Original subtitles

0 Hello Everyone, so let us continue to the second vulnerability in OWASP and the second vulnerability in OWASP 1

2017 is broken authentication so when any application functionality is broken or weak and any attacker 2

is able to bypass the authentication using Session token flaws, Brute forcing the application, No-Rate limiting 3

or Password compromised using response manipulation or any other flaws which gives an attacker temporary 4

or permanent access to the user user's identity is known as broken authentication what type of vulnerabilities 5

lies under broken authentication? Vulnerabilities like OTP bypass, Captcha bypass, Common passwords 6

brute force, No-Rate limit or Two factor authentication bypass. Why broken authentication happens? Manipulated 7

response is interpreted by the application.When any application takes decisions based on the 8

manipulated response then it becomes a vulnerability when the application does not have a rate limit there 9

is no rate limit on the application. 10

The lack of session management if any application is having improper session management then also broken 11

authentication can occur. 12

So what can be achieved by a broken authentication. 13

Temporary access to users account can be achieved permanent access to any user's account can be achieved. 14

Attacker can modify and alter any user's detail accounts can be used for malicious purposes 15

to conduct attacks further on. 16

So basically any attacker can do a temporary or permanent account takeover and modify the details like 17

email I'd, password and other crucial and vital details into the account. 18

So how do we fix broken authentication issues. 19

The first thing a usage of strong authentication like JWT tokens, SAML or open authorization can 20

be used do not allow default or weak credentials. 21

Escaping is the primary means to make sure that untrusted data can't be used to convey an induction attack. 22

OK so you can also use a rate limit. 23

Also usage of server side secure session management that generate high entropy secured sessions can 24

also be used to fix broken authentication types of issues. 25

Thank you.