Pentester Academy Challenge 4 via Python
Challenge 4 from Pentester Academy turned out to be nothing but a combination of two previous challenges. The login form expects POST credentials. But it also pops out a basic authentication login when the user enters the credentials. So let’s break this up into two parts: 1. Cracking the password for Basic Authentication: We know the response for Basic Authentication is a header the contains Base64 encoded username:password preceded by Basic : Authorization: Basic YWRtaW46bXlwYXNz So we will generate a list of all password combinations and bombard the server with them till we succeed. At the end we will have user/password combination for Basic Authentication. The code for this looks like: import urllib2 import base64 import sys def fun(a): chars="vie" l = len(a) lenthPerWord = len(a[0]) if lenthPerWord == 5: return a c=[] for i in range(0,l): for j in chars: c.appe