AuthTrans (original tool) + BurpSuite's violent aesthetics-cracking Http Basic Authentication

In front of this article: I am a cainiao and I like it very much. I encountered the following problems when I tried to use BurpSuite to crack the http basic Authentication:

The Basic value of Authorization is Base64 encrypted, and the value is username: password (note ":") after base64 encryption, but I have no such dictionary at hand, based on my limited understanding of BurpSuite (BP), BP's decoder cannot completely solve this problem.

A dictionary, which can be converted to base64 by setting encode.

The B format is a collection of user and pass dictionaries. The two encode, respectively. Is the effect of this splicing the same as that of A? After experiment, I think too much. For the solution to the problem, there must be a better solution. We look forward to communicating with you.
The focus here is to generate a dictionary composed of user: pass. Since the Basic value is base64 encrypted, it is better to generate a result dictionary after base64_encode (user: pass, this is a function implemented by AuthTrans (written in Ruby.
Functional interface: (Chinese English, please forgive me .....)

The current Code is the password (pass.txt), user name (user.txt), and user: Password (user-pass.txt), which can be converted to user: pass dictionary through AuthTrans.
The options are as follows:

A: user.txtand pass.txt generate A base64-encrypted user-pass dictionary for traversal.

B: load the user: pass dictionary and output the base64 encrypted user-pass dictionary.

C: enter a user name and use pass.txt.

D: enter a password and upload user.txt

The directory structure of the demo environment is as follows:

Select the running result of option C, and the output folder is the automatically created output directory.

File output location, which can be easily identified by naming rules.

The generated rootuser name and the root-pass dictionary after pass.txt Traversal

Now return to BP and load the generated dictionary. After a round of traversal, all are 401. Depressed. Check the package.



In the past, our value was encoded by BurpSuite to the URL. Locate the problem and cancel the automatic encoding.

Run again. There are 200, but it is too tired to search manually.

Learning to use filters can save a lot of time.



In fact, the filter can also be written as 200, but this is the conclusion after we know the returned results of the correct results. In practice, you do not know what the correct returned page is, but you can know the characteristics of the error page. Therefore, we use reverse selection to make it more practical.
Select negative (reverse selection), match items, and enter the features on the error page.
I feel that the choice of filter is a great learning. I can write a long article.
Welcome to the discussion.
2013-02-21 19:46:30
Plusman