KNOX D3: Burpe

<div dir="ltr" style="text-align: left;" trbidi="on">Mutillidae  is a free, open source, vulnerable web-application providing a target for web-security tester. Mutillidae can be installed on Linux and Windows using LAMP, WAMP, and XAMMP. <br /><br />Username <span class="label">Enumeration</span> :- We have an application that will reveal to us when a username exists on the system which can be used in further step like brute-force account.<br /><br />In Mutilliade login page , when you provide valid username & invalid password , web-application reply us that password incorrect.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhODnoLB1IpysDm27zHrdF9zwsSmdJ9WU6BuISEqeDLmizjoQ3ERm3SgCiWeQEQLGH72tTcflDNual9IJjMdUtBu8gkdxvP858PLE4eDZ675sXYe1ed1LPzlpCsrHQgdXD1AJhT0i20cxTA/s1600/password.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Username Enumeration " border="0" height="98" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhODnoLB1IpysDm27zHrdF9zwsSmdJ9WU6BuISEqeDLmizjoQ3ERm3SgCiWeQEQLGH72tTcflDNual9IJjMdUtBu8gkdxvP858PLE4eDZ675sXYe1ed1LPzlpCsrHQgdXD1AJhT0i20cxTA/s320/password.PNG" title="Username Enumeration " width="320" /></a></div><br /><br />When we provide invalid username ; then application tell us that Account does not exist.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgvH6Ui-h9QI5TETiVHk2V4imglcaCJ3U20F6zm07w9qYD63X2ceprczetX9DpSvCLr70TwJvzbd27vAl9-4IcHslbZdJpBJXs-JFzJygIvBoP6n0IKixedEwqJsigo0J2cDhZSmeDUyck/s1600/Account.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Username Enumeration Mutillidae" border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgvH6Ui-h9QI5TETiVHk2V4imglcaCJ3U20F6zm07w9qYD63X2ceprczetX9DpSvCLr70TwJvzbd27vAl9-4IcHslbZdJpBJXs-JFzJygIvBoP6n0IKixedEwqJsigo0J2cDhZSmeDUyck/s320/Account.PNG" title="Username Enumeration Mutillidae" width="320" /></a></div><br />So by monitoring web-application message one can know that username is valid or not.<br /><br />First we will examine source code of page ; when we provide valid username reply is "var lAuthenticationAttemptResultFlag = 1" & when we provide invalid username reply is "var lAuthenticationAttemptResultFlag = 0"<br /><br />var lAuthenticationAttemptResultFlag = 1    It means username exist.<br /><br />var lAuthenticationAttemptResultFlag = 0    It means username does not exist.<br /><br /><a name="more"></a><br /><br />Alternatively we can do this by saving both page (valid username & invaild username) source code in text file & then use diff command.<br /><br />root@bt:~# diff login password <br />762c762<br />< var lAuthenticationAttemptResultFlag = 0;<br />---<br />> var lAuthenticationAttemptResultFlag = 1;<br /><br />Now Open burpe suite, setup listener ; try to sign in from browser & capture request.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcJ_tUPh_DaOwsvxYKbmO8SvYEPnTsWHXKJaEvZrt_th1daZtohgkTjM7bRNwVjsW5uVGztzGUFy2wRHHUoRH3Jol3wVPDycLWS_ckANLvllXb9EpQtqFJD94isn3PyyXL3sVTKg63NtXT/s1600/captured.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Burpe-Request" border="0" height="270" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcJ_tUPh_DaOwsvxYKbmO8SvYEPnTsWHXKJaEvZrt_th1daZtohgkTjM7bRNwVjsW5uVGztzGUFy2wRHHUoRH3Jol3wVPDycLWS_ckANLvllXb9EpQtqFJD94isn3PyyXL3sVTKg63NtXT/s320/captured.PNG" title="Burpe-Request" width="320" /></a></div><br />Now right click on request & click on send  to inrtuder.<br /><br />For position we choose only username.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhas6MPsBloHPwSj5Ob1fqRbT5Sv455EdtErbLMu5HiBS-oa-Jw0v4wn9V5J-aOvlF0qZJ6aP4sARCb5ZZLA_kL0ba9-nkdw6Bi328oRNYChizh7r23A7xs7gze_knJskYT8awE5XHaYWjp/s1600/Intruder.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Burpe-Intruder" border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhas6MPsBloHPwSj5Ob1fqRbT5Sv455EdtErbLMu5HiBS-oa-Jw0v4wn9V5J-aOvlF0qZJ6aP4sARCb5ZZLA_kL0ba9-nkdw6Bi328oRNYChizh7r23A7xs7gze_knJskYT8awE5XHaYWjp/s320/Intruder.PNG" title="Burpe-Intruder" width="320" /></a></div><br />On payload tab  ---) payload option  ----) load sample <a href="http://pastebin.com/PKxu5HLN" target="_blank">username list</a>.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGQYw75Q8rLxkk7wcq5wiaI2FBpFBt4zalxKNqHyHmDiqAiBjBgT7HAennQRAVGG1PgUqf9uPN2WAjtzD7E1AUuXtuK0x08yMoU1sImoZetPtOGAV9pkowmHw15VJgrupilGgXz8-zbtu-/s1600/payload.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Intruder-Payload" border="0" height="224" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGQYw75Q8rLxkk7wcq5wiaI2FBpFBt4zalxKNqHyHmDiqAiBjBgT7HAennQRAVGG1PgUqf9uPN2WAjtzD7E1AUuXtuK0x08yMoU1sImoZetPtOGAV9pkowmHw15VJgrupilGgXz8-zbtu-/s320/payload.PNG" title="Intruder-Payload" width="320" /></a></div><br />In option tab      ---)    Grep match     ---) Add<br />var lAuthenticationAttemptResultFlag = 1; var lAuthenticationAttemptResultFlag = 0;<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYSliCb9v-57p3t4x5kCecyJsZI0YM0JNsf3JH627Cie_pRL0aw4t0kcR_SlMpS0Ks3j6CMqD4jOYqyA6dIiJbzeMI7FlEMlwRDxOqLON-mRCbCF_yRE7c4ZI2tJjGYhkZ-IFPm5SsL5lR/s1600/grep-match.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Intruder-Option" border="0" height="252" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYSliCb9v-57p3t4x5kCecyJsZI0YM0JNsf3JH627Cie_pRL0aw4t0kcR_SlMpS0Ks3j6CMqD4jOYqyA6dIiJbzeMI7FlEMlwRDxOqLON-mRCbCF_yRE7c4ZI2tJjGYhkZ-IFPm5SsL5lR/s320/grep-match.PNG" title="Intruder-Option" width="320" /></a></div><br />Click on intruder ---) start Attack<br /><br />Now Burpe make request to login page & examine request & classified responce according to option which we provided.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2w8lEWrGseaZCzPrE5D6RqtkMtx-U1ivdmshDRAxCe0lh-TsZN8IEzI9NRfd3HmNPdH9YdKSgLIq_FcJbUTnkikuWpmDHxC3RvDK7y4BnT4Pvwby_8H4QbaounTdVK0pr6FRm5WqXgojj/s1600/attack.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Intruder-Attack" border="0" height="219" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2w8lEWrGseaZCzPrE5D6RqtkMtx-U1ivdmshDRAxCe0lh-TsZN8IEzI9NRfd3HmNPdH9YdKSgLIq_FcJbUTnkikuWpmDHxC3RvDK7y4BnT4Pvwby_8H4QbaounTdVK0pr6FRm5WqXgojj/s320/attack.PNG" title="Intruder-Attack" width="320" /></a></div><br />Click on save , result table & Delimiter click on custom & put ";" ,then select column which we need , in this case i select payload,var lAuthenticationAttemptResultFlag = 1,var lAuthenticationAttemptResultFlag = 0 and then save it.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWU9J2AA73iAB5B-Q2NtyKXD4-pVDD15vRDV7HaP6bq1D9jTpAWaXp6EJH8azj4loh1U9BxHOhiwkuUIirqYtipkqaitB9-tyt92RY0VqNqcKYy3E2TNVcJYe0kHqjmqJmExflZnPWM-Mq/s1600/Saved_Intruder.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Intruder-Result" border="0" height="175" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWU9J2AA73iAB5B-Q2NtyKXD4-pVDD15vRDV7HaP6bq1D9jTpAWaXp6EJH8azj4loh1U9BxHOhiwkuUIirqYtipkqaitB9-tyt92RY0VqNqcKYy3E2TNVcJYe0kHqjmqJmExflZnPWM-Mq/s320/Saved_Intruder.PNG" title="Intruder-Result" width="320" /></a></div><br />Saved file is look like following format.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtxZUl-ThC8mvPL2JY-72rCSXPgXOR6ZiNpswwF3k5-zfgu92o3rGR5Iw-tXGISEs8xHpodSnP6Fi8H7yU7FbmIJje568RprAlNhCeH2XKeXt7FsV2R3ELnfWmKwwYwIssCyGY8N_j1V1k/s1600/response.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Intruder-saved-file" border="0" height="224" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtxZUl-ThC8mvPL2JY-72rCSXPgXOR6ZiNpswwF3k5-zfgu92o3rGR5Iw-tXGISEs8xHpodSnP6Fi8H7yU7FbmIJje568RprAlNhCeH2XKeXt7FsV2R3ELnfWmKwwYwIssCyGY8N_j1V1k/s320/response.PNG" title="Intruder-saved-file" width="320" /></a></div><br />In file first is username ; then true means username exist , false menas username is invalid. So now we only need entry which second column is true.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhl9AP4yWtwvo3MCPcN_1PvzI1vtOkiMTSfe3Y8ve4KqTlCBCELb2fk6dF770a_-Fe4CB2I_Wf7qLfoRoMhboaCFK3JbzxVYqJJjB_iUjExDQuH1ZY_VSxogGmQp1weJfGdiWgrWqQrowSu/s1600/Username.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Possible-Username" border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhl9AP4yWtwvo3MCPcN_1PvzI1vtOkiMTSfe3Y8ve4KqTlCBCELb2fk6dF770a_-Fe4CB2I_Wf7qLfoRoMhboaCFK3JbzxVYqJJjB_iUjExDQuH1ZY_VSxogGmQp1weJfGdiWgrWqQrowSu/s320/Username.PNG" title="Possible-Username" width="320" /></a></div><br />So i saved this value in another temp file from where you can extract username from file using delimiter. I used simple <a href="http://pastebin.com/9m3E11CY" target="_blank">python script</a> for this purpose. <br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLpoU4WTXZegNWMjzmlLZgbL2SyhinxfckPgz7S2lc2Wsgs1OCi5szqtHRJbQwK3hMjFikWKYPvLd6XX0ds8tZujCQziNzQXHksa90Soz5yBwV36AUtg_wIwVZ58gGZwxKK_VR9hPxcKOK/s1600/final-list.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Username List" border="0" height="237" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLpoU4WTXZegNWMjzmlLZgbL2SyhinxfckPgz7S2lc2Wsgs1OCi5szqtHRJbQwK3hMjFikWKYPvLd6XX0ds8tZujCQziNzQXHksa90Soz5yBwV36AUtg_wIwVZ58gGZwxKK_VR9hPxcKOK/s320/final-list.PNG" title="Username List" width="320" /></a></div>Finally we got list of username which exist on system.</div>