Bluffing a session value

[MikeGarde]

I am setting up a forum for students at a school and to save my unpaid time I decided to look at some of the free prepackaged forums available. I decided on

http://www.maxwebportal.com

I know, I know, there is no reason to give me shit about it. When I get some time I am going to develop my own, but that’s not why you are reading this.

My concern with the system is this:
The authentication process for administrators and moderators appears good; however it requires only one variable to gain access to some administrator functions,

For example if the user is logged out and value A is placed into variable B inside the users session cookie then he can access administrator featured including taking the forum offline or displaying previously hidden user data.

Now as far I am aware this value must be placed into the user’s web browser by the server. But I am assuming that someone is aware of a way to bluff this.

What I am looking for is a Hack that can place a given value into a given variable, bluffing the browser into believing that it is the website.

Once this value is loaded that person would have the access I explained above.

If a program that is capable of this does not exist then I have no concern. But I can only assume that it does, it just seems too simple.

Thanks in advance for any help

 

[Salem]

It depends on the value that is needed to enable admin access.

If it is something trivial like

admin=yes

Then gaining access will be trivial.

If on the other hand, the server generates a session key which is valid once only, along the lines of say

admin=35a6507dcee725e3adbcc867e67e8446

Then any "hacker" will need to be a lot more inventive.

 

[MikeGarde]

Well it just-as-well use "yes" because the number it uses is not generated

Session(strCookieURL & "Approval&quot = "256697926329"

strCookie is a variable that gets the path info
the output looks like this:
/scad/Approval : and then the above value

This is a session variable that it gives every user that successfully loges in as an Administrator or System Moderator. This key gives them access to the administrator functions of the system. Nothing is random about it. Hence my concern.

Ohh, and I didn’t mention it above, the programming is done in ASP

Thanks again.

 

[MikeGarde]

sorry, just for clarification, /scad/Approval it may be easier to read

/somefolder/Approval

 

[pansophic]

You may want to look at this:

http://news.com.com/2100-1023-275643.html?legacy=cnet

http://lists.insecure.org/lists/bugtraq/2003/Jun/0068.html

It is easy to alter cookies on the local machine, and if the variable is static you can count on the fact that one of your students will figure it out, and alter their own cookie. Maybe not this week, or even next....but eventually.


pansophic