the-web-application-hackers-handbook

160 Chapter 6 n Attacking Authentication
Many of the most common authentication vulnerabilities are no-brainers.
Anyone can type dictionary words into a login form in an attempt to guess
valid passwords. In other cases, subtle defects may lurk deep within the application’s
processing that can be uncovered and exploited only after painstaking
analysis of a complex multistage login mechanism. We will describe the full
spectrum of these attacks, including techniques that have succeeded in breaking
the authentication of some of the most security-critical and robustly defended
web applications on the planet.
Authentication Technologies
A wide range of technologies are available to web application developers when
implementing authentication mechanisms:
n HTML forms-based authentication
n Multifactor mechanisms, such as those combining passwords and physical
tokens
n Client SSL certificates and/or smartcards
n HTTP basic and digest authentication
n Windows-integrated authentication using NTLM or Kerberos
n Authentication services
By far the most common authentication mechanism employed by web applications
uses HTML forms to capture a username and password and submit these
to the application. This mechanism accounts for well over 90% of applications
you are likely to encounter on the Internet.
In more security-critical Internet applications, such as online banking, this
basic mechanism is often expanded into multiple stages, requiring the user to
submit additional credentials, such as a PIN or selected characters from a secret
word. HTML forms are still typically used to capture relevant data.
In the most security-critical applications, such as private banking for high-worth
individuals, it is common to encounter multifactor mechanisms using physical
tokens. These tokens typically produce a stream of one-time passcodes or perform
a challenge-response function based on input specified by the application.
As the cost of this technology falls over time, it is likely that more applications
will employ this kind of mechanism. However, many of these solutions do not
actually address the threats for which they were devised — primarily phishing
attacks and those employing client-side Trojans.
Some web applications employ client-side SSL certificates or cryptographic
mechanisms implemented within smartcards. Because of the overhead of administering
and distributing these items, they are typically used only in security-critical