Cyber Thursday - Broken Authentication

Broken Authentication is caused due to

• Exposure of sensitive application/user details to unauthorized users

• older or poorly configured XML processors evaluate external entity references within XML documents

• improper implementation of authentication and session management

• application includes untrusted data in a new web page without proper validation or escaping

"iloveindia" is strong password

• true

• flase

Implementation of password strength check at client side only is enough to prevent broken authentication

• false

• true

Which threat can be prevented by having unique usernames generated with a high degree of entropy?

• Crypt-analysis of hash values

• Spamming

• Authorization Bypass

• Authentication bypass

What flaw arises from session tokens having poor randomness across a range of values?

• Insecure Direct Object References

• Session Replay

• Session Hijacking

• Session Fixation

An attack technique that forces a user's session credential or session ID to an explicit value.

• Session Fixation

• Brute Force Attack

• XSS

• Dictionary Attack

Role-Based Access control helps prevent this OWASP Top 10 weakness

• Forced Browsing or failure to restrict URL

• Invalidated redirect and forward

• Insecure Misconfiguration

• SQL Injection

Broken Authentication may be prevented by (more than one correct answer):-

• implementing password strength restriction

• using predictable session ID

• Destroying session token post logout

• restricting internal URL to authenticated/authorized users only

Which of the following functionalities should you include in an authentication and session management system? (Choose two.)

• Escaping functionality

• User Input validation

• Inactive session timeout functionality

• Session invalidation post Logout functionality

Dictionary attack may be prevented by (more than one correct answer)

• Implement account lockout after few incorrect login attempt

• implement password expiry after certain

• Allow users to choose their password

• Implement use of CAPTCHA