Original subtitles

in this lesson I'm going to be talking

about password attacks so similarly to

just normal password attacks against

systems what you're usually doing is

some form of brute force and I'm going

to do a quick search here for a user and

I'm going to find web pages that have

come from my scans that have a user

associated with them or a UID and here's

a good one here's a log in form and it

looks like there's a user ID and a

password that's associated with it so I

can actually send that one to the

intruder and I'm going to go to the

intruder I'm going to take a look at my

positions so I've got a number of attack

types that i can use and i'm going to

use a cluster bomb approach because that

gives me the ability to manipulate the

user ID and the password with two

different types of payloads so in the

first payload set i am going to put in

user names and burp suite has a number

of user names that are built in and the

second payload set i am going to put in

passwords and i'm not going to do any

options here I'm actually just going to

start my attack

except that it requires me to plug this

in and so I'm going to do a simple list

and I'm going to go back and actually

add the value back in so I'm not

actually playing with the value at all

I'm just going to use one payload to use

what it was and then I am going to go

run my attack and what this is doing is

it's brute-forcing so what it's going to

do is check all of the usernames with

the first password and then it's going

to go check all of the usernames with

the second password and you can see

there are like 30 million requests that

we're going to be going through here

just to do this brute force password

attack now one of the interesting things

here is that the different payloads have

these special characters in them and

usually you wouldn't have special

characters because that may open the

door to things like sequel injection or

cross-site scripting so normally you

would do some sort of input validation

on any data that you get and it's useful

to do the input validation at the border

between different layers in your

application architecture you wouldn't do

the validation strictly at the browser

for example because that's going to be

done in JavaScript and I can always run

a proxy behind your JavaScript and undo

any validation that you may have done

there so while validation is useful to

do in javascript and you can certainly

do it in the browser there are ways of

getting around that and you also can't

guarantee that there may not be

something happening at different layers

and so it's useful to do some level of

input validation at the different layers

between your application architecture so

that's always helpful to do now this is

going to take quite a while to run and

I'm not going to actually run it to

completion I'm going to pause the

back here because the goal was simply to

show you a different way of doing a

password attack and just the ways that

password attacks work so it actually

showed me some different things here

with regards to the password another way

of doing a password attack against a web

application is in cases where there is a

clear text submission of a password so

you can see here there was actually no

encryption involved in this particular

submission of this password it was all

done in the clear and because of that I

could actually run a sniffer on the

network and be able to capture the

username and password

so that's another type of password

attack that you can use and it's not

commonly one you could use against

systems but often web applications are

done without SSL or TLS involved and so

there's no encryption and sometimes I

guess people believe that because we're

primarily in switched architectures

these days that they are sort of in

vulnerable to grabbing passwords like

that the reality is they're just not and

so encryption particularly since it's

pretty easy to do encryption is just

really something that you should be

doing any time you're transmitting data

between a client and a server so input

validation is a really good thing to

protect against cross-site scripting and

sequel injection and other types of

attacks and also you want to be doing

encryption on your communication between

your web server and your browser