Difference between revisions of "Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)"

Revision as of 14:00, 30 June 2008

OWASP Testing Guide v3 Table of Contents

This article is part of the OWASP Testing Guide v3. The entire OWASP Testing Guide v3 can be downloaded here.

OWASP at the moment is working at the OWASP Testing Guide v4: you can browse the Guide here

This is a draft of a section of the new Testing Guide v3

Brief Summary

The problem we are going to discuss is to verify that authentication datas that we are sending are actually transferred via en encrypted channel to avoid being intercepted by some malicious user. The analysis focus simply on trying to understand if our datas travel unencrypted from our web browser to the server or if the web application takes the appropriate security measures using a protocol like HTTPS. This protocol, like others that use encryption, is built on TLS/SSL to encrypt the data that we want to transmit and to ensure that we are sending them towards the desired site. Clearly, the fact that our traffic is encrypted does not necessarily means that it's safe. The security also depends from the encryption algorithm used and from the robustness of the keys that we are using. But this particular topic will not be addressed in this section, for a more detailed discussion on testing the safety of our TLS/SSL channel you can refer to chapter (INSERT CHAPTER LINK). We will just try to understand if the data that we put into the web form, in order to log into a web site, are transmitted using sure protocols that protect them from an attacker or not. To do this we will consider various examples.

Description of the Issue

Nowadays, the most common example of this issue is the login page of a web application. This page may use several methods to authenticate the user, but, apart which method it uses, we want to be sure that in the transaction that is established between clients (the web browsers) and server (the application itself), sensitive data (in this case username and password) are transmitted via en encrypted channel. In order to log into a web site, usually we have to fill a simple form that passes the inserted data with the POST method. What is less obvious is that these data can be passed using the HTTP protocol, and then in a non-secure way, or using HTTPS which encrypts the data. To further complicate things, there is the possibility that the site has the login page accessible via HTTP (making us believe to an insecure transmission), but then it actually sends data via HTTPS.We do this because we want to be sure that an attacker can not be able to retrieve sensitive information simply sniffing the net with a sniffer tool. Using HTTPS prevents packet sniffing and Man In The Middle attacks.

Black Box testing and example

Testing for Topic X vulnerabilities:
...
Result Expected:
...

Gray Box testing and example

Testing for Topic X vulnerabilities:
...
Result Expected:
...

References

Whitepapers
...
Tools
...