Web Application Defender's Cookbook

Recipe 7-6: Enforcing Password Complexity

This recipe demonstrates how to apply a password complexity check when a user initially creates an account.

Ingredients

• ModSecurity
  • SecStreamInBodyInspection directive
  • ARGS variable
  • STREAM_INPUT_BODY variable
  • @rx operator
  • prepend action

Poor Passwords

The truth is that, left to their own devices, users pick terribly weak passwords. This fact has been confirmed multiple times recently with the data breaches at Gawker and Sony, where security researchers analyzed millions of user account passwords. Table 7-1 lists the top 25 most-used passwords from the Sony breach.

Table 7-1: Sony’s Top 25 Most-Used Passwords

You can see that most of these passwords are not complex, and many are simply dictionary words. We can conclude that, unless the web application enforces minimum password complexity restrictions concerning the length and character sets in use, users will pick passwords that are easy to remember. Although this seems like an easy issue to address, many web applications do not include granular controls over password complexity management.

Enforcing Password Complexity

Using ModSecurity, we can easily analyze password data that is submitted as part of initial account creation or a password change process. Consider the WordPress Add New User interface, shown in Figure 7-9.

Figure 7-9: WordPress Add New User screen

As you can ...