SKF write-ups
Search…
Introduction
Cross Site Scripting (XSS)
Cross Site Scripting - Attribute (XSS-Attribute)
Cross Site Scripting - href (XSS-href)
Cross Site Scripting - DOM (XSS-DOM)
Cross Site Scripting - DOM-2 (XSS-DOM-2)
CSRF
CSRF - Samesite
CSRF - Weak
XML External Entity (XXE)
File upload
Clickjacking
Ratelimiting (Brute-force login)
HttpOnly Session Hijacking XSS
Exposed docker daemon
SQLI (Union)
SQLI (Like)
SQLI (Blind)
URL Redirection
URL Redirection - Harder
URL Redirection - Harder-2
Formula Injection
Client Side Template Injection (CSTI)
CORS exploitation
Parameter Binding
Local File Inclusion 1 (LFI-1)
Local File Inclusion 2 (LFI-2)
Local File Inclusion 3 (LFI-3)
Remote File Inclusion (RFI)
Content-Security-Policy (CSP)
Session Puzzling
Command Injection (CMD)
Command Injection 2 (CMD-2)
Command Injection 3 (CMD-3)
Command Injection 4 (CMD-4)
Command Injection Blind (CMD-Blind)
Server Side Request Forgery (SSRF)
Server Side Template Injection (SSTI)
Insecure Direct Object References (IDOR)
Deserialisation Yaml (DES-Yaml)
Deserialisation Pickle (DES-Pickle)
Deserialisation Pickle 2 (DES-Pickle-2)
GraphQL DOS
GraphQL IDOR
GraphQL Injections
GraphQL Introspection
GraphQL Mutations
JWT Null
JWT Secret
Race Condition
Race Condition File-Write
DoS Regex
Information Leakeage in Comments
Information Leakeage in Metadata
Auth Bypass
Auth Bypass - 1
Auth Bypass - 2
Auth-bypass - 3
Auth-bypass - Simple
Untrusted Sources (XSSI)
TLS Downgrade
Client Side Restriction Bypass
Client Side Restriction Bypass - Harder
Credentials Guessing
Credentials Guessing - 2
Python - Credentials Guessing - 2
NodeJS - Credentials Guessing - 2
Java - Credentials Guessing - 2
CSS Injection (CSSI)
Prototype Pollution
Right To Left Override (RTLO)
Ldap Injection
Ldap Injection - harder
template item
Powered By GitBook
Java - Credentials Guessing - 2

Running the app Java

First make sure java is installed on your host machine. After installation, we go to the folder of the lab we want to practice. "i.e /skf-labs/XSS, /skf-labs/RFI/" and run the following command:
1
$ ./mvnw spring-boot:run
Copied!
Now that the app is running let's go hacking!

Reconnaissance

It is very common to use very guessable and weak usernames and passwords because they are easier to use and remember. However, this ease for the users becomes a great advantage for potential attackers who are trying to crack the user's credentials. It is pretty easy for them to guess or brute force many different credentials until they get to the right ones.
When we start the application we can see that there is a login form.
If we try with some wrong and random credentials such as: [ admin:admin ], we don`t get access to the inside of the website and an error message is displayed:

Exploitation

Provided that once the username is incorrect it will appear an error message and supossing that once it is correct, this message will not appear, we will use Burp in order to brute force different usernames and discover the right one by analysing the length of the HTTP responses for each trial. We use the "Intruder" functionality and we will load a prefixed dictionary with multiple usernames that will be tried against the website one by one.
If we check the lenght of the different HTTP responses for each of the password that Burp tried, we find that there's one with a different length than the rest of the possibilities:
We found something promising! This must be the desired username.
We can check now sending the HTTP request using this word as the username:
No error messages are now displayed (which means that this username must be correct):
Now, if we follow the same methodology for the password or we simply try the username as the password in the login form, we will get access to the inside of the website:
And goal achieved!

Additional sources

https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)
www.owasp.org
Previous
NodeJS - Credentials Guessing - 2
Next
CSS Injection (CSSI)
Last modified 2mo ago
Export as PDF
Copy link
Edit on GitHub
Contents
Running the app Java
Reconnaissance
Exploitation
Additional sources