Hack Like a Pro: How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!In this series, we are exploring the myriad of ways to hack web applications. As you know, web applications are those apps that run the websites of everything from your next door neighbor, to theall-powerful financial institutionsthat run the world. Each of these applications is vulnerable to attack, but not all in the same way.In the mylast installmentin this series, we examined the ways that web apps authenticate users. Now, with that background, let's begin to examine ways that the web app authentication can be broken.Here we will examine at least one way to break web app authentication.Once again, we will be using the Damn Vulnerable Web Application (DVWA) on our Metasploitable OS with the security setting on high. One of the best tools to crack web authentication isBurp Suite. In previous tutorials, we have used the Burp Suite proxy, but this time we will using the proxy in conjunction with the Burp Intruder capabilities in this Burp Suite of web hacking tools.Please note that brute force attacks will not work against all web forms. Often, the web application will lock you out after a number of failed attempts. Also, this attack is dependent upon having a good password list as the application goes through every possible password looking for a match. With that caveat having been said, brute-forcing web forms is a good place to start in hacking web authentication. Of course, we will look at other forms of breaking authentication in subsequent tutorials.We will be using the free version of Burp Suite that is built into Kali. This free version has some limited capabilities that work well for learning or in a lab, but for real world hacking, you will probably want to buy the Pro version ($299).Step 1: Fire Up Kali and Start MetasploitableLet' start by firing up Kali and starting Metasploitable on another system or VM.Step 2: Open Ice WeaselOnce the Metasploitable system is up and running, let's open Ice Weasel and navigate to the IP address of the Metasploitable system. When we get there, select DVWA, which will open a login screen like that below.Here I have entered my username, OTW, and my password, NullByte.Step 3: Intercept the Login RequestBefore sending the login credentials, make certain that the Burp Suite Proxy intercept is turned on and the proxy setting are set in IceWeasel. Then, when you send the request, the proxy will catch the request like in the screenshot below.Notice that my username and password are in the last line of the login request.Step 4: Send the Request to Burp Suite IntruderNext, we need to send this request to the Burp Suite Intruder. Right-click on this screen and select "Send to Intruder" as seen below.This will open the Intruder. The first screen it will show us is the IP address of the target. It has gathered this information from the intercepted request. If it is wrong, change it here. Also note that it assumes you are using port 80. Once again, if you're attempting authentication on another port or service, change it here, but usually Burp Suite gets it right.Next, click on the "Positions" tab. It will highlight the fields that it believes it needs to use in cracking this authentication form.Since we want to set the positions manually, click the "Clear" button to the far right.Step 5: Set Attack TypeNow, we need to set the attack type. There are four types of attacks in Burp Intruder:1. SniperSingle set of payloads. It targets each payload and places each payload into each position.2. Cluster BombMultiple payload sets. There are different payload sets for each position.3. Pitch ForkMultiple payload sets. There are different payload sets for each position. It iterates through each payload set simultaneously.4. Battering RamSingle set of payloads. It uses a single payload set and runs it through each position.For a more detailed explanation of the differences in these payloads, see the Burp Suite documentation.Although it defaults to "Sniper;" let's select the "Cluster Bomb" attack and then highlight the two fields we want to use in the attack: username and password.Step 6: Set the PayloadsNow, we need to set the two payloads we designated. These are the fields that Intruder will be attacking. Select Payload Set #1 and enter some common usernames that nearly every system has such as "admin," "guest," "systemadmin," "sys," etc.Next we need to set the second payload, in this case, the password. Here we want to use a list of passwords that likely contain the user's password. There are thousands of lists available on the web and many built into Kali. To find those built into Kali, type:kali > locate wordlistsTo load a wordlist, click "Load" and provide the path to the wordlist you want to use. In this case , I loaded the wordlist at/usr/share/wordlists/sql.txt. As you can see below, it's quite a big list and when combined with the number of usernames I'm testing (4), it calculates that the request count will be 4,811,468 (the number of usernames multiplied by the number of passwords). That's quite a few and likely will take some time.Now, go the "Options" tab and make certain that "store requests" and "store responses" are both checked.Finally, go up to the Intruder tab at the top of the menu bar and select "Start attack," which will launch your authentication attack against the web form!Now, a window pops up shows us the requests as they are tried.Step 7: Reading the ResultsHere it's important to note a few things. First, the status column. Note that all the requests in the screenshot are "302" or "found". Also, note that the length of the responses are all uniform (354).That uniform length message would be the uniform bad request response. When a response is of a different length and a different code (200), it will warrant further investigation, as it is likely to have the correct username and password. The filter window between the tabs and the results enables us to find those different status codes and response lengths, rather than going through all 4 million responses manually.As the free version of Burp Suite is throttled, these 4 million possibilities will take quite awhile to iterate through. One of the advantages of the Burp Suite Pro version is that this attack is not throttled, saving you hours, maybe days.Keep coming back, my tenderfoot hackers as we explore the multitude of ways of hacking web apps!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How to Hack Web Apps, Part 3 (Web-Based Authentication)Hack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:Hack SAML Single Sign-on with Burp SuiteHow To:Generate a Clickjacking Attack with Burp Suite to Steal User ClicksHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)How To:Use Burp & FoxyProxy to Easily Switch Between Proxy SettingsHacking Windows 10:How to Hack uTorrent Clients & Backdoor the Operating SystemNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Secure Your Facebook Account Using 2FA — Without Making Your Phone Number PublicHow To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsNews:Make Use of Your Bigger Screen with These 12 Tablet-Ready AppsHow To:Set Up Two-Factor Authentication for Your Accounts Using Authy & Other 2FA AppsHow To:Set Up Instagram Recovery Codes So You Can Always Access Your Account with 2FA EnabledHack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)How To:Save Custom Shooting Presets in Filmic Pro So You Don't Have to Adjust Settings Later for Similar ShotsNews:New Apple Update Brings Collaboration Features to Pages, Keynote & Numbers AppsNews:New iWork Update Lets You Unlock Password-Protected Documents with Touch IDHack Like a Pro:How to Crack Online Passwords with Tamper Data & THC HydraHow To:iOS 12 Makes 2FA for Third-Party Apps & Websites Easy with Security Code AutoFill from SMS TextsHow to Hack Wi-Fi:Evading an Authentication Proxy Using ICMPTXHow To:The Safest Way to Disable ALL Bloatware on Your Galaxy S10How To:Stop Third-Party Apps You Never Authorized or No Longer Use from Accessing Your Instagram AccountHow To:Lock Apps Using Your Samsung Galaxy S6’s Fingerprint ScannerNews:What to Expect from Null Byte in 2015How To:Add Life to Wallpapers with Filters & EffectsHow To:Use JavaScript Injections to Locally Manipulate the Websites You Visit