Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: HTTP sniffer for Digest Authentication? |
|---|---|
| Date: | Wed, 22 Sep 2004 09:51:29 -0700 |
That is correct, but there is still a window of opportunity while a server-generated nonce remains valid. Nonce lifetime is implementation and configuration specific. For example, on Apache it defaults to 300 seconds. If I am in position to discover Digest hashes as they travel over the wire, each hash would give me
As I understand, even though a nonce generated digest can be valid for a certain amount of time, it one-use only. In other words once a valid user authenticates, the nonce generated digest is useless to the attacker. This is how I wrote my application, but I m not sure if webservers work the same way. Thanks. Saqib Ali http://validate.sf.net
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | RE: XSS, SQL injection etc - permutations of input strings, Frank Knobbe |
|---|---|
| Next by Date: | Re: HTTP sniffer for Digest Authentication?, Ivan Ristic |
| Previous by Thread: | Re: HTTP sniffer for Digest Authentication?, Ivan Ristic |
| Next by Thread: | Re: HTTP sniffer for Digest Authentication?, Saqib . N . Ali |
| Indexes: | [Date] [Thread] [Top] [All Lists] |