InfoSecSpot

The Challenge 1 for Pentester Academy uses GET method for sending over the credentials. So the username and password go like: http://pentesteracademylab.appspot.com/lab/webapp/1?email=admin%40PentesterAcademy.com&password=zzzxx Also one big hint dropped here is that the domain is PentesterAcademy.com. So the email addresses would look like admin@PentesterAcademy.com and jack@PentesterAacademy.com . I reused the code for generating all combinations of x , y and z from my previous blog post aimed at challenge 3. We just need to update the URL with the username and the password while sending the request for each combination. But how do we verify if the credentials have been accepted as valid or rejected? The webpage says “ Failed! Please try again!” if the credentials are rejected. So we can search for the string “Failed” in the response to check if the credentials were accepted. The complete solutions looks as follows: import urllib2 import sys def fun(a)...

Since I am learning python here is a try at solving a Basic Auth Brute Force challenge posted at Pentester Academy: http://pentesteracademylab.appspot.com/lab/webapp/basicauth The challenge is Basic in difficulty level and already provides the usernames: nick or admin. The password is of 5 letters and consists of only a , s and d . So the problem can be divided into two parts: 1. Creating all the password combinations Here is the recursive function that returns a list of all the 5 letter combinations of a , s and d : def fun(a):     chars="asd"     l = len(a)     lenthPerWord = len(a[0])     if lenthPerWord == 5:         return a     c=[]     for i in range(0,l):         for j in chars:                      ...