Hello everyone and welcome to this lesson.
In this lesson, we are going to understand that with
the help of nuclei. We can also perform fuzzing.
This can be super useful for us if
we are trying to fuzz the parameters
for some default usernames and
default passwords.
This helps us identify Security misconfigurations on
multiple targets sub domains
Etc if they are running all default username
or password.
We can also use this to First for URL endpoints
as well.
In this specific lesson. We are going to understand how you
can run various types
of payload using nuclei.
We will be using the payload from a word
list file or we can also use a normal list file.
Payloads can be defined in the
nuclei template with the help of payloads colon.
So the first fuzzing technique that we are
going to see is cluster pump.
So what exactly is cluster bomb?
Let's assume we have assigned in page which has a
username field and a password field.
In cluster bomb Technique, we are going to take one value.
From the word list and Supply it in the username one
value from the password and Supply into
the password.
Similarly for the next attempt. We are going to
take again the first value itself and the
second password from the word list.
Similarly first username third password
first username fourth password and so
on.
So we are using different combinations to First
the application to identify if
we are successfully able to authenticate into
a application with the help of cluster bomb
technique.
In simple terms, we fix the payload
one and we iterate for payload 2 and we
do that continuously for payload 2
3 4 5 Etc.
So it is the Practical time and let's understand how exactly
we can use the cluster bomb
fuzzing technique with the help of nuclei.
So you can see over here. This is the Target that
we are going to use for testing.
I want to endpoint which is nuclei slash fuzzing test
dot PHP.
Here you can see I have supplied a username as admin. I'm
going to supply a password as test and
hit on login.
When I do that if you look very carefully in the request.
The username parameter contains the username that
was supplied the password parameter contains the password
that I just supplied and there is a login button
which is equals to login.
You will be able to see the same thing when we capture
this request in burpsute as well.
You can see as the password was incorrect. We got a
field login attempt.
Let us change this to Batman and hit enter.
And you can see this was again a field
login attempt.
Let's try the default password as admin itself
and hit enter.
And you can see the password admin was correct,
and we got a message which is success.
Great.
Now we are going to write a custom template that
we can use for fuzzing.
So as you can see over here, I have written first in
cluster Bomb Dot. Yml template. Let's quickly understand.
How does this template look like and
how you can also write your own templates.
The first is the ID block which contains the name of
the template.
Next is the info block which contains basic information
about the template.
Next is the request block.
I'm using a raw HTTP request right
now.
You can see the HTTP method is get.
I'm sending a request to this specific endpoint and we
have seen the same thing in our browser as
well.
Username equals to we don't know the username. So
we are going to specify that as parameter a
we don't know the password. So we are going
to specify the password field or the password parameter as
parameter B and login equals to
login. Let's see the same thing over
here once again.
Username equals to parameter a password equals
to parameter B and login equals to
login.
Let's go back over here. This is the same request
as it is. Let's go and check the payloads.
In the payload block you can see we have specified
that parameter a should
contains or should read the word list,
which is username.txt.
Parameter B should read passwords.txt.
The attack type that we are going to use is cluster bomb
and finally the matches condition which is
and we are going to match a word in
the body, which is Success that we
have seen just now over here.
And we should also see a status code of 200. Okay?
Let us see how we can run this template
and RV able to successfully identify the
correct username and password.
So I'm going to save this template quickly and go to
my terminal.
I'm going to specify the target URL which is
HTTP. Colon slash slash bug Bounty Hunter
dot org.
I'm going to specify the template as well. So the
template is over here. I'm going to drag and
drop this template here.
And then we need to specify hyphen
P which stands
for proxy that means I want to see and capture
this request from burpsuit as
well.
Let us see with hyphen V flag what exactly happens
when we run this template.
Now remember when we are running fuzzing, we
require usernames.txt and passwords.txt that
we have given in our template. So let's
create that as well.
So now I'm going to say Nano usernames Dot
txt. And we are going to
create a quick word list.
Let's give the password demo.
Tomcat
actify
password
admin Keto
hacker
I love you.
And hacking these are some of the most
default passwords. Let's copy this file to
passwords dot txt as well.
So now we have to files which are over word
list.
So let's run this template.
now so I'm going to specify nuclei hyphenu
the target the template that
we have written just now, which is fuzzing cluster
Bomb Dot, yml and hyphen V
Now let us also read quickly the username.txt file.
Oops, let's let's read the
username.txt file and we have similarly a
password dot txt file as well. So we
are going to use these two word list for fuzzing.
Let's hit enter and let us see the
output as you can see over here. The fuzzing has
started successfully. The first request has been
sent and you can see in the username demo was
used as a username and password demo.
In the username Tomcat demo hackify and
password as demo username
password and password as demo
and so on so you can see this is
because of the cluster bomb technique that
we are using enrich. We are keeping one payload position
as fixed and reiterating the second one.
So let's wait for this to complete and you
can see in between itself. You are successfully
able to match and get the output over
here where in the username supplied is admin
and the password supplied is also admin over
here, which is the parameter a
and parameter B. Absolutely, correct.
Let us stop this and let's run this once
more without hyphen V.
So this will keep on running the cluster bomb
fuzzing in the background for the parameter a
and parameter B, which is basically username and
password with our two word
list that we have created. Once it identifies that
the username password has correctly worked.
based on the matcher condition that we have written which is Success it
will give us the output that
result found
as you can see on your screen right now, you are successfully
able to identify the correct username and
password.
I hope you guys understood this. Thank you.