Difference between revisions of "Repudiation Attack"
|Line 8:||Line 8:|
Consider a web application that makes access control and authorization based on SessionId, but register actions based on user parameter defined on header, as follows:
Consider a web application that makes access control and authorization based on
|Line 25:||Line 24:|
Revision as of 11:36, 4 July 2007
Repudiation is the act of refuse authoring of something that happened. A repudiation attack happens when an application or system do not adopt controls to properly track and log users actions, thus permitting malicious manipulation or forging the identification of an action. This attack can be used to change the authoring information of malicious actions that are stored on application log files and its usage can be extended to general data manipulation in name of others. If this attack takes place, the data stored on log files can be considered invalid or misleading.
Consider a web application that makes access control and authorization based on SessionId, but register user actions based on user parameter defined on Cookie header, as follows:
POST https://tequila:8443/atualiza/atualizaUploads.jsp HTTP/1.1 Host: tequila:8443 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:220.127.116.11) Gecko/20070515 Firefox/18.104.22.168 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: https://tequila:8443/uploads.jsp Cookie: JSESSIONID=EE3BD1E764CD6EED280426128201131C; user=leonardo Content-Type: multipart/form-data; boundary=---------------------------263152394310685 Content-Length: 321
And the log file is composed by:
Date, Time, Source IP, Source port, Request, User
Once user information is acquired from user parameter on header, a malicious user could make use of a local proxy (eg:paros) and change it by a known or unknown username.