Unit 1: Encoding, hashing and encryption · Lesson 3 of 5 · 18 min
Credentials hiding in base64
Find Basic authentication headers in a proxy log and work out which accounts are exposed.
mission
- You are
- You are the analyst on shift.
- Situation
- An audit found that the outbound proxy logs the Authorization header. Some internal services still talk plain HTTP.
- Goal
- Find which accounts sent reusable credentials in the clear.
- Hand in
- The exposed account names, so their passwords can be rotated.
HTTP Basic authentication sends user:password encoded in base64. It is only safe inside TLS. Over plain HTTP, anyone on the path can decode it, and so can anyone reading these logs.
Count the auth headers
grep -c Basic proxy.log 7 grep Basic proxy.log | grep -c http:// 7
you should see Every Basic header in this log went over http://.
Group the values
The same credential repeats on every request. Group them so you decode each one once.
grep -oE 'Basic [A-Za-z0-9+/=]+' proxy.log | sort | uniq -c
3 Basic c3ZjX2JhY2t1cDpsYWItb25seS1CNGNrdXA=
4 Basic c3ZjX3JlcG9ydHM6bGFiLW9ubHktUjNwMHJ0cw==
Decode one value
Decode only what you need to identify the account. Write the user name in your report, never the password.
echo c3ZjX3JlcG9ydHM6bGFiLW9ubHktUjNwMHJ0cw== | base64 -d
svc_reports:lab-only-R3p0rts
you should see user:password. The part before the colon is the account.
defender tip Ask for the proxy to drop or redact Authorization headers. Logs are copied to many places and kept for months.
Identify the second account
echo c3ZjX2JhY2t1cDpsYWItb25seS1CNGNrdXA= | base64 -d
svc_backup:lab-only-B4ckup
you should see A second service account. Both passwords need rotating today.
What a defender takes away
- 1Basic auth is encoding, so TLS is the only thing protecting it.
- 2Logs that capture auth headers become a credential store.
- 3Rotate exposed passwords and move services to HTTPS with tokens.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.