Hi everyone,
Today I want to look at methodology when attacking web login portals. I see many posts about various vulnerabilities in programs, but very few people talk about this topic. Of course, there is some sense behind this, as without valid credentials, there is little functionality to exploit. For this reason, these portals are often not well secured.
There are some vulnerabilities/misconceptions that will earn you some nice bug bounties and discoveries during the engagement, such as:
- Default Credentials
- Username Enumeration
- Weak Lock-Out mechanism
So, let’s deep dive into each one of them and see how this can earn you some money.
1. Default Credentials
Misconfiguration with default credentials can be seen everywhere and is a vulnerability that is usually rated high or critical depending on the access you are given. The methodology behind this is very simple – first, you need to find the default credentials for the application you are testing. Then find all the login portals where you can use those credentials.
Because I already have a topic on this, I will not go into too much depth and will instead give you potential reads to show you that this really works:
- Critical Vulnerability Through OSINT only (by me): https://medium.com/@mares.viktor/critical-vulnerability-through-osint-only-56e56eb97516
- $350 DVR default username and password: https://hackerone.com/reports/398797
- Default Admin Username and Password: https://hackerone.com/reports/1195325
There are many other reports that have been disclosed on the topic, however, I think those are enough to get you started. Let’s move on to the next one
2. Username Enumeration
The idea here is to verify whether it is possible to collect a set of valid usernames by interacting with the application’s authentication mechanism.
The methodology is to first try to log in with an invalid email or reset your password and then try a potentially valid email (find email via OSINT or register an account) and see the response from the website.
This is how a vulnerable page will look:
- Use an incorrect email (e.g. [email protected]) and check the response
2. Use a valid email and check the response
As you can see from the above example, the password reset allows us to enumerate users. If you are doubting whether this is impactful, please see some reports:
- $100 Email enumeration at SignUp page: https://hackerone.com/reports/666722
- User enumeration through forgot password: https://hackerone.com/reports/1166054
- Username Enumeration: https://hackerone.com/reports/667613
Now, let’s move on to a bit of a more interesting attack.
3. Weak Lock Out mechanism
What is it?
Account lockout mechanisms are used to mitigate password hashing or brute force attacks. Accounts are typically locked after 3 to 5 unsuccessful login attempts and can only be unlocked after a predetermined period of time, through self-service unlock mechanisms or intervention by administrators.
How to test for it?
I have a really simple methodology, that goes as follows:
- Find valid usernames & passwords (through breach databases)
- Try enumerating existing usernames (if possible)
- Try a brute force attack
- Try a credential-stuffing & password-spraying attack
So, let’s start looking into each one of these and see how you can do all of this as well.
Finding Valid Usernames & Passwords
- [FREE] Use the Breach Parse to find plaintext credentials — https://github.com/hmaverickadams/breach-parse
- [BEST] Use Leak Peek, to find the latest plaintext credentials (for a subdomain) — https://leakpeek.com/
- Same as Leak Peek, but a bit more expensive — https://www.dehashed.com/
All of the above resources work in the same way. Let’s say that you are attacking example.com and you have a login portal at example.com/login. You can try enumerating all of the emails of the domain @example.com that have been breached in the past.
Please, ensure that you are only using the data that you collect for ethical hacking purposes and that your bug bounty program or penetration testing engagement allows this attack vector
Also note that you can search by username, email, password, etc.
Enumerating Usernames
This has already been explained in point 2 (username enumeration) – the idea is to check to see if the emails/usernames you collect are valid. Though it may not always be possible and we may have to go with the attack anyway.
Starting a Brute Force Attack
I would only do this, if I am sure that the web application allows this.
Below is an example, that shows the web application will disable our login if we try guessing the password more than 3 times.
However, if I see that the password is not being disabled, I would usually attack each email/username with my own wordlist:
https://github.com/ViktorMares/rockyou_strong_passwords
Of course, if you are unsure of the password requirements, then you can just use the normal rockyou.txt wordlist: https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
Credential Stuffing & Password Spraying
Finally, we get to the most successful attacks, which are the Credential Stuffing & Password Spraying attacks.
What is Credential Stuffing? Remember, how can we use Breach Parse or Leak Peek to obtain valid plaintext credentials (username and password) of our targets? Well, credential stuffing is the process of using all those credentials against a login portal.
What is password spraying? Well, password hashing is a bit different. The idea here is to use all those collected emails or usernames and attack them all with a single password. Let’s say we have collected 50 emails from a company. Then we find a login portal and attack each of these emails with a known-bad password (such as P@ssw0rd or Summer2022! and others).
Below is a really good video on this, by The Cyber Mentor (from TCM Academy) who basically explains & shows the whole concept of this attack.
Credential Stuffing & Password Spraying: https://youtu.be/sH4JCwjybGs?t=11222
And here are some reports that may help you in understanding these attacks more:
- $100 [dubsmash] Username and password bruteforce: https://hackerone.com/reports/1165225
- $420 Ability to brute force mopub account’s password due to lack of rate limitation protection using {ip rotation techniques}: https://hackerone.com/reports/819930
Hopefully, I was able to show you something interesting and useful for your future engagements in bug bounty programs & penetration tests.
Thank you for making it so far into the story and if you really enjoyed reading it, please consider supporting me by getting an affiliate medium membership: https://medium.com/@mares.viktor/membership
