slides - owasp

More documents

Recommendations

Info

Who Am I Principal Consultant with Foundstone McAfee Tools (TesserCap, SSLSmart, and many internal) Security Research, Web Applications, Networks, Mobile Applications…. and more Ruby, C#, Rails www.foundstone.com © 2010, McAfee, Inc.
Research Scope Quantcast Top 1 Million • 200+ CAPTCHA schemes analyzed • Scores of Websites for Implementation CAPTCHA Schemes • Known OCR Engines for Classification • Custom Image Preprocessing CAPTCHA Implementations • Register User Pages • Recover Account/Password Pages • Contact Us and Feedback Pages www.foundstone.com © 2010, McAfee, Inc.
Page 1: Attacking CAPTCHAs for Fun and Prof
Page 5 and 6: From Here On… Breaching the Clien
Page 7 and 8: Hidden Fields, Client Side Storage
Page 9 and 10: Arithmetic CAPTCHAs www.foundstone.
Page 11 and 12: CAPTCHA Rainbow Tables Implementati
Page 13 and 14: CAPTCHA Rainbow Tables Attacking St
Page 15 and 16: CAPTCHA Rainbow Tables Dynamic Iden
Page 17 and 18: CAPTCHA Fixation Attack Client 1 GE
Page 19 and 20: Persistent CAPTCHAs Same CAPTCHA wa
Page 21 and 22: In Session CAPTCHA Brute-Force Clie
Page 23 and 24: OCR Assisted CAPTCHA Brute-Force So
Page 25 and 26: The Victims www.foundstone.com © 2
Page 27 and 28: TesserCap Introduction Retrieve CAP
Page 29 and 30: Spatial Filters This Image: Digital
Page 31 and 32: TesserCap Results CAPTCHA Provider
Page 33 and 34: Let’s Play Nice a.k.a. Conclusion
Page 35 and 36: A Secure CAPTCHA Implementation No
Page 37: Thank You! Gursev Singh Kalra (@igu

slides - owasp

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?