Re: Login credentials and session id security

[pagvac <unknown.pentester () gmail com>]

Hi Vishal!

You don't wanna submit auth requests as a GET as the creds will be
embedded within URLs. This means they might be leaked in the browser's
history, proxy logs (if users connect through a corporate proxy for
instance) or 'Referer' headers among others.

Even if you enforce SSL encryption on your app, someone could still
launch a SSL MITM attack, most likely by being in the same subnet
through ARP poisoning. The attack behaves similarly to when you do a
MITIM to yourself through Paros for webapp testing purposes (notice
Paros also works with HTTPS URLs). From the victim side, the only
difference is that the browser issues an invalid certificate warning.
This is due to the cert not being validated by a "trusted certificate
authority". But then again many legitimate sites don't even use proper
ceritificates which means that the end user will most likely not
notice if he/she is being SSL-MITMed. Instead, he/she will simply
click on "continue" on the warning window.

So yes, an attacker CAN capture your password if you're being
SSL-MITMed (using dsniff for instance).

If you want a proprietary HTTP authentication mechanism you might want
to go for Windows (NTLM) auth. However, this mechanism has been
reverse-engineered for a while by some clever guys out there and
implemented by tools/libraries such as CURL. This means someone could
write a NTLM auth bruteforcing tool by scripting commands such as the
following:

curl -v --ntlm -u YOURUSERNAME:YOURPASSWORD http://hackme.target.com/

If you're truly paranoid I guess you want to use client-side
certificates, or even better: don't go online at all :-)


On 6/6/07, Vishal Garg <vishal () firstbase co uk> wrote:
> Hi All,
>
> Can someone please tell what is the most secure way of sending login
> credentials to the server. The possible ways that I am familiar with are:
>
> - get method
> - post method
> - hidden form fields
>
> By using an encrypted connection we cannot sniff the credentials, but
> still it is very easy to capture or manipulate these credentials
> using a web proxy from any of these methods. So I am looking to find
> a method to transport the credentials to the server so that the
> security of these credentials can't be compromised even by deploying
> a web proxy.
>
> Also once a session id is generated, what is the best way to maintain
> the security of a session id.
>
> Any help would be much appreciated.
>
> Regards
> Vishal
>
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> The Twelve Most Common Application-level Hack Attacks
> Hackers continue to add billions to the cost of doing business online
> despite security executives' efforts to prevent malicious attacks. This
> whitepaper identifies the most common methods of attacks that we have seen,
> and outlines a guideline for developing secure web applications.
> Download today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
> --------------------------------------------------------------------------


-- 
pagvac
gnucitizen.org, ikwt.com

-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------