From the course: Dynamic Application Security Testing

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

A7: Identification and authentication failures

A7: Identification and authentication failures - Burp Suite Tutorial

From the course: Dynamic Application Security Testing

Start my 1-month free trial Buy for my team

A7: Identification and authentication failures

“

- [Instructor] The seventh set of risks in the OWASP top 10 list are identification and authentication failures. If an attacker can find a way around the login screen and start interacting with the application, or if you can't trust that the person using the app is the person they claim to be, then the application is vulnerable to these flaws. With all the data breaches in recent years, a lot of valid usernames and passwords have ended up on the dark web. It doesn't take a lot of technical skill for an attacker to download one of these lists and start logging into your application with valid user accounts that belong to somebody else. Default passwords are even worse. You don't believe me? Google for the admin guide for some of the older technology on your network, tech with an administrative web interface, and see if there's a default admin password combo listed in that guide. Even if the attacker doesn't have…

Contents