Ethical Hacking – Through My Eyes

Ethical Hacking: Playing around with the basics | Part#2

Continuing with sharing my further experience around Ethical Hacking learning journey.

Was occupied with quite a few things on personal front recently hence couldn’t go with the speed I wanted but could juice out some productivity in the form of some reading and some practical exercises.

Read few chapters of The Web Application Hacker’s Handbook and the best part, read lots of publicly disclosed reports by HackerOne, Publicly Disclosed and Bugcrowd.

On the practical side, tried RCE on few Bugcrowd program sites though couldn’t succeed yet 😐 Also, the learning and discussions journey continued with awesome Santhosh Tuppad. So recently he gave me around ten exercises to crack. Let’s see how I approached them one by one.

Exercise#1

In the first exercise, I was supposed to crack username and password of a dummy login page. The hint was left in the source code that Base64 encoded value of username is password. I guess the agenda was to get the learner familiar with the encoding thing and to check whether he/she is checking the source code for hints. It took me a minute or so to use an online encoder to get the password expected value. However, due to some technical glitch in the dummy exercise application, it was not letting me get through(the error was genuine so it looked like expected working where access was denied).

Hence, even though my answer was right, I felt that it is not and kept on searching and trying new things. This technical glitch pushed me a for days where I kept on trying different things to crack through. Below are few things I tried, I know some of them are silly but I tried them anyway.

Admin as username and password as many sites actually have such password for admin panels
UserName as username and password, pwd as password (Hint from source code)
admin / admin123 as username and password (again from past experience and usual username-password patterns)
santhoshtuppad as username and password
santhoshtuppad as username and c2FudGhvc2h0dXBwYWQ= as password (The Correct answer, which I got to know only after trying everything)
comment as password (Hint from source code)
value of comment encoded in Base 64 as password (Hint from source code)
empty username, password
single space as username and password
Enabled token ID field on UI and tried SQL injection, 1=1′, 1=1–, 2=2–, and others (Tried SQL injection on CSRF token field by enabling it
Tried SQL Injection on username and password
Used tamper data plugin to play with parameters passed
Tampered cookie values
Added debug points using developer tool trying to understand the flow through script
Tried changing the method TYPE to GET from POST with same parameters and request data and executed same
Went through integrated scripts as well
Tried for context variations, /one/admin
Looked for XML-RPC
Knowing MySQL, tried few queries on mysql / information_schema, users table, etc. (as part of SQL injection)
Tried /exercise/one/admin as well with several credentials
Tampering the POST request

Exercise#2

The goal was to try dummy username and password in all the forms one by one and finding out the best error message and also explaining why other error messages are not recommended.

Here are my findings:

Messages Observed-

The password you entered for admin is incorrect.
Invalid username / password
Wrong password.
The username doesn’t exist

I put my money on would be on message#2.

While 3 and 4 clearly tell me if particular username I am using is registered with the system or not, which narrows down my target zone. OR

It might also violate privacy as it tells me if a particular user is present/registered on system or not.

Message#1 is basically an incorrect message as it always throws standard message even if a user is not registered. So this, in turn, might confuse the registered user.

(more…)

My new love: Ethical Hacking : Post#1

Hope the post title don’t annoy my wife :p . It shouldn’t I guess, as long as the love is for learning something very good.

The Start:

We all face dilemmas in a day to day life. Sometimes in personal life, sometimes in professional. In the later category, I was facing one from last many months. And worst part being in dilemma is sometimes you either end up doing nothing or you do both the things. What happens then is you end of thinking about two things and end up working on two as well. This delays your achievement, this reduces or rather diverts your focus frequently. Being someone who always ends up getting a lot of new ideas on daily basis regarding new things to learn, try and implement it sometimes becomes very tough to select one and finish it completely.

The dilemma I am talking about was with respect to the choice of new skillset to learn to advance professionally and to make the days count even better. It was between two things which are booming nowadays and probably they are here to stay- Automation and Ethical Hacking/Security Testing. I worked on both of these and have basic or intermediate knowledge of both. Or you can say I am logically clear on both. But to implement the ideas, solve the problems or make your logic work, you also need to have in depth of technical knowledge of the task at hand, you should know how to. And putting my efforts on both things was delaying my expertise on either.

The choice was finally made as I understood my natural inclination towards the unknown. I am curious by birth, like to explore. So Ethical Hacking was definitely my thing. It’s like an endless road, you can go on and on and on. I have just started on it and will try to share my experience here as I progress. Let’s see how it goes.

The pre-requisite:

It is not necessary to be from software and networking background to learn Ethical Hacking I think but it will definitely help. At least it helps me when I read stories of other hackers or incidents and can understand at least 70-80% of those technically. Again the area to test is so vast that even your preparations or pre-requisites differ according to your target. If you are going to test mobile devices, you will have to gain knowledge around that, if you are going to test web applications your preparations shall differ and so on. I will surely update about what exactly to do and from where to start once I reach some level.

If you ask me, I collected basic knowledge around networking, protocols like HTTP and https, Linux, HTML, javascript over years at my Job. That shall help I guess. Apart from that, I follow a lot of hackers on Twitter. Their stories, tweets, and interview are of great information. Reading their experience feels like watching a sci-fi/mystery movie. I love it. And yes, I am also reading The Web Application Hacker’s Handbook as my first book purely into Security Testing.

And yes, one more important thing. Did I mention that you should be having a Mentor? It is always necessary and helps a lot with anything in life. I am not saying you should have one for everything, but there should be someone whom you look up to when you do some good work in some field. It is applicable to life in general as well. I am lucky to have few. And here guess with whose help and guidance I am learning to hack? Santhosh Tuppad. If you don’t know him already(which is rare if you are into the testing world), you should read his bio and know about his work.

(more…)