the-web-application-hackers-handbook

Chapter 6 n Attacking Authentication 169
details (for example, checking whether the account is expired), and then validate
the password (which may involve a resource-intensive hash algorithm) before
returning a generic message if the password is incorrect. The timing difference
between the two responses may be too subtle to detect when working with only
a browser, but an automated tool may be able to discriminate between them.
Even if the results of such an exercise contain a large ratio of false positives, it
is still better to have a list of 100 usernames, approximately 50% of which are
valid, than a list of 10,000 usernames, approximately 0.5% of which are valid.
See Chapter 15 for a detailed explanation of how to detect and exploit this type
of timing difference to extract information from the application.
TIP In addition to the login functionality itself, there may be other sources of
information where you can obtain valid usernames. Review all the source code
comments discovered during application mapping (see Chapter 4) to identify
any apparent usernames. Any e-mail addresses of developers or other personnel
within the organization may be valid usernames, either in full or just the userspecific
prefix. Any accessible logging functionality may disclose usernames.
TRY IT!
http://mdsec.net/auth/53/
http://mdsec.net/auth/59/
http://mdsec.net/auth/70/
http://mdsec.net/auth/81/
http://mdsec.net/auth/167/
Vulnerable Transmission of Credentials
If an application uses an unencrypted HTTP connection to transmit login credentials,
an eavesdropper who is suitably positioned on the network can, of
course, intercept them. Depending on the user’s location, potential eavesdroppers
may reside:
n On the user’s local network
n Within the user’s IT department
n Within the user’s ISP
n On the Internet backbone
n Within the ISP hosting the application
n Within the IT department managing the application