Authentication Testing - Testing for Vulnerable Remember Password & Password Reset

Most modern web application has a way for users to reset their password through "security questions". Apps also tends to have a "remember password" feature.  In this test, we check to see if these two features are properly implemented.

The main problem with using security questions for password resets is that often times, the security questions are really not that personal. For example, "your mother's main name" is a very common yet terrible question. A mother's maiden name can easily be retrieved by a hacker. A better question could be "What was your 2nd grade teacher's name".  The problem with saving passwords to the browser is that anyone who has access to that system can use the  account.

So, how does one exploit these features?  Well to exploit the password reset feature, we must first see if the reset process even requires a secret question. Sometimes, the reset password process just sends a new or the old password the e-mail address on file. This means that if the e-mail account is compromised, the password can easily be retrieved. If secure questions are used, we then must asses the strength of the questions. We do this by figuring out how many questions must be answered and also the strength of the question. A lot of times, a user is given the option of choosing 1 or 2 questions from a question "bank". We can take advantage of this by choosing the questions that can easily be answered with a little bit of research.