OWASP Security Shepherd Project - Broken Session Management Lesson

What is Broken Session Management Vulnerability/Threat?

     Attacks against an application's authentication and session management can be performed using other vulnerabilities. For example, any application's session management can be compromised if there is a XSS exists in the application. (Because an attacker could always steal user's session tokens to authenticate himself/herself.) However, in this topic, OWASP is more focus on the vulnerabilities that happens in the applications' authentication and session management process.
    Broken session management are usually happens on logout process, password management, secret question and account update. An attack can potentially abuse these functions to modify other users credentials by guessing their secret question or through parameter abuse. Finding such vulnerabilities can sometimes be difficult, as each implementation is unique.

The following scenarios are vulnerable to these security risks;
1) User credentials are stored with insufficient cryptography levels.
    Ex: Using base64 as encryption method...
2) User credentials can be guessed or changed through poor account management.
    Ex: Using sequential numbers as user identifier/session tokens...
3) Session identifiers are exposed in the URL.
    Ex: http://www.example.com/login.html?session_token=xxxxxx...
4) The application does not use sufficient transport protection (Such as HTTPS or SFTP).
    Ex: Using FTP for transfer account/password(FTP is plaintext transmission.)
5) Session parameters can be manually changed by the user through application functionality.
    Ex: See the answer of this lesson : -)

Lesson

    In  this lesson, we are asked to trick the server to believe we have completed the lesson.



     First, let's click at the Complete This Lesson button directly to see what happens.


    There must be a session validation process in this application! Let's use BurpSuite to see what exactly do we send out.


    Through the request captured by BurpSuite, we can see that there is a Cookie named lessonComplete and its value is lessonNotComplete. What if we just change its value as lessonComplete and forward this request?


    Great!! This completes the Broken Session Management Lesson : -)