So here we are on our application we stuff suite up.
This should just be a continuance for you every video.
So I'm here.
I'm going to go to account and I'm actually going to log out of this account.
And from here I to go back to account into the log in page.
So we're going to play as if we were on authenticated for right now.
So what do we want to do.
First thing when I see a log in page I want to check actually for any kind of enumeration that we can
do.
Username enumeration so we could do tests that test dot com and just do tests here and just submit this
and try to log in and this is great.
This is what you want to see.
You don't see this all the time but this is what you want to see.
So it says invalid email or password.
A lot of places will just say invalid email address or incorrect password.
That way you know.
OK well the email address is correct.
I don't know the password.
If that were the situation that would be a finding it would be a low level finding but it's still considered
information disclosure when you are allowing for user name enumeration.
So keep that in mind when you're in a log in page like this something that you want to check now.
From here we can go to hey I forgot my password.
And then here we can do the same thing test that test dot com and remember we were talking about the
username enumeration before hand.
Well guess what's happening.
We don't have a security question coming through here right.
So that's an issue.
This is username enumeration for example we did log in as the admin user and their email was admin at
juice Dash.
S h the o p handbook.
Now we are able to click on this.
This is bad.
This is so bad.
There are situations I see especially doing web apps all the time and bug bounty hunting all the time
where you have the situation where if you provide an invalid email address nothing happens or you say
even if it's just imagine there's nothing right here down.
It just says hey I want to.
I forgot my password.
I don't know.
I'm going to go ahead and just say here's my email address and submit it and they'll say we don't have
that email on file.
Well then that's still username enumeration right.
So here this is also username enumeration because we weren't able to get to this security question until
we provided a valid username.
This is not good.
Now we take this and it tells us hey what was your mother's maiden name.
This is bad.
This is very bad because it's allowing us to just go do O.S. or go do Googling and say hey you know
I know who this user is.
Let me look up what their mother's maiden name might have been.
And it's very possible that it's just this person's last name.
And then we come in here we reset their password and we're good to go and we change this.
Right.
So this is a very very bad example of a well a good example of a bad log in form.
Other things you can check for is session fixation so we can create account really quick and I'll show
you what this looks like.
So if we're going to log in and we go not yet a customer and we'll just make a test at test dot com
really quick and I'll make the password tests one two three four and test one two three four as well
and we'll just do a security question of what's your eldest sibling's middle name will say.
Bob will register here OK so now a registered.
Let's go ahead and intercept this and we could see that we have these cookies here continue code whatever.
A lot of times there's a session I.D. specifically let's go ahead and just send this to repeaters so
we have this saved and then I'll turn this off.
Let's go ahead and log in now as test at test dot com
Test one two three four log in.
OK.
Now let's turn this back on and refresh and see what we got.
OK.
Now we have a token.
So this is OK.
We have this token here.
This is good.
So we could test here for this session and we can see.
OK well this session didn't need to rotate because there was no cookie here to start or a session token
to start.
So that's good.
This is no no session fixation here.
We're testing.
OK.
We could also log out and see what happens.
We can send this to repeater as well.
And so we have repeater we get a request here.
It says three or four not modified.
That's fine.
What we're after here is we're just trying to see if when we actually log out of this now say we log
out and then we refresh this page if there's any cookie or token or anything in here and there's not.
So that's a good sign as well.
We could try as well to come into this repeater and pass along this session and see if we can get in
with this session token if it actually expired anything or if this changes when we log into something
different.
And there's a lot of things that we can do playing around with these session tokens but we're after
when it comes to this testing for broken authentication is is there session fixation here.
And I'm not seeing it but it's good to look around at all these features and again the user name enumeration
doesn't happen to the log in page in even if it doesn't it happens a lot on the forgot password page
and if we're able to brute force this page repeatedly that's an issue if we're able to you know use
default credentials here that's an issue if we're able to log in and there's no multi factor authentication
which there isn't.
That's an issue.
So these are things you're going to start looking for and thinking about and prodding so not only are
you checking you know sequel injection here which we do on log in forms and pages but we're also going
to be checking for authentication issues before we ever log in as well.
Can't we bypass authentication.
So that's it for this lesson.
Hopefully this all makes sense.
Again I do encourage you to for every challenge to check out all the challenges here.
And the reason we didn't actually do any of these solutions if we go into broken authentication most
of them are relating to the reset feature.
You could see change feature change feature or change password here in the reset.
So for me it didn't feel like it was really a challenge was more of like going out to Google and figure
out the answer like to a bender for examples from the TV show Futurama and it wanted you to to figure
out his security answer just proving a concept.
So I just wanted to talk more theoretically through this instead and again like I was saying go out
to the last top 10 review a lot of this stuff you can go into these challenges and give it a try on
your own just to kind of understand what they're wanting from these aspects and why broken authentication
is bad and it's number two because it happens so so much.
So from here we're going to move on to number three which is sensitive data exposure so catch you over
in the next video.