SecurityInnovation/TMContentReview — Issue #118: How to Test for Network Credential Sniffing Bugs
Author: SergeTruth
Created: 2011-11-07 22:49:49+00:00
State: open

Step 1: Understand Attack Scenarios
First, it is necessary to understand the different attack scenarios related to network credential sniffing bugs.

A network credential sniffing attack [stars] with an attacker...

"The username and password will travel in clear text unless the application encrypt[s] the password before sending it to the server of if the authentication packet is sent over a secure connection such as SSL/TLS."

"This means that before any authentication packets are exchanged between the client and the server, the client and server must establish an encrypted channel using public key encryption using digital certificates like those used in SSL/TLS, HTTPs, or through Kerberos authentication (integrated Windows Authentication through IIS)[ ]."

"or they can run [a] client application like Xarp to protect against ARP poisoning attacks in switched networks."

"Step 3: Execute Test Cases
Now that you’ve learned the theoretical aspects of network credential sniffing bugs, i[f] is necessary to execute the following test cases to check in your application is vulnerable."

"Execute an eavesdropping attack between [a] client and ASP.NET application. For detail[s] on eavesdropping attacks refer to Team Mentor’s article How to Test for Network Eavesdropping Bugs.
Use network monitoring tool[s] to check if credentials are transmitted in clear text."

"In the HTTP proxy, check if the authentication request’s URL."
Sounds like you were going to say more...