WSTG - Latest | OWASP Foundation (2024)

Home>Latest>4-Web Application Security Testing>04-Authentication Testing

ID
WSTG-ATHN-04

Summary

In computer security, authentication is the process of attempting to verify the digital identity of the sender of a communication. A common example of such a process is the log on process. Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism.

While most applications require authentication to gain access to private information or to execute tasks, not every authentication method is able to provide adequate security. Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the log in page and directly calling an internal page that is supposed to be accessed only after authentication has been performed.

In addition, it is often possible to bypass authentication measures by tampering with requests and tricking the application into thinking that the user is already authenticated. This can be accomplished either by modifying the given URL parameter, by manipulating the form, or by counterfeiting sessions.

Problems related to the authentication schema can be found at different stages of the software development lifecycle (SDLC), like the design, development, and deployment phases:

In the design phase errors can include a wrong definition of application sections to be protected, the choice of not applying strong encryption protocols for securing the transmission of credentials, and many more.
In the development phase errors can include the incorrect implementation of input validation functionality or not following the security best practices for the specific language.
In the application deployment phase, there may be issues during the application setup (installation and configuration activities) due to a lack in required technical skills or due to the lack of good documentation.

Test Objectives

Ensure that authentication is applied across all services that require it.

How to Test

There are several methods of bypassing the authentication schema that is used by a web application:

Direct page request (forced browsing)
Parameter modification
Session ID prediction
SQL injection

Direct Page Request

If a web application implements access control only on the log in page, the authentication schema could be bypassed. For example, if a user directly requests a different page via forced browsing, that page may not check the credentials of the user before granting access. Attempt to directly access a protected page through the address bar in your browser to test using this method.

Figure 4.4.4-1: Direct Request to Protected Page

Parameter Modification

Another problem related to authentication design is when the application verifies a successful log in on the basis of a fixed value parameters. A user could modify these parameters to gain access to the protected areas without providing valid credentials. In the example below, the “authenticated” parameter is changed to a value of “yes”, which allows the user to gain access. In this example, the parameter is in the URL, but a proxy could also be used to modify the parameter, especially when the parameters are sent as form elements in a POST request or when the parameters are stored in a cookie.

http://www.site.com/page.asp?authenticated=noraven@blackbox /home $nc www.site.com 80GET /page.asp?authenticated=yes HTTP/1.0HTTP/1.1 200 OKDate: Sat, 11 Nov 2006 10:22:44 GMTServer: ApacheConnection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD></HEAD><BODY><H1>You Are Authenticated</H1></BODY></HTML>

Figure 4.4.4-2: Parameter Modified Request

Session ID Prediction

Many web applications manage authentication by using session identifiers (session IDs). Therefore, if session ID generation is predictable, a malicious user could be able to find a valid session ID and gain unauthorized access to the application, impersonating a previously authenticated user.

In the following figure, values inside cookies increase linearly, so it could be easy for an attacker to guess a valid session ID.

Figure 4.4.4-3: Cookie Values Over Time

In the following figure, values inside cookies change only partially, so it’s possible to restrict a brute force attack to the defined fields shown below.

Figure 4.4.4-4: Partially Changed Cookie Values

SQL Injection (HTML Form Authentication)

SQL Injection is a widely known attack technique. This section is not going to describe this technique in detail as there are several sections in this guide that explain injection techniques beyond the scope of this section.

Figure 4.4.4-5: SQL Injection

The following figure shows that with a simple SQL injection attack, it is sometimes possible to bypass the authentication form.

Figure 4.4.4-6: Simple SQL Injection Attack

PHP Loose Comparison

If an attacker has been able to retrieve the application source code by exploiting a previously discovered vulnerability (e.g., directory traversal), or from a web repository (Open Source Applications), it could be possible to perform refined attacks against the implementation of the authentication process.

In the following example (PHPBB 2.0.12 - Authentication Bypass Vulnerability), at line 2 the unserialize() function parses a user supplied cookie and sets values inside the $sessiondata array. At line 7, the user’s MD5 password hash stored inside the backend database ($auto_login_key) is compared to the one supplied ($sessiondata['autologinid']) by the user.

1. if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid'])) {2. $sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();3. $sessionmethod = SESSION_METHOD_COOKIE;4. }5. $auto_login_key = $userdata['user_password'];6. // We have to login automagically7. if( $sessiondata['autologinid'] == $auto_login_key )8. {9. // autologinid matches password10. $login = 1;11. $enable_autologin = 1;12. }

In PHP, a comparison between a string value and a true boolean value is always true (because the string contains a value), so by supplying the following string to the unserialize() function, it is possible to bypass the authentication control and log in as administrator, whose userid is 2:

a:2:{s:11:"autologinid";b:1;s:6:"userid";s:1:"2";} // original value: a:2:{s:11:"autologinid";s:32:"8b8e9715d12e4ca12c4c3eb4865aaf6a";s:6:"userid";s:4:"1337";}

Let’s disassemble what we did in this string:

autologinid is now a boolean set to true: this can be seen by replacing the MD5 value of the password hash (s:32:"8b8e9715d12e4ca12c4c3eb4865aaf6a") with b:1
userid is now set to the admin id: this can be seen in the last piece of the string, where we replaced our regular user ID (s:4:"1337") with s:1:"2"

WebGoat
Zed Attack Proxy (ZAP)

References

As an expert in web application security testing, I have extensive knowledge and hands-on experience in the field of authentication testing. My expertise is grounded in both theoretical understanding and practical application, allowing me to effectively assess and enhance the security of authentication mechanisms within web applications.

In the realm of computer security, authentication plays a pivotal role in verifying the digital identity of communication senders. In the context of web applications, authentication is commonly associated with the login process. Testing the authentication schema involves a comprehensive examination of how the process operates and leveraging that insight to potentially bypass the authentication mechanism.

The article you provided delves into the intricacies of authentication testing, highlighting common vulnerabilities and testing objectives. Let's break down the key concepts discussed in the article:

Authentication Schema Testing:
- The process of verifying the digital identity of the sender in a communication.
- Involves understanding and potentially circumventing the authentication mechanism.
Authentication Issues in SDLC:
- Errors can be present in different phases of the software development lifecycle (SDLC), including design, development, and deployment.
- Design phase errors may include misdefining protected application sections and neglecting strong encryption protocols.
- Development phase errors can involve incorrect implementation of input validation and not following security best practices.
- Deployment phase issues may arise during setup due to a lack of technical skills or insufficient documentation.
Testing Objectives:
- Ensure that authentication is applied across all services requiring it.
Methods of Bypassing Authentication Schema:
- Direct Page Request (Forced Browsing):
  - Access control implemented only on the login page could be bypassed by directly requesting a different page.
  - Testing involves attempting to access a protected page through the address bar.
- Parameter Modification:
  - Authentication design issues may arise when the application verifies a successful login based on fixed parameter values.
  - Testing involves modifying parameters to gain unauthorized access.
- Session ID Prediction:
  - Web applications often use session identifiers (session IDs) for authentication.
  - Predictable session ID generation may allow attackers to impersonate authenticated users.
  - Testing involves assessing the predictability of session ID values.
- SQL Injection:
  - SQL injection is a well-known attack technique that can sometimes bypass authentication forms.
  - Testing involves attempting SQL injection attacks on authentication forms.
- PHP Loose Comparison:
  - Exploiting vulnerabilities in the source code, such as directory traversal, can lead to refined attacks against authentication processes.
  - Testing involves understanding and manipulating code structures, as demonstrated in the PHP example.

These concepts collectively contribute to a comprehensive understanding of authentication testing, helping security professionals identify and mitigate potential vulnerabilities in web applications.