Brute forcing HTTP basic authentication
Basic authentication is a type of access control mostly used in internal environments to restrict access to restricted areas in a website. It has a lot of weaknesses, including the following:
- The basic authentication sends the information in plain text. This means that a malicious user can intercept the information sent by the client to the server and extract the credentials.
- The password is protected by a Base64 encoding. It does not mean that the password is encrypted; anyone can get the plain password using a decoder, like the one included in Burp Suite, as shown in the following screenshot:
- The credentials are cached by the web browser.
- The credentials are stored in the web browser, and they are sent in each request. Growing the probability to be stolen by a malicious user using a men in the middle (MITM) attack.
Despite all of these security issues, the basic authentication is still commonly used. For example, a lot of network devices use it as access...
