Http_Basic_Auth!
Sherlock Scenario
We receive a log indicating a possible attack, can you gather information from the .pcap file?
To connect to the challenge from pwnbox use the command:
xfreerdp /v:<ipaddress> /u:analyst /p:’123’ /cert:ignore /dynamic-resolutionLog file: Desktop/ChallengeFile/webserver.em0.pcap
Note: pcap file found in public resources.
Task 0
How many HTTP GET requests are in pcap?
5
While analyzing the PCAP for the HTTP Basic Authentication challenge, I used the Wireshark filter
http.request.method == “GET”
to identify all HTTP GET requests. This filter displays only packets where the HTTP request method is GET, making it easier to focus on web requests without manually checking every packet. The filter returned 5 requests, so the answer is 5 HTTP GET requests.
Task 1
What is the server operating system?
freebsd
To identify the server operating system, I used the Wireshark filter
http.server
This displays the Server header from HTTP responses, which can provide information about the web server software and, in some cases, the underlying operating system.
Task 2
What is the name and version of the web server software?
apache/2.2.15
To identify the web server software and version, I used the Wireshark filter
http.server
The HTTP response showed the Server header as Apache/2.2.15, revealing both the software name and version.
Task 3
Get Yufan Limbu’s stories in your inbox
Join Medium for free to get updates from this writer.
What is the version of OpenSSL running on the server?
openssl/0.9.8n
I used the Wireshark filter
http.server
to inspect the HTTP server information. The response revealed the OpenSSL version as OpenSSL/0.9.8n.
Task 4
What is the client’s user-agent information?
lynx/2.8.7rel.1 libwww-fm/2.14 ssl-mm/1.4.1 openssl/0.9.8n
To find the client’s user-agent information, I used the Wireshark filter
http.user_agent
This filter displays the User-Agent header sent by the client in an HTTP request. The captured traffic showed that the client was using the Lynx 2.8.7rel.1 web browser, along with libwww-fm/2.14, ssl-mm/1.4.1, and OpenSSL/0.9.8n. This information helps identify the client software and its version
Task 5
What is the username used for Basic Authentication?
webadmin
To identify the username used for HTTP Basic Authentication, I inspected the Authorization header using the Wireshark filter http.authorization. The captured header was:
Authorization: Basic d2ViYWRtaW46VzNiNERtMW4=
The value following Basic is Base64-encoded. After decoding it, the credentials are webadmin:W3b4Dm1n, where webadmin is the username and W3b4Dm1n is the password. The Authorization: Basic header is used to transmit the client's authentication credentials to the web server in Base64-encoded form.
Task 6
What is the user password used for Basic Authentication?
W3b4Dm1n
To identify the password used for Basic Authentication, I inspected the
Authorization header using the Wireshark filter http.authorization. The captured value was
Authorization: Basic d2ViYWRtaW46VzNiNERtMW4=
After Base64 decoding the value, the credentials were revealed as webadmin:W3b4Dm1n , where W3b4Dm1n is the password.
