Showing posts with label crytography. Show all posts
Showing posts with label crytography. Show all posts

Understanding HTTP Authentication Basic and Digest

HTTP authentication uses methodologies via which web servers and browsers securily exchanges the credentials like user names and passwords. Http authentication or we can also call it as Digest Authentication follows the predefined methods / standards which use encoding techniques and MD5 cryptographic hashing over HTTP protocol.

In this article we are covering the methodologies/standards used for Http Authentication.

For the sake of understanding we will be using our php scripts that will simply capture user name and passwords and we will generate the Authorization value as per the standards.

For http codes visit here

Basic Access Authentication using Base 64 Encoding

In basic Authentication we will be using base 64 encoding for generating our cryptographic string which contains the information of username and password. Please note we can use any of the encoding techniques like URL, Hexadecimal, or any other we want.

The below example illustrates the concept, we are using Burpsuite for capturing and illustrating the request.


The webpage is asking for input from the client


We are providing "hackingarticles" as User Name and "ignite" as password.

Syntax of basic Authentication
 Value = username:password
Encoded Value =  base64(Value)
Authorization Value = Basic  

In basic authentication username and password are combined into a single string using a colon in between.
Value =  hackingarticles:ignite

This string is then encoded using base 64 encoding.

Encoded Value = base64 encoded value of hackingarticles:ignite which is aGFja2luZ2FydGljbGVzOmlnbml0ZQ==

Finally the Authorization Value is obtained by putting the text "Basic" followed by before the encoded value. (We can capture the request using burpsuite to see the result)


The Authorization Value for this example is "Basic aGFja2luZ2FydGljbGVzOmlnbml0ZQ==" . This is the value which is sent to the server.  

Finally the server is decrypting the authorization value and returning the entered credentials


Basic Authentication is less secure way because here we are only using encoding and the authorization value can be decoded, In order to enhance the security we have other standards discussed further.



RFC 2069 Digest Access Authentication

Digest Access Authentication uses the hashing methodologies to generate the cryptographic result. Here the final value is sent as a response value.
RFC 2069 authentication is now outdated now and RFC2617 which is enhanced version of RFC2069 is being used. 

For the sake of understanding the syntax of RFC 2069 is explained below.

Syntax of RFC2069
Hash1=MD5(username:realm:password)
Hash2=MD5(method:digestURI)
response=MD5(Hash1:nonce:Hash2)

Hash1 contains the MD5 hash value of (username:realm:password) where realm is any string
provided by server and username and passwords are the input provided by client.

Hash2 contains the MD5 hash value of (method:digestURI) where method could be get or post depending on the page request and digestURI is the URL of the page where the request is being sent. 

response is the final string which is being sent to the server  and contains the MD5 hash value of (hash1:nounce:hash2) where hash1 and hash2 are generated above and nonce is an arbitrary string that could be used only one time provided by server to the client.

RFC 2617 Digest Access Authentication

RFC 2617 digest authentication also uses MD5 hashing algorithm but the final hash value is generated with some additional parameters

Syntax of RFC2617
Hash1=MD5(username:realm:password)
Hash2=MD5(method:digestURI)
response=MD5(Hash1:nonce:nonceCount:cnonce:qop:Hash2)

Hash1 contains the MD5 hash value of (username:realm:password) where realm is any string
Provided by server and username and passwords are the input provided by client.

Hash2 contains the MD5 hash value of (method:digestURI) where method could be get or post depending on the page request and digestURI is the URL of the page where the request is being sent. 

response is the final string which is being sent to the server  and contains the MD5 hash value of (Hash1:nonce:nonceCount:cnonce:qop:Hash2) where Hash1 and Hash2 are generated above
and for more details on other parameters refer " https://technet.microsoft.com/en-us/library/cc780170(v=ws.10).aspx"

The actual working of RFC2617 is described below

The webpage is asking for input from the client



We are providing "guest" as User Name and "guest" as password.

Through burpsuite we are capturing the request so that all the parameters could be captured and we can compare the hash values captured with the hash values that we will generate through any other tool (hash calculator in this case).


We have captured the values for the following parameters

realm="Hacking Articles", nonce="58bac26865505", uri="/auth/02-2617.php", opaque="8d8909139750c6bd277cfe1388314f48", qop=auth, nc=00000001, cnonce="72ae56dde9406045" , response="ac8e3ecd76d33dd482783b8a8b67d8c1",

Hash1 Syntax=MD5(username:realm:password)
hash1 =  md5(guest:Hacking Articles:guest)

The MD5 hash value is calculated as 2c6165332ebd26709360786bafd2cd49


Hash2 Syntax =MD5(method:digestURI)
 Hash2=MD5(GET:/auth/02-2617.php)


MD5 hash value is calculated as b6a6df472ee01a9dbccba5f5e6271ca8

response Syntax =  MD5(Hash1:nonce:nonceCount:cnonce:qop:Hash2)
response = MD5(2c6165332ebd26709360786bafd2cd49:58bac26865505:00000001:72ae56dde9406045:auth:b6a6df472ee01a9dbccba5f5e6271ca8)


MD5 hash is calculated as  ac8e3ecd76d33dd482783b8a8b67d8c1

Finally the response value obtained through hash calculator is exactly same as that we have captured with burp suit above. 

Finally the server is decrypting the response value and the following is the result

Beginner Guide to Understand Hashing in Cryptography

Cryptography is conversion of plain readable text into unreadable form. In cryptography first the data is converted into cipher text (that is encryption) and then the cipher text is converted back into readable form (that is decryption). Cryptography basically works on the concept of encryption and decryption. Encryption and decryption should not be confused with encoding and decoding, in which data is converted from one form to another but is not deliberately altered so as to conceal its content. Encryption is achieved through the algorithms. These algorithms are works with logic, mathematic calculations and its complexities.
Hash Function is most important function in Cryptography. A hash means a 1 to 1 relationship between data. This is a common data type in languages, although sometimes it’s called a dictionary. A hash algorithm is a way to take an input and always have the same output, otherwise known as a 1 to 1 function. An ideal hash function is when this same process always yields a unique output. So you can tell someone, here is a file, and here is its md5 hash. If the file has been corrupted during then the md5 hash will be a different value.
In practice, a hash function will always produce a value of the same size, for instance md5 () is will always return 128bits no matter the size of the input. This makes a 1 to 1 relationship impossible. A cryptographic hash function takes extra precautions in making it difficult to produce 2 different inputs with the same output, this is called a collision. It also makes it difficult to reverse the function. Hash functions are used for password storage because if an attacker where to obtain the password's hash then it forces the attacker to break the hash before he can use it to login. To break hashes, attackers will take a word list or an English dictionary and find all of the corresponding hash values and then iterate though the list for each password looking for a match.
md5 (), sha0 and sha1 () are all vulnerable to a hash collision attacks and should never be used for anything security related. Instead any member of the sha-2 family, such as sha-256 should be used.
To calculate Hash Value, we will use Hash Calculator. Install Hash Calculator from --> http://www.slavasoft.com/hashcalc/
Hash function plays major role in hacking/forensic world because it helps us to know whether a particular file has changed or not. You can also calculate hash value of your computer and know if anyone has made any kind of changes.

To calculate hash value open Hash Calculator.


Now browse the file of which you want to calculate the hash value. And click on Calculate.


After clicking on calculate it will give too hash values using four different hashing algorithms i.e MD5, SHA1, RIPEMD160, CRC32. You can check other boxes too if you want to use those algorithms to calculate hash value.
This way Hash calculator helps us to know the hash value. Now if there are any changes made in this file, the hash value will change too.
Once I calculated the hash value above i made some changes in the file and calculated the hash value again with the same method and as a result the hash value was changed.



 Now, we have two hash values. Let us compare both of these values of MD5. The value of first file is 1110808875326e25dl93e4ee096afaf1 and the value of other file is fb9d53883f302d78c978a583e8a85.
Seeing these two values of MD5 of the same file we can conclude that some changes are made. Because even slightest difference will change the hash value.
But now the main question is how to detect this change because a file can be of 1TB too. Also imagine that you are sending a harddisk full of important documents to someone and there is a huge possibility that someone can bribe the sender and make changes in your documents. So how can you detect these changes?
The answer is very simple --> Compare it! This tool helps us achieve our goal which is to detect the change.
Download Compare it! From -->http://www.grigsoft.com/wincmp3.htm
Open Compare it!



Click file and a drop menu will appear. Select compare files option.


A Dialogue box will open which will ask you to choose the files that you want to compare. Click on Browse button and select your file. And click on Open.


It will show you the changes by highlighting them with green color and the red color will tell the exact change as shown below:


So, in such way you can protect your sensitive data and detect the crime done too.