Authentication

Username enumeration via different responses

• This lab is vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and password, which can be found in the given wordlists.
• To solve the lab, enumerate a valid username, brute-force this user's password, then access their account page.

Enumeration

- We tried to login with random credentials and realised that there is a "Invalid username". - We realised that logging in is through POST request.

Vulnerability Assessmemnt / Exploitation

• We will try to test with the given username list with Burp Intruder using Sniper attack type.
• From the above, we can see that atlanta is the one with a different response length compared to other responses.
• We realised that our hypothesis above is right that a correct username can be enumerated.
• Next we set the password field as the field to attack.
• From the above, we see that with the password computer, there is a HTTP 302 (redirect). This is likely the correct credentials.
• We login with the credentials atlanta:computer and we managed to login.

2FA simple bypass

• This lab's two-factor authentication can be bypassed.
• You have already obtained a valid username and password, but do not have access to the user's 2FA verification code.
• To solve the lab, access Carlos's account page. Your credentials: wiener:peter and Victim's credentials carlos:montoya

Enumeration

• As this is a 2FA bypass challenge, we will skip the thorough mapping of the website. Below is the "Home" page.
• We simply, go directly to the login page and is faced with the page below.
• We then attempt login with wiener:peter credentials and got to the 2FA page below.
• We go to the email client and retrieved the 2FA code to login to the account.
• Then we get to the page below.
• The transactions above are logged in burp proxy and can be seen below. We repeated the steps above, but did not key in the correct 2FA the next time.
• As can be seen above, a successful login procedures are as follows

  graph LR
  
  1[GET /login] --> 2[POST /login] --> 3[GET /login2] --> 4[POST /login2] --> 5[GET /my-account]

• We then examine the Request/Response in the sequence above to see if there might be any clue.
• Looking closely at the logic above, we see that the session cookie produced by /login and /login2 are different.
• However, we do notice that /login and /login2 are 2 different resources and that the session cookie generated by /login will allow access to /login2

Vulnerability Assessment / Exploitation

• Going by the logic above, there might be a possibility that /my-account can also be accessed by the session cookie generated by /login2.

Password reset broken logic

• This lab's password reset functionality is vulnerable.
• To solve the lab, reset Carlos's password then log in and access his "My account" page.
• Your credentials: wiener:peter and Victim's username: carlos.

Enumeration

• As this is a password reset challenge, we will skip the thorough mapping of the website. Below is the "Home" page.
• We simply, go directly to the login page and is faced with the page below.
• There is a "Forgot password" button.
• We map the login process by logging in with wiener:peter and the result is as follows.
• We then go on to map the forget password process by accessing the "Forgot password" button. We get the page below.
• Then we subsequently submitted a password reset request using wiener's username.
• Below is the link received by wiener's email.
• The webpage below is the reset password page.
• An interesting observation is the password reset request as seen below.
• The temporary token, username to reset and new password are passed as a parameters for password reset.

Vulnerability Assessment / Exploitation

• Continuing from the thought process above, we can test if the token is universal or that we can reuse the same token but change the username.
• We used burp repeater to send the request and changed username from wiener to carlos.
• We attempt to login to carlos with the password we set and we were successful.