In this video, i will sniffed the web traffic and extracted the username and password. This particular forum uses MD5 hash to protect the password. But common hash values can be search from the Internet. Even if the hash value cannot be found(due to strong password), you can still use the captured login data to login as the user via a webproxy.
Monday, May 18, 2009
How Secure is your forum login?
After doing a video on sidejacking, i received comments and feedbacks asking on bypassing other web login that does not use SSL(HTTPS). So i decided to do a simple video to show how easy to collect user's login credential on unsecured website. The most common unsecured login is Internet forum.
In this video, i will sniffed the web traffic and extracted the username and password. This particular forum uses MD5 hash to protect the password. But common hash values can be search from the Internet. Even if the hash value cannot be found(due to strong password), you can still use the captured login data to login as the user via a webproxy.
In this video, i will sniffed the web traffic and extracted the username and password. This particular forum uses MD5 hash to protect the password. But common hash values can be search from the Internet. Even if the hash value cannot be found(due to strong password), you can still use the captured login data to login as the user via a webproxy.
Subscribe to:
Post Comments (Atom)
4 comments:
Superb video demonstration clearly describing how it is done. I think you have touched on a very important security issue that many webmasters are not even aware of. This is an effective way to make them sit up and really take notice about how lax they are and how much they take the security of their forums for granted. Keep up the good work. You belong to the kind of internet security analysts that is a rare breed in Singapore.
Just use live http headers, its easier.. DUH!!
Live HTTP Headers is COOL. Very useful for people like me who do application assessment such as XSS and SQL injection. Thanks
it will be much more interesting to see what you can see using live http when logging in thru a secure session like gmail.
Post a Comment