the-web-application-hackers-handbook

176 Chapter 6 n Attacking Authentication
“Remember Me” Functionality
Applications often implement “remember me” functions as a convenience to
users. This way, users don’t need to reenter their username and password each
time they use the application from a specific computer. These functions are
often insecure by design and leave the user exposed to attack both locally and
by users on other computers:
n Some “remember me” functions are implemented using a simple persistent
cookie, such as RememberUser=daf (see Figure 6-6). When this
cookie is submitted to the initial application page, the application trusts
the cookie to authenticate the user, and it creates an application session
for that person, bypassing the login. An attacker can use a list of common
or enumerated usernames to gain full access to the application without
any authentication.
Figure 6-6: A vulnerable “remember me” function, which automatically logs in a
user based solely on a username stored in a cookie