slides - owasp

More documents

Recommendations

Info

CAPTCHA Fixation Attack Client 1 GET /captcha.php + SESSIONID Server 2 HTTP/1.1 302 Moved Temporarily Location: /get_captcha.php?id=captchaID 3 Pick a random CAPTCHA ID from finite set of CAPTCHA values GET /get_captcha.php?id=evil_ID+ SESSIONID 5 4 CAPTCHA 6 < CAPTCHA Verification > Set CAPTCHA ID and/or solution in HTTP Session www.foundstone.com © 2010, McAfee, Inc.
Persistent CAPTCHAs Same CAPTCHA was returned for any number of registration attempts CAPTCHAs can be brute-forced www.foundstone.com © 2010, McAfee, Inc.
Page 1 and 2: Attacking CAPTCHAs for Fun and Prof
Page 3 and 4: Research Scope Quantcast Top 1 Mill
Page 5 and 6: From Here On… Breaching the Clien
Page 7 and 8: Hidden Fields, Client Side Storage
Page 9 and 10: Arithmetic CAPTCHAs www.foundstone.
Page 11 and 12: CAPTCHA Rainbow Tables Implementati
Page 13 and 14: CAPTCHA Rainbow Tables Attacking St
Page 15 and 16: CAPTCHA Rainbow Tables Dynamic Iden
Page 17: CAPTCHA Fixation Attack Client 1 GE
Page 21 and 22: In Session CAPTCHA Brute-Force Clie
Page 23 and 24: OCR Assisted CAPTCHA Brute-Force So
Page 25 and 26: The Victims www.foundstone.com © 2
Page 27 and 28: TesserCap Introduction Retrieve CAP
Page 29 and 30: Spatial Filters This Image: Digital
Page 31 and 32: TesserCap Results CAPTCHA Provider
Page 33 and 34: Let’s Play Nice a.k.a. Conclusion
Page 35 and 36: A Secure CAPTCHA Implementation No
Page 37: Thank You! Gursev Singh Kalra (@igu

slides - owasp

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?