Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: HTTP sniffer for Digest Authentication?

from [Saqib . N . Ali] Network Security [Permanent Link]
Subject: Re: HTTP sniffer for Digest Authentication?
Date: Mon, 20 Sep 2004 21:45:01 -0700 
If I remember correctly Colasoft's ( http://www.colasoft.com ) can capture 
the MD5 digest for authentication for HTTP traffic, and display them in a 
nice format.

However I am not sure how you plan to use this Digest to replay an attack. 
Usually the webservers use "nonce" to calculate the MD5 digest for digest 
authentication, which makes replaying an attack, using a sniffed digest, 
virtually impossible. Nonce is different each time 401 challenge is 
issued, thus making the digest different each time.
 
Thanks.
Saqib Ali
http://validate.sf.net

Ivan Ristic <ivanr@webkreator.com> wrote on 09/20/2004 11:04:43 AM:



Does anyone know of a tool that automates Digest authentication
sniffing? Or performs any other related activity (e.g. uses
the sniffed hash to authenticate against the web server)?

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Has anyone ever exploited these Websphere (WAS) Weaknesses, If so How ? Can anyone Elaborate ?, bob
Next by Date:  Re: online bill payment using OFX or similar?, Ido Rosen
Previous by Thread:  HTTP sniffer for Digest Authentication?, Ivan Ristic
Next by Thread:  Re: HTTP sniffer for Digest Authentication?, Ivan Ristic
Indexes:  [Date] [Thread] [Top] [All Lists]