Authentication Vulnerabilities - Lab #1 Username enumeration via different responses | Long Version

Summary

In this video, the instructor demonstrates how to exploit username enumeration and password brute force vulnerabilities in a web application using Burp Suite's Intruder tool. The lab focuses on identifying valid usernames through error message variations and then brute-forcing the password for the valid account. The video also covers other vulnerabilities such as the lack of brute force protection, allowing rapid login attempts without being blocked. Additionally, the instructor highlights the potential for automation using tools like Hydra. The video is part of a broader web security course, offering early access to content, a Discord community, and ad-free viewing.

Takeaways

• 😀 The video is part of a web security academy course focused on authentication vulnerabilities.
• 😀 The course provides early access to material, a Discord channel for questions, ad-free viewing, and direct support for the creator.
• 😀 The specific lab covered in this video addresses username enumeration and password brute force attacks.
• 😀 The lab contains a vulnerable system with predictable usernames and passwords for testing.
• 😀 The goal of the lab is to identify valid usernames, brute force their passwords, and gain access to a user account.
• 😀 The user uses Burp Suite Professional for this exercise, highlighting the limitations of the community version.
• 😀 The first step in the process involves testing a random username and password to observe the system’s responses.
• 😀 The username enumeration is achieved by comparing response lengths for valid and invalid usernames.
• 😀 The second step involves brute forcing the password by testing against a list of candidate passwords.
• 😀 A successful login results in a redirect (status code 302) to the 'my account' page, indicating a valid username and password.
• 😀 The vulnerabilities identified include verbose error messages for username enumeration and lack of brute force protection, allowing multiple requests without IP blocking.

Q & A

What is the primary focus of the lab in the video?

The primary focus of the lab is to demonstrate username enumeration via different responses and password brute force attacks in a web security context.

Why does the instructor suggest purchasing the course despite it being available for free on YouTube?

The instructor suggests purchasing the course for four reasons: early access to recorded material, access to a dedicated Discord channel for questions, no ads or sponsor messages, and supporting the instructor in maintaining and creating more content.

What is username enumeration, and how is it demonstrated in this lab?

Username enumeration is the process of identifying valid usernames based on different responses from a system. In this lab, the instructor enumerates usernames by analyzing the response length differences between valid and invalid usernames during login attempts.

How does the instructor use Burp Suite to perform the enumeration of usernames?

The instructor uses Burp Suite’s Intruder tool to perform the enumeration. They send login requests with different usernames, analyze the response lengths, and identify a valid username based on the response's length difference.

What difference in response is used to identify a valid username?

The instructor identifies valid usernames by comparing the response lengths. A valid username results in a response length of 2986, while an invalid username has a response length of 2984.

What security flaw does the lab reveal in the system's handling of login attempts?

The system has a verbose error message that reveals whether the username is valid or not, allowing an attacker to enumerate valid usernames. Additionally, there is no brute force protection, enabling an attacker to perform multiple login attempts without restriction.

What method does the instructor use to brute-force the password for a valid username?

The instructor uses Burp Suite's Intruder tool again to brute-force the password. They provide a list of candidate passwords and analyze the HTTP response status codes. A successful login results in a 302 status code and a redirect to the 'My Account' page.

What was the valid username and password discovered during the lab?

The valid username discovered was 'Arkansas,' and the valid password was 'Matthew.'

What tool does the instructor recommend for automating the brute-force attack instead of using Burp Suite?

The instructor recommends using Hydra, an automated tool that can perform brute-force attacks by trying every possible combination of usernames and passwords from a given list.

What other vulnerability besides username enumeration is highlighted in the lab?

In addition to username enumeration, the lab highlights the lack of brute force protection on the login page, allowing an attacker to send a large number of login attempts without the system blocking the IP address.