Ethical Hacking and Penetration Testing Guide

Types of Authentication
Let’s talk about some of the authentication mechanisms and their insecurities before looking at 
brute force attacks. There are three types of HTTP-based authentication schemes used primarily:
HTTP Basic Authentication
HTTP basic authentication is one of the first authentication mechanisms that were introduced. 
It works as follows:
When we send a GET request to the protected resource, the webserver would respond with a 
log-in screen, which would set a “WWW-Authenticate” header also known as the authorization 
header. Our credentials are then sent to the server via the authorization header in the 
base64-
encoded
form. Upon receiving the header, the server would decode the base64 string to plain text 
and compare it with the information stored in the authorization file.
Upon submitting a correct username and password, the client would get access to the protected 
storage, and a “401” “Unauthorized” response from the server if an incorrect username/password 
is submitted.
Now, obviously, the problem with this type of authentication is that an attacker could launch 
a man in the middle attack and easily decode the encoded base64 string containing the username 
and the password.
Let’s try analyzing it in our favorite web proxy called “burp suite.” If you haven’t set up burp 
suite, I would recommend you to see the “Information Gathering Techniques” chapter (Chapter 3), 
where I have explained step by step how to install and run burp suite.
As we can see, a base64 string is being sent to the server, which the server would decode and 
match with the password set in .htaccess in case you are on an apache webserver. Let’s try sending 
the string to burp’s decoder.

---

316
◾ 
Ethical Hacking and Penetration Testing Guide
In the decoder, you would see a drop-down menu, which would ask you for the type of string 
that is submitted as an input. We will select base64.
It would successfully decode the contents of the base64 string, which happen to be 
admin:password in this case, where “admin” is the username and “password” is the password.