‫In this section, we're going to talk about the authentication mechanism flaws and how to beat the authentication
‫mechanisms.
‫Authentication is a process of verification that an individual entity or website is who it claims to
‫be.
‫Authentication in the context of web applications is commonly performed by submitting a username or
‫ID and one or more items of private information that only a given user should know.
‫The authentication process can be two sided.
‫The user can verify the identity of the server while the server authenticate the identity of the user.
‫The application should have a strong password policy and should have prevention methods to dispose of
‫brute force attacks.
‫The authentication methods are displayed in the sly since other methods have some disadvantages.
‫The most commonly used authentication method is form based authentication, form based authentication.
‫These are flexible, so you can use different authentication factors together.
‫In addition, they're able to be used with the proxies and firewalls, et cetera.
‫In most cases, username and password values are used to authenticate a user.
‫In this case, it's vital to have strong passwords.
‫Therefore, the application should have a strong password policy.
‫Here is an example for a good password policy, password must meet at least three out of the four following
‫complexity rules at least one uppercase character at least one lowercase character, at least one digit
‫and at least one special character password must have at least 10 characters.
‫And you cannot use more than two identical characters in a row, for instance, one one one is not alone.
‫There are three factors in authentication mechanisms.
‫One, the knowledge factors, something the user knows password, partial password, passphrase or pin,
‫etc. to the ownership factors, something the user has an ID card security token cell phone with built
‫in hardware, token, software token, etc..
‫Three.
‫The inherent factor something the user is or does a fingerprint, retinal pattern, DNA sequence, signature,
‫face, voice, etc. And there are three types of authentication.
‫One Single factor authentication as the weakest level of authentication, only a single component from
‫one of the three categories of factors is used to authenticate an individual's identity.
‫Two.
‫Two factor authentication one.
‫Elements representing two factors are required for authentication.
‫The term is applied.
‫For example, a bank card, something the user has and a pin, something the user knows.
‫Three.
‫Multi-factor authentication Instead of using two factors, multiple authentication factors are used
‫to enhance security.
‫So while trying to bypass authentication mechanisms first, we try to find out valid credentials for
‫this purpose.
‫Let's first attempt to log in to the application using valid and invalid username password pairs.
‫Analyze the reactions of the application in case of different login attempts.
‫Examine the error codes and error pages returned after these attempts.
‫Try to reach restricted pages and see if there are adequate access controls.
‫Examine the responses of the application.
‫Don't forget to try the default username and password we can use the username and password policies
‫of the company who owns the application.
‫If we were able to find the policies while gathering information in some of the applications, there
‫are password recovery mechanisms such as hidden questions.
‫You should examine these mechanisms closely.
‫If the answer space is big enough, for example, to fit the answer for what's your favorite color?
‫Is it big enough?
‫We can talk about two basic types of online password cracking brute force attacks work by calculating
‫every possible combination that could make up a password and testing it to see if the password is correct.
‫As the password length increases, the amount of time on average to find the correct password increases
‫exponentially as you see the possibility to find a password.
‫Using brute force attack is theoretically 100 percent, but cracking the password can take many years,
‫depending on the password complexity.
‫So to make the possible value set smaller, it's better to use this method if we know something which
‫will reduce the number of tries, such as the length of the password, since users tend to use known
‫words in dictionary attack.
‫We use previously prepared dictionaries to find the passwords.
‫It's a smarter method compared to brute force attacks and reduces the number of tries dramatically.
‫But in this case, finding the password is not guaranteed.
‫You can find the password only if it's not complicated enough.
‫It's possible to prepare SECTOR-SPECIFIC or company specific dictionaries to increase the chance.