The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Attacking Authentication

C H A P T E R

6

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 133

---

particular application, a number of potential vulnerabilities materialize, any

one of which may be sufficient to break the application.

Many of the most common authentication vulnerabilities are literally no-

brainers. Anyone can type dictionary words into a login form in an attempt to

guess valid passwords. In other cases, subtle defects may lurk deep within the

application’s processing, which can only be uncovered and exploited after

painstaking analysis of a complex multistage login mechanism. We will

describe the full spectrum of these attacks, including techniques which have

succeeded in breaking the authentication of some of the most security-critical

and robustly defended web applications on the planet.