Week Login Panel Over HTTP

Password Policy Vulnerability

Week Login Function(Panel) Over HTTP

A weak login function over HTTP refers to a web-based login system that lacks sufficient security measures, making it vulnerable to various security risks and attacks. When a login function is implemented over HTTP, the data exchanged between the user's device and the web server is transmitted in plain text, which means it is not encrypted or protected.

To address these security concerns, it is highly recommended to use a secure protocol like HTTPS for login functions. HTTPS encrypts the data transmission, providing confidentiality and integrity, which significantly reduces the risks associated with weak login functions over HTTP.

Impact :

The impact of a weak login function over HTTP includes the risk of unauthorized access, data breaches, compromised user accounts, loss of trust, legal and compliance issues, and user inconvenience.

Weak login functions make it easier for attackers to compromise user accounts and gain access to personal or confidential data stored on the server. This can result in significant data breaches and potential harm to users.

Security vulnerabilities associated with weak login functions can damage the reputation of the organization or service provider. Users may lose trust in the system, leading to a decrease in user engagement, customer satisfaction, and potential loss of business.

Mitigation :

1. Use an SSL/TLS certificate to enable secure communication by encrypting data transmitted between the user's device and the server.

2. Set up server-side redirects to automatically redirect HTTP requests to the HTTPS version of the login page.

3. Keep all software and frameworks up to date with the latest security patches to prevent known vulnerabilities.

4. Enforce strong password requirements, including length, complexity, and regular password updates.

5. Implement robust authentication mechanisms like two-factor authentication (2FA) or multi-factor authentication (MFA) to enhance login security.

                        How To Find Vulnerability ?

STEP #1: Go to the site and search login page then click on that.

STEP #2:  Now you can see your login page running on http

When you transmit data over plain HTTP, it is not encrypted, which means it can be intercepted and read by malicious actors. This poses a significant risk to the confidentiality of user credentials and opens up opportunities for various forms of attacks, such as man-in-the-middle attacks.

                               How To Report ?

Hello Team                        

                  I'm Career Technology Cyber Security India a white security researcher from Mumbai INDIA, founded on your website : https://branchx.in/home-page.html

Vulnerability Name : Login Panel over http

Descriptions :

HTTPS is a secure version of HTTP that encrypts the data exchanged between a web browser and a web server, providing a higher level of security and protection against unauthorized access or interception.

Vulnerable URL :

http://vendor.dmt.staging.branchx.in/login

Steps to reproduce ?

1.Simply visit the above URL and your whole site is running on https

2.Click the sign in option Then click on login 

3.Now look your login page is running over http  

Impact :

Since login credentials are transmitted in plaintext over HTTP, attackers can easily capture and collect usernames and passwords. These stolen credentials can be exploited for unauthorized access to user accounts, potentially leading to identity theft and unauthorized activity.

Solution:

Through website developer make the changes in password policy

How to secure your login page:

Obtain an SSL/TLS certificate.

Configure your web server to use HTTPS.

Update your login page to use the HTTPS URL.

PFA of video for steps by steps guidance also help to regenerate the Vulnerability

Thank You :)

Career Technology Cyber Security India 

Indian Bug Hunter