In this lesson, we're going to talk
about four types of password and authentication attacks,
Password Spraying, Password Masking Attacks,
Credential Stuffing Attacks, and MFA Fatigue.
Understanding these attacks
will help you both defend against them
and use them ethically during a penetration test.
First, let's look at password spraying attacks.
Password spraying is a technique
where the attacker tries a few common passwords
across many accounts
rather than trying many passwords on a single account.
This method avoids account lockups
and can occur with traditional brute force attacks
because it limits the number of attempts per account.
Imagine trying password 123 on hundreds of accounts
instead of trying a hundred different passwords
on one account.
This attack is more effective in environments
where users often choose common passwords.
A tool commonly used for this purpose is CrackMapExec.
Here's how you might perform a password spraying attack
using CrackMapExec.
First, you need a list of usernames,
which might be stored in a file called users.txt.
This file could be generated from the reconnaissance phase,
where you gather potential usernames
from public sources like LinkedIn.
Next, you choose a common password to test.
Let's say the password is Summer2004!
You would then use CrackMapExec with the command
like crackmapexec smb IP address
u users.txt -p
'Summer2004!'
So, let's break this command down really quick.
The smb specifies the SMB Protocol,
which is used by Windows Systems.
Then, we have the 192.168.1.0/24,
which specifies the IP range.
And then, we have the -u users.txt,
which tells CrackMapExec to use the usernames
listed in users.txt.
And then the -p option,
which is set to 'Summer2004!'
which specifies the password to be tried.
This command will try the password 2024
across all usernames in the users.txt file
on all IP addresses in a specific range.
Next, let's talk about password masking attacks.
Password masking attacks involve creating passwords
that follow specific patterns or rules,
which can be used to guess other passwords.
For example, if you know that a company
requires passwords to have a capital letter, a number,
and special character, you might create a mask
that follows this pattern
and try different combinations within that mask.
Hashcat is a powerful tool that can be used
for password masking attacks.
For instance, if you want to try passwords
that start with a capital letter,
followed by four lowercase letters,
two digits, and a special character,
you could use a command like this,
hashcat -a 3
m 0 hashfile.txt
and then we have the masking format.
In this command, the -a with a 3 option
specifies a mask attack.
The -m 0 specified the hash type.
In this case, it will be a MD5 hash.
And then, the hashfile.txt
is the file contained in the hashed passwords.
And then, we see the ?u?l?l?l
and then and so forth specifies the mask,
which the ?u is for uppercase,
?l is for lowercase, ?d is for digits,
and ?s is for special characters.
This command tries passwords that fit
that specified mask pattern,
making it a focus and quick way to guess passwords
that follow certain rules.
Next, let's look at credential stuffing attacks.
Credential stuffing is a type of attack
where attackers use
previously breached username and password pairs
to gain unauthorized access to account.
This attack takes advantage of the fact
that many people reuse the same credentials
across multiple sites.
If attackers have a list of usernames and passwords
from one breach, they can use tools to try these credentials
on other websites or services.
A tool commonly used for credential stuffing attacks
is Hydra.
Here's how you might perform
a credential stuffing attack using Hydra.
First, you need a list of breached credentials,
which might be stored in a file called credentials.txt
This file could be obtained for very sources of leak data.
Ensure that the credentials are formatted correctly,
typically with each line
containing a username and password pair
separated by a space.
A sample command might look like this,
hydra -L usernames.txt
P passwords.txt
and then, we have http-post-form option.
And then, we have a path in multiple options.
Let's break this down really quick.
So the -L option with usernames.txt
specifies the file containing the usernames.
The -P passwords.txt specifies the files
containing the passwords.
And then, we have the http-post-form option,
and we have a long path here.
So, pretty much we have the login option
with the username set password,
and then we have the :F=incorrect option.
Now, all this does is simply sets the target URL
in the form parameters, where the F=incorrect
indicates a failed login attempt message
to detect unsuccessful logins.
And then, we just have to -V option,
which enables the verbose mode to see more detailed output.
Hydra will then automate the process
of trying each credential pair against the target website,
logging successful attempts.
As the attack progresses,
you can monitor the output for any successful log-ins,
which Hydra will clearly indicate.
This allows you to document which credentials were valid
and access the compromise accounts accordingly.
To protect against credential stuffing,
organizations should implement multi-factor authentication,
monitor for unusual login attempts,
and encourage users to use unique passwords
for different accounts.
Password managers can help users create and store
strong unique passwords.
Finally, let's discuss MFA Fatigue.
Multi-factor Authentication Fatigue occurs
when users become overwhelmed
by frequent authentication prompts,
leading them to make mistakes or take shortcuts
that compromise security.
Attackers can exploit MFA Fatigue
by bombarding users with repeated authentication requests,
hoping that they will eventually approve a malicious request
out of frustration or confusion.
For example, an attacker might repeatedly trigger
authentication requests on a user's device,
and the user receives multiple MFA prompts
within a short period.
After being overwhelmed by the continuous request,
the user might eventually approve one
without verifying its legitimacy.
To defend against MFA Fatigue attacks,
organizations should implement user-friendly MFA solutions
that minimize unnecessary prompts.
Educate users on the importance
of verifying each authentication request
and monitor for unusual authentication patterns
that could indicate an attack.
So remember, password spraying tries common passwords
across many accounts.
Password masking attacks creates passwords
that follow specific patterns.
Credential stuffing use breach credentials
to gain unauthorized access.
And MFA Fatigue exploits users' frustration
with frequent authentication prompts.
Understanding these methods
will help you both defend against and ethically used
these attacks in a penetration test.