InfoSecSpot

Challenge 4 from Pentester Academy turned out to be nothing but a combination of two previous challenges. The login form expects POST credentials. But it also pops out a basic authentication login when the user enters the credentials. So let’s break this up into two parts: 1.        Cracking the password for Basic Authentication: We know the response for Basic Authentication is a header the contains Base64 encoded username:password preceded by Basic : Authorization: Basic YWRtaW46bXlwYXNz So we will generate a list of all password combinations and bombard the server with them till we succeed. At the end we will have user/password combination for Basic Authentication. The code for this looks like: import urllib2 import base64 import sys def fun(a):     chars="vie"     l = len(a)     lenthPerWord = len(a[0])     if lenthPerWord == 5:      ...

Since I am learning python here is a try at solving a Basic Auth Brute Force challenge posted at Pentester Academy: http://pentesteracademylab.appspot.com/lab/webapp/basicauth The challenge is Basic in difficulty level and already provides the usernames: nick or admin. The password is of 5 letters and consists of only a , s and d . So the problem can be divided into two parts: 1. Creating all the password combinations Here is the recursive function that returns a list of all the 5 letter combinations of a , s and d : def fun(a):     chars="asd"     l = len(a)     lenthPerWord = len(a[0])     if lenthPerWord == 5:         return a     c=[]     for i in range(0,l):         for j in chars:                      ...