Testing for Brute Force (OWASP-AT-004) - Revision history

Mmeucci at 15:47, 7 April 2014

2014-04-07T15:47:19Z

Landon Mayo: milw0rm has been down for a long time, netcraft shows 15-Jun-2010 is the last reported date

2012-12-07T13:26:21Z

milw0rm has been down for a long time, netcraft shows 15-Jun-2010 is the last reported date

Ryan Dewhurst at 14:13, 30 May 2012

2012-05-30T14:13:29Z

Zakiakhmad: /* Brute force Attacks */

2011-08-26T07:49:43Z

‎Brute force Attacks

Antonio Vázquez Blanco at 13:48, 16 March 2011

2011-03-16T13:48:32Z

Neil Bergman at 20:57, 4 October 2009

2009-10-04T20:57:52Z

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-06-03T12:50:03Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 02:13, 31 May 2009

2009-05-31T02:13:39Z

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-29T18:00:41Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 16:30, 29 May 2009

2009-05-29T16:30:52Z

← Older revision		Revision as of 15:47, 7 April 2014
Line 252:		Line 252:


−	~~[[Category:FIXME\|link not working:~~
−	* milw0rm - http://www.milw0rm.com/cracker/list.php
−	* Rainbowcrack.com - http://www.rainbowcrack.com/
	]]		]]

@@ Line 241: / Line 241: @@
 * OPHCRACK (the time-memory-trade-off-cracker) - http://lasecwww.epfl.ch/~oechslin/projects/ophcrack/
 * Project RainbowCrack - http://www.antsight.com/zsl/rainbowcrack/
-* milw0rm - http://www.milw0rm.com/cracker/list.php
 '''Tools'''<br>
 * Bruter: http://sourceforge.net/projects/worawita/
@@ Line 253: / Line 253: @@
 [[Category:FIXME|link not working:
+* milw0rm - http://www.milw0rm.com/cracker/list.php
 * Rainbowcrack.com - http://www.rainbowcrack.com/
 ]]

@@ Line 243: / Line 243: @@
 * milw0rm - http://www.milw0rm.com/cracker/list.php
 '''Tools'''<br>
 * THC Hydra:        http://www.thc.org/thc-hydra/
 * John the Ripper:  http://www.openwall.com/john/

@@ Line 169: / Line 169: @@
 [STATUS] attack finished for www.site.com (waiting for childs to finish)
 Hydra (http://www.thc.org) finished at 2009-07-04 18:16:34
 </pre>

@@ Line 216: / Line 216: @@
 * THC Hydra:        http://www.thc.org/thc-hydra/
 * John the Ripper:  http://www.openwall.com/john/
-* Brutus http://www.hoobie.net/brutus/
+* Brutus: http://www.hoobie.net/brutus/
 <br>

@@ Line 138: / Line 138: @@
 <pre>
 <form method="POST" action="login">
-  <input type="text" name"username">
+  <input type="text" name="username">
   <input type="password" name="password">
 </form>

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v3}}
@@ Line 88: / Line 45: @@
 '''HTTP authentication'''
-There are two native HTTP access authentication schemes available to an organization â Basic and Digest.
+There are two native HTTP access authentication schemes available to an organization – Basic and Digest.
 * Basic Access Authentication
-Basic Access Authentication assumes clients will identify themselves with a login name (e.g., "owasp") and password (e.g., "password"). When the client browser initially accesses a site using this scheme, the web server will reply with a 401 response containing a âWWW-Authenticateâ header, containing a value of âBasicâ and the name of the protected realm (e.g., WWW-Authenticate: Basic realm="wwwProtectedSiteâ). The client browser will then prompt the user for her login name and password for that realm. The client browser then responds to the web server with an âAuthorizationâ header, containing the value âBasicâ and the base64-encoded concatenation of the login name, a colon, and the password (e.g., Authorization: Basic b3dhc3A6cGFzc3dvcmQ=). Unfortunately, the authentication reply can be easily decoded should an attacker sniff the transmission.
+Basic Access Authentication assumes clients will identify themselves with a login name (e.g., "owasp") and password (e.g., "password"). When the client browser initially accesses a site using this scheme, the web server will reply with a 401 response containing a “WWW-Authenticate” header, containing a value of “Basic” and the name of the protected realm (e.g., WWW-Authenticate: Basic realm="wwwProtectedSite”). The client browser will then prompt the user for her login name and password for that realm. The client browser then responds to the web server with an “Authorization” header, containing the value “Basic” and the base64-encoded concatenation of the login name, a colon, and the password (e.g., Authorization: Basic b3dhc3A6cGFzc3dvcmQ=). Unfortunately, the authentication reply can be easily decoded should an attacker sniff the transmission.
 Request and Response Test:
@@ Line 139: / Line 96: @@
 * Digest Access Authentication
-Digest Access Authentication expands upon the security of Basic Access Authentication by using a one-way cryptographic hashing algorithm (MD5) to encrypt authentication data and, secondly, adding a single use (connection unique) ânonceâ value set by the web server. This value is used by the client browser in the calculation of a hashed password response. While the password is obscured by the use of the cryptographic hashing and the use of the nonce value precludes the threat of a replay attack, the login name is submitted in clear text.
+Digest Access Authentication expands upon the security of Basic Access Authentication by using a one-way cryptographic hashing algorithm (MD5) to encrypt authentication data and, secondly, adding a single use (connection unique) “nonce” value set by the web server. This value is used by the client browser in the calculation of a hashed password response. While the password is obscured by the use of the cryptographic hashing and the use of the nonce value precludes the threat of a replay attack, the login name is submitted in clear text.
 Request and Response Test: