diff --git a/app/models/user.rb b/app/models/user.rb index 39787e1..9d0ca4f 100755 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -4,7 +4,8 @@ class User < ActiveRecord::Base validates :password, :presence => true, :confirmation => true, :length => {:within => 6..40}, - :on => :create + :on => :create#, + #:format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/} validates_presence_of :email validates_uniqueness_of :email validates_format_of :email, :with => /.+@.+\..+/i diff --git a/app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb new file mode 100644 index 0000000..ebb4cbb --- /dev/null +++ b/app/views/layouts/tutorial/broken_auth_sess/_password_complexity.html.erb @@ -0,0 +1,100 @@ +
+
+
+ A3 - Broken Authentication and Session Management - Lack of Password Complexity +
+
+
+
+
+
+ + + + Description + +
+
+
+

+ Password complexity is incredibly important and highly debated subject. Other factors play a part in the stringency of the enforcement policy applied. If a username can be enumerated, a CAPTCHA on the login form is not present or other methods to deter a brute-force password guessing campaign are not in place, at least password complexity enforcement policy can make it a that much more difficult for an attacker to guess users passwords. +

+
+
+
+
+
+ + + + Bug + +
+
+
+

+ Within app/models/User.rb +

+ 
+				validates :password, :presence => true,
+			                       :confirmation => true,
+			                       :length => {:within => 6..40},
+			                       :on => :create
+
+

+ The application validates only the password length and nothing else. Developers can leverage the format option to apply a regular expression that checks the password has sufficient complexity. +

+
+
+
+
+
+ + + + Solution + +
+
+
+

Lack of Password Complexity - ATTACK

+

+ Leverage a tool such as BurpSuite's intruder to brute-force the passwords of the users. The highest privileged account that you an attacker can compromise is the admin. The password is very simple ("admin1234"), username is ("admin@metacorp.com"). +

+

Lack of Password Complexity - SOLUTION

+

+ This regular expression validates the password has the following requirements: +

  • 1 digit
    • +
  • 1 lowercase alphabet
    • +
  • 1 uppercase alphabet
    • +
  • 1 special character
    • +

    + 
    +				  validates :password, :presence => true,
+				                       :confirmation => true,
+				                       :length => {:within => 6..40},
+				                       :on => :create,
+				                       :format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}
+
    +
    +
    +
    +
    +
    + + + + Hint + +
    +
    +
    +

    + I wonder how strong the administrator's password is? +

    +
    +
    +
    +
    +
    +
    diff --git a/app/views/tutorials/broken_auth.html.erb b/app/views/tutorials/broken_auth.html.erb index 52ee205..7d85147 100755 --- a/app/views/tutorials/broken_auth.html.erb +++ b/app/views/tutorials/broken_auth.html.erb @@ -5,6 +5,11 @@ <%= render :partial => ("layouts/tutorial/broken_auth_sess/user_pass_enum")%> +
    +
    + <%= render :partial => ("layouts/tutorial/broken_auth_sess/password_complexity")%> +
    +