Implementation Flaws in Authentication
Even a well-designed authentication mechanism may be highly insecure due to mistakes made in its implementation. These mistakes may lead
Read moreweb hacking
Non-Unique Usernames
Some applications that support self-registration allow users to specify their own username, and do not enforce a requirement that usernames
Read moreUser Impersonation Functionality
Some applications implement the facility for a privileged user of the application to impersonate other users, in order to access
Read moreRemember Me” Functionality
Applications often implement “remember me” functions as a convenience to users, to prevent them needing to reenter their username and
Read moreForgotten Password Functionality
Like password change functionality, mechanisms for recovering from a forgotten password situation often introduce problems that may have been avoided
Read morePassword Change Functionality
Surprisingly, many web applications do not provide any way for users to change their password. However, this functionality is necessary
Read moreVulnerable Transmission of Credentials
If an application uses an unencrypted HTTP connection to transmit login credentials, an eavesdropper who is suitably positioned on the
Read moreActiveX Controls
ActiveX controls are a much more heavyweight technology than Java applets. They are effectively native Win32 executables that, once accepted
Read moreCapturing User Data: Thick-Client Components
Besides HTML forms, the other main method for capturing, validating, and submitting user data is to use a thick-client component.
Read more