SICorp

SICorp

1. Information Disclosure (Username Stored in Cookies)

   • Session Hijacking
     • Update password
       • Web application does not ask for old password while updating
     • Session management compromise, attacker can figure out the cookie generation algorithm and take over the user session

2. Information Disclosure (Mail servers enumerate users)

3. HBCF

   • Plain HTTP authentication
     • Password Compromise
       • Update Password
         • Denial of Service (Account lockout)