1

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing a new password. So, when pentesting some of these websites I've noticed that the password recovery token seems to be somewhat guessable. Some of the websites use MD5 or Base64 encoding for their password recovery tokens.

So, my question is whether is there are any standard procedures we could use to determine the strength of a token, or the method through which token has been generated?

Example of password recovery link:

http://example.com/users/password?recover_token=qQGgQrwzzz1SV1X9xznc

(Where the password Recovery token is qQGgQrwzzz1SV1X9xznc)

Improve this question
2
  • What do you mean guessable? I don't think I've seen one that was obviously weak x
    – Emily Shepherd
    Apr 3, 2014 at 19:07
  • I have seen some of the cases,that is why i have asked such question.
    – justtrying123
    Apr 3, 2014 at 19:09

2 Answers 2

Reset to default
3

If you do not have access to the source code, you will have to make multiple attempts to see if there are any patterns in the token generation. If it is a basic incrementor, this may be easy to defeat. You can take the length of the token into account as well.

Here are some OWASP guides on the topic, which may be of use:

These will help you with the testing part, but you may want to open a question on the cryto or math SE on how you would actually go about pattern prediction.

Improve this answer
0
1

Burp can execute statistical analysis on tokens with the Sequencer tool.

  • Send requests that return a security token from other Burp Suite tools to test in Burp Sequencer.
  • Reissue the same request repeatedly, to generate a large sample of tokens for statistical analysis.
  • Perform a rigorous set of tests, including the standard FIPS tests and others, to estimate the degree of randomness within the sample, at both the character and bit level. Start performing the analysis with as few as 100 tokens, and re-perform this as a larger sample is collected, up to the FIPS-recommended sample size of 20,000 tokens.
  • View an intuitive, at-a-glance summary of all the tests performed, letting you quickly understand the overall quality of randomness.
  • Review detailed, graphical test output, letting you drill down into the detailed reasons why individual parts of the token passed or failed each test. Load an existing sample of tokens for analysis, if these have already been captured elsewhere.

This functionality is available in the free edition.

Improve this answer
2
  • Thank's fore replying but I already know that .I want a better way to analyse with the corresponding email address.Burp doesn't take email address in to consideration
    – justtrying123
    Apr 4, 2014 at 9:03
  • 1
    @exploitprotocol what does the email address have to do with it? How would the code handling the HTTP request upon token presentation have any idea what email address was involved?
    – Pointy
    Apr 3, 2015 at 16:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .