Testing for Bypassing Authentication Schema (OWASP-AT-005)

Revision as of 02:13, 18 August 2008 by Marco (Talk | contribs)

Jump to: navigation, search

OWASP Testing Guide v2 Table of Contents


Brief Summary




Description of the Issue

Problems related to Authentication Schema could be found at different stages of the software development life cycle (SDLC), like design, development and deployment phase.


Problems in the development phase are, for example, the incorrect implementation of input validation functionalities, or not following the security best practices for the specific language.

In addition, there may be issues during the application setup (installation and configuration activities), due to a lack in required technical skills, or due to poor documentation available.

Black Box testing and example


  • Direct page request (forced browsing)
  • Parameter Modification
  • Session ID Prediction
  • Sql Injection

Direct page request

If a web application implements access control only on the login page, the authentication schema could be bypassed. For example, if a user directly requests a different page via forced browsing, that page may not check the credentials of the user before granting access. Attempt to directly access a protected page through the address bar in your browser to test using this method.


Parameter Modification

Another problem related to authentication design is when the application verifies a successful login on the basis of a fixed value parameters. A user could modify these parameters to gain access to the protected areas without providing valid credentials. In the example below, the "authenticated" parameter is changed to a value of "yes", which allows the user to gain access. In this example, the parameter is in the URL, but a proxy could also be used to modify the parameter, especially when the parameters are sent as form elements in a POST request.

raven@blackbox /home $nc www.site.com 80                    
GET /page.asp?authenticated=yes HTTP/1.0                    
HTTP/1.1 200 OK                                             
Server: Apache                                              
Connection: close                                           
<H1>You Are Auhtenticated</H1>                              

Session ID Prediction

Many web applications manage authentication using session identification values (SESSION ID). Therefore, if session ID generation is predictable, a malicious user could be able to find a valid session ID and gain unauthorized access to the application, impersonating a previously authenticated user.

In the following figure, values inside cookies increase linearly, so it is easy for an attacker to guess a valid session ID.


In the following figure, values inside cookies change only partially, so it's possible to restrict a brute force attack to the defined fields shown below.


Sql Injection (HTML Form Authentication)



The following figure shows that with a simple SQL injection attack, it is sometimes possible to bypass the authentication form.


Gray Box Testing And Example


2.  {
7.  $sessionmethod = SESSION_METHOD_COOKIE;
8.  }
12. {
14. }






OWASP Testing Guide v2

Here is the OWASP Testing Guide v2 Table of Contents