Password Brute-Force via Password Change

Lab#

Password brute-force via password change · Practitioner

Solution#

Already tired of writing the report :)

In short, nothing complicated here. There's a route POST /my-account/change-password. It has no brute-force protection, and we can swap the username.

There's a nuance: if you set the new password and its confirmation the same, and the current password is wrong, the server responds with a redirect.

If the passwords don't match, then 200 is returned. And if they match — also 200, but the response length will differ.

We set up the attack in Intruder. We use the provided password dictionary.

Body:

username=carlos&current-password={pwd}&new-password-1=123&new-password-2=321

pwd here gets substituted with a password from the dictionary. We launch the attack and sort by response length.

Password — ginger.

Lab solved!