The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

For example, the main login page may present a form containing fields for

username, password, and one of various secret questions. Each time the login

page is loaded, the secret question changes. In this situation, the randomness

of the secret question does nothing to prevent an attacker from replaying a

valid login request having captured a user’s input on one occasion, and the

login process cannot be modified to do so in its present form, because an

attacker can simply reload the page until he receives the varying question to

which he knows the answer. In a variation on this scenario, the application may

set a persistent cookie to “ensure” that the same varying question is presented

to any given user until that person answers it correctly. This measure can of

course be trivially circumvented by modifying or deleting the cookie.