Re: Script Based Attacks & Form Hacks

[Stephen de Vries <stephen () corsaire com>]

Hi Vicente,

On 22 Jul 2005, at 07:46, Vicente Aguilera wrote:
> To prevent automatic form submissions in login forms you can also use:
>
> 1. One-time-logins/One-time-passwords
> For example, if the user password is: "a34.;(vad78!$" the  
> application can ask for the password: "Put the character  
> 1,5,2,6,8,9,10,4 of your password", and these positions could  
> change randomly.

Perhaps I don't understand this solution, but it looks as though this  
could be automated by a script.  It would be fairly trivial to write  
a script that parses the sentence "Put the character 1,5,2,6,8,9,10,4  
of your password" and submits the correct characters from the  
password to the login form...(?)

> 2. Account lock
> For example after 5 unsuccessful attempts.

There is always the danger that an attacker could use this to lockout  
all accounts on the system - which is also an effective DoS.


regards,
Stephen


> Vicente Aguilera Díaz
> OPST, OPSA, ITIL
> vaguilera () isecauditors com
>
>
>
> Paul Kurczaba escribió:
>
>
> > To prevent automatic form submissions I use a custom written  
> > implementation of CAPTCHA (http://www.captcha.net/). This prevents  
> > robots from automatically setting up accounts. Many web developers  
> > do use client side JavaScript for controlling form submission data  
> > (ex. making sure all text boxes are filled, verifying email  
> > address structure, etc.) This is unprofessional and (could be)  
> > insecure. The form verification should be done on the server side.
> >
> > The following page I have set up:
> > http://www.securinews.com/login/register.htm
> > uses CAPTCHA to help prevent automatic submissions. If the CAPTCHA  
> > string is not entered, the form will not be processed by the  
> > server. You are free to create a Java program to test bypassing  
> > CAPTCHA.
> >
> > -Paul
> >
> >
> > Chad Maniccia wrote:
> >
> >
> > > Hi List,
> > >
> > > One thing I have not heard any one discuss is the use of automated
> > > scripts and form hacking. I could easily write a Java program to
> > > attack any ASP,JSP,PHP etc.. simply by viewing the page source to  
> > > find
> > > the parameters the form processor will be looking for. You could use
> > > this to fill up some ones database with garbage bring the server  
> > > to a
> > > standstill or worse yet bypass all the fancy javascript you had  
> > > on the
> > > calling page. Some web applications actually use javascript to
> > > calcualte currency transactions.
> > >
> > > What ideas do you guys have to protect yourself from these?
> > >
> > >
> > > Thanks,
> > > Chad