Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

0x04e - About OTP Authentication Checks #1938

Merged
merged 4 commits into from
Jun 12, 2022
Merged

0x04e - About OTP Authentication Checks #1938

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
941cb85
Update 0x04e-Testing-Authentication-and-Session-Management.md
Saket-taneja Sep 28, 2021
6f9a970
Update 0x04e-Testing-Authentication-and-Session-Management.md
Saket-taneja Oct 13, 2021
3e68264
Update Document/0x04e-Testing-Authentication-and-Session-Management.md
cpholguera Jun 12, 2022
3c206e5
Update Document/0x04e-Testing-Authentication-and-Session-Management.md
cpholguera Jun 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions Document/0x04e-Testing-Authentication-and-Session-Management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,6 +326,10 @@ To test this, the captured request should be sent 10-15 times to the endpoint wi

> A OTP should be valid for only a certain amount of time (usually 30 seconds) and after keying in the OTP wrongly several times (usually 3 times) the provided OTP should be invalidated and the user should be redirected to the landing page or logged out.

Whenever OTP Authentication is implemented in the application, always check if the application is responding back with static responses like "message":"Success" or some default application related content.If that is the case , the attacker can easily bypass the 2FA implementation by manipulating the server response. For eg. If the app is giving "message":"OTP is not correct" , the attacker can change it to "message":"Success" and takeover the user account.
cpholguera marked this conversation as resolved.
Show resolved Hide resolved

> The application should always pass user token or some dynamic information related to the user to prevent the attack
cpholguera marked this conversation as resolved.
Show resolved Hide resolved

Consult the [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/01-Testing_for_Session_Management_Schema "OWASP Testing Guide V4 (Testing for Session Management)") for more information about testing session management.

## Testing Stateless (Token-Based) Authentication (MSTG-AUTH-3)
Expand Down