Authentication Retries

Question

Authentication proceeds even if fields are blank or incorrect.

I'm using Kali Linux and everything is working, php is properly running.

<?php

$auth = 1;

$user1='14c4b06b824ec593239362517f538b29';       //username
$pass1='5f4dcc3b5aa765d61d8327deb882cf99';       //password

if($auth==1)
{
    if(!isset($_SERVER['PHP_AUTH_USER']))
    {
        if(md5($HTTP_SERVER_VARS['PHP_AUTH_USER'])!=$user1 || md5($HTTP_SERVER_VARS['PHP_AUTH_PW'])!=$pass1)
        {
            header("WWW-Authenticate: Basic");
            header("HTTP/1.0 401 Unauthorized");
            die("Unauthorized access!");
        }
    }
}

?>

If the input username=username & password=password then continue to load the page, else if not then retry

But what I am experiencing is that even when the input is blank or incorrect, it continues to load the page.

Answer 1

But what I am experiencing is that even when the input is blank or incorrect, it continues to load the page.

Because in this case $_SERVER['PHP_AUTH_USER'] is set!

That should fix your problem:

if($auth==1)
{
    if(md5($_SERVER['PHP_AUTH_USER'])!=$user1 ||
       md5($_SERVER['PHP_AUTH_PW'])!=$pass1)
    {
        header("WWW-Authenticate: Basic");
        header("HTTP/1.0 401 Unauthorized");
        die("Unauthorized access!");
    }
}

Old answer:

Something is fishy here.

On one line you are checking if $_SERVER['PHP_AUTH_USER'] is set, on another you are calculating md5 from $HTTP_SERVER_VARS['PHP_AUTH_USER'].

Note the difference.

Probably should be:

if(md5($_SERVER['PHP_AUTH_USER'])!=$user1 || md5($_SERVER['PHP_AUTH_PW'])!=$pass1)

Answer 2

I would like to add to the existing answer that you should not compare secrets (such as passwords) using the equality operator due to timing attacks. PHP has a function specifically designed to avoid this: hash_equals()

if ($auth == 1) {
    if (!hash_equals(md5($_SERVER['PHP_AUTH_USER']), $user1) || !hash_equals(md5($_SERVER['PHP_AUTH_PW']), $pass1)) {
        header("WWW-Authenticate: Basic");
        header("HTTP/1.0 401 Unauthorized");
        die("Unauthorized access!");
    }
}

I would also advise against MD5 as it's quite a weak algorithm that is not sufficient for passwords. Using a free online tool it is ridiculusly easy to "reverse" those hashes using lookup (rainbow) tables that contain a large number of hashes and their plain text equivalents, which can be queried within seconds.

Should you chose to improve the security of your script I would suggest taking a look at password_hash and it's pair password_verify() which is timing attack safe.

You could make a standalone script that generates the hashes for you:

<form method="POST">
  <input name="data[Username]" placeholder="Username">
  <input name="data[Password]" placeholder="Password">
  <input type="submit">
</form>
<?php
if (!empty($_POST['data']) && is_array($_POST['data'])){
  $hashes = array_map(function ($value) {
    return password_hash($value, PASSWORD_DEFAULT);
  }, $_POST['data']);
  echo '<p>Your hashes:</p><pre>';
  print_r($hashes);
  echo '</pre>';
}

This will give you two inputs that you can enter your desired values into and it will output hashes when you submit the form. These hashes are non-reversible, similar to MD5, but they are much less prone to the lookup attack demonstrated above.

You may notice that even when hitting refresh in your browser the values won't be the same each time. This is due to salting which further increases the resilience of any hashing algorithm by making sure you can't just take the hash and compare it against a table of known hashes with their plain text equivalents. Use the values you get in place of the MD5 hashes of your script, and replace the verification code with the following:

if ($auth == 1) {
    if (!password_verify($_SERVER['PHP_AUTH_USER'], $user1) || !password_verify($_SERVER['PHP_AUTH_PW'], $pass1)) {
        header("WWW-Authenticate: Basic");
        header("HTTP/1.0 401 Unauthorized");
        die("Unauthorized access!");
    }
}