9d8c58bef3
git-svn-id: http://webgoat.googlecode.com/svn/trunk@367 4033779f-a91e-0410-96ef-6bf7bf53c507
43 lines
1.8 KiB
HTML
43 lines
1.8 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
|
<title>Multi Level Login 2</title>
|
|
<link rel="stylesheet" type="text/css" href="lesson_solutions/formate.css">
|
|
</head>
|
|
<body>
|
|
<p><b>Lesson Plan Title:</b> Multi Level Login 2</p>
|
|
|
|
<p><b>Concept / Topic To Teach:</b><br/>
|
|
A Multi Level Login should provide a strong authentication.
|
|
This is archived by adding a second layer. After having logged
|
|
in with your user name and password you are asked for a
|
|
'Transaction Authentication Number' (TAN). This is often used by
|
|
online banking. You get a list with a lots of TANs generated only
|
|
for you by the bank. Each TAN is used only once. Another method is
|
|
to provide the TAN by SMS. This has the advantage that an attacker
|
|
can not get TANs provided by the user.
|
|
</p>
|
|
|
|
<p><b>General Goal(s):</b><br/>
|
|
In this lesson you have to try to break into another account.
|
|
You have an own account for WebGoat Financial but you want to log into
|
|
another account only knowing the user name of the victim to attack.
|
|
</p>
|
|
|
|
<b>Solution:</b><br/>
|
|
The solution for this lesson is similar to the solution from
|
|
multi level login 1 stage 2 but the approach is a little different.
|
|
This time you have only the user name of your victim but an own account
|
|
on WebGoat Financial. <br><br>
|
|
Log in as Joe with password banana. Now make sure the next request will be intercepted
|
|
by WebScarab. Fill in the TAN you are asked for and hit the submit button.
|
|
Change now the hidden_user value from Joe to Jane and you are logged in
|
|
as Jane.
|
|
<div align="left">
|
|
<img src="lesson_solutions/MultiLevelLogin2_files/success.png"><br>
|
|
<font size="2"><b>Figure 1: Manipulation Of The Hidden Field With WebScarab</b></font>
|
|
</div>
|
|
|
|
</body>
|
|
</html> |