[CLICKING]
[SOUND LOGO]
In the past lab, we used Hydra to brute force
a login for a web app.
In this lab, we're going to use Burp
Suite to get through some basic authentication.
And it's a little different.
And I think you'll enjoy it.
Let's jump into the lab.
Let me start these off, finding our IP address.
And we're the .2.
The target is the .3.
And we can just run a simple nmap scan
to see, yup, that's our target.
Throw it into the browser.
And there we are.
Well, there is a special authentication
for this website, not just the normal login.
It's in the basic directory.
So if we go forward slash basic, this pops up.
This is different than we've seen so far with this web app.
And we can do test, and test, and see.
Nope, nothing terribly useful comes up.
But this is unique.
This is interesting.
Let's see how it all works.
I hate cancel.
Whoa, it did not like that.
Can I turn on Burp here, and then open Burp.
And we're going to try to capture this request
and see what all is going on.
Burp is great for that.
It also is going to allow us to play with a few things,
like using repeater and intruder.
Intruder, in this case.
Repeater is not quite the brute forcing tool that we want.
Burp is on.
Burp is turned on.
Let's do this again.
It is basic.
It captured it.
Looks like it's trying to go there.
Let's send it.
And then, this popped up.
Now let's do test and test.
And it captured that.
So it's a get request.
We don't see it in the URL.
There's a cookie, and there is authorization.
This is different.
This is a little different than what we've seen so far.
This right here, we got lowercase, we've got uppercase.
I see a zero.
This is encoded.
So I right-click, and I can go to convert selection.
And then, this is Base64 encoded.
So let's decode it.
And yeah.
OK.
It's test and test.
That's what I sent.
So that's-- it's showing up there.
Base64 right.
So it's going to send whatever we put here.
And it's going to Base64 encode it and send that.
So let's send this whole thing to Intruder.
Pop over to Intruder.
Yep.
Let's pick our positions.
I don't care about the cookie.
What I want is this right there.
So it's test and test.
Let's get into our payloads.
Payloads at one, yeah, it's the only one we've got.
We'll load.
I'm going to go with this 100 most common passwords.
It's on our desktop as root, right there.
And that should do it.
Yeah, open.
Open that one.
Sweet.
A lot of good passwords.
But that's just passwords.
Now, we're going to assume that we know the username.
It's going to be admin.
So we need to come down to payload processing.
And you go to add.
And we saw it was a username colon password.
So we will add a prefix.
And it's going to be admin and a semicolon.
Not a full colon, just a semicolon.
And then, with each request, that also
needs to be encoded with Base64.
So encode with Base64.
Now that we've got that set up, we got the word list.
We've got our prefix and encoding.
Let's start our attack.
It's going to be slow.
That's fine.
There it is.
And it's trying out a bunch of different stuff.
And we can take a look at what it might look like.
That looks like something.
We'll just look at this request.
And let's send it to Decoder.
Pull that up first, Decoder.
OK, here's that code.
I'm not exactly sure what it is.
Let's smart decode it.
Does it come up with anything?
It could be Base64.
Let's try decoding as Base64.
OK, cool.
It's admin and 242424.
Perfect.
And it's doing what it's supposed to do.
Let's get-- do we have any status codes other than 401?
Doesn't look like it.
Not yet.
Let's take one more look.
Let's double click to open this guy.
Action, and I want to send it to Decoder, because I'm worried
it won't decode properly here.
Yep.
Oh.
It's because this is not Base64.
This is a URL.
So if we decode the URL, oh yeah, it doesn't like it.
Thusly, send it all to Decoder.
And then, we could try smart decode.
And it only changed that last part.
So that's not great.
Let's do it again.
Decode as a URL.
That might still be the same.
That's fine.
And then decode that as Base64 admin lollipop.
OK, neat.
Nothing really useful yet.
OK, 301.
That's a redirect.
Let's take a look at this guy.
We got more of those percentage 3d's.
We can't do anything crazy with it here.
So we'll send this whole thing to Decoder.
So action, send to Decoder.
And I highlighted it, so it only did that stuff.
I'll smart decode.
Looks like it works.
This part is Base64, but it was part of the URL.
The equal signs weren't making it.
Base64 you can have up to two equal signs,
uppercase, lowercase, and numerals zero through nine.
So that's all of them.
And now, let's decode this as Base64.
And we see admin and cookie one.
Neat.
So that should be a good login right there.
Then we'll let that one go.
Why not.
I'll turn off intercept, and admin, and cookie one.
And it logged us in.
And we've got our flag here.
So some neat stuff that we can do with Burp.
And it's a lot of fun.
We're going to go back and do one more thing with the proxy
before we end all of these labs.
And hopefully, now you've got a taste,
and you'll be able to do a little bit of web app
pen-testing in the full complete external pen test
that we're going to do for EJPD.
So enjoy.
And I'll see you in the next one.