2KKUU7ita

296
Part V: Hacking Applications
Figure 14-10:
The URL
returns a
different
error when
an invalid
password is
entered.
In either case, this is bad news because the application is telling you not only
which parameter is invalid, but also which one is valid. This means that malicious
attackers now know a good username or password — their workload
has been cut in half! If they know the username (which usually is easier to
guess), they can simply write a script to automate the password-cracking
process, and vice versa.
You should also take your login testing to the next level by using a web login
cracking tool, such as Brutus (www.hoobie.net/brutus/index.html), as
shown in Figure 14-11. Brutus is a very simple tool that can be used to crack
both HTTP and form-based authentication mechanisms by using both dictionary
and brute-force attacks.
As with any type of password testing, this can be a long and arduous task, and
you stand the risk of locking out user accounts. Proceed with caution.
An alternative — and better maintained — tool for cracking web passwords
is THC-Hydra (www.thc.org/thc-hydra)