The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

16

Chapter 2 

■

Core Defense Mechanisms

70779c02.qxd:WileyRed  9/14/07  3:12 PM  Page 16

---

addition to the core login process, authentication mechanisms often employ a

range of other supporting functionality, such as self-registration, account recov-

ery, and a password change facility.

Figure 2-1: A typical login function

Despite their superficial simplicity, authentication mechanisms suffer from

a wide range of defects, in both design and implementation. Common prob-

lems may enable an attacker to identify other users’ usernames, guess their

passwords, or bypass the login function altogether by exploiting defects in its

logic. When you are attacking a web application, you should invest a signifi-

cant amount of attention in the various authentication-related functions that it

contains. Surprisingly frequently, defects in this functionality will enable you

to gain unauthorized access to sensitive data and functionality.