Broken authentification.
Just by its name, we can already assume what type of vulnerability this is and what it does.
And this is one of the most common attacks and vulnerabilities in past years now, broken authentication
is usually tied to sessions, but let's define a session first.
So what is it?
What we can say sessions are a sequence of network transactions or network requests associated to the
same user for a certain period of time.
This is what identifies an individual on a Web page, a session.
Now, don't confuse sessions with authentication, even though they are quite similar.
And sessions to interact and do change based on whether a user is authenticated or not, sessions are
established even when a user is not authenticated.
It's just that it changes once the user does authenticate on the website.
OK, but regarding broken authentication, what attacks do we have, what can we do to test for this
vulnerability?
Well, there are different types of the attacks, but we can separate them into two different groups,
group number one, which are attacks that the user is responsible for, and group number two attacks
that the developer is responsible for.
OK, so both sides take place into making these attacks work, how exactly?
Well, users are responsible for their credentials.
They're responsible for making their passwords as strong as it can be by adding numbers, characters,
upper and lower case letters.
However, usually this isn't the case and they choose an easy password that has a meaning to them.
We can target this with attacks like brute force of the credentials.
We can brute force usernames, passwords, security questions and anything that we need to get into
an account.
These type of the attacks we will cover in the next section, however, in this section, we're more
interested in covering mistakes in website configuration that allows us to steal our session.
These Web developers are responsible for this session management, how the website is going to process
different sessions and what parameters is it going to use?
Usually these sessions are identified with cookie values or other type parameters.
Sessions are considered as important as user credentials.
Highjacked session ID is as strong as a stolen login credential.
And that is the tag that we will mostly be doing, session hijacking or session stealing.
There are many approaches as to how we can do that.
One of them is an attack called session fixation.
The main idea behind this attack is that the attacker predetermines the session ID that the victim will
use.
For example, the attacker could send the victim a link that contains a predetermined session ID, and
that link might require the victim to log in after they log in.
The attacker can then use that session ID to impersonate the victim after the victim logs in.
There is also a possibility of weak encryption or weak cookie values.
It can be that the website transmit the passwords in plain text or in a weak encryption that can easily
be reversed.
This is also a point of attack for hackers.
Credentials should have best encryption possible since they are the main things keeping someone to have
an unauthorized access to another person's account.
Same goes with cookie values.
They have to be random and unpredictable.
Now, different examples of broken authentication text we're going to see in this section while brute
force attacks and similar will do much more in the next section.
So get ready and let's get straight into practical examples.