Challenges
Last updated
Last updated
Website doesn’t require sufficiently strong passwords. Users may use unsafe passwords, which they shouldn’t be able to, as it’s unsafe.
In this challenge, you need to register a user with a weak password.
Go to /Auth/Register
Usually, this issue occurs when you register a new user with a password that has a low number of password chars and can also be "111, aaaa, test" ... ... As we can see, the site validates the input, which needs to be at least five characters long.
3. Diving into the code, we can see that the password is validated inside javascript.
4 . By removing this check with debugging or intercepting connection, we can set a password at a length of fewer than five characters. This indicates that the input is improperly validated on the server.
Looking into the code (AuthController.cs->AuthBL.cs->UserDAO.cs->RegisterUser) you can see how passwords are stored. Passwords are stored in plain text, which is a big issue.
