Predictable Tokens
Some session tokens do not contain any meaningful data associating them with a particular user but are nevertheless guessable because
Read moreWebsite
Weaknesses in Session Token Generation
Session management mechanisms are often vulnerable to attack because tokens are generated in an unsafe manner that enables an attacker
Read moreAttacking Session Management
The session management mechanism is a fundamental security component in the majority of web applications. It is what enables the
Read moreSecuring Authentication
Implementing a secure authentication solution involves attempting to simultaneously meet several key security objectives, and in many cases trade off
Read moreDefects in Multistage Login Mechanisms
Some applications use elaborate login mechanisms involving multiple stages. For example: ■ Entry of a username and password. ■ A
Read moreImplementation Flaws in Authentication
Even a well-designed authentication mechanism may be highly insecure due to mistakes made in its implementation. These mistakes may lead
Read moreNon-Unique Usernames
Some applications that support self-registration allow users to specify their own username, and do not enforce a requirement that usernames
Read moreUser Impersonation Functionality
Some applications implement the facility for a privileged user of the application to impersonate other users, in order to access
Read moreRemember Me” Functionality
Applications often implement “remember me” functions as a convenience to users, to prevent them needing to reenter their username and
Read moreForgotten Password Functionality
Like password change functionality, mechanisms for recovering from a forgotten password situation often introduce problems that may have been avoided
Read more