Golang Snippet #06
This challenge covers the review of a snippet of code written in Golang
The Code Review Snippet challenges on Pentesterlab offer you a chance to examine small snippets of vulnerable code, specifically written in Golang for this lab. You are encouraged to find the vulnerability on your own first. If you struggle or wish to confirm your findings, a detailed video walkthrough is available. The video covers the code's import statements, the use of HMAC with SHA256 for signing, and the construction of referral and password reset links.
However, it highlights a significant issue: both functions use the same key and value for signatures, making the application vulnerable to a signing oracle attack. An attacker could generate a valid signature for one function and reuse it in another part of the application, thereby bypassing security checks. The video advises adding function-specific elements to the signature to prevent such attacks and recommends including an expiry date for the signatures to enhance security.