The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

In addition to the login functionality itself, there may be other sources of

information where you can obtain valid usernames. Review all of the source code

comments discovered during application mapping (see Chapter 4) to identify any

apparent usernames. Any email addresses of developers or other personnel

within the organization may be valid usernames, either in full or just the user-

specific prefix. Any accessible logging functionality may disclose usernames.

Chapter 6 

■

Attacking Authentication

141

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 141

---

Vulnerable Transmission of Credentials

If an application uses an unencrypted HTTP connection to transmit login cre-

dentials, an eavesdropper who is suitably positioned on the network will of

course be able to intercept them. Depending on the user’s location, potential

eavesdroppers may reside:

■■

On the user’s local network

■■

Within the user’s IT department

■■

Within the user’s ISP

■■

On the Internet backbone

■■

Within the ISP hosting the application

■■

Within the IT department managing the application

N OT E

Any of these locations may be occupied by authorized personnel but

also potentially by an external attacker who has compromised the relevant

infrastructure through some other means. Even if the intermediaries on a