DVWA: Brute Force login low

Tutorial bagaimana caranya melakukan brute force attack untuk memperoleh passsword di DVWA dengan low securiry.

Kebutuhan Alat

• Kali Linux
• DVWA x1.9 jalan di mesin yang terpisah

Langkah 1: intelejen

Pekerjaan rumah yang harus di selesaikan:

• apa yang terjadi saat user submit form?
• apakah GET atau POST request?
• kemana request tersebut di kirim?
• bentuk data yang dikirim?

Kita akan menggunakan Burp Suite sebagai proxy.

HTTP request now:
Our browser -> Target server

HTTP request through a proxy:
Our browser -> Proxy server -> Target server

Dengan Burp Suite bekerja sebagai proxy, kita bisa melihat / inspect HTTP request yang terjadi.

Siapkan DVWA

• login ke DVWA
• Klik DVWA Security (di bagian bawah)
• Ubah Security Level > Low
• Klik Submit

Setup Proxy

Masuk ke

Applications > Favorites > burpsuite

Cek proxy running

Klik Proxy (Tap Kiri Atas) > Options

lihat bahwa:

• proxy berjalan di 127.0.0.1:8080
• kondisi running

Setup browser, di Kali Linux kita menggunakan Iceweasel. Pastikan proxy menggunakan burpsuite, caranya,

• Klik kanan pada Iceweasel > aktifkan menu - supaya hidup kita mudah.
• Klik Edit > Preferences > Advanced > Network > Settings
• Pindahkan dari

 use system proxy settings > manual proxy configuration

• Pastikan proxy di set ke burpsuite 127.0.0.1 port 8080

For this to work we need to point our browser to the proxy server, so all requests go through it. So, lets do that. Go ahead and open up Burp Suite.

Click Proxy in the top row of tabs, then select Option. You’ll see the proxy server address.

Kali’s default installed browser is Ice Weasel. Go ahead and open that up, and we’ll point it to our Burp Suite proxy server. In the url bar type about:preferences, this will take you to the settings page. On the left select Advanced, from the tabs on the right select Network. Click Settings and enter the proxy server address.

With our proxy configured, we’re almost good to go. Head to the target page (http://target.site/dvwa/vulnerabilities/brute/) and enable the Burp Suite interceptor. I

Analisa login request

With interceptor enabled, any requests made from our browser will be stopped by the proxy server. Then we can inspect, modify, drop or forward the request.

Without entering any credentials, hit the login button and let’s take a look at the request. You should see this:

There is some key info here:

• Its a GET request
• The login paramaters (username=&password=&Login=Login)
• The cookie (security=low; PHPSESSID=ahs8eugnukjkh9auegathrbfg5)

With all this info, we can recreate the request and use it in our brute force attack.

Step 2, the attack.

Our weapon of choice is THC Hydra. Hydra can perform rapid dictionary attacks against an authentication service.

Hydra has a bunch of options, to learn more about them just type hydra -h in the terminal for more info and examples.

Here’s the info we’re going to providing Hydra for our attack:

target server
URL path
username
password dictionary
cookie
failure message

For the username, we’re going to cheat a bit and assume we know the username is admin. You can also provide Hydra with username dictionary, but for now, we’ll just focus on the password.

The failure message is the response we get from the login form when submit a bad login. It’s just a string that Hydra searches the response HTML for to see if the login succeeded or failed. For instance, the message we get in red under the login form after a bad login attempt is “Username and/or password incorrect.”.

The complete command will look like this:

hydra 192.168.0.11 -l admin -P /usr/share/set/src/fasttrack/wordlist.txt http-get-form “dvwa/vulnerabilities/brute/index.php:username=^USER^&
password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security=Low;PHPSESSID=eogppved743ckngeo0so6tnp87"

In action:

The tutorial for brute forcing on medium and high security will follow soon. If you got stuck or have any questions, leave a comment, I’ll do my best to get back to you.

If you’re ready, move on to the next tutorial for the medium security level.

Happy hacking,

Danny

Referensi

• https://medium.com/@dannybeton/dvwa-brute-force-tutorial-low-security-463880d53e50#.ehax731nt