Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue-1151: Update WSTG-ATHN-07 #1176

Merged
merged 5 commits into from
Dec 20, 2024
Merged

Conversation

alp1n3-eth
Copy link
Contributor

This PR covers the first deliverable discussed within issue #1151.

  • This PR handles the issue and requires no additional PRs.
  • You have validated the need for this change.

What did this PR accomplish?

  • Updates the name for WSTG-ATHN-07 to be "Testing for Weak Authentication Methods".
  • Updates the summary to include weak credential usage.
  • Adds a step to the "How to Test" section to check for auto-assigned / easily guessed authN methods like SSN, birth date, etc.

- Reflect agreed name change.
- Update summary for weak credential usage.
- Add a step to the the how to test section.
liueu -> lieu
Changed wording surrounding brute forcing to "susceptible to brute-force attacks" per suggestions and prior usage of it in WSTG-ATHN-09.
Updated summary portion to reflect suggestion to include PINs & security questions.
@alp1n3-eth
Copy link
Contributor Author

Both of the requested changes have been implemented. It should be ready for another round 😁.

@rbsec
Copy link
Collaborator

rbsec commented Dec 18, 2024

Looks good to me.

Copy link
Collaborator

@kingthorin kingthorin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just that one thing, otherwise it looks good.

checklists/checklist.json Outdated Show resolved Hide resolved
Altered the changes to WSTG-ATHN-07 back to reference "Weak Password Policy" instead of the new naming in order to ensure the automations run correctly and detect the changes.
@alp1n3-eth
Copy link
Contributor Author

Apologies! I hadn't realized they relied on that, thank you for pointing it out. It should be good to go now!

@kingthorin
Copy link
Collaborator

In your next PR don't forget to add yourself to the credits.

@kingthorin kingthorin merged commit 0da9065 into OWASP:master Dec 20, 2024
3 checks passed
@alp1n3-eth alp1n3-eth deleted the fix-1151 branch December 30, 2024 15:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants