Authentication and Session Flaws: Small Mistakes That Add Up to Takeover

What it is#

These bugs rarely look dramatic on their own. A code that's guessable, a cookie that's only obfuscated instead of signed. Individually they seem minor; together they add up to taking over someone else's account.

The labs here#

• QuickCourt reset-code takeover: the reset code isn't random. It's derived from crc32(time()), which means it's predictable if you know roughly when it was generated, and there's no rate limit stopping you from trying candidates.
• MoveWell Physio remember-me forgery: the "remember me" cookie is an account id XORed against a fixed key, and that key ships inside the site's own client-side JavaScript. Read the key, and you can build a valid cookie for any account id you want, no signature required.