Page 1 of 1

PAM login system

PostPosted: Tue Sep 16, 2008 6:36 am
by tiduswc
There's a web hacking competition in my university. And one of the question is about guessing the username to put in the textbox. And the only hint is that site uses PAM.

I tried with all kind of SQL injection. But none seems to work. Not even has a SQL error statement. Just usual 'wrong username'.

Searched about PAM and it appears to be unix base system login module. So tried all those passwd, ls, none work as well.

Any clue/hint/idea?

Thank you.

Re: PAM login system

PostPosted: Sun Oct 05, 2008 7:56 pm
by thedotmaster
First check if the "/images/" folder has directory listings enabled. If it does, that's your first step. Then check out the robots.txt file and see if there's anything interesting in there. Run burpsuite and see how it handles the login. Try inputting various special characters - see if it reacts badly to any. Perhaps run nikto as well. See if it stores anything in cookies. That sorta thing. Check .htaccess.
Hope this helps.

Re: PAM login system

PostPosted: Sun Oct 05, 2008 8:14 pm
by myhexhax
Maybe they're using LDAP authentication or something d: Try logging in with your user account, lol. Did you also try default user accounts like root, guest, etc?

Re: PAM login system

PostPosted: Sun Oct 05, 2008 10:41 pm
by Rijnzael
PAM is an authentication module framework for linux. You should look at the site in question and try to determine which pam authentication module they're using for those login credentials, and look for any vulnerabilities in their implementation of it.

Re: PAM login system

PostPosted: Sun Oct 05, 2008 10:42 pm
by Dwere13
I don't know if this wiki page will do any good... http://en.wikipedia.org/wiki/Pluggable_ ... on_Modules
But I googled PAM. Figured that's as good a way as any to start. Let us know how you do, eh?

Edit: I personally, would expect the... most useful information - if any - on the wiki page, to be in the criticisms bit.

Re: PAM login system

PostPosted: Mon Oct 06, 2008 1:37 am
by thedotmaster