The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

can be exploited as the basis for username enumeration or brute-force

attacks (see the previous details).

■

If the application generates an email containing a recovery URL in

response to a forgotten password request, obtain a number of these

URLs, and attempt to identify any patterns that may enable you to predict

the URLs issued to other users. Employ the same techniques as are rele-

vant to analyzing session tokens for predictability (see Chapter 7).

Chapter 6 

■

Attacking Authentication

147

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 147

---

“Remember Me” Functionality

Applications often implement “remember me” functions as a convenience to

users, to prevent them needing to reenter their username and password each

time they use the application from a specific computer. These functions are

often insecure by design and leave the user exposed to attack both locally and

by users on other computers:

■■

Some “remember me” functions are implemented using a simple per-

sistent cookie, such as 

RememberUser=peterwiener

(see Figure 6-5).

When this cookie is submitted to the initial application page, the appli-

cation trusts the cookie to authenticate the user, and creates an applica-

tion session for that person, bypassing the login. An attacker can use a

list of common or enumerated usernames to gain full access to the

application without any authentication.

Figure 6-5: A vulnerable “remember me” function

■■

Some “remember me” functions set a cookie which does not contain 

the username but rather a kind of persistent session identifier — for

example, 

RememberUser=1328

. When the identifier is submitted to the

login page, the application looks up the user associated with it and 

creates an application session for that user. As with ordinary session

tokens, if the session identifiers of other users can be predicted or

extrapolated, an attacker can iterate through a large number of poten-

tial identifiers to find those associated with application users, and so

gain access to their accounts without authentication. See Chapter 7 for

techniques for performing this attack.