the-web-application-hackers-handbook

Chapter 6 n Attacking Authentication 161
contexts where an application’s user base is small, such as web-based VPNs for
remote office workers.
The HTTP-based authentication mechanisms (basic, digest, and Windowsintegrated)
are rarely used on the Internet. They are much more commonly
encountered in intranet environments where an organization’s internal users
gain access to corporate applications by supplying their normal network or
domain credentials. The application then processes these credentials using one
of these technologies.
Third-party authentication services such as Microsoft Passport are occasionally
encountered, but at the present time they have not been adopted on any
significant scale.
Most of the vulnerabilities and attacks that arise in relation to authentication
can be applied to any of the technologies mentioned. Because of the overwhelming
dominance of HTML forms-based authentication, we will describe each
specific vulnerability and attack in that context. Where relevant, we will point
out any specific differences and attack methodologies that are relevant to the
other available technologies.
Design Flaws in Authentication Mechanisms
Authentication functionality is subject to more design weaknesses than any
other security mechanism commonly employed in web applications. Even
in the apparently simple, standard model where an application authenticates
users based on their username and password, shortcomings in the design of
this model can leave the application highly vulnerable to unauthorized access.
Bad Passwords
Many web applications employ no or minimal controls over the quality of users’
passwords. It is common to encounter applications that allow passwords that are:
n Very short or blank
n Common dictionary words or names
n The same as the username
n Still set to a default value
Figure 6-1 shows an example of weak password quality rules. End users typically
display little awareness of security issues. Hence, it is highly likely that
an application that does not enforce strong password standards will contain a
large number of user accounts with weak passwords set. An attacker can easily
guess these account passwords, granting him or her unauthorized access to the
application.