Lab 05 Broken Authentication

Broken authentication

Challenge "Password strength"

One (naive) way to gain entry to a password-protected system is to simply try all possible password combinations, for example by first trying "a", then "b", and so on until you reach "ZZZZZZZZZZ" or something similar. However, since passwords are often not chosen at random, you can speed up this time-consuming process by making more selective guesses. You can easily find lists of varying length containing the most commonly used passwords. By feeding these to a fuzzer, the fuzzer can try each of them for you.

This lab assumes that we (the attacker) knows there is an admin account named admin@juice-sh.op, but doesn't know the password for it.

1. Download the password dictionary to your computer.
2. Start OWASP ZAP.
3. Launch Firefox with ZAP as its proxy by selecting Firefox in the dropdown and then clicking the "Launch Browser" button.
4. Enter your Juice Shop url.
5. Go to the Login page and attempt to login using admin@juice-sh.op as the username and a random non-empty password.
6. Check the History tab in ZAP.
7. Select the most recent HTTP POST request and inspect the request and response.
8. Right click the POST request and choose Attack -> Fuzz.
9. Select the password you entered in the Body and click Add.
10. Click Add and add a File Fuzzer, using the dictionary you downloaded in step 1 as the source.
11. Start the Fuzzer.
12. Check if any of the fuzzed requests generated anything useful.

Questions

• How could this vulnerability be negated in the application?

Recommended reading

• OWASP Top 10-2017:A2 Broken Authentication