Easy
QuickCourt reset-code takeover
A padel and tennis court booking site. The reset code is derived from the send time, with no rate limit.
0 solves
Authentication & Session Flaws
Small mistakes in login, reset and session handling that individually look harmless and add up to account takeover.
What it is
Authentication and session handling accumulate small design mistakes that each look harmless in isolation: a reset code that is short but "impossible to guess fast enough," a signing key that is technically secret but shipped to the browser anyway.
How it works
$code = str_pad(crc32((string) time()) % 1000000, 6, '0', STR_PAD_LEFT); mail($user->email, 'Your reset code', $code);
A code derived from a predictable value, like the current timestamp, is not random no matter how it looks. With no rate limit, even a genuinely random six-digit code is only a million requests away.
Real-world impact
Account takeover, directly, with no phishing or malware required.
How to prevent it
- Generate reset codes and tokens with a CSPRNG, never a timestamp or counter.
- Rate limit attempts per account, not only per IP address.
- Never ship a value meant to be secret, such as a signing key, inside client-side JavaScript.
Labs in this topic
Medium
MoveWell Physio remember-me forgery
A physical-therapy appointment portal. The "remember me" cookie is XORed with a key the client-side JS also ships.
0 solves