Broken Authentication and Session Management - owasp shepherd

最新推荐文章于 2022-10-09 16:02:34 发布

maoguan121

最新推荐文章于 2022-10-09 16:02:34 发布

阅读量330

点赞数

分类专栏： owasp shepherd

原文链接：http://shepherd.anquanbiji.com/vul/Broken-Authentication-and-Session-Management.html

版权

java http

owasp shepherd 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

本文转自http://shepherd.anquanbiji.com/vul/Broken-Authentication-and-Session-Management.html

Broken Authentication and Session Management(失效的身份认证和会话管理)

题介绍

本题主要考察不好的会话管理,需要通过点击完成该课程按钮,欺骗服务器，让服务器认为我们已经完成了该课程，进而获得通关密钥

功能实现

页面点击完成该课程按钮

POST /lessons/b8c19efd1a7cc64301f239f9b9a7a32410a0808138bbefc98986030f9ea83806 HTTP/1.1
Cookie: lessonComplete=lessonNotComplete; JSESSIONID=0B5E5DB01DD31D29205ED99B77ABB56C; token=-127827516577406622538923948450307535312

服务端代码: /src/main/java/servlets/module/lesson/SessionManagementLesson.java

Cookie userCookies[] = request.getCookies();
int i = 0;
Cookie theCookie = null;
for(i = 0; i < userCookies.length; i++)
{
	if(userCookies[i].getName().compareTo("lessonComplete") == 0)
	{
		theCookie = userCookies[i];
		break; //End Loop, because we found the token
	}
}
String htmlOutput = null;
if(theCookie != null)
{
	log.debug("Cookie value: " + theCookie.getValue());
	
	if(theCookie.getValue().equals("lessonComplete"))
	{
		log.debug("Lesson Complete");

功能实现，读取cookie,判断是否存在cookie的key为 lessonComplete，进而判断lessonComplete 的值是否为 lessonComplete