User credentials are not encrypted when they are transmitted?!
I just built the website and then made the security scan by Acunetix Web Vulnerability Scanner which identified some hole in my website: "User credentials are not encrypted when they are transmitted". I guess that it means that someone who is able to monitor my website is able to capture someone's else username as well as password.
I would like to check this issue myself. Can you recommend me which tools I have to use in order to check this issue?!
I would like to check from a different computer, run some tools, and then log in with my personal computer in order to see if I can capture the credentials or not?!
Re: User credentials are not encrypted when they are transmitted?!
I don't know what you call "monitoring your website" but the message means that creds are sent in plain text. A simple Mitm attack or decrypting wpa/wep packets, or capturing packet on an open wifi network would show them clearly.
You should use ssh to protect them. Well... Even that can be broken with sslstrip.
Hope this helps !
Running both KDE and GNOME BT5 flawlessly. Thank you !
Re: User credentials are not encrypted when they are transmitted?!
Which tools can I use in order to get a gateway of my uploaded website? Again, I would like to check if someone can do it from a different IP address?!
Re: User credentials are not encrypted when they are transmitted?!
Which tools can you use to get "what" again?Originally Posted by alex198555
-----------
~peace
MacPhail
Re: User credentials are not encrypted when they are transmitted?!
The simple tool traceroute can help you figure out what exactly your gateway is from the website. And simply watching the link actions while logging in will tell you whether or not encryption is activated. If "https" pops up during log in, then it's there. But I'm guessing you won't see it there because of the scanner you used. And it's probably not that hard to turn on encryption, but I've never put one up.
Re: User credentials are not encrypted when they are transmitted?!
First I suggest using your eyes and brain. Does the login form require the use of SSL (HTTPS) or is it available without SSL (HTTP)? Does the login form action require the use of SSL (HTTPS) or is it available without SSL (HTTP)?
Second, fireup wireshark or ettercap, access the site via HTTP (not HTTPS) and record yourself logging in, then do a string search on the captured traffic for your username or password.
Last edited by thorin; 04-26-2011 at 12:51 PM.
I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.
I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.
Re: User credentials are not encrypted when they are transmitted?!
OK! Let's say I have my own website who has IP of AAAA.AAAA.AAAA.AAAA.
I check my website with some security scanner and it was figured out that "# User credentials are not encrypted when they are transmitted?!".
So, my laptop IP has the different IP address from my website like BBBB.BBBB.BBBB.BBBB.
The question is which tools may I use in order to capture the user credentials?! Which set of tools can be used to check or pen-test if my website is secure?!
So, I should be able to capture the user credentials from website's IP (AAAA one) by using laptop's IP(BBBB ones).
Waiting for your recommendations?!
Re : User credentials are not encrypted when they are transmitted?!
Answer has already been given (cf. my previous post, and other's as well). Maybe it's time for some googling
Running both KDE and GNOME BT5 flawlessly. Thank you !
Re: User credentials are not encrypted when they are transmitted?!
If your website is safe or not, will depend on the privileges of the hacked account. Maybe just the account will be compromised.
Re: User credentials are not encrypted when they are transmitted?!
@alex198555 try reading! Answers to your questions appear in posts 6, 2, and to some degree 5.
I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.
I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.
Posting Permissions
