Hey, guys, welcome back to another episode on How to Hack.
So we're at the end of the challenges for Web goat, which is a Web application penetration testing
series that we have began with you and of course, on the challenges, we have no challenges.
I want to take this chance to go through what happens when you are going through a use case of bug bounty
or finding vulnerabilities manually with a Web application system or server.
And of course, we are on the second challenge, which is, of course, over here.
It says, can you log in?
Is there.
So as part of this challenge, in a real world scenario, you would have no hints?
There will be no hints for you to take or advise where you will point to you specifically in a direction
that ask you to try to break into the system.
All right.
So in this case, one wonderful workflow that you can actually try to follow is based directly on a
hint that has been provided to you through this whole course, and that is on the left side injection,
broken authentication, sensitive data exposure, XML external entities, broken access control, cross
site scripting in secure.
These serialisation vulnerable components request forgeries as well as client server attacks.
OK, so what do I mean exactly is that as you're doing all this bug bounty web application penetration
testing, you can actually try to go through each and every of this open web application security project,
top 10.
And as you try it, you realize that it becomes a workflow for you.
And of course, in this case, we have a login page.
All right.
And which is going to be the most applicable for a login page.
Chances are you will start off with bijection.
All right.
And you'll be looking for other input places.
You could be looking at cross site scripting.
So you start off as debt and you'll look into Arda Places are parts of the website where you could possibly
try to run some of this vulnerability's checks and find out whether there are any input forms, any
parts of the server that could be exposing data.
So very quickly, we'll be able to find all all the details.
All right.
So without further ado, let us go ahead with the tutorial.
So in this case, where we are straight into dialoging page, right.
For this particular challenge, no hints.
So what do we do?
Right.
So he says the following is a login page or we have not submitted anything.
And it says, can you log in as Larry?
OK, so I'm going to go ahead and enter l a r y and I'm going to enter, say, for example, password
as Larry and see what we get in a normal use case.
So a normal use case, meaning that as you're signing in, you're testing out the input forms and so
on.
You want to try to just enter what would a not more user enter into the inputs?
OK, so go in and click on login and once you click on login, it says, please try to log in as Larry,
not Larry.
OK, so with a capital L..
All right.
So immediately we can change that up.
I can change it to a capital L..
All right.
So it's case sensitive.
And when I click on login, it says this is not the correct password for Larry.
Please try again.
All right.
So obviously, right at the top here, it already has some kind of check or some kind of verification
that you can only enter this particular user name to enter into the site.
OK, and of course, to password, you can enter any future that you want.
OK, so in my case, we can use a number of examples.
All right.
So we can try.
For example, over here, we have a sequel injection that we could try to insert into the system.
So, for example, I can enter a semicolon or a single code so I can enter a single code and I can enter
password, for example.
OK, and when I hit log in.
All right, I'll you at the bottom, you'll be able to see this is not the correct password for there.
Please try again so we can see this kind of details and data directly by trying it out.
All right.
So we can try a single code as well.
So, for example, over here I can enter a a cut and I can copy the information and I can go into the
password for you and I can pace it and click login.
All right.
So once I go in, once again, we're not able to get any response from a server.
OK, so what we can do next is that we can go and try to automate some of the sequel injection.
So one of it is, of course, via SQL map, which we have done as part of the course.
The other way is more of a manual approach, which is using suite.
So again, we can hit back to preferences, go on in network settings and we can enable the manual proxy
configuration.
Click OK on that.
And we have running right here.
OK, so all I got to do right now is I can actually turn on into SAP.
All right.
So once I have the intercept turn on, I can go back to the site and I can go ahead and click.
For some kids, some data and click on login, OK, and of course, on the Web suite, OK, I can drop
this lesson overview lesson manual.
All this our information is always central and to the system.
So in this case, we have a post.
All right.
Which is we are trying to log into the Web application system.
And right at the bottom, we have username on a scroll log in and we have the password unaskable log
in.
All right.
So I can do it right.
Click and send to repeat it sent to repeat or you can use a control as well as a shortcut.
So once we go to repeater, OK, we have a right, for example, over here we have the following information.
All right.
So here we have the following.
OK, so we have username and we have password.
OK, so all you're going to do is try a password so I can try.
For example, Larita, we have tried earlier and we recognize that we were not able to get a response.
So it says over here at a feedback, this is not the correct password for Larry.
Please try again.
OK, so what about if we try a single code?
All right.
So we have a list of all those payloads that we can inject into the Web application system or as part
of SQL injection, as part of learning SQL injection.
So again, this is a more menu approach in learning about how we can do manual payloads into Web application
systems.
So I can go ahead and click on send.
And right here, we will get the error message.
So sometimes a lot of this error messages, they do not get shown in the Web application system because
to trying to mask some of this error messages, configuration feedback, that could accidentally expose
a lot of data.
So back here back to Bourbon Street, we are picking up all those different responses.
So over here we can see the following or message request processing.
Phil, necessary exception around stateman, as you can see over here.
All right.
We have a number of single instatement SELEK pastorate from challenge on the score uses where user ID
is, Larry.
All right.
And password we have tree.
Sengoku is right here.
OK, so what we can do right now is we can put, for example, OK, we can put or one equal one, OK?
And we can go ahead and click send crisis in Turner server error and we have request processing felt
necessary exception so we can read the syntax error exception.
So he's showing us literally what we're entering wrongly.
OK, so in this case we can see and password.
All right.
It's a semi.
We have a double single code here or one equal one.
So what we can do instead is we can actually go ahead and enter a single code.
All right.
For one and then a single code again right before the last one.
And go ahead and click send.
All right.
And it says, congratulations, you solved a challenge.
Here is your flag and you can copy and paste a flag into the Web application system to track your score.
OK, so once again, I hope you've learned something valuable and you have any questions.
Feel free to leave a comment below and my best to answer any of your questions.
And we'll like share and subscribe to the channel so that you can be kept abreast of the latest cyber
security tutorial.
Thank you so much once again for watching.