So so far we know that the user name is
administrator and we have a password of length 20.
The only thing we need to do is get the password now.
Like I said,
you could use award list of passwords of length 20 and have a script that
goes through them or use the intruder functionality
of Burp to actually go through them.
But there is a better way because if you do that,
you're simply doing award list attack.
We can actually do a brute force attack where we cover all possible passwords
and you can actually do that with a very short period of time,
especially if you have the professional version of Burp suite.
So what we're gonna try to do basically,
we're gonna use the same idea that we're doing in here where where we
ask a question and the question that we're gonna ask is is the first
character of the password is A.
And then if the answer is no we're gonna ask the same question again.
But this time we're gonna say is it b if the answer is no we're gonna do it again.
And we're gonna answer the question is gonna be is it C.
And then once we get the first character, we're gonna do the same for 2nd, 3rd,
4th 5th all the way up to the 20th character and we can do this.
Like I said using a script you can actually write it very easily in python or any other
programming language or you could use the burp intruder
which is what I'm going to show you right now
to do this, we're gonna run this again.
Just one more time we have the request in here,
we're gonna right click and send it to the intruder
and then we're gonna go to the intruder and I actually
covered using this before in the excess s vulnerabilities section.
But we're gonna cover it again.
And when I covered it,
I said that this is very useful and it can be used in so many scenarios.
So this is just another example.
But just a quick recap with the way that the intruder works.
You simply have the request in here that we have been playing with the whole time.
So you could see the tracking idea the cookie that we have been playing with as well.
And you have these signs.
So these signs basically tell the Burp suite intruder to
manipulate the value that is enclosed between these two characters.
So I'm actually gonna clear these signs for now because I want to select
something else and we're gonna have a
payload and we're gonna manipulate the payload.
So let's go and write the question.
So we said the question that we're going to ask
is is the first character of the password is a
and we're gonna build this on the original one in here.
Or actually we'll build it on this one.
So we're gonna copy this and paste it here.
And as I said if all of this is correct,
it will evaluate to a and then we're comparing it to A.
So instead
this time we're going to select
a sub string
from the password
and we're gonna select only one character starting at the first character.
That's why we have 11 and I'll explain it better as we go and we're selecting
this from users where the user name is administrator and we don't need this anymore.
And we're saying in this question is the first character
is A because we're comparing it to a in here.
So basically the only confusing part of this select
statement is this one and this is an SQL function
that takes a string and divides it. So we're saying take the password as a string
and get me the first character.
And then I want you to check if that character is A.
So then as we go we're gonna be replacing this with B. C. D.
Whatever as we go through the alphabet until one of the
results shows us welcome back which means that it is true.
And then we can move to the next character.
Now the cool thing about the intruder,
it can replace the values that you enclose with this character.
So basically what I can do is I can put this in here and put this in here and then
burp is going to automatically send requests one request at
a time and go through the alphabet starting at A.
And then finishing at Z.
And then I can analyze the results and know the value for the first character easily
without having to send these individual requests asking for A B c D E f G.
So basically it's a way of scripting the attack instead of having to do it manually.
So I'm gonna copy this and we're gonna clear the
signs in here because we want to add our own.
So let's click on clear and then we are gonna
have our injection in here after the tracking I.
D. So let's paste it in here and make sure it's pasted correctly.
So we have the colon we have everything and we have the two signs,
I forgot my quotes, I need quotes in here.
And the next thing you want to do is go to the payloads.
So this is where you select the values that will be substituted in here between these
two strange as signs because you could select anything you could put on the numbers,
you can select alpha numeric characters or on the alphabetic characters.
So here you can actually select what you want to inject in there.
So we're gonna keep the payload set to number
one because we only have one set of payload.
So this is the payload set and we only have one of them and we're gonna
say the payload type to brute force because we want to do a brute force.
The character set is automatically set to alpha numeric characters.
So we're gonna keep that the way it is.
And we're going to set the minimum length to one
And the maximum length to one as well.
And that's it. We're ready to go. We're gonna hit start attack.
This is just a warning telling you that this is the
community version so it's going to be a bit slower.
That's why I said if you have the professional it'll be much faster.
So you want to give this some time.
And like I said this will only guess the first character.
I'll show you how you can guess all of the characters in one go. Once we finish this
and here we go.
We have the length of the response was a little bit different than all of them.
And if we analyze that response
and look for our clue to a true statement
to something that is true which is welcome back.
You can see that we have Welcome back in this one which is the letter N.
But if we go here and look for welcome back you'll see that we have zero matches.
And therefore we note now that the first character of our password is the letter N.
So now you can go ahead and ask the same question
to figure out the next character in the password
to ask what's the next character.
All you have to do is simply replace this with two to ask
about the second character because now we're
saying we want to subdivide the password
to get one character out of the password starting at the second character.
So this will get you the second character of the password.
And we're saying is the second character is a B c D e f G.
We're going to go through all the alphanumeric character due
to the use of the intruder with these two characters.
This way you can get the second character and move on to the 3rd, 4th,
5th and continue on.
Now obviously as you can see this could take a bit of time,
especially if you have a password made out of 20 characters.
Therefore you could use Python script if you want to make
it faster yourself if you have any programming knowledge or check
out the next lecture to learn how to configure burp to
guess all the characters of the password in one go.