1. Authentication
- Brute Force
- Insufficient Authentication
- Weak Password Recovery Validation
2. Authorization
- Credential/Session Prediction
- Insufficient Authorization
- Insufficient Session Expiration
- Session Fixation
3. Client-side Attacks
- Content Spoofing
- Cross-site Scripting
4. Command Execution
- Buffer Overflow
- Format String Attack
- LDAP Injection
- OS Commanding
- SQL Injection
- SSI Injection
- XPath Injection
5. Information Disclosure
- Directory Indexing
- Information Leakage
- Path Traversal
- Predictable Resource Location
6. Logical Attacks
- Abuse of Functionality
- Denial of Service
- Insufficient Anti-automation
- Insufficient Process Validation
|
 |
Insufficient Anti-automation
Insufficient Anti-automation is when a web site permits an attacker to
automate a process that should only be performed manually. Certain
web site functionalities should be protected against automated
attacks.s
Left unchecked, automated robots (programs) or attackers could
repeatedly exercise web site functionality attempting to exploit or
defraud the system. An automated robot could potentially execute
thousands of requests a minute, causing potential loss of
performance or service.
For example, an automated robot should not be able to sign up ten
thousand new accounts in a few minutes. Similarly, automated robots
should not be able to annoy other users with repeated message
board postings. These operations should be limited only to human
usage.
References
Telling Humans Apart (Automatically)
http://www.captcha.net/
"Ravaged by Robots!", By Randal L. Schwartz
http://www.webtechniques.com/archives/2001/12/perl/
".Net Components Make Visual Verification Easier", By JingDong (Jordan) Zhang
http://go.cadwire.net/?3870,3,1
"Vorras Antibot"
http://www.vorras.com/products/antibot/
"Inaccessibility of Visually-Oriented Anti-Robot Tests"
http://www.w3.org/TR/2003/WD-turingtest-20031105/
To receive your Free Application
Vulnerability Assessment for testing of one attack vulnerability of your choice, please submit your payment of $1999.00 for a second Insufficient Anti-automation attack vulnerability test.
|
