In this video, we're going to talk
about authentication bypass.
Authentication bypasses happen when
there is some configuration or a logical flaw
in your code that allows for an attacker
to simply bypass your authentication methods.
Historically, this has been some big players in
the industry and it is an easy mistake to make,
and that's why so many people make
those kinds of mistakes.
Typically, these mistakes are
rooted in writing your own authentication,
your own authorization functionality.
Much like crypto authentication and
authorization functionality is something that is
best inherited from another source that focuses on
authentication and authorization rather
than writing our own from scratch,
because there is many pitfalls in that.
So this is an interesting case.
So this lesson actually gives you
an example of a PayPal two-factor authentication bypass.
Essentially, the bypass works as
such you go on to fill out your security questions.
When you go to your security questions,
you simply remove the security questions
that are being sent to the endpoint.
By doing so, you full the back end to
essentially bypass the logic
that would verify your security questions.
Now, that's a pretty big mistakes you
make especially for someone like PayPal.
This example is not as severe.
So we'll poke through
it and see what the traffic looks like,
and then we'll end the video and let you try it for
yourself and we'll come back and solve
it in another video. All right.
So I am using my Firefox instance,
and I do have my trusty burp going.
Like I said, it's pretty noisy and
there's a lot of traffic in it.
So I'll go ahead and submit my favorite teacher.
I'm just going to say testing or test1 and test2,
for what street I grew up on.
I'm going to submit that.
Looking at our burp,
the last post them we made,
we can see that security question test1
and security question test2.
So the question becomes,
how can I go about resetting
my password without removing these?
Because the test tells us it's
not as simple as above method,
is just a variation of it.
This is something that's pretty common
and it happens all the time.
So we can just right-click on this body and send it to
our repeater, and the question becomes,
what can you do to
modify this so that it passes our vulnerability?
Go and give it a try, and we'll come back
and discuss that in another video.