Based Burpsuite safety testing six: ciphertext comparison certification test
Scenario 1: The user password encryption method
- Browser client passwords in the foreground encryption that submitted password is transmitted in ciphertext encrypted login, the ciphertext is a front end by local JS script to achieve, as the system is MD5 encrypted
so by brute force way to get users login password
- After encryption algorithm and database comparison, the same can log on to the server after the password encryption algorithm, the server receives the user name and password.
- The second is more secure, because the first way it is easy to get to from the code encryption process.
System Repair program:
Preferably the password encryption process and the matching process in the server ciphertext background, the background is specified by the encryption password encryption processing and database stored in the encrypted passwords do the comparison, the same is allowed to log on.