Q K Authentication Authentication can bypass authentication Olga can influence or alter (no card) (no card) because it is not enforced with authentication code/routines so equal rigor for all types of they can be bypassed authentication functionality (e.g. register, password change, password recovery, log out, administration) A 2 3 Session Session Session Session You have invented a new attack (no card) William has control over the Ryan can use a single account in against Session Management generation of session identifiers parallel concurrent sessions are allowed Management Management Management Management
Authentication Q Authentication K can bypass authentication because it is not enforced with equal rigor for all types of authentication functionality (e.g. register, password change, password recovery, log out, administration) Olga can influence or alter authentication code/routines so they can be bypassed (no card) (no card) Session Management A Session Management Session Management 2 Session Management 3 You have invented a new attack against Session Management (no card) William has control over the generation of session identifiers Ryan can use a single account in parallel concurrent sessions are allowed
20150331165650%21OWASP-Cornucopia-Ecommerce_Website.docx