Sumeru Cyber Security
  • Sumeru Cyber Security
  • Workarounds for prevalent vulnerabilities
    • Version Disclosure
    • Host Header Attack
    • HttpOnly and Secure Flag
    • Security Headers
    • Clickjacking
    • Weak Password
    • Username Enumeration
    • jQuery Outdated
    • Cross-Origin Resource Sharing
    • AWS S3 Bucket Misconfiguration
    • Directory Listing
    • Laravel Debug Enabled
    • Autocomplete and Remember Password Enabled
    • Brute Force Attack
    • Cross Site Request Forgery
    • SQL Injection
    • PhpMyAdmin page Available Publicly
    • Implementation of BASIC Authentication
    • Cache Browsing
    • Insecure Direct Object Reference
    • Active mixed content over https
    • Improper forgot password implementation
    • ASP.NET Debug Enabled
    • Sensitive Data Sent in GET Request
    • Weak CAPTCHA Implementation
    • Csv Injection
    • Cross Site Scripting
    • Web Server Robot.txt Information Disclosure
    • SSL Related Issues
    • Local File Inclusion
    • Weak CAPTCHA Implementation
    • Automated Form Submission
    • Php.ini File Available Publicly
    • ITLP
    • Internal Path Disclosure
    • Insecure Direct Object Reference
    • Access Token Not Expiring After Logout
  • OWASP A09-Security Logging and Monitoring Failures
  • OWASP API09-Improper Inventory Management v1.0
Powered by GitBook
On this page
  • Introduction
  • How to Test
  • Steps:
  • How to Fix
  • References:

Was this helpful?

  1. Workarounds for prevalent vulnerabilities

Implementation of BASIC Authentication

Introduction

Basic authentication sends username and password in plain text or base64 encoded. Generally, using basic authentication is not a good solution.

There are a few issues with Basic Auth:

  • The password is sent over the wire in base64 encoding (which can be easily converted to plaintext).

  • The password is sent repeatedly, for each request. (Larger attack window)

  • The password is cached by the web browser, at a minimum for the length of the window / process. (Can be silently reused by any other request to the server, e.g. CSRF).

  • The password may be stored permanently in the browser, if the user requests. (Same as previous point, in addition might be stolen by another user on a shared machine).

How to Test

Steps:

  • Go to Inspect Element in the browser

  • In the network tab, you can see the request header of your application.

  • Check in request headers whether Authorization Header uses BASIC authentication method as shown in the below screenshot.

How to Fix

The below list of authentication methods can be used for authorization.

  • OAuth1.0 (Digest Scheme)

  • OAuth2 (Bearer Token Scheme)

  • OpenID Connect Discovery (JWT)

References:

PreviousPhpMyAdmin page Available PubliclyNextCache Browsing

Last updated 5 years ago

Was this helpful?

https://blog.restcase.com/4-most-used-rest-api-authentication-methods/