the-web-application-hackers-handbook

184 Chapter 6 n Attacking Authentication
TRY IT!
http://mdsec.net/auth/172/
Insecure Distribution of Credentials
Many applications employ a process in which credentials for newly created accounts
are distributed to users out-of-band of their normal interaction with the application
(for example, via post, e-mail, or SMS text message). Sometimes, this is done
for reasons motivated by security concerns, such as to provide assurance that
the postal or e-mail address supplied by the user actually belongs to that person.
In some cases, this process can present a security risk. For example, suppose
that the message distributed contains both username and password, there is
no time limit on their use, and there is no requirement for the user to change
the password on first login. It is highly likely that a large number, even the
majority, of application users will not modify their initial credentials and that
the distribution messages will remain in existence for a lengthy period, during
which they may be accessed by an unauthorized party.
Sometimes, what is distributed is not the credentials themselves, but rather
an “account activation” URL, which enables users to set their own initial password.
If the series of these URLs sent to successive users manifests any kind of
sequence, an attacker can identify this by registering multiple users in close succession
and then infer the activation URLs sent to recent and forthcoming users.
A related behavior by some web applications is to allow new users to register
accounts in a seemingly secure manner and then to send a welcome e-mail to
each new user containing his full login credentials. In the worst case, a securityconscious
user who decides to immediately change his possibly compromised
password then receives another e-mail containing the new password “for future
reference.” This behavior is so bizarre and unnecessary that users would be
well advised to stop using web applications that indulge in it.
HACK STEPS
1. Obtain a new account. If you are not required to set all credentials during
registration, determine the means by which the application distributes
credentials to new users.
2. If an account activation URL is used, try to register several new accounts
in close succession, and identify any sequence in the URLs you receive.
If a pattern can be determined, try to predict the activation URLs sent to
recent and forthcoming users, and attempt to use these URLs to take ownership
of their accounts.
3. Try to reuse a single activation URL multiple times, and see if the application
allows this. If not, try locking out the target account before reusing
the URL, and see if it now works.