News for hackers. Stuff that matters.

A comment on Mistakes Beginners Make When Working with Databases. Parent comment

Re:Mistakes Beginners Make When Working with Databases by VLM on Wednesday June 08, 2016 @02:19PM (#11864326)
password reset email #123 gets url /user/123

password reset email #124 gets url /user/124

password reset email #125 gets url /user/125 but that doesn't work because someone predicted it and got there before the requestor. no idea what account they'll get, but they'll get an account of some type.

This also comes up in shipping records. OK where do we go to steal an XYZ delivered today and sitting on a front porch? Well lets check

/shippinglabel/345

/shippinglabel/346

/shippinglabel/347 oh look delivered today, sitting on back porch step, and the address is right there

Another fun one is online financial documents with sequential accounts.

[ Parent | on HN ]
Re:Mistakes Beginners Make When Working with Databases by sopooneo on Wednesday June 08, 2016 @07:32PM (#11866537)
Shouldn't this risk be mitigated with authorization rules? Or do we assume we are delivering pages without any type of auth first?
[ Parent | on HN ]
Re:Mistakes Beginners Make When Working with Databases by dennisgorelik on Wednesday June 08, 2016 @09:13PM (#11866933)
You should allow to reset password to the users without authentication (and therefore without authorization).

That's the nature of password reset link.

[ Parent | on HN ]
Re:Mistakes Beginners Make When Working with Databases by sopooneo on Thursday June 09, 2016 @03:41PM (#11871775)
Oh of course. Good point.
[ Parent | on HN ]