Welcome to Broken authentication session in
this first part. We will focus on threats analysis. We
will take our time to dig into authentication flaws details, then
we will discuss how the system can be harmed. The
impact of successful exploitation, and
give you some insights to identify who may want to harm your system.
Let's put things. Simple in
web applications context. Authentication is the
act of providing users identity.
Authentication and authorization are two different things. The
former is used to prove identity and
the later access rights. Authentication in
web application context is far behind
the login form the signup recover
password in the process by which the server maintains
the state of the entity interacting with it or
session management are all sorting vacation
mechanisms to identify the party interacting
with the system.
Mm, such party has to provide authentication factors.
Authentication factors can be grouped in
these three main classes security research has
determined that for a positive authentication elements
from at least two and preferably all
three classes should be verified traditional
web application forms, use the weakest single
Factor authentication, just requiring a
knowledge Vector, the password when
passwords leak, then this knowledge becomes shared
knowledge.
And it is no more, a secret when you're logging
in, you're saying I'm John but do at
Samos.com and to prove you that, take my password and
check it against your records. The server takes your
email and password and looks up the database for matching
records.
This is no different when someone else takes
your email and password and performs the login on your behalf. Yes,
it does. And on our exploitation session, we
will change several syndication flows together to get admin access.
Let's first discuss attack vectors impact
in threat agents.
A simple search for username password, combination lists will
return, millions of records as a result of authentication, data
leaks fitting. This list in a software tool
will be enough to compromise several web applications. There
are plenty of free, Brute Force, automated attacking tools.
This is just a matter of setting your target application and
provide the username password list or
even just let it compute all possible combinations. The
most common authentication issues are well documented. And
the information is generally available.
Liable and easy to understand. Sometimes you're
one application can be used against itself. Abusing
other issues such as user enumeration, help
compromising Authentication.
An attacker with access to a victim's account. Might
be able to lock the victim out by replacing its email or
password attacker can also impersonate the
victim and perform system. Transactions application might
not be able to distinguish between transactions initiated by
the victim or the attacker depending on the
application. Domain attackers with access to victims accounts
might be able to perpetrate some kind of fraud. Attackers
will always be able to gather victims
profile data as
Going for ransom is quite common nowadays.
Unfortunately, you're fighting virtually anyone and
anything. There are fully automated networks
of computers, trying to exploit authentication in
several web applications just using credential stuffing attacks
based on leaked authentication date. It
is fairly easy, to a non Tech malicious actor to
perpetrate a Brute Force attack such as credential stuffing.
Even just stealing user profile data will
be rewarding since this data will always be valuable to
someone else. Sometimes authentication flaws
such as default or weak. Passwords are
abused inside the organization as a way to excavate privileges
access to sensitive information, may
have a huge business impact.
You'll find this table in the west, top 10, pause
the video, and take your time to carefully, read it in
the next part. We will exploit several indications
flaws in order to access the application aside mean.