1

I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the tokens had 8 characters, all alphabetes capital and small, no numbers or special characters.

Would you consider it a weak token? If so, how long would it take to brute force such a token considering you have a good computer and internet?

Also, with each account it appears that a password reset token is attached. It never changes no matter how many times I ask for password reset link - it always comes with the same token for that particular account. Wouldn't you consider that a vulnerability?

  • I would report it as a vulnerability, eight characters is just not enough and should be fixed quite easily in code. Are the "static" tokens session based? Meaning if you reset your cookies, do you still get the same "static" token as before or did it change? – Jeroen Sep 4 '19 at 6:12
  • 1
    If every account has an unchanging reset code, then that's bad. It's like a backdoor password you can never change or disable. It might not actually be unchanging though. You might want to check if guessing many invalid codes, if waiting a couple days, or if going through with the password reset forces the code to change. – Future Security Sep 4 '19 at 20:44
  • The passoword reset token should be one time value with a high diversity. Low diversity in token is treated as medium vulnerabilty. – Bartosz Rosa Sep 16 '19 at 22:07
6

all the tokens had 8 characters, all alphabetes capital and small, no numbers or special characters

This is on the edge of acceptable.

It isn't easy to compromise an account this way. In an online brute-force attempt you can typically try between 10 and 100 tries per second. A random eight character password like you describe has 53459728531456 possibilities. Brute-forcing all the possible passwords would take 16951 years. So this isn't really a feasible attack.

But it could be improved. If the token is sent in an email and the user doesn't have to type it in, there is no reason not to make it a little bit longer.

it never changes no matter how many times i ask for password reset link

This is suspicious. Normally, a password reset token expires after some time, or after it has been used. In your case, it doesn't seem to expire at all. This means that once a token or account has been compromised, it is not possible to recover from this: the attacker can keep resetting the password if he knows the token.

| improve this answer | |
  • i think you meant "there is no reason to not maker it longer" – Sefa Oct 4 '19 at 9:08
1

How long the brute force would take depends on a lot of factors. If done over the internet, it would depend on how fast the server responds to an attempt, and maybe whether the attacker is able to use multiple clients (i.e. a botnet) to run attempts in parallel. 8 characters is pretty short, but brute forcing it through the website would probably take a very long time.

Now if you were to get a hold of a hashed copy of the token (such as through a database compromise), it would be a lot faster, but would depend on the hashing algorithm. An 8-character password (upper + lower case) has about 52⁸, or 53 quadrillion possibilities.

As an example, according to this benchmark one GTX 1080 can calculate about 25 billion md5 hashes per second. This would calculate all possibilities in about 36 minutes.

According to the same benchmark, the same GPU would calculate a slow hash like bcrypt at about 13,000 hashes per second. That comes up to about 130 years. (Note, however, that the speed of bcrypt depends on the number of rounds it is configured to use. In the benchmark, the work factor appears to be set to 5.)

it never changes no matter howany times i ask for password reset link it always comes with same token for that perticular account , wouldn't you consider a vulnerability?

With regards to this, it would definitely be a bad practice. Reset tokens should be time limited. If the actual user requested the reset, he/she should be able to use the token within a short period of time. Allowing the reset token to be used indefinitely invites brute force attacks, and also gives more time for attackers to try to steal the token from the original user. Further, if the reset token never changes, it essentially becomes a permanent password-alternative that cannot be changed.

| improve this answer | |
0

Leaving this, rather worrying, fact aside for the moment:

it always comes with the same token for that particular account

then an eight-character, alphanumeric, randomly generated reset token shouldn't be a vulnerability if properly handled by the server. A password reset token should essentially be a one-time-use object: you ask to reset the password, the system emails you the reset token (to your known email address) and you use that token to access the Enter a new password page. Once that has been done, the token should then be useless. As such, it should never be possible to brute-force the token online. Even if you allow two or three attempts to enter the same token (to allow for finger-trouble), this only gives you three attempts at guessing a token. (After that, the token would be discarded and the user would need to request a new reset token).

An offline attack (using a compromised database) shouldn't be an issue if an secure, password-quality hash is used to store the temporary tokens. Indeed, it should be safer than for normal passwords, if reset tokens are also time-limited (if tokens only work for 24 hours, you have to both exfiltrate the database and brute-force the token's hash within that 24 hour period).

However, given:

it always comes with the same token for that particular account

then clearly all bets are off. This is so clearly "bad practice" (as other answers state), that there seems little likelihood that the rest of the system has been designed well.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.