1
00:00:01,100 --> 00:00:10,490
So logout is another important function in applications as a login mechanism log out, you should also

2
00:00:10,490 --> 00:00:11,570
be done securely.

3
00:00:12,450 --> 00:00:15,690
But sometimes the application doesn't log out the user properly.

4
00:00:16,770 --> 00:00:20,160
And of course, this causes some serious privacy problems.

5
00:00:21,300 --> 00:00:25,060
There may be hundreds of ways to implement such an insecure logout function.

6
00:00:25,500 --> 00:00:28,740
So let's just have a look at one of them from BW.

7
00:00:29,650 --> 00:00:31,780
OK, so go to Caleigh and log in to be Web.

8
00:00:32,890 --> 00:00:39,340
And from the drop down menu above opened the logout management under broken authentication.

9
00:00:41,190 --> 00:00:45,960
OK, so this is a sample authenticated page, and the default level is low.

10
00:00:46,950 --> 00:00:53,430
Now view the page source to get some interesting information if, of course, the source has it.

11
00:00:54,360 --> 00:00:56,120
And there's nothing here.

12
00:00:58,000 --> 00:01:04,510
So when the link is clicked, JavaScript confirmation dialogue will appear and then the location will

13
00:01:04,510 --> 00:01:07,150
redirect us to a new page.

14
00:01:07,570 --> 00:01:10,900
B.A. underscore logout, underscore one.

15
00:01:12,090 --> 00:01:13,890
OK, so now open berp.

16
00:01:15,070 --> 00:01:16,990
And activate interception.

17
00:01:19,760 --> 00:01:22,470
I'm going to rearrange my brother here for a better view.

18
00:01:23,550 --> 00:01:27,630
All right, enabling foxy proxy to send traffic to burb.

19
00:01:28,520 --> 00:01:31,340
And now I'm going to click here to logout.

20
00:01:31,370 --> 00:01:31,940
OK?

21
00:01:32,990 --> 00:01:35,210
And burb capture the lock out request.

22
00:01:36,120 --> 00:01:37,710
So let's forward the request.

23
00:01:38,970 --> 00:01:47,340
And we get a three oh two redirection response, hmm, so it redirects us to another page with a location

24
00:01:47,340 --> 00:01:47,670
header.

25
00:01:48,840 --> 00:01:50,370
What is it, log in.

26
00:01:52,080 --> 00:01:54,240
So that means that the application log out.

27
00:01:55,270 --> 00:01:59,350
Sends us to the login page, doesn't log is out.

28
00:02:00,830 --> 00:02:04,550
So this is a general logout mechanism example.

29
00:02:06,180 --> 00:02:09,080
And I'm going to forward the next messages as well.

30
00:02:11,200 --> 00:02:12,370
And I logged out.

31
00:02:14,720 --> 00:02:19,910
So the login page opened in the browser, but do we really log out?

32
00:02:20,680 --> 00:02:24,710
OK, so now move on to the back button in the toolbar, right?

33
00:02:24,710 --> 00:02:25,190
Click.

34
00:02:26,120 --> 00:02:29,780
And you will see pages that we've previously visited and cashed.

35
00:02:31,040 --> 00:02:35,330
As you can see, the authenticated page that we visited is right there.

36
00:02:36,250 --> 00:02:43,230
So if we go back, the page will be displayed and I forgot the purpose interception mode.

37
00:02:43,480 --> 00:02:44,530
So go forward.

38
00:02:46,190 --> 00:02:50,600
Disable interception, disable foxe proxy also.

39
00:02:52,130 --> 00:02:56,510
And open the page again, as we think it should.

40
00:02:56,540 --> 00:02:58,640
So now let's visit some other pages.

41
00:03:00,310 --> 00:03:02,710
And as you can see, we're still logged in.

42
00:03:04,080 --> 00:03:08,410
So even for the medium and high level, the application really blog out the user.

43
00:03:10,540 --> 00:03:12,580
But there are a few differences in the code.

44
00:03:13,330 --> 00:03:14,650
So now select medium.

45
00:03:16,340 --> 00:03:21,410
And I'm going to click here to log out, OK, so I logged out.

46
00:03:22,630 --> 00:03:25,330
But when I pressed the back, but nothing happens.

47
00:03:26,690 --> 00:03:29,330
This means that the application did indeed Lagny out.

48
00:03:30,770 --> 00:03:33,470
And the same thing happens when I choose the high level.

49
00:03:34,100 --> 00:03:38,360
OK, so let's let's go to the code and have a look, see what's happening.

50
00:03:39,640 --> 00:03:45,520
Now, I previously downloaded the VoIP application of Cali because sometimes I want to show you the

51
00:03:45,520 --> 00:03:51,070
code as well, so I'm going to open the underscore logout, underscore one.

52
00:03:52,070 --> 00:03:56,630
And scroll down to see the actual section of logout.

53
00:03:58,360 --> 00:04:04,540
I yeah, so it works based on the cookie levels, if the level is low, it does nothing and that's why

54
00:04:04,540 --> 00:04:06,810
we can see the page by pressing the back button.

55
00:04:08,160 --> 00:04:11,430
And if the level is medium, it just destroys the session.

56
00:04:13,100 --> 00:04:15,410
Now, for locking out, it may be enough.

57
00:04:16,350 --> 00:04:23,280
But it isn't really secure, is it, because the session related values are still present in the session

58
00:04:23,280 --> 00:04:24,720
variable in memory.

59
00:04:26,820 --> 00:04:31,440
So this variable also needs to be assigned a null or empty value.

60
00:04:32,590 --> 00:04:36,610
And that is done in the high level, as you can see here.

61
00:04:37,600 --> 00:04:42,340
So this bug is directly caused by an insecure logout mechanism.

62
00:04:43,590 --> 00:04:45,780
But we'll be talking about session problems in the next.

63
00:04:47,130 --> 00:04:49,800
I want to go on with a couple of other problems.