‫So another big problem in authentication is insecure login forms.
‫There may be hundreds of ways to make a form and secure.
‫So for these examples, I'm going to be in B WEAP and I'll go to Cali first and log in to be webapp
‫and from the drop down menu above Chew's insecure login form under the broken authentication section.
‫And the default level is low.
‫And it is rare to see the first two levels in the real world, actually, but I think it's a lot of
‫fun.
‫So let's try and solve them, OK?
‫So when I try to log in with the wrong credentials, I'm going to get this warning.
‫So then we view the page source by right clicking and scroll down to the log informed source.
‫So see here is taxed with a white font color, you know, the log-in label.
‫And also another text with the same property near the password label.
‫So if you mark here and here, you're going to display them.
‫So I'm going to use these values.
‫And it is done, we've just logged in.
‫OK, so that was fun.
‫Let's choose the medium level.
‫So I'm going to mark here.
‫But there is nothing.
‫OK, so view the page source again, scroll down the login form.
‫And here there are no hidden values.
‫But see over here, the submit button.
‫Have a look, you're going to see it executes a JavaScript function.
‫Now, I think this is the first function that we've seen opening this horse.
‫So here's a function.
‫I don't think it's very hard to guess how it uses some of the characters in the string to create a password.
‫And again, it's it's really a load of fun.
‫To get the password from this function, just copy it.
‫And open developer tools.
‫Go to settings from here and check.
‫Scratchpad to enable the tab and go there.
‫So clear here and paste the function.
‫I'm going to just zoom in a little bit here.
‫OK, so we don't need these lines.
‫And to see the result, I'm going to add here return secret.
‫And an alert message to view the result.
‫OK, so let's run it.
‫And it is done, what's this?
‫Yes, we get the password.
‫So in case you think I'm joking that I'm going to use this.
‫OK, we're done.
‫We've just logged in.
‫OK, so.
‫At last, we were going to do a brute force attack, so let's choose the high level.
‫So here's your new page and view source, if you scroll down, you won't see anything with the form.
‫So, OK, let me just log in with some wrong credentials and see what's happening.
‫OK, you get the same warning message and valid credentials.
‫So now we're going to do the rest with berp.
‫So enable Foxe proxy, then open burb.
‫And I'm going to arrange a windows.
‫Now log in again.
‫And captures a login request, so.
‫Send it to intruder and repeat or to use later.
‫Then forward the request.
‫OK, so open intruder tab now there are four sub tabs under intruder and under the target tab, you
‫can configure the target options.
‫For example, you may force it to use https and then go to the positions tab.
‫And here you can can figure out where and what to brute force, so berp heuristically select some parameters
‫to attack, but we don't need them all.
‫So you can clear them.
‫And let's just use only the password and username.
‫So let's choose cluster bomb as the attack type.
‫OK, so we're done with this, so now go to the payloads tab.
‫Now, here's a place that we provide data or dictionary files to attack so we can choose two parameters
‫to attack at the same time.
‫And here are two payload sets which are available here, but we don't have any payloads yet.
‫So let's create some payloads first.
‫We can use crunch or we can try and other as well.
‫So, in fact, open up your terminal and type C W.L..
‫Sewell is another password generator, but it works kind of differently, so it'll crawl a you URL and
‫extract words to create a word list.
‫So Type C, W.L. Dash dash help to see options.
‫OK, then add W as a parameter to say the result.
‫And the parameters to define the coral depth.
‫The parameter to define the minimum length of the word that will be extracted and E for including email
‫addresses and let's include words with numbers.
‫OK, so I'm going to copy this, your URL and pasted here.
‫Nothing change and hit enter.
‫And it executes quickly, so here's a generated wordlist file.
‫Let's have a look at it.
‫Now it contains 44 lines, so I'm going to delete some of the entries because it will take time to try
‫every single one, so I think these ones are going to be enough.
‫So now go to Berp Intruder, choose the first payload, don't change the payload type.
‫It's a simple list.
‫Just come back here and click lowed.
‫OK, so we load the first payload.
‫And choose the second payload again, load wordlist.
‫And Burp automatically calculates the requests that will be sent, and I think if we do this with a
‫huge list, it's going to slow down our target network in our environment.
‫So there's nothing change here.
‫And go to the options tab.
‫Now, scroll to grip match.
‫So in this section, we teach Berp to understand when it is going to be successful or not.
‫So then Berthelsen to each login request, it contains values from our payload list and then analyzes
‫the associated responses.
‫And then that way, if it matches something and the response with these strings, it can mark that request
‫for us.
‫So the strings are not useful in our scenario, right?
‫So I'm going to clear them.
‫And then I'm going to copy this warning on the page and paste to add it here.
‫And then I'm going to check this box to make berp flag the resulting items containing this warning.
‫All right.
‫All right, so, yeah, there's nothing more to configure here, so let's go up.
‫And start the attack.
‫So this is the attack window.
‫And we can wait a little bit for it to finish.
‫And looky here, berp flags, all the result items containing this warning.
‫Now, if a result doesn't contain this warning, it means that we're successfully logged in, you get
‫it?
‫So let's click this uncheck line.
‫And below are the details of the request present.
‫It's rice, bees and bug.
‫So look at the response.
‫Here's a successful Log-in message.
‫OK, so obviously, this is a very basic brute force attack to an insecure login form.
‫Don't worry, we are going to do a little more advanced ones in the next videos.
‫But you get the concept right.