{"id":675,"date":"2009-09-27T23:08:24","date_gmt":"2009-09-27T17:38:24","guid":{"rendered":"https:\/\/www.qadit.com\/blog\/?p=675"},"modified":"2009-09-27T23:08:24","modified_gmt":"2009-09-27T17:38:24","slug":"fuzzing-with-webscarab","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/fuzzing-with-webscarab\/","title":{"rendered":"Fuzzing with Webscarab"},"content":{"rendered":"

Let’s say that you have been asked by Abcxyz Inc to test their HR web portal. You decide to use fuzzing to check for easily guessable user IDs and passwords. You have collected a list of possible user names and a password dictionary has also been shortlisted by you.<\/p>\n

 <\/p>\n

<\/p>\n

 <\/p>\n

We will today see how to use Webscarab to facilitate this fuzzing.<\/p>\n

 <\/p>\n

Start webscarab (see Webscarab – A beginner’s guide). Set it as the proxy and visit the HR portal’s login page. Here try to login with any credential. In the summary tag, choose that conversation where the user ID and password was sent to the web application. Right click on the conversation and click on ‘Use as fuzz template’. <\/p>\n

 <\/p>\n

Now, go to the Fuzzer tab of Webscarab which looks like this:<\/p>\n

 <\/p>\n

\"The
The fuzz template<\/figcaption><\/figure>\n

 <\/p>\n

Now, click on the ‘sources’ button to select the lists for user ID & password. Here, give a name to be associated with the list of usernames & passwords and click on ‘browse’ to select the file.<\/p>\n

 <\/p>\n

\"Add
Add source file for passwords<\/figcaption><\/figure>\n

 <\/p>\n

\"Add
Add source file for username<\/figcaption><\/figure>\n

 <\/p>\n

Back in the main webscarab window, in the Fuzz source column, click against username. A dropdown of available fuzz sources will be displayed. Click on the appropriate list. <\/p>\n

 <\/p>\n

\"Set
Set the fuzz sources<\/figcaption><\/figure>\n

 <\/p>\n

Since we are planning to fuzz on 2 fields, we need to set the ‘priority’. The field with the lesser priority number attached to it will be fuzzed first. So, we could choose priority 0 for passwords and priority 1 for usernames. This is a very important step. The number of requests that will be sent to the application is shown on the left above the bottom frame. <\/p>\n

 <\/p>\n

Now, click on the ‘Start’ button. You will see the fuzzed requests being sent and the count of number of request sent being updated. Click on the first fuzzed conversation in the bottom frame of the fuzzer.<\/p>\n

 <\/p>\n

\"The
The first fuzzed request<\/figcaption><\/figure>\n

 <\/p>\n

You can see the credentials passed to the web application. The response can also be seen at the bottom. The response shows that the credentials provided are not correct.<\/p>\n

 <\/p>\n

Click on the ‘next’ conversation. As you keep going through the conversations, you notice that one of them has a different response from the server. The application has logged you in.<\/p>\n

 <\/p>\n

\"Correct
Correct credentials - Logged in<\/figcaption><\/figure>\n

 <\/p>\n

We have seen how to use the fuzzer in Webscarab. You could use the same process to check for SQL injection vulnerabilities and XSS vulnerabilities. <\/p>\n

 <\/p>\n

Searching through the responses generated is also a fairly time consuming process. The search plugin in Webscarab can be used to make this process simpler. That would probably be another blog sometime in the future.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Let’s say that you have been asked by Abcxyz Inc to test their HR web portal. You decide to use fuzzing to check for easily guessable user IDs and passwords. You have collected a list of possible user names and a password dictionary has also been shortlisted by you.  <\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[12],"tags":[79,54,53],"class_list":["post-675","post","type-post","status-publish","format-standard","hentry","category-itsec","tag-fuzzing","tag-web-application-security","tag-webscarab"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9AH7Q-aT","_links":{"self":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/comments?post=675"}],"version-history":[{"count":0,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/675\/revisions"}],"wp:attachment":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/media?parent=675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/categories?post=675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/tags?post=675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}