diff --git a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb index 9fad652..fee6f8b 100644 --- a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb +++ b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb @@ -1,20 +1,20 @@
- A3 - Broken Authentication and Session Management - Insecure Compare and Timing Attacks + A2 - Broken Authentication and Session Management - Insecure Compare and Timing Attacks
-
+

A timing attack can exist in several forms. This specific case relates to username (email address) enumeration. By leveraging an automated tool, an attacker can review any subtle variation in response times after submitting a login request to determine if the application is performing a computationally intense function. Meaning, if a function is run once a user is discovered, even if the password is incorrect, this information provides the user with valid or invalid usernames. @@ -24,13 +24,13 @@

-
+
@@ -38,13 +38,13 @@
-
+
@@ -52,13 +52,13 @@
-
+

Test diff --git a/app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb index ebb4cbb..507bf0c 100644 --- a/app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb +++ b/app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb @@ -1,7 +1,7 @@

- A3 - Broken Authentication and Session Management - Lack of Password Complexity + A2 - Broken Authentication and Session Management - Lack of Password Complexity
diff --git a/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb index 2d7ccf0..1c311c3 100755 --- a/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb +++ b/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb @@ -1,7 +1,7 @@
- A3 - Broken Authentication and Session Management - Username/Pass Enumeration + A2 - Broken Authentication and Session Management - Username/Pass Enumeration