Top 10 2013-A2-Broken Authentication and Session Management

Consider anonymous external attackers, as well as users with their own accounts, who may attempt to steal accounts from others. Also consider insiders wanting to disguise their actions. Attacker uses leaks or flaws in the authentication or session management functions (e.g., exposed accounts, passwords, session IDs) to impersonate users. Developers frequently build custom authentication and session management schemes, but building these correctly is hard. As a result, these custom schemes frequently have flaws in areas such as logout, password management, timeouts, remember me, secret question, account update, etc. Finding such flaws can sometimes be difficult, as each implementation is unique. Such flaws may allow some or even all accounts to be attacked. Once successful, the attacker can do anything the victim could do. Privileged accounts are frequently targeted. Consider the business value of the affected data or application functions. Also consider the business impact of public exposure of the vulnerability.

The primary assets to protect are credentials and session IDs. See the ASVS requirement areas V2 and V3 for more details.
 * 1) Are credentials always protected when stored using hashing or encryption? See A6.
 * 2) Can credentials be guessed or overwritten through weak account management functions (e.g., account creation, change password, recover password, weak session IDs)?
 * 3) Are session IDs exposed in the URL (e.g., URL rewriting)?
 * 4) Are session IDs vulnerable to session fixation attacks?
 * 5) Do session IDs timeout and can users log out?
 * 6) Are session IDs rotated after successful login?
 * 7) Are passwords, session IDs, and other credentials sent only over TLS connections? See  A6.

The primary recommendation for an organization is to make available to developers:
 * 1) A single set of strong authentication and session management controls. Such controls should strive to:
 * 2) meet all the authentication and session management requirements defined in OWASP’s Application Security Verification Standard (ASVS) areas V2 (Authentication) and V3 (Session Management).
 * 3) have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.
 * 4) Strong efforts should also be made to avoid XSS flaws which can be used to steal session IDs. See A3.
 * 5) blankBullet1
 * 6) blankBullet2

blank blank code blank http://example.com/app/accountView?id= ' or '1'='1 blank


 * OWASP SQL Injection Prevention Cheat Sheet
 * ESAPI Encoder API


 * CWE Entry 77 on Command Injection
 * CWE Entry 89 on SQL Injection