Let's see if we can do the same when we increase the security level.
So as you can see here the security level is set to zero so it's the least secure right now.
So I'm going to do is I'm going to click on top of security and that will increase our security level
to number one which will basically make the Web site more secure so that the attacks will not work the
same way that it used to be.
So again we're still on the same page we're at the log in page and we're going to try to bypass the
log in use in the exact same way that we did in the previous lecture.
So I'm going to put Agyeman followed by a comment and then we can put any password we want right here.
And when I hit enter and as you can see we get an error message saying that some illegal characters
got detected.
So let's try the other exploited exploit that we found which was we put the user name normally and then
we put the password as anything we closed the code and we use or one equal to one which is correct.
So again I'm going to just keep the user name as admin normally and then I'll paste this exploit right
here.
Hit enter and again we get the same error saying that some illegal characters got detected.
Now this filtering could be happening at the client side or it could be happening on the server side.
What I mean is if it's happening on the client side it's the stuff is being filtered before it gets
sent to the server.
The other way the server side me is these characters are being detected and filtered out the server
site after they get sent to the server.
Now if it's happening on the client side then it's very easy to bypass using burb proxy verb can also
help us identify whether this is happening at our site at the client side or if it's happening at the
server side.
So as you are going to go to the proxy and I'm going to set up the proxy settings again for Firefox
just like we did in previous videos so that it uses burb.
So we're going to go in advanced settings and we're going to use manual configuration and set to port
80 80.
So that's all good.
Now everything we do as we said before should go through a burp.
So if we go to home you'll see that packets are coming here.
If we forward them they go to the server.
So again when I go to the log in the packets come here we forward them from birth.
And then they go here.
Now watch this.
Now I'm going to try to put in the user name as admin and I'm going to put this exploitation right here.
And when I pasted notice that the package will not be sent so I'm going to click on log in and see that
nothing was sent to burp.
So this request was stopped before it even reaches the Internet before it even reached the server.
So it was stopped by some code loaded on the browser or in this web page itself.
So the filtering is happening on the client side on our side before it even goes to the website and
still must have some dangerous characters were detected.
So let's go back to our diagram here.
So we have our history a web site with client side filtering.
So when it detects special characters the client side code will remove these characters or it will display
an error.
So what we're doing is we're going to write a username and password without any special dangerous characters.
We're just going to write it normally send the request which will bypass the filtering that's happening
on the same page on the client side.
It's going to go to a proxy then right here when it comes to here we'll get to modify it and our dangerous
special characters that will allow us to bypass authentication or run code on the target website.
Once we do that we're going to send it to the server.
The server will execute and send it to us.
So use unberth.
We're going to be able to bypass client side filtering.
So let's go back and see how we're going to do this.
So we're going to use a normal user name as admin and I'm glad I'm going to put a random password so
it doesn't have to be right.
I'm just going to put a.
Doesn't really matter.
And I'm going to click on logon.
Now this is a valid request.
So it will be sent to the Internet.
It won't be stopped by the filter which works on the client side.
So I'm going to click and log in.
And as you can see the request has came here and there are costs.
And here we can see that the user name is a it is admin and the password is a.
So we're going to do now we're going to actually modify the user name and the password values right
here instead of modifying them.
The web browser.
Because at this stage we've bypassed the filter so the username and password were valid at the client
side.
They got sent to the Internet before they got into the Internet.
We captured them by birth proxy and we're going to modify this password exactly the same way that we
wrote our exploitation and the previous video.
So this is going to be
a.
Or one is equal to one.
And then we close it with the comment here.
OK so I'm just going to repeat this.
So the filtering is happening at the client side by javascript code which gets executed on the page
itself.
So the request is being stopped before it even reaches the server.
When we run burp we actually used a good username and password that are not considered to be dangerous.
They pass through the filter and before they go to the Internet we have burp proxy work in which capture
that we're going to modify it in here because we've already bypassed the filter.
And when I click on forward
you'll see that I managed to log in as the admin.