the-web-application-hackers-handbook

202 Chapter 6 n Attacking Authentication
made and to help you spot the subtle logic flaw that can be exploited to walk
right through the door.
The most important lesson when attacking authentication functionality is to
look everywhere. In addition to the main login form, there may be functions to
register new accounts, change passwords, remember passwords, recover forgotten
passwords, and impersonate other users. Each of these presents a rich target of
potential defects, and problems that have been consciously eliminated within
one function often reemerge within others. Invest the time to scrutinize and
probe every inch of attack surface you can find, and your rewards may be great.
Questions
Answers can be found at http://mdsec.net/wahh.
1. While testing a web application, you log in using your credentials of joe
and pass. During the login process, you see a request for the following
URL appear in your intercepting proxy:
http://www.wahh-app.com/app?action=login&uname=joe&password=pass
What three vulnerabilities can you diagnose without probing any further?
2. How can self-registration functions introduce username enumeration
vulnerabilities? How can these vulnerabilities be prevented?
3. A login mechanism involves the following steps:
(a) The application requests the user’s username and passcode.
(b) The application requests two randomly chosen letters from the user’s
memorable word.
Why is the required information requested in two separate steps? What
defect would the mechanism contain if this were not the case?
4. A multistage login mechanism first requests the user’s username and
then various other items across successive stages. If any supplied item is
invalid, the user is immediately returned to the first stage.
What is wrong with this mechanism, and how can the vulnerability be
corrected?
5. An application incorporates an antiphishing mechanism into its login
functionality. During registration, each user selects a specific image from
a large bank of memorable images that the application presents to her.
The login function involves the following steps:
(a) The user enters her username and date of birth.