Wstg Athn 01

---
name: wstg-athn-01
description: "Testing for Credentials Transported over an Encrypted Channel"
category: authentication
owasp_id: WSTG-ATHN-01
version: "1.0.0"
author: cyberstrike-official
tags: [authentication, login, credentials, mfa, wstg, athn]
tech_stack: []
cwe_ids: [CWE-522]
chains_with: []
prerequisites: []
severity_boost: {}
---

# wstg-athn-01

## Test ID

WSTG-ATHN-01

## Test Name

Testing for Credentials Transported over an Encrypted Channel

## High-Level Description

This test verifies that user credentials (usernames, passwords, tokens) are transmitted over encrypted channels (HTTPS/TLS) to prevent interception by attackers. Transmitting credentials over unencrypted HTTP exposes them to man-in-the-middle attacks, network sniffing, and session hijacking. All authentication-related traffic must be encrypted.

---

## What to Check

### Encryption Requirements

- [ ] Login pages served over HTTPS
- [ ] Login form submits to HTTPS endpoint
- [ ] Password reset over HTTPS
- [ ] Registration over HTTPS
- [ ] API authentication over HTTPS
- [ ] Session tokens transmitted securely

### Common Vulnerabilities

| Issue                                        | Risk                    |
| -------------------------------------------- | ----------------------- |
| HTTP login page                              | Credential interception |
| Mixed content (HTTPS page, HTTP form action) | Form hijacking          |
| HTTP redirects before HTTPS                  | SSL stripping           |
| Insecure API endpoints                       | Token theft             |

---

## How to Test

### Step 1: Check Login Page Protocol

```bash
# Check if login page is served over HTTPS
curl -sI "http://target.com/login" | head -20
curl -sI "https://target.com/login" | head -20

# Check for HTTP to HTTPS redirect
curl -sI -L "http://target.com/login" 2>&1 | grep -i "location\|http"

# Verify no mixed content
curl -s "https://target.com/login" | grep -i "http://"
```

### Step 2: Analyze Login Form Action

```bash
# Get login form and check action URL
curl -s "https://target.com/login" | grep -i "<form" | grep -i "action"

# Check if form action is HTTPS
curl -s "https://target.com/login" | \
    grep -oP 'action="[^"]*"' | \
    head -5

# Look for JavaScript that might change form action
curl -s "https://target.com/login" | grep -i "form.action\|submit"
```

### Step 3: Test Actual Login Request

```bash
# Attempt login and capture request details
curl -v -X POST "https://target.com/api/login" \
    -H "Content-Type: application/json" \
    -d '{"username":"test","password":"test123"}' 2>&1 | \
    grep -i "< \|> \|ssl\|tls"

# Check for secure cookies
curl -sI -X POST "https://target.com/api/login" \
    -H "Content-Type: application/json" \
    -d '{"username":"test","password":"test123"}' | \
    grep -i "set-cookie"

# Verify Secure flag on session cookies
```

### Step 4: Test HTTP Availability

```bash
# Check if HTTP endpoints are accessible
endpoints=(
    "/login"
    "/api/login"
    "/api/auth"
    "/register"
    "/password-reset"
    "/api/token"
)

for endpoint in "${endpoints[@]}"; do
    http_status=$(curl -s -o /dev/null -w "%{http_code}" "http://target.com$endpoint")
    https_status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com$endpoint")

    echo "$endpoint - HTTP: $http_status, HTTPS: $https_status"

    if [ "$http_status" != "301" ] && [ "$http_status" != "302" ] && [ "$http_status" != "000" ]; then
        echo "  [WARNING] HTTP endpoint accessible without redirect"
    fi
done
```

### Step 5: Check TLS Configuration

```bash
# Test TLS version support
nmap --script ssl-enum-ciphers -p 443 target.com

# Check for weak protocols
openssl s_client -connect target.com:443 -ssl3 2>&1 | head -5
openssl s_client -connect target.com:443 -tls1 2>&1 | head -5
openssl s_client -connect target.com:443 -tls1_1 2>&1 | head -5
openssl s_client -connect target.com:443 -tls1_2 2>&1 | head -5
openssl s_client -connect target.com:443 -tls1_3 2>&1 | head -5

# Check certificate validity
openssl s_client -connect target.com:443 -servername target.com 2>/dev/null | \
    openssl x509 -noout -dates
```

### Step 6: Test HSTS Implementation

```bash
# Check for HSTS header
curl -sI "https://target.com" | grep -i "strict-transport-security"

# Verify HSTS parameters
# Should include: max-age (long duration), includeSubDomains, preload

# Check HSTS preload status
# https://hstspreload.org/?domain=target.com
```

### Step 7: Test API Authentication Endpoints

```bash
# Check API endpoints for HTTPS
api_endpoints=(
    "/api/v1/auth/login"
    "/api/v1/auth/token"
    "/api/v1/auth/refresh"
    "/api/oauth/token"
    "/oauth2/token"
)

for endpoint in "${api_endpoints[@]}"; do
    # Test HTTP (should fail or redirect)
    http_response=$(curl -s -o /dev/null -w "%{http_code}" \
        "http://target.com$endpoint")

    # Test HTTPS
    https_response=$(curl -s -o /dev/null -w "%{http_code}" \
        "https://target.com$endpoint")

    echo "$endpoint"
    echo "  HTTP: $http_response (should be 301/302 or unavailable)"
    echo "  HTTPS: $https_response"
done
```

---

## Tools

### TLS Analysis

| Tool           | Description                | Usage                     |
| -------------- | -------------------------- | ------------------------- |
| **SSLyze**     | TLS configuration analyzer | `sslyze target.com`       |
| **testssl.sh** | TLS testing                | `./testssl.sh target.com` |
| **nmap**       | SSL enumeration            | `nmap --script ssl-*`     |

### Traffic Analysis

| Tool           | Description               |
| -------------- | ------------------------- |
| **Wireshark**  | Network traffic analysis  |
| **Burp Suite** | Proxy with TLS inspection |
| **mitmproxy**  | MITM proxy                |

---

## Example Commands/Payloads

### Comprehensive TLS Test Script

```bash
#!/bin/bash
TARGET=$1

echo "=== CREDENTIAL TRANSPORT SECURITY TEST ==="
echo "Target: $TARGET"
echo ""

# 1. Check HTTPS availability
echo "[+] Checking HTTPS availability..."
https_status=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET")
if [ "$https_status" == "000" ]; then
    echo "  [FAIL] HTTPS not available!"
    exit 1
else
    echo "  [OK] HTTPS available (Status: $https_status)"
fi

# 2. Check HTTP redirect
echo ""
echo "[+] Checking HTTP to HTTPS redirect..."
http_location=$(curl -sI "http://$TARGET" | grep -i "^location:" | cut -d' ' -f2)
if echo "$http_location" | grep -qi "https://"; then
    echo "  [OK] HTTP redirects to HTTPS"
else
    echo "  [WARNING] HTTP may not redirect to HTTPS"
fi

# 3. Check HSTS
echo ""
echo "[+] Checking HSTS header..."
hsts=$(curl -sI "https://$TARGET" | grep -i "strict-transport-security")
if [ -n "$hsts" ]; then
    echo "  [OK] HSTS enabled: $hsts"
else
    echo "  [WARNING] HSTS not enabled"
fi

# 4. Check login form
echo ""
echo "[+] Checking login form..."
login_form=$(curl -s "https://$TARGET/login" 2>/dev/null)
if echo "$login_form" | grep -qi 'action="http://'; then
    echo "  [FAIL] Login form submits over HTTP!"
elif echo "$login_form" | grep -qi 'action="https://\|action="/\|action=""'; then
    echo "  [OK] Login form submits securely"
else
    echo "  [INFO] Could not determine form action"
fi

# 5. Check for mixed content
echo ""
echo "[+] Checking for mixed content..."
mixed=$(curl -s "https://$TARGET/login" | grep -i "http://" | grep -v "https://")
if [ -n "$mixed" ]; then
    echo "  [WARNING] Potential mixed content found"
else
    echo "  [OK] No obvious mixed content"
fi

# 6. Check TLS version
echo ""
echo "[+] Checking TLS versions..."
for version in tls1 tls1_1 tls1_2 tls1_3; do
    result=$(echo | timeout 5 openssl s_client -connect "$TARGET:443" -$version 2>&1)
    if echo "$result" | grep -q "Cipher is"; then
        echo "  $version: Supported"
    else
        echo "  $version: Not supported"
    fi
done

# 7. Check secure cookie flags
echo ""
echo "[+] Checking cookie security..."
cookies=$(curl -sI -X POST "https://$TARGET/login" \
    -d "username=test&password=test" 2>/dev/null | \
    grep -i "set-cookie")

if echo "$cookies" | grep -qi "secure"; then
    echo "  [OK] Secure flag present on cookies"
else
    echo "  [WARNING] Secure flag may be missing"
fi

if echo "$cookies" | grep -qi "httponly"; then
    echo "  [OK] HttpOnly flag present"
else
    echo "  [WARNING] HttpOnly flag may be missing"
fi

echo ""
echo "[+] Test complete"
```

---

## Remediation Guide

### 1. Enforce HTTPS Everywhere

```nginx
# Nginx - Redirect all HTTP to HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    # Strong TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
}
```

### 2. Implement HSTS

```nginx
# Nginx HSTS header
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
```

```apache
# Apache HSTS header
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
```

### 3. Secure Cookie Configuration

```python
# Python/Flask
app.config.update(
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE='Lax'
)

# Set secure cookies
response.set_cookie(
    'session',
    value=session_token,
    secure=True,
    httponly=True,
    samesite='Lax'
)
```

### 4. Application-Level HTTPS Enforcement

```python
# Flask - Redirect HTTP to HTTPS
from flask import Flask, redirect, request

@app.before_request
def enforce_https():
    if not request.is_secure and not app.debug:
        url = request.url.replace('http://', 'https://', 1)
        return redirect(url, code=301)
```

---

## Risk Assessment

### CVSS Score

| Finding                    | CVSS | Severity |
| -------------------------- | ---- | -------- |
| Credentials over HTTP      | 7.5  | High     |
| No HTTP to HTTPS redirect  | 5.3  | Medium   |
| Missing HSTS               | 4.3  | Medium   |
| Weak TLS configuration     | 5.3  | Medium   |
| Missing Secure cookie flag | 4.3  | Medium   |

---

## CWE Categories

| CWE ID      | Title                                           | Description        |
| ----------- | ----------------------------------------------- | ------------------ |
| **CWE-319** | Cleartext Transmission of Sensitive Information | HTTP credentials   |
| **CWE-523** | Unprotected Transport of Credentials            | Missing encryption |
| **CWE-614** | Sensitive Cookie Without Secure Flag            | Cookie theft       |

---

## References

- [OWASP WSTG - Testing for Credentials Transported over Encrypted Channel](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/01-Testing_for_Credentials_Transported_over_an_Encrypted_Channel)
- [OWASP TLS Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html)
- [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/)


---

## Checklist

```
[ ] Login page served over HTTPS
[ ] Login form action is HTTPS
[ ] HTTP redirects to HTTPS
[ ] HSTS header present
[ ] HSTS max-age sufficient (>1 year)
[ ] No mixed content on auth pages
[ ] TLS 1.2+ only
[ ] Strong cipher suites
[ ] Secure flag on session cookies
[ ] HttpOnly flag on session cookies
[ ] API auth endpoints HTTPS only
[ ] Certificate valid and not expired
[ ] Findings documented
[ ] Remediation recommendations provided
```