% secure 2

[ThomasJSmart]

Just thought i would mention it

when making a login/password system make sure you do something that stops a user from loging in with "%"

iv noticed that a lot of login/pasw tutorials dont mention this....... and it can make a login/pasw site totally insecure.



I learned a bit yesterday, today i learned a lot, imagine what i'll learn tomorrow!

 

[KarveR]

Depending on how slack the person doing the set up/site was, its also possible to log in to places as root with no password too.

how hard is it to add this.

$username=str_replace('%','',$username);
// don't md5 the password before this.
$password=str_replace('%','',$password);
if(empty($password)){
echo "No password entered!":
exit;
}


______________________________________________________________________
There's no present like the time, they say. - Henry's Cat.

 

[jimoblak]

I'm lost here. How does allowing '%' make a password-authenticated page or site insecure? I just tried it on my authentication script and it doesn't do anything. - - - And I'm not that smart when it came to making my authentication script. It was one of the first scripts I wrote and haven't updated it with my recent learning.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[ThomasJSmart]

% means anything, its like the wildcard *

if your password system is like this:

SELECT * from logins WHERE password=$pass && login=$login


then this should return 1 row where the login and pasw are correct:
$login = "name"
$pasw = "pasw"


however this will return any row:

$login = %
$pasw = %


this is like querying

SELECT * from logins WHERE password=anything && login=anything





I learned a bit yesterday, today i learned a lot, imagine what i'll learn tomorrow!

 

[ThomasJSmart]

another thing iv seen is that ppl sometimes use this as a solution

if($pasw=="%"){ don't continue }else{ continue }

of course if a user then typed %% as a pasword it would continue....


the insecure % thing doesnt just alow users acces to a protected site but a user can do %a %b %c etc. to go through all the letters of the alfabet and thus see all the details of each account as these are shown in the protected area....



I learned a bit yesterday, today i learned a lot, imagine what i'll learn tomorrow!

 

[sleipnir214]

K9logic:
In what database engine are you talking about?

In this query:

SELECT * from logins WHERE password=$pass && login=$login

"%" will not work as a wildcard in either position in MySQL. And to the best of my knowledge, neither is the character a wildcard in an equivalence comparison in PostgreSQL, SQL Server, or Oracle.

Only when using the LIKE operator in MySQL is "%" a wildcard. But if you wanted your query to be secure, you shouldn't have use LIKE in the first place.



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[ThomasJSmart]

thats true, but it still happens

u wouldnt believe the amount of sites that are left open to intrusion with %



I learned a bit yesterday, today i learned a lot, imagine what i'll learn tomorrow!

 

[jimoblak]

I'm using MySQL and I cannot bypass anything by entering %. I'm not using LIKE in my SQL. ...so I am puzzled how this is a problem. Could it be the version of MySQL? Did earlier versions allow this security hole?

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[ingresman]

I'm on 4.0.18 on XP, and im all ok. Can you tell us which site it fails on !!!!

 

[sleipnir214]

It is not a flaw in MySQL. It is a logic flaw in some scripts which use the LIKE operator anywhere near passwords.

Since "%" only has any special meaning within the context of a LIKE operation, simply don't use LIKE. You shouldn't be using LIKE to check user credentials anyway -- do you want your user to provide exact credentials, or approximate credentials.

The very query K9logic posted is an example:

SELECT * from logins WHERE password=$pass && login=$login

For certain in MySQL and for fairly sure in most other RDBMs, "%" has no more meaning in the above query than "a" does.

The real security gotcha in the above query could more than likely be the missing quotes around the value for which the query is searching. That could lead to more security failures in more interesting ways than just "%".



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[NVSbe]

Very useful tip. While I didn't use LIKE for my passwords anyway, it was something that I indeed didn't think of as possible... I guess I'll have to spend some more time now thinking on other possibilities I might have forgotten. Thank you.

--------------------------------------
It's not the monsters under your bed, it is the men next door.
That make you fear, make you cry. Make you cry for the Child.
All the wars are fought amongst those lonely men. Unharmed, unscarred.