Apps Using Your Samsung Galaxy S6’s Fingerprint ScannerBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHow To:Block Ads in Android Web Browsers (No Root Needed)How To:Secure Your Facebook Account Using 2FA — Without Making Your Phone Number PublicHow To:Launch Apps, Tasks, & Websites Directly from Your iPhone's Notification CenterHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)News:Revamped Video Tab Testing Shows Facebook Really Wants to Compete with YouTubeHow To:Hack web browsers with BeEFHow To:Set Up Two-Factor Authentication for Your Accounts Using Authy & Other 2FA AppsHow To:Change Slack's Default Browser to Chrome, Firefox, or SafariHow To:No Data, No Problem—Use SMS to Connect to Your Favorite Web Services on AndroidHack Like a Pro:How to Fingerprint Web Servers Using HttprintNews:Chrome for iOS Updated to Add a 'Read Later' FeatureNews:Apple's Ditching the 'Do Not Track' Option for Safari in iOS 12.2News:The New Web-Based Snap Map Lets Anyone Watch Public Snaps, No Account NeededNews:Mastercard, Qualcomm-Powered ODG Smartglasses Use Iris Authentication for AR ShoppingHow To:Set Up Instagram Recovery Codes So You Can Always Access Your Account with 2FA EnabledNews:Epson's Moverio Smartglasses Line Gets Major Upgrades with New SDK and Web-Based PublishingHow To:Get the Chrome Experience on Android Without Google Tracking YouNews:You Can Now Send Web Links & Landscape Photos on Instagram DirectHow To:A Security Bug Just Made It Risky to Open Links on Your iPhone—Here's How to Protect YourselfHow To:Hack the iPhone or iPod TouchBinance 101:How to Enable Google Authenticator for WithdrawalsHack Like a Pro:How to Find Website Vulnerabilities Using WiktoHow To:Stop Third-Party Apps You Never Authorized or No Longer Use from Accessing Your Instagram AccountHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitHow To:The Official Google+ Insider's Guide IndexNews:Don Williamson's Real-Time Web-Based DCPU-16 Emulator & ASM Code EditorHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceCommunity Byte:Coding a Web-Based Password Cracker in Python