In the past I had written a quick blog post on password spraying Dell SonicWALL Virtual Office. While it wasn’t all that exciting of a post, a number of people did find it useful and having a blog for it helped people find it more easily than only being in a random Github repo or tweet.
This post is about RapidIndentity. This can be used for Single Sign On (SSO). From testing I’ve found two different types of portals. The older one seems to be pretty basic, and the logon takes the username and password in regular POST parameters.
There isn’t too much special about this, and you can spray it using the methods I described in my post How to Burp Good (password spraying). You just need to set a grep extract for:
Start after expression: -message”>
End at delimiter: </div>
What’s more interesting though is a newer logon portal I found. This one requires three separate steps to login, and is more resistant to a typical HTTP based brute force.
Note: The login portal can (and will likely be) styled with custom CSS. It may not look exactly like the examples above.
The three requests needed are as follows:
- A GET request to the authentication API. This returns a unique ID value.
- A POST request containing the username and the previously provided ID value.
- A second POST request with the password and the previously provided ID value.
This can vary, as there are many policies for authentication. Review the API documentation and tweak as needed. If in doubt, run a login through Burp and see how it matches up.
Unfortunately we cannot use the method provided within How to Burp Good (CSRF Tokens) because Burp doesn’t handle JSON that well (at least within macros) and can’t extract the ID number and place it in subsequent requests. While this may have still be possible in Burp with extensions, I opted to create a Python script to spray these endpoints. Here is the full code:
Also on Github here: https://github.com/n00py/RapidIdentity_spray
The script requires the endpoint, a username list, and a password list. It sprays all usernames with a single password once per hour to avoid lockouts.