# Broken Authentication with bWAPP

## URL  - [`http://192.168.31.112:8086`](http://192.168.31.112:8086)

Let's exploit this vulnerability in practical.

* Kindly Open **bWaPP**
* **Click on Install**
* Type the Username and Password as "bee" and "bug" respectively
*

**Click on Broken Auth**. - Insecure Login Forms and then "**Hack"**

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWptzs7WTKzvZohM4MQ%2F-LWpuy9oE8rYWDS0W8-B%2F1B7BF49A-4D49-4995-8CB7-26250BFC6FDA.png?alt=media\&token=b00476e3-c9bb-4f67-9bca-80500b14ee86)

![Broken Auth. – Insecure Login Forms](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQx6zChodVVZzM-KH%2Fbroken-auth.-insecure-login-forms.jpg?generation=1547571289211848\&alt=media)

**Read through the code and see if you can find something interesting**

![Credentials in Code](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQx70DsTQFByDkYhs%2Fcredentials-in-code.png?generation=1547571288888141\&alt=media)

So, when you view the page source (right click on page and select view page source), you should see the user credentials stored in the HTML. 

This allows hackers to gain authentication with ease, anyway this won’t be the case in real time, you may see this rarely. In general we sift through the HTML comments and hidden fields, I would say that’s a good practice

![Insecure Login](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQx72GOQIKrFtU5IN%2Finsecure-login.jpg?generation=1547571289462239\&alt=media)

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*Challenge Completed\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

Now we will see another code level flaw, select `Session Mgmt. – Administrative Portals` and set security level to `low`. 

<div align="left"><img src="https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWptzs7WTKzvZohM4MQ%2F-LWpw6jyPojosGG_lx54%2F43D5EAF4-214A-425D-AE34-43CB27C4083A.png?alt=media&#x26;token=be6c95e2-d0f4-42c4-98de-70eb00ccb42e" alt=""></div>

If you notice the URL `/bWAPP/smgmt_admin_portal.php?admin=0`, there’s a string appended after the `?` with a value `0`, which means the session ID was passed in the query string where anyone could see and manipulate the values.&#x20;

Let’s change the value from `0` to `1`.

If your URL is not the same, Kindly go to  <http://192.168.31.112:8086/smgmt_admin_portal.php?admin=1>