One last lab with gusto for this course.
We're going to attack HTTP logins using ZAProxy.
So this one should be a lot of fun.
Let's jump in.
Always, we start with our IP address,
because it changes lab to lab.
The 192 is going to stay the same, but the 214 and 184
is going to change.
Our target will always be the .3.
So just making sure that we got the right one.
It looks like we do.
It is the bWAPP.
We're going to fuzz this with ZAProxy.
I didn't need to actually open this.
I'm going to close it for demonstration purposes.
That's fine.
And do a Manual Explore.
http://, our IP address.
Use the HUD, and launch the browser.
Give it a second.
It's loading the page.
Follow the redirect.
We've got extra stuff going on.
There it is, the HUD.
Continue to the target.
And we are here.
We're in.
Now, we want to capture this.
So test, and test.
Why not?
Invalid credentials, but over here,
this is what I kind of care about.
I have this post for the login.
And with this, I am going to--
I've highlighted it here.
I'm going to go to the request over here.
And now I can see what I tried to log in with.
That's kind of neat.
We're going to right-click on it.
And we're going to fuzz.
And what we do is we need to add some things.
So I'm going to highlight test, and then Add.
And for this payload, I'm just going
to add some words, some simple ones, like admin and bee.
We'll add those.
Admin and bee, that looks good.
And then highlight test over here.
And we'll add some stuff.
And you could load in a whole word list if you wanted.
For example, multiline there.
But I'll go with admin and maybe password, adminpassword,
cookie, hello, cookie1, and bug, and bee.
We'll add all those in.
That looks good and solid.
So now we've got a login fuzz and a password fuzz all set up.
And then we're going to start the fuzzer.
That is fine.
I'm not going to change the other ones.
Let's remove that guy.
Now start fuzzer.
There we go.
Fuzzer opens up a new thing here.
And we've got a 302.
There's a whole bunch of 200's.
And finally, this 302, and we can see down here
it says bee and bug.
It tried admin, admin.
It tried all these.
Eventually, bee and bug worked.
We got a 302 code.
Reason, because it was found.
Awesome.
And we could go back in here.
Try bee and bug.
And great success.
We're logged in as bee.
And it's a pretty neat tool.
It works kind of the way you want it to work.
It's nice.
Big fan of ZAP.
It does what you expect it to do when you want it to do it.
Limited a little bit, but if you are starting out
and you're overwhelmed by Burp--
I feel comfortable in Burp now, but I've
been playing with it for a while.
If you're not, then try some ZAP, and use the HUD feature.
We've got a few labs here, and several videos
covering some of the features on how to use it.
This is going to be the last lab.
And I'll get into the conclusion in a minute.
But go back through, get comfortable with them
if you want, and thanks for following along.