full-disclosure - Re: Predefined Post Authentication Session ID Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEJizba2cAasGXvFp--KRXNRKjYUvpMa03rdc7GErbf=H2Bw+Q@mail.gmail.com>
Date: Fri, 13 Jul 2012 10:54:18 +0100
From: Benji <me@...ji.com>
To: genericone@...hmail.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Predefined Post Authentication Session ID
	Vulnerability

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

On Thu, Jul 12, 2012 at 2:15 PM,  <genericone@...hmail.com> wrote:
> Benji,
>
> Do you write anything but scathing criticism?  I've never seen you
> contribute anything of use to this list.   You must be a real pleasure in
> person.
>
>
> Sent using Hushmail
>
>
>
> On 07/12/2012 at 4:52 AM, Benji <me@...ji.com> wrote:
>
> Ah, please send more emails explaining the faults of retarded
> programmers and serious vulnerabilities, and then link to an owasp
> page.
>
> Can you explain HTTPOnly cookies to me? I will only accept your
> explanation if you can justify an impact of Critical, a likelihood of
> High and a severity of High?
>
> fuq'in kidz...
>
> On Wed, Jul 11, 2012 at 11:20 PM, Gökhan Muharremoğlu
> <gokhan.muharremoglu@...ec.org> wrote:
>>
>> This article explains how this vulnerability works with Session Fixation
>> attack.
>>
>> https://www.owasp.org/index.php/Testing_for_Session_Fixation_(OWASP-SM-003)
>>
>>> From: gokhan.muharremoglu@...ec.org
>>> To: full-disclosure@...ts.grok.org.uk
>>> Date: Wed, 11 Jul 2012 11:34:11 +0300
>>> Subject: [Full-disclosure] Predefined Post Authentication Session ID
>
>>> Vulnerability
>>
>>>
>>> Vulnerability Name: Predefined Post Authentication Session ID
>>> Vulnerability
>>> Type: Improper Session Handling
>>> Impact: Session Hijacking
>>> Level: Medium
>>> Date: 10.07.2012
>>> Vendor: Vendor-neutral
>>> Issuer: Gokhan Muharremoglu
>>> E-mail: gokhan.muharremoglu@...ec.org
>>>
>>>
>>> VULNERABILITY
>>> If a web application starts a session and defines a session id before a
>>> user
>>> authenticated, this session id must be changed after a successful< br>>
>
>>> authentication. If web application uses the same session id before and
>>> after
>>
>>> authentication, any legitimate user who has gained the "before
>>> authentication" session id can hijack future "after authentication"
>>> sessions
>>> too.
>>>
>>>
>>> Vulnerable Login Page & Session ID before Authentication
>>> (Status-Line) HTTP/1.1 200 OK
>>> Server Apache/2.2.3 (CentOS)
>>> Set-Cookie PHPSESSID=8usd2oeo11a8cod9q3lnev9je2; path=/
>>> Expires Thu, 19 Nov 1981 08:52:00 GMT
>>> Cache-Control no-store, no-cache, must-revalidate, post-check=0,
>>> pre-check=0
>>> Pragma no-cache
>>> Content-Type text/html
>>> Content-Length 308
>>> Date Tue, 10 Jul 2012 06:16:57 GMT
>>> X-Varnish 1922993981
>>> Age 0
>>> Via 1.1 varnish
>>> Connection keep-alive
>>>
>>>
>>> Vulnerable Login Page & Authentication Request
>>> (Request-Line) POST /io sec_login_vulnerable.php HTTP/1.1
>
>>
>>> Host www.iosec.org
>>> User-Agent Mozilla/5.0 (Windows; U; Windows NT 6.0; tr; rv:1.9.2.25)
>>> Gecko/20111212 Firefox/3.6.25 ( .NET CLR 3.5.30729; .NET4.0E)
>>> Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
>>> Accept-Language tr-tr,tr;q=0.8,en-us;q=0.5,en;q=0.3
>>> Accept-Encoding gzip,deflate
>>> Accept-Charset ISO-8859-9,utf-8;q=0.7,*;q=0.7
>>> Keep-Alive 115
>>> Connection keep-alive
>>> Referer http://www.iosec.org/iosec_login_vulnerable.php
>>> Cookie PHPSESSID=8usd2oeo11a8cod9q3lnev9je2
>>> Content-Type application/x-www-form-urlencoded
>>> Content-Length 42
>>> POST DATA
>>> user gokhan
>>> pass muharremoglu
>>> submit Login
>>>
>>>
>>> Vulnerable Login Page & Session ID after Authentication
>>> (Status-Line) HTTP/1.1 200 OK
>>> Server Apache/2.2.3 (CentOS)
>>> Set-Cookie PHPSESSID=8usd2oeo11a8cod9q3lnev9je2; path=/
>>> Expires Thu, 19 Nov 1981 08:52:00 GMT
>>> Cache-Control no-store, no-cache, must-revalidate, post-check=0,
>>> pre-check=0
>>> Pragma no-cache
>>> Content-Type text/html
>>> Content-Length 308
>>> Date Tue, 10 Jul 2012 06:16:57 GMT
>>> X-Varnish 1922993981
>>> Age 0
>>> Via 1.1 varnish
>>> Connection keep-alive
>>>
>>>
>>> MITIGATION
>>> To avoid this vulnerability, sessions must be regenerated after a
>>> successful
>>> login. In a session fixation attack, attacker fixates (sets) another
>>> person's (victim's) session identifier because of "never regenerated and
>>> validated" session id and this vulnerability can also lead to the Session
>>> Fixation attack.
>>>
>>> _______________________________________________
>>> Full-Discl osure - We believe in it.
>
>>
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/