Ethical Hacking
Module XIII
Web Based Password Cracking Techniques
Module Objective
HTTP Authentication Basic & Digest
NTLM Authentication
Certificate Based Authentication
Forms Based Authentication
Microsoft Passport
Password Guessing
WebCracker
Brutus
WWWHACK
ObiWan Password Cracker
Basic Authentication
Basic authentication is the most basic form of authentication to web applications.
The authentication credentials are sent clear-text with base64 encryption (can be decoded) and is subject to eavesdropping and replay attacks.
The use of 128 bit SSL encryption can thwart attacks.
Digest Authentication
Digest authentication is based on a challenge-response authentication model.
The user makes a request without authentication credentials and the Web Server replies with a WWW-Authenticate header indicating credentials.
Instead of sending the username and password the server challenges the client with random nonce.
The client responds with the message digest of the username/password.
NTLM Authentication
NTLM Authentication is Microsoft`s proprietary NT LAN Manager authentication algorithm over HTTP. It works on Microsoft Internet Explorer only.
Integrated Windows authentication works the same way as Message Digest authentication.
Certificate Based Authentication
Certificate authentication is stronger than other authentication mechanisms
Certificated authentication uses public0key cryptography and digital certificate to authenticate a user. Certificates can be stored in smart cards for even greater security.
There is no current known attacks against PKI security so far.
Microsoft Passport Authentication
Single signon is the term used to represent a system whereby users need only remember one username and password, and be authenticated for multiple services.
Passport is Microsoft`s universal single sign-in (SSI) platform.
It enables the use of one set of credentials to access any Passport enabled site such as MSN, Hotmail and MSN Messenger.
Microsoft encourages third-party companies to use Passport as a Universal authentication platform.
Forms-Based Authentication
It is highly customizable authentication mechanism that uses a form composed of HTML with

and tags delineating fields for users to input their username/password.
After the data input via HTTP or SSL, it is evaluated by some server-side logic and if the credentials are valid, then a cookie is given to the client to be reused on subsequent visits.
Forms based authentication technique is the popular authentication technique on the internet.
Hacking Tool: WinSSLMiM
http://www.securiteinfo.com/outils/WinSSLMiM.shtml
WinSSLMiM is an HTTPS Man in the Middle attacking tool. It includes FakeCert, a tool to make fake certificates.
It can be used to exploit the Certificate Chain vulnerability in Internet Explorer. The tool works under Windows 9x/2000.
Usage:
  - FakeCert: fc -h
  - WinSSLMiM: wsm -h

Password Guessing
Password guessing attacks can be carried out manually or via automated tools.
Password guessing can be performed against all types of Web Authentication
The common passwords used are: root, administrator, admin, operator, demo, test, webmaster, backup, guest, trial, member, private, beta, [company_name] or [known_username]
Hacking Tool: WebCracker
WebCracker is a simple tool that takes text lists of usernames and passwords and uses them as dictionaries to implement Basic authentication password guessing.
It keys on "HTTP 302 Object Moved" response to indicate successful guess.
It will find all successful guesses given in a username/password.
Hacking Tool: Brutus
http://www.hoobie.net/brutus/
Brutus is a generic password guessing tool that cracks various authentication.
Brutus can perform both dictionary attacks and brute-force attacks where passwords are randomly generated from a given character.
Brutus can crack the following authentication types:
HTTP (Basic authentication, HTML Form/CGI); POP3; FTP; SMB; Telnet
Hacking Tool: ObiWan
http://www.phenoelit.de/obiwan/docu.html
ObiWan is a powerful Web password cracking tool. It can work through a proxy.
ObiWan uses wordlists and alternations of numeric or alpha-numeric characters as possible as passwords.
Since Webservers allow unlimited requests it is a question of time and bandwidth to break into a server system.
Hacking Tool: Munga Bunga
Dictionary Maker
You can download dictionary files from the Internet or generate your own.

Hacking Tool: PassList
Passlist is another character based password generator.
Query String
The query string is the extra bit of data in the URL after the question mark (?) that is used to pass variables.
The query string is used to transfer data between client and server.
Example:
http://www.mail.com/mail.asp?mailbox=sue&company=abc%20com
You can attempt to change Joe`s mailbox by changing the URL to:
http://www.mail.com/mail.asp?mailbox=sue&company=abc%20com
Hacking Tool: cURL
http://curl.haxx.se
cURL is a multi-protocol transfer library.
cURL is a free and easy-to-use client side URL transfer library, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP.
cURL supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading, Kerberos, HTTP form based upload, proxies, cookies, user+password authentication, file transfer resume, http proxy tunneling and more
Cookies
Cookies are popular form of session management.
Cookies are often used to store important fields such as usernames and account numbers.
Cookies can be used to store any data and all the fields can be easily modified using a program like CookieSpy
Hacking Tool: ReadCookies.html
Read cookies stored on the computer. this tool can be used for stealing cookies or cookies hijacking.
Hacking Tool: SnadBoy
http://www.snadboy.com
"Snadboy Revelation" turns back the asterisk in password fields to plain text passwords.
Summary
The "basic" authentication scheme, the simplest method of authentication and one of the most commonly used authentication method sends authentication details in clear.
Digest authentication, never sent across the network user`s credentials in the clear, but transmits as an MD5 digest of the user`s credentials.
NTLM, a Microsoft-proprietary protocol authenticates users and computers based on an authentication challenge and response.
Certificated authentication which uses public key cryptography and digital certificate to authenticate is stronger than other authentication mechanisms.
Forms based Authentication is a system in which unauthenticated requests are redirected to a web form where the unauthenticated users are required to provide their credentials.
Attackers make use of different tools to get better of the authentication protocols.
It is therefore necessary to evaluate the most secure option while designing web applications to counter cracking activities.