the-web-application-hackers-handbook

Chapter 6 n Attacking Authentication 181
Each of these limitations on password validation reduces by an order of
magnitude the number of variations available in the set of possible passwords.
Through experimentation, you can determine whether a password is being
fully validated or whether any limitations are in effect. You can then fine-tune
your automated attacks against the login to remove unnecessary test cases,
thereby massively reducing the number of requests necessary to compromise
user accounts.
HACK STEPS
1. Using an account you control, attempt to log in with variations on your
own password: removing the last character, changing the case of a character,
and removing any special typographical characters. If any of these
attempts is successful, continue experimenting to try to understand what
validation is actually occurring.
2. Feed any results back into your automated password-guessing attacks to
remove superfluous test cases and improve the chances of success.
TRY IT!
http://mdsec.net/auth/293/
Nonunique Usernames
Some applications that support self-registration allow users to specify their
own username and do not enforce a requirement that usernames be unique.
Although this is rare, the authors have encountered more than one application
with this behavior.
This represents a design flaw for two reasons:
n One user who shares a username with another user may also happen to
select the same password as that user, either during registration or in a
subsequent password change. In this eventuality, the application either
rejects the second user’s chosen password or allows two accounts to
have identical credentials. In the first instance, the application’s behavior
effectively discloses to one user the credentials of the other user. In the
second instance, subsequent logins by one of the users result in access to
the other user’s account.
n An attacker may exploit this behavior to carry out a successful brute-force
attack, even though this may not be possible elsewhere due to restrictions
on failed login attempts. An attacker can register a specific username