WebApp Sec mailing list archives
Re: NTLM Authenthication,
From: Amit Klein <aksecurity () gmail com>
Date: Thu, 01 Mar 2007 00:04:14 +0200
IRM wrote:
Dear all, On my Web Pen test, I have seen one application that relies on the NTLM Auth for the authorization. The thing is I have seen many people rely on the NTLM Authentication to segregate access at the file level but not atthe business logic level.
[...]
Any Thought About this particular design?
Keep in mind the proxy scenario ("NTLM HTTP Authentication is Insecure by Design", http://www.securityfocus.com/archive/1/405541)
-Amit ------------------------------------------------------------------------- Sponsored by: Watchfire The Twelve Most Common Application-level Hack AttacksHackers continue to add billions to the cost of doing business online despite security executives' efforts to prevent malicious attacks. This whitepaper identifies the most common methods of attacks that we have seen, and outlines a guideline for developing secure web applications. Download today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008fHe --------------------------------------------------------------------------
Current thread:
- NTLM Authenthication, IRM (Feb 28)
- RE: NTLM Authenthication, McCarty, Eric C. (Mar 01)
- Re: NTLM Authenthication, Amit Klein (Mar 01)