slides - owasp

More documents

Recommendations

Info

CAPTCHAs: More Than Just the Image Client 1 GET /register.php Server ... … 3 4 GET /captcha.php + SESSIONID Return the CAPTCHA 6 POST /verify.php + CAPTCHA Solution + Form Fields 7 2 5 Create a SESSIONID for the current registration request Generate a random CAPTCHA and store in HTTP Session 8 Verify solution 9 www.foundstone.com © 2010, McAfee, Inc.
From Here On… Breaching the Client Side Trust Server Side Attacks Attacking CAPTCHA Schemes with TesserCap Let’s Play Nice www.foundstone.com © 2010, McAfee, Inc.
Page 1 and 2: Attacking CAPTCHAs for Fun and Prof
Page 3: Research Scope Quantcast Top 1 Mill
Page 7 and 8: Hidden Fields, Client Side Storage
Page 9 and 10: Arithmetic CAPTCHAs www.foundstone.
Page 11 and 12: CAPTCHA Rainbow Tables Implementati
Page 13 and 14: CAPTCHA Rainbow Tables Attacking St
Page 15 and 16: CAPTCHA Rainbow Tables Dynamic Iden
Page 17 and 18: CAPTCHA Fixation Attack Client 1 GE
Page 19 and 20: Persistent CAPTCHAs Same CAPTCHA wa
Page 21 and 22: In Session CAPTCHA Brute-Force Clie
Page 23 and 24: OCR Assisted CAPTCHA Brute-Force So
Page 25 and 26: The Victims www.foundstone.com © 2
Page 27 and 28: TesserCap Introduction Retrieve CAP
Page 29 and 30: Spatial Filters This Image: Digital
Page 31 and 32: TesserCap Results CAPTCHA Provider
Page 33 and 34: Let’s Play Nice a.k.a. Conclusion
Page 35 and 36: A Secure CAPTCHA Implementation No
Page 37: Thank You! Gursev Singh Kalra (@igu

slides - owasp

Create successful ePaper yourself

Delete template?

Save as template?