Re: Web Application Vulnerability Categorization
"m@d m0nk" <[email protected]> Thu, 3 Apr 2014 00:06:28 +0530
| Newsgroups | gmane.comp.security.web-applications |
|---|---|
| Message-ID | <CAEbtD=yZcphitCmHpPVVp7NL8jVt3Xjusp0GyJEj4P_dC5BbkA@mail.gmail.com> |
Thank you guys - got the idea. On Wed, Apr 2, 2014 at 7:10 PM, Eric Schultz <[email protected]> wrote: > Its important to note that you described two different findings. > > 1. Password recovery is brute forcable. If you stuck with owasp, the broken > auth catagory is the best fit. Check if your client has an account lockout > policy. Policy violations may be taken more seriously. Seth listed the > correct cwe if you go that way too. > > 2. Passwords in database stored in clear text or reversible format. If you > can see the password, one of the two is happening. Best practice is that > passwords should be stored as hashes (nonreversable encryption). > > -Eric > > On Apr 1, 2014 2:25 AM, "m@d m0nk" <[email protected]> wrote: >> >> Hello Team, >> >> Greetings!!!. >> >> I have a web app with a password recovery option. There is a secret >> question and if the user enters the correct answer to the secret >> question, the username and password is provided to the user. >> >> If the password recover page / module allows multiple tries >> (brute-force and no CAPTCHA or similar mechanism), can we categorize >> this vulnerability under "Broken Authentication and Session >> Management" or does this fall under any other Vulnerability Category / >> OWASP Top 10? >> >> Thanks in advance. >> >> ch33rs, >> >> -- >> >> __| madm0nk |__ >> th3 sib3rian m0nk >> -------------------------- >> >> >> >> This list is sponsored by Cenzic >> -------------------------------------- >> Let Us Hack You. Before Hackers Do! >> It's Finally Here - The Cenzic Website HealthCheck. FREE. >> Request Yours Now! >> http://www.cenzic.com/2009HClaunch_Securityfocus >> -------------------------------------- >> > -- __| madm0nk |__ th3 sib3rian m0nk -------------------------- This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------