From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Authentication and references

Authentication and references

From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Start my 1-month free trial Buy for my team

Authentication and references

“

- In this lesson, we're going to discuss broken authentication and insecure references, and how these vulnerabilities are exploited by threat actors. First, we have broken authentication. Broken authentication is a software vulnerability where the authentication mechanisms are insecure and can allow the attacker to gain entry. If the application doesn't implement secure authentication mechanisms, then a threat actor is going to be able to exploit the system to compromise a user session or their password. This exploitation usually occurs because the passwords being used are weak or easily guessed, or because the authentication system itself was programmed insecurely and has several coding flaws within it. For example, I've come across some broken authentication mechanisms in my assessments that included mechanisms that display the credentials in clear text, or they used weak randomization when defining their session tokens. I've also seen some that permit brute force login requests…

Contents