All language subtitles for 6. Password Spraying and Credential Stuffing

Let's talk again about credential stuffing.

And while we're at it we're going to talk about password spring.

Now I realize we talked about this earlier in the course with breach pass and we leak info but I do

think that hammering concept over and over and how important they are does help for information retention.

So again if we look at this example here what is credential stuffing while it's just injecting breech

account credentials in hopes of account takeover.

So if you look at the compromised server here in the upper right hand corner we pull down user names

and credentials and we get these from leaks like the linked link or the Equifax link or whatever those

have come out recently.

We get these leaked credentials and we grab these databases we search through them like we did with

breach pass or like we can with we leak info and we get these stolen credentials and we take these credentials

and we try to pass them to the site log in.

Now we could take a look at a real life example of that which I have pulled up here and again this is

just an example of the Tesla breach pass.

So we have some usernames and passwords.

We have repeat offenders.

Remember we also have similar passwords here.

But the art of credential stuffing is taking these passwords and these usernames and throwing them at

a Web site.

That's all it is.

So we're going to throw them at a Web site and just kind of spray and pray.

Now I just gone ahead and open up this same Tesla dash master I've only opened up the users and the

passwords just for an example of spraying.

This video is going to be in theory only I don't want you attacking Tesla's Web site.

So just take this for example you can follow all the way up until the point that we actually hit attack.

If you want to follow along.

But for this please do not attempt an exploit against Tesla.

You do not know when the criteria is going to change.

And I just don't want you getting in trouble just in case it does.

So from here I'm going to go ahead and go to Firefox and while we are in Firefox what I want to do is

I want to take a quick pit stop and go to Google and I want to look up something called Foxy proxy.

So go ahead and do this.

Look up Foxy proxy like this not Foxy Foxy proxy.

And go ahead and click on this top one here the standard.

And we're just gonna go ahead and install the standard to our Firefox.

And this is going to be a useful tool that we'll be using throughout the course.

So OK we've got Foxy proxy installed.

Now what has happened up on the right hand corner we've got this here.

You see Foxy proxies here and we can say hey options and in the options we're going to add in a proxy

over here on the left and we're just going to call it burp sweep

and then over here we've got proxy types.

We're just gonna leave this at HDP and then we're gonna give it an address which is 1 2 7 0 0 about

1 same thing as before.

And again this is 80 80 while this hit save and then we're going to go ahead and close out and then

all we had to do now is click this and click this.

And now Barb sweets turned on super simple so let's go ahead.

Also to our applications and let's just go up here and open up Herb sweet and let's test out our proxy

and make sure ignore the errors don't worry about those was go ahead and hit next and use for defaults.

And I will give you a second here to catch up.

So I realized that I might be clicking through a little fast so once you have everything set up like

this what we're going to do is we're just going to make sure our proxy works is going to refresh the

page and you can see that it worked so easy on easy off.

That's all we're looking for here.

Instead of having to go in the menu and go to preferences and you know go through that whole process

all we got to do is click a little button.

We could turn it on or off within a couple of clicks.

So from here I'm going to turn the intercept off and we're just gonna go ahead and go to Tesla dot com

and Tesla should look like this when you go to it in the upper right hand corner there is a sign in

button.

Go ahead and click sign in

and again this is just a watch and learn exercise you can follow along up until the point that we fire

the attack.

There will be opportunities here and very very soon videos where you actually get to do this and you

can practice along.

So from here let's turn on the intercept and let's go ahead and just put a fake e-mail this dude test

at test stock com and we'll do tests as the password and hit sign in in that intercept here so you can

see the user equals or e-mail equals test site test dot com and password equals test.

We're going to go ahead and just right click this and say send two intruder and from intruder what we're

going to do is we're going to go to positions in here and then we're gonna clear all those green go

away because it tries to auto select positions for us.

So now what we're going to do is we're just going to highlight this here and we're going to say ad and

then we're going to highlight this here and we're gonna say ad so we're selecting two different parameters.

We're selecting the e-mail parameter and we're selecting the password parameter.

And now we have different attack types up here.

The most common that we're going to use is either sniper but sniper uses one parameter.

So we're actually going to use what is called a pitchfork here and we're going to go ahead and go over

to our payloads and what we're going to do.

All right I'm going to do is I want to take this list of users and I'm just going to copy this and I'm

going to paste it and then on the second one I'm going to take my list of passwords and I'm going to

paste it now what this is doing to go back payloads that one has all the usernames it's going into the

first one we set here payload set to all the passwords.

Those are all going into here and we have 30 total accounts.

Meaning what's happening with this.

This Pitchfork is payload one.

No one is corresponding to payload to number one.

So they only run together.

So this will run the username and password.

These are just the separated users and passwords.

This will run this username against or against this password here.

So what we're going to do is just we started attack and it just says hey this is a demo version of intruder

because you're on community.

Don't worry about that it still runs.

It's just a little slower.

I'm going to go ahead and hit pause on the attack.

Now there are some interesting things that we can look for when we're doing this.

What we're looking for is a status code change of some sort.

Maybe we see two hundreds here and we want like a 3 0 one which means a redirect or we see a significant

change in length.

That would be a good indicator that maybe we had a successful log in other items too is that we can

clicking here and look at the response and we can say OK what did the response say.

If we scroll down maybe it said something in here about failed log in.

OK.

We could not sign you in and we could just take we could not sign you in like this.

Copy this and then we can come back.

We'll close this attack.

We'll come into options here and there's actually a grep feature so we can remove we can clear all these

in this little box McGinnis pace this and say yes match match this here so watch what this does.

So we're going to start this attack again and then I'm going to posit and you can know immediately look

at the checkboxes this means it's showing up in the response it's scrapping it out.

It knows immediately that we didn't sign it successfully.

So this is an example of a credential stuffing attack.

So we're looking for these few different things a status change a significant length like we're seeing

all the same kind of lengths here.

But what if it was like five thousand or two thousand or fifteen thousand if the page length changes

there's a good chance that you signed into something and we have a yes a log in.

Same thing here with this.

If you can find your air code or what it says and then grep on that then you can click up here into

sort by that and you can search for the ones that don't return that and possibly have a log in as well.

So this is the art of credential stuffing.

Now let's say we wanted to close this out.

We want to go back and we want to do password spraying.

Well we're going to go ahead and just clear this out.

And if you remember password spraying is the art of using known user names without a known password.

So we'll just say add here and we would gather a list of all the possible users that we can think of.

We can look at Hunter dot Io we can look at you know the breach password lists we can look at LinkedIn

and gather people who work there come up with this big list and then actually clear sorry.

No this is right.

We'll add these and we'll have all the different users and then for this we'll just change the requests

to like fall of 20 19 or we can set it up to we could set this up here like fall 20 19 exclamation or

whatever the time frame is or however you want or maybe you know they work at Tesla.

So maybe we'll do a Tesla one if they have a week pass or policy or one two three or at sign or pound

you just try a few these.

The only downside to this is you are most likely attacking Active Directory accounts when you're attacking

Active Directory accounts you want to be very careful because you could lock them out without even trying.

So if you're doing a pen test the best idea is to ask before you attack say hey how many attempts do

you have unsuccessfully before I log out happens or a lockout happens because the worst thing you want

to do is fire off 10 cities in a row lockout a bunch of users and closet denial service that is very

very possible and very very easy to do so make sure you're not just firing these willy nilly that you

have a good idea of the password policy the lockout policy etc. that will really help you when you do

these attacks but you just want to do these kind of one or two at a time wait a few hours fire another

one or two at a time and you should be good to go OK.

So same deal here we could fire this and we could to say you know all the say password one two to three

and we'll just switch this to sniper here and if we come to the payloads you could see it just kept

the emails.

There is no payload to anymore.

So what this would do if we had start attack is it would start firing this against this e-mail address

with a password a one two three and then this on this e-mail address with the password of one two three

it would just go down the list and that's all password spring is but the feature that I'm showing you

here between credential stuffing and password spring is by far the most common way that we get in on

external assessments.

Way way more than you're ever gonna see just an exploit out in the wild where you're gonna see this

most likely and second you're probably gonna see something like default credentials.

So if you see a log in page always check default credentials because you never know you're likely not

going to see a exploit out there because the chances are one is that if you see an exploit like that

out there who knows who else is seeing that already.

What kind of bad actors because bad actors are scanning the Internet all the time for these sorts of

things and if they're seeing it then guess what.

You know or if you're seeing it then guess what.

They're probably already seeing it as well.

So that's a bad situation too.

You got to think of protection and clients just think of clients like a house when you talk about the

external of your house your external your doors have really good locks on them.

You might have two locks on your door.

You might have good lighting all this other stuff.

I'd like to try to keep bad guys out.

But on the inside some of your doors probably don't even lock.

And that's really how you can treat an external assessment.

The clients do a really good job of you know buffeting up their external.

But when it comes to the internal it's not usually as good.

So same thing with physical assessments as well.

You just gotta you gotta get inside.

Once you're inside it's kind of easy breezy for the most part so take that lesson away.

If anything you take from the course again at least for the external side take away that enumeration

and information gathering super important because you want to get to the stage here where you are doing

these credentials stuffing attacks and you can use burb suite for it.

This is my favorite go to there's other methods as well but it's so easy just to grab any different

Web site and just you know intercept the proxy send it to intruder make one modification and fire it

off.

So super super simple.

This is something you will come up in an interview as well so make sure you're very aware of it and

make sure you watch this again if you need to understand the concepts.

So from here we're gonna go ahead and take a quick look at our notes in the next video just kind of

where I want you to be with your notes and then we're going to get into what I call that midcourse Capstone

where I'm going to show you a bunch of different hacks and just my thought process and theories and

thinking when I go into a scan and looking at results and just so you can kind of get into the mind

of an attacker and how we think and then we'll start moving on to exploit development.

And my favorite the Active Directory exploitation.

So I look forward to seeing you in the next video.