使用burpsuite对基础认证进行爆破 2016-12-07 #burpsuite #基础认证 #base64

很多小伙伴不知道怎么使用burpsuite对基础认证进行报错,这次工作中遇到了,刚好写篇文章记录一下,更是为了分享给不知道的小伙伴。

基础认证

有的人可能不知道基础认证是啥，但我相信你一定在实战中遇到过，比如tomcat的manager平台的登录验证：

4023401861

基础认证的数据包跟往常的POST和GET的包认证方式不一样,他的请求包是像下面这样的格式：

GET /manager/html HTTP/1.1
Host: www.xxx.com
Connection: keep-alive
Cache-Control: max-age=0
Authorization: Basic YWRtaW46MTIzNDU2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4,ko;q=0.2
Cookie: JSESSIONID=xxxxxxxxx;

其中Authorization这一行才是认证的重点：

Authorization: Basic YWRtaW46MTIzNDU2

我们可以看到他的数据包是经过加密以后才发送出去的，并且前面有加上Basic字样。

并且加密方式是base64：

1615691261

解密以后的格式是：

账号:密码

这样的认证方式可是难倒了很多人，也有一些人问过我，今天刚好写篇博文科普一下。

用burpsuite爆破

burpsuite简单的爆破如果都不会的话，还是建议看一看官方文档，再来看我这个吧。

首先我们把认证的请求包发送到intruder中，然后设置好要爆破的地方，这里直接把整个base64选中，然后点add $

3373222932

设置payload这里跟平常爆破POST包和get包的有一丁点不一样，payload type选择Custom iterator：

1328176673

Custom iterator翻译成中文就是自定义迭代器，官方文档上有详细的描述，我这里摘抄过来给大家：

Custom Iterator

This payload type lets you configure multiple lists of items, and
generate payloads using all permutations of items in the lists. It
provides a powerful way to generate custom permutations of characters
or other items according to a given template. For example, a payroll
application may identify individuals using a personnel number of the
form AB/12; you may need to iterate through all possible personnel
numbers to obtain the details of all individuals.

The custom iterator defines up to 8 different “positions” which are
used to generate permutations. Each position is configured with a list
of items, and an optional “separator” string, which is inserted
between that position and the next. In the example already mentioned,
positions 1 and 2 would be configured with the items A - Z, positions
3 and 4 with the items 0 - 9, and position 2 would be set with the
separator character /. When the attack is executed, the custom
iterator iterates through each item in each position, to cover all
possible permutations. Hence, in this example, the total number of
payloads is equal to 26 26 10 * 10.

The list items can be edited in the same way as described for the
simple list payload type. The “Clear all” button removes all
configuration from all positions of the custom iterator.

The “Choose a preset scheme” drop-down menu can be used to select a
preconfigured setup for the custom iterator. These can be used for
various standard attacks or modified for customized attacks. Available
schemes are “directory / file . extension”, which can be used to
generate URLs, and “password + digit” which can be used to generate an
extended wordlist for password guessing attacks.