Exploiting poor credential management#
Let us discuss how hard coded database credentials can be exposed when an attacker gains access to the source code, followed by how credentials stored using weak hashing algorithms can be cracked and viewed in clear text.
Accessing hard coded credentials#
Applications often contain hardcoded credentials to authenticate to other services such as databases. When an attacker gains access to the source code, these hard coded credentials may be found and abused. Let us see an example of how this may be done through a vulnerable web application.
We are going to target Xtreme Vulnerable Web Application (XVWA) for this example. Navigate to OS Command Injection, which is a page vulnerable to command injection. Let us enter the following payload into the text box.
This looks as follows.
Using command injection, we are attempting to read the file config.php from the server. The request intercepted in Burp proxy looks as follows.
Send the request to repeater and trigger the request. We should be able to see the following in the HTTP response returned from the server.
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.105/xvwa/vulnerabilities/cmdi/
Connection: close
Cookie: PHPSESSID=s009kc6a731sos0p23i3gcfiq7
Upgrade-Insecure-Requests: 1
As highlighted, the database credentials are hardcoded in the config file and the credentials are in clear text. An attacker with access to the internal infrastructure may be able to use these credentials to directly connect to the underlying database.
$XVWA_WEBROOT = “”;
$host = “localhost”;
$dbname = ‘xvwa’;
$user = “root”;
$pass = “root”;
$conn = new mysqli($host,$user,$pass,$dbname);
$conn1 = new PDO(“mysql:host=$host;dbname=$dbname”, $user, $pass);
$conn1->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
?>
Credentials hashed using weak algorithms#
Use of weak hashing algorithms such as MD5 to store credentials is another commonly seen practice in applications. Let us discuss how one may be able to gain access to these hashed credentials and perform password cracking to obtain clear text passwords.
Once again, we are going to target Xtreme Vulnerable Web Application (XVWA) for this example. Navigate to SQL Injection, which is a page vulnerable to error based SQL Injection.
Configure a proxy such as Burp, select an Itemcode as shown in the preceding figure and click Submit. The intercepted request should look as follows.
Right click and save the request to a file. In this case, it’s named sqli.txt.
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.105/xvwa/vulnerabilities/sqli/
Content-Type: application/x-www-form-urlencoded
Content-Length: 14
Connection: close
Cookie: PHPSESSID=s009kc6a731sos0p23i3gcfiq7
Upgrade-Insecure-Requests: 1
item=1&search=
One can exploit this SQL Injection vulnerability to retrieve data stored in the database. Let us use SQLMAP and exploit this.
The following command can be used to retrieve the list of databases available by exploiting the parameter item from the request specified in sqli.txt.
If the exploitation is successful, we should see the list of databases as follows.
xvwa appears to be the only user defined database in the list. Let us choose xvwa and retrieve the tables available in it using the following command.
The output should look as follows.
users table looks promising and it may contain sensitive data. So, let us use the following command to extract the columns available in this table.
The following figure shows that there is a column named password.
Since the table seems to have column names of our interest, Let us dump the data from it using the following command.
If successful, we should see the following output from sqlmap.
As we can observe in the preceding figure, the table contains usernames, but the password column does not contain any clear text data. As an attacker we can find out what type of hashes they are and then attempt to crack using a good dictionary. It should be noted that sqlmap can also assist in cracking these hashes using a dictionary, but we will use john the ripper to do it in this article.
The hashes obtained from sqlmap have been saved in a file called hashes.txt as shown below.
To be able to crack these hashes using tools like hashcat or john the ripper, we should know what algorithm is used to generate these hashes. We can identify the algorithm using techniques like length of the hash, but there are tools to assist us too.
xvwa:570992ec4b5ad7a313f5dc8fd0825395
user:25890deab1075e916c06b9e1efc2e25f
Let us launch a tool called hash-identified in Kali Linux and provide a hash as input as shown below.
Hit enter and we should see the following.
As we can observe in the preceding figure, the hash is possibly of type MD5. Using a good dictionary, we can use John the ripper to crack these hashes. The command to run looks as follows.
As we can observe, John the ripper has cracked the passwords and we can view the cracked passwords using –show flag as shown below.‘
This shows how storing credentials using insecure practices can be dangerous. Determined attackers may be able to access these credentials using other vulnerabilities such as SQL Injection and crack them to retrieve a clear text version of it.
Conclusion#
Poor credential management may look harmless until an attacker’s presence is uncovered. Several data breaches show that it is extremely important to manage the credentials of both users as well as applications securely. Developers must be educated to follow secure coding practices and users must be educated to use strong passwords on the internet. In the next few articles, we will discuss some case studies and ways to avoid poor credential management in applications.
Sources#
https://cwe.mitre.org/data/definitions/312.html
https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password
https://owasp.org/www-community/vulnerabilities/Password_Management_Hardcoded_Password
