The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 6 

■

Attacking Authentication

135

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 135

---

tain a large number of user accounts with weak passwords set. These pass-

words can be easily guessed by an attacker, granting them unauthorized

access to the application.

Figure 6-1: An application that enforces weak password quality rules

HACK STEPS

Attempt to discover any rules regarding password quality:

■

Review the web site for any description of the rules.

■

If self-registration is possible, attempt to register several accounts with

different kinds of weak passwords to discover what rules are in place.

■

If you control a single account and password change is possible, attempt