The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

If passwords are generated by the application, try to obtain several pass-

words in quick succession and determine whether any sequence or pat-

tern can be discerned.

■

If so, extrapolate the pattern to obtain a list of passwords for other appli-

cation users.

154

Chapter 6 

■

Attacking Authentication

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 154

---

HACK STEPS (continued)

■

If passwords demonstrate a pattern that can be correlated with user-

names, you can try to log in using known or guessed usernames and the

corresponding inferred passwords. 

■

Otherwise, you can use the list of inferred passwords as the basis for a