1. Authentication
- Brute Force
- Insufficient Authentication
- Weak Password Recovery Validation
2. Authorization
- Credential/Session Prediction
- Insufficient Authorization
- Insufficient Session Expiration
- Session Fixation
3. Client-side Attacks
- Content Spoofing
- Cross-site Scripting
4. Command Execution
- Buffer Overflow
- Format String Attack
- LDAP Injection
- OS Commanding
- SQL Injection
- SSI Injection
- XPath Injection
5. Information Disclosure
- Directory Indexing
- Information Leakage
- Path Traversal
- Predictable Resource Location
6. Logical Attacks
- Abuse of Functionality
- Denial of Service
- Insufficient Anti-automation
- Insufficient Process Validation
|
 |
Credential/Session Prediction
Credential/Session Prediction is a method of hijacking or
impersonating a web site user. Deducing or guessing the unique
value that identifies a particular session or user accomplishes the
attack. Also known as Session Hijacking, the consequences could
allow attackers the ability to issue web site requests with the
compromised user's privileges.
Many web sites are designed to authenticate and track a user when
communication is first established. To do this, users must prove their
identity to the web site, typically by supplying a username/password
(credentials) combination. Rather than passing these confidential
credentials back and forth with each transaction, web sites will
generate a unique "session ID" to identify the user session as
authenticated. Subsequent communication between the user and the
web site is tagged with the session ID as "proof" of the authenticated
session. If an attacker is able predict or guess the session ID of
another user, fraudulent activity is possible.
Example
Many web sites attempt to generate session IDs using proprietary
algorithms. These custom methodologies might generation session
IDs by simply incrementing static numbers. Or there could be more
complex procedures such as factoring in time and other computer
specific variables.
The session ID is then stored in a cookie, hidden form-field, or URL. If
an attacker can determine the algorithm used to generate the session
ID, an attack can be mounted as follows:
1) attacker connects to the web application acquiring the current
session ID.
2) attacker calculates or Brute Forces the next session ID.
3) attacker switches the current value in the cookie/hidden form-
field/URL and assumes the identity of the next user.
References
"iDefense: Brute-Force Exploitation of Web Application Session ID's", By David Endler - iDEFENSE Labs
http://www.cgisecurity.com/lib/SessionIDs.pdf
"A Guide to Web Authentication Alternatives", Jan Wolter
http://www.unixpapa.com/auth/homebuilt.html
To receive your Free Application
Vulnerability Assessment for testing of one attack vulnerability of your choice, please submit your payment of $1999.00 for a second Credential/Session Prediction attack vulnerability test.
|
