Most modern web
application has a way for users to reset their password through "security
questions". Apps also tends to have a "remember password"
feature. In this test, we check to see
if these two features are properly implemented.
The main problem
with using security questions for password resets is that often times, the
security questions are really not that personal. For example, "your
mother's main name" is a very common yet terrible question. A mother's
maiden name can easily be retrieved by a hacker. A better question could be
"What was your 2nd grade teacher's name". The problem with saving passwords to the
browser is that anyone who has access to that system can use the account.
So, how does one
exploit these features? Well to exploit
the password reset feature, we must first see if the reset process even
requires a secret question. Sometimes, the reset password process just sends a
new or the old password the e-mail address on file. This means that if the
e-mail account is compromised, the password can easily be retrieved. If secure
questions are used, we then must asses the strength of the questions. We do
this by figuring out how many questions must be answered and also the strength
of the question. A lot of times, a user is given the option of choosing 1 or 2
questions from a question "bank". We can take advantage of this by
choosing the questions that can easily be answered with a little bit of
research.
