Skip to main content

When the locked account bypassed

Generally the accounts are locked when the attempt to login exceed a certain no. of unsuccessful attempts. The userids are locked by the application to thwart any further attempt to brute force. Generally the threshold is 3 unsuccessful attempts.
But I recently came across an application where there was a flaw which leads to bypass the account lockout.
Suppose an account is already locked and we try to provide the correct userid and password as now we remember the correct combination.

It acts like the below:
1. In one tab we'll access the login page and enter the userid/ password correctly. But the app will not let you in because the userid is locked and displays account locked message.

2. Now try accessing an internal url of the application in the second tab in the same browser since two tabs share the session id in most of the browsers.

3. The application lets you in the second tab!

This behavior of the application puzzled us until we inspected it closely and came to know about the below reason which could cause this.

1. In the first tab, when first time we try to login into a already locked user, using correct credentials, the application validates it and once it finds it correct, it sets the session ID before checking if the userid is locked or not.

2. When in the 2nd tab we try to access any internal url, now the application finds that this is a valid session and logs you in.

3. So the issue was the order in which the application was checking the session vs the locked account flag.



Comments

Popular posts from this blog

File Upload through Null Byte Injection

Sometimes, during file upload we come across situation wherein there would be check on the file extension at the client side as well as server side too. If the application does allow only .jpeg extension to be uploaded, the client side java script checks for the extension of the file before passing the request. We all know that how easily this can be defeated.
Some applications, checks for the extension at the server side also. That's not easy to bypass. However there are some ways with which it still can be bypassed. Most of server side scripts are written in high level languages such as Php, Java etc who still use some C/C++ libraries to read the file name and contents. That leads to the problem. In C/C++ a line ends with /00 or which is called Null Byte. So whenever the interpreter sees a null byte at the end of the a string, it stops reading thinking it has reached at the end of the string.
This can be used for the bypass. It works for many servers, specially php servers. Th…

SQL Injection in search field

Earlier I had written about performing SQL injection in search field and how to do a DoS attack and privilege escalation using 'Like' operators. Now another SQLi exploitation I came across recently. That too in the search field. This becomes important as lots of people don't pay much attention on the search forms/ fields in the application. My aim is to show that a search form can also be exploited with SQL Injection. The following queries are based on a real world exploitation. The steps and data are for just illustration purpose only. Suppose, the search form provides the details of users who have accessed the application some time and their login time details etc, we just need to provide their name in the search box provided. All the data were being going as Post request. So, to just fingerprint the database, I provide, 'nil'+'esh' in the search field and it successfully gives me the results. That means the database behind the application is concatenat…

Insecure protocols

Some basic insecure protocols and risk associated with them: