So now we know the user name is administrator.
We know the password length is 20 characters.
The next target is to actually get that password.
The problem with that is it's a 20 character
password and we can't actually get it displayed anywhere.
Therefore we're going to have to follow a very similar approach
to what we did in the previous blind SQL injection example.
Again we're simply just manipulating the condition in here.
We're asking if the user name is administrator
and
the first character of the password is A.
And the way we're doing this we're using the sub string function.
So again you can look this function up basically what this function does.
It can divide the strength and what we're saying is the
strength that we want to divide is the value of the password
and we want to get the first characters. That That's why we're saying one and one.
So this specifies where to start the division from and
this specifies how many characters you want to get.
So we're saying we want to start our division at the first character.
We will only want to get one character starting from there.
And therefore we're checking if the first letter or the
first character in the password is equal to a.
If it is sleep for 10 seconds otherwise move on.
And then we do that for the next character by changing this value to two.
So we're going to say is the second character is equal to A.
And then we say if the second character is equal to B.
And go ahead,
go through all of the possible characters to actually get every single character
in the password very similar to what we did in the previous example.
That's why I'm kind of going through it quicker than I did in the previous example.
So if you don't remember how this works please go back and revise that example.
So let's go ahead and let's edit this.
So instead of saying the length we're actually now doing sub string
And we're doing it for the password and we're getting
the first character starting for one and then we're checking if
that is equal to a then I want you to
sleep for 10 seconds otherwise don't do any of that.
Don't sleep for anything. Let's hit enter.
And as you can see we didn't sleep for any seconds at all which
means that the first character of the password is not the letter A.
So now you have to go ahead and try the letter B
and the letter C and move on to all possible characters.
And as mentioned the previous examples that could take a lot of time.
Therefore what we usually do is send it to the intruder.
But bear with me I'm not repeating myself,
there is a slight difference with this example that's why I'm covering it
in here because I know we use the intruder in the previous example
you should know by now what the intruder does.
It basically allow us to specify certain locations within the
request where we can automatically change and send to the
target web application and then get our results straight away
instead of having to manually I guess every single character.
And we actually relied on the sniper first and then
I showed you how to do the cluster bomb but
with this example because I showed you the sniper and
it's actually the simpler and longer way of doing it,
I'm going to go ahead and do it with the cluster bomb straight away.
So the first thing we wanna do is clear out all the signs that we have
and we need to specify the locations in our request that we actually want to modify.
So as we know the first thing that we want to modify in our request is
this part of it where we actually change the character that we want to guess.
And the second thing that we want to modify is the letters.
So again you want to replace this with every single
possible character that could be used in a password.
Therefore we're going to go to the request.
And the first thing that we want to modify is in here it's this number
one so we're gonna highlight it like this and click on add the characters.
So as you can see it's gonna add
these characters surrounded by these characters which means that
this part of the request will be changed
based on whatever configuration I'm gonna set later on
and the next part that we want to change is this a letter?
Again we're gonna click on add to add it in here.
So now we're basically gonna be modifying this part and this part of the request
and we need to change the attack type to
the cluster bomb because we're actually going to be
changing two parts or manipulating two parts in the
request and then we're gonna go to the payloads.
Now this party is similar to what we did before.
So the first set is actually gonna be numbers
and we're just gonna go from 1 to 20
And we're gonna go one number at a time.
So what this will do it will basically increase this number from 1 to 20
the next set. So we're going to specify the next set from here
and in this one we're gonna do a brute force
and we want to guess one character at a time
and this is the character set that we'll be using.
So we're using alphabetical characters and
numbers without special characters but that's fine
for this example it really depends on your example and your target.
But basically what we're doing here with the second
set we're modifying the second part of our request in
here and we're replacing this a with all of the
characters that we're specifying in here in every request.
So as you can see the configuration that we set between set
one and set two is going to result in 720 requests,
which you would have had to do manually but now they will
all be done automatically for you by burp suite by the intruder
plugging of burp suite.
Now so far it's been very similar to what we did previously.
But the main thing that we want to change is if you go here to the resource pool,
it's usually set to the default which will basically
send 10 concurrent requests at the same time.
That's good in most scenarios.
But because in our scenario we actually want to monitor the amount of time taken for
the response to get back to us because
remember this is a time-based blind SQL injection.
Therefore
the results would be much more accurate.
If we send only one request at a time,
obviously it'll be slower but your results would be more accurate
by default. You would not have this option in here. That's an option that I created.
So therefore instead of keeping it at the default,
you would need to create a new resource pool.
You can call it whatever you want. So let's this time, just call it
one request and we're gonna take the maximum concurrent
requests and we're gonna set it to one.
So we actually only send one request at a time, wait for the response,
log the amount of time taken for that response.
So that later on when we come back and analyze the results,
we know which ones were the correct characters.
So these little things that in a real life scenario it
might make you even doubt yourself because if you set it to
10 concurrent requests at the same time you're gonna be sending
10 requests and waiting for delays for 10 of these requests.
Whatever is else you get back.
The time is not going to be very accurate and
you'll think there's something wrong with your payload and then
you're gonna have to go back and start playing with
it and thinking why is the normal test is working?
But when I'm trying to guess characters it's breaking
it's just simply just because you're sending too many requests at the same time.
So once you're happy with all of this,
similar to what we did previously we're gonna click on start attack
Burp suite is gonna go ahead and execute the configuration that you said.
So it's going to start guessing the password for you by increasing
this number to get every single character of the 20 characters that
make up the password and then guess the value of that character
based on the brute force option that we set in set two.
Now how are you going to determine the correct guesses based on the information
that is displayed here in the previous example we went by the length because
as you as I said before and as you remember the page that was
loading changed based on the injection or the pale that we were sending it.
So we looked at the length of the page and if it was
of a certain length we knew that that is the correct character.
But so far we rely on the time taken for the response to come
back to us to decide whether a certain guess is correct or not.
And therefore we're going to have to go to the columns in here
and we're gonna have to enable the response received.
And now we have a new column in here that
shows us the amount of time taken for the response
to come back in milliseconds keep in mind so I
know you're seeing 65 and 89 that's not in seconds,
that's in milliseconds.
So now what we're looking for is 1000 or something that is over 1000.
So so far we don't really have anything that took over 1000
which means that so far we haven't really guessed any correct characters.
But if you let this run for long enough you should start getting the
characters one by one similar to what we did in the previous lecture.
So there you go. As you can see now we got a correct guess already.
So we know the 19th character is the letter D. Because that took over 12th to load.
So that is the first character that we guessed and simply
all you have to do is just let it run right now
once it's done, as I showed in the previous lecture again,
you're just gonna have to open up a text file and
literally match every character to its position in the password.
And then you would be able to extract the full password for the administrator simply
by monitoring the amount of time taken for the response to come back to us.