the-web-application-hackers-handbook

186 Chapter 6 n Attacking Authentication
are made, in which many potential errors may arise and be handled in different
places, and where the more complicated validation logic may involve maintaining
significant state about the login’s progress.
HACK STEPS
1. Perform a complete, valid login using an account you control. Record
every piece of data submitted to the application, and every response
received, using your intercepting proxy.
2. Repeat the login process numerous times, modifying pieces of the data
submitted in unexpected ways. For example, for each request parameter
or cookie sent by the client, do the following:
a. Submit an empty string as the value.
b. Remove the name/value pair altogether.
c. Submit very long and very short values.
d. Submit strings instead of numbers and vice versa.
e. Submit the same item multiple times, with the same and different
values.
3. For each malformed request submitted, review closely the application’s
response to identify any divergences from the base case.
4. Feed these observations back into framing your test cases. When one
modification causes a change in behavior, try to combine this with other
changes to push the application’s logic to its limits.
TRY IT!
http://mdsec.net/auth/300/
Defects in Multistage Login Mechanisms
Some applications use elaborate login mechanisms involving multiple stages,
such as the following:
n Entry of a username and password
n A challenge for specific digits from a PIN or a memorable word
n The submission of a value displayed on a changing physical token
Multistage login mechanisms are designed to provide enhanced security over
the simple model based on username and password. Typically, the first stage
requires the users to identify themselves with a username or similar item, and
subsequent stages perform various authentication checks. Such mechanisms