From: Maxime Ducharme (mducharmecybergeneration.com)
Date: Mon Nov 06 2006 - 09:43:39 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello
 
Depends if you are using Windows auth to secure a web site

This configuraiton will prompt the user for a login when
accessing web site

if there is no pompt when accessing your web site, username
is "anonymous", i.e. IUSR_MACHINENAME where MACHINENAME
is the name of your server

This user is logged in IIS log file, ensure cs-username
is checked in IIS logging, then open the log file

Another way to extract this user from HTTP commnication
is to capture 1 HTTP request from the client and read the
HTTP header "Authorization"

if the first string you see is "Basic", you can extract
username and password from the second string which
is username:password encoded in base64

So the complete header for someuser / somepass would be :

Authorization: Basic c29tZXVzZXI6c29tZXBhc3M=

use base64 tools to decode it :
http://www.rbl.jp/base64.php
http://josefsson.org/base64/
...

HTH

Have a nice day

Maxime Ducharme
 

-----Message d'origine-----
De : listbouncesecurityfocus.com [mailto:listbouncesecurityfocus.com] De
la part de Anurag Agarwal
Envoyé : 3 novembre, 2006 21:14
À : security-basicssecurityfocus.com; webappsecsecurityfocus.com
Objet : How to find the login name of a user accessing my website

I was wondering if anyone could help me how I can find out the windows login

of the user, accessing my website. I think i read it somewhere that it gets
passed as a header information but i am not sure. If anyone of you guys can
help me with this, i will really appreciate it.

thanks
anurag

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan delivers new remediation capabilities, key regulatory compliance
reporting, and productivity enhancements that dramatically improve,
automate and streamline users' ability to quickly find, remediate and
manage web application security vulnerabilities. Change the way you think
about application security testing - download AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008YTE
--------------------------------------------------------------------------

-------------------------------------------------------------------------
Sponsored by: Watchfire

It's been reported that 75% of websites are vulnerable to attack. That's
because hackers know to exploit weaknesses in web applications.
Traditional approaches to securing these assets no longer apply.
Download the "Addressing Challenges in Application Security" whitepaper
today, and see for yourself.

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008YTU
--------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]