Authentication Testing - Testing for Brute Force

The topic of brute forcing has always interested me due to its simplicity.  The whole idea is that you have an enumerated set of "candidates" or options and then through simple trial and error see which of these candidates will solve the situation. So, let's say a hacker is trying to retrieve the username and password for the administrator's panel of a website.  Using bruteforcing tools, he or she can automatically try out all the credential candidates. If the candidate list is somewhat accurate, the hacker can get the correct username and password in a certain period of time.

There are different bruteforcing techniques in existence and a specific technique must be used depending on the "authentication method used by the application" (131).   The two most common authentication methods used by apps are HTTP Authentication and HTML Form-based Authentication.  Within HTTP Authentication, there are two sub methods which are called Basic Access Authentication and Digest Access Authentication.

With the Basic method, the client first sends a request (going to the protected site area via a browser). Then the server sends a response stating that the location is a protected and sends the client a HTTP 401 Authorization. 

The 401 Authorization response has the following header.

HTTP/1.1 401 Authorization Required
Date: Sat, 04 Nov 2006 12:52:40 GMT
WWW-Authenticate: Basic realm="User Realm" Content-Length: 401
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

 The "User Realm" is the protected area and the line also contains the word Basic which tells the potential hacker the type of authentication used.

The 401 Authorization response also opens a username and password window.  The username, colon, and password is base64 encoded and then sent to the server.  If the credentials are right, then the client has access to the web site.   The main problem with this method is that if an attacker gets a hold of that encoded string, he or she can easily decode it to reveal the username and password. This is the primary reason for the existence of the Digest method.  With Digest,  the password is hashed through MD5. The username is sent to the server in plaintext form.   

Although digest is relatively safe, a lot of web apps uses the html form-based authentication method.  Basically, this means the login process is done trough an HTML form.

Now it's time to talk about the different kinds of bruteforcing attacks. The first one is called a dictionary attack.  In this attack, a bruteforcing program uses a file containing possible usernames and passwords to repetivitly attempt to login to the app. The more detailed and concise the dictionary, the faster a sucessful login will take place. In search attacks,  the program attempts all possible combination of a given "character set and givven password range".  Lastly, in a rule-based search attack, the program uses certain rules to generate good login/password "candidates". For example, if we know the password is 5 characters, and the last three characters are "cat", can setup a rule that tries every possible combination of letters and numbers to get the full password.

Some tools used for bruteforcing:  John The Ripper, Brutus, THC Hydra