Based on standard implementations

Knowledge-Based Authentication (Something You Know)

• Passwords
• PINs
• Security Questions

These are the most common and most abused mechanisms. Weak passwords, reuse, and lack of rate limiting make them trivial to attack.

Possession-Based Authentication (Something You Have)

• OTP applications
• SMS-based codes
• Hardware tokens

These improve security but are still vulnerable to SIM swapping, phishing, and interception attacks.

---

Inherence-Based Authentication (Something You Are)

• Fingerprint
• Facial recognition
• Voice recognition

These are harder to bypass but not impossible. Spoofing and replay attacks exist depending on implementation.

---

Multi-Factor Authentication (MFA)
A combination of multiple authentication factors.

Important point: MFA reduces risk but does not eliminate it. Poor implementations can still be bypassed.

---

2. Session-Based Authentication

Session-based authentication is the most widely used model in web applications.

How It Works

• User submits credentials
• Server validates them
• Server creates a session (stored in memory or database)
• Session ID is sent to the client via cookies
• Client sends this session ID with every request

Attack Surface

From:

• Session hijacking
• Session fixation
• Predictable session IDs
• Improper session invalidation

What to Test

• Is the cookie marked as Secure (HTTPS only)?
• Is HttpOnly enabled (prevents JavaScript access)?
• Is SameSite configured (CSRF protection)?
• Is there proper session expiration?
• Are sessions invalidated after logout?

Most real-world applications fail in at least one of these controls.

---

3. Token-Based Authentication (JWT)

Token-based authentication is commonly used in APIs and modern applications.

How It Works

• User logs in
• Server generates a token (JWT)
• Client stores the token
• Token is sent in Authorization headers for each request

Token Structure

• Header
• Payload
• Signature

Common Vulnerabilities

From:

• Weak or guessable signing keys
• Algorithm confusion attacks
• Missing or weak signature validation
• Tokens without expiration
• Sensitive data stored in payload

If implemented incorrectly, JWT becomes a major attack vector instead of a security mechanism.

---

4. OAuth 2.0 and SSO Authentication

OAuth allows users to authenticate via third-party providers.

Simplified Flow

1. User clicks “Login with provider”
2. Application redirects to provider
3. User authenticates
4. Provider returns an authorization code
5. Application exchanges code for access token

Common Vulnerabilities

From:

• Missing state parameter (CSRF risk)
• Open redirect in redirect_uri
• Token leakage via improper handling
• Scope escalation
• Account linking issues

OAuth implementations are frequently misconfigured due to their complexity.

---

5. API Key Authentication

API keys are used for service-to-service authentication.

Where API Keys Are Found

• Query parameters
• HTTP headers
• Cookies

Common Weaknesses

From:

• Keys exposed in frontend code
• Keys committed to public repositories
• No rate limiting
• Over-privileged keys
• No rotation policies

API keys are often treated as secrets but handled insecurely.

---

6. Authentication Bypass Techniques

This section focuses on practical attack techniques used during assessments.

Default Credentials

Many systems still use default credentials:

• admin:admin
• root:root

These should always be tested first.

---

SQL Injection in Login

Authentication can be bypassed using input manipulation:

• ' OR 1=1 --
• admin' --

---

Authentication Logic Flaws

• Removing authentication parameters
• Manipulating responses
• Direct access to restricted endpoints

---

Token-Based Attacks

• JWT tampering
• Session prediction
• Token fixation

---

Password Reset Exploitation

• Predictable reset tokens
• Host header injection
• Email parameter manipulation

---

MFA Bypass Techniques

• OTP brute force
• Backup code abuse
• MFA fatigue attacks

---

Race Conditions

• Simultaneous requests to bypass controls
• Token generation abuse

---

7. Default Credentials Testing

From:

Test common credentials systematically across login endpoints.

Also consider service-specific defaults:

• Tomcat
• Jenkins
• MongoDB
• Redis
• Grafana

Automated tools and scripts should be used to speed up testing.

---

8. Authentication Testing Checklist

Based on WSTG methodology

:

• Are credentials transmitted securely (HTTPS)?
• Are default credentials allowed?
• Is account lockout implemented?
• Can authentication be bypassed?
• Are password policies enforced?
• Are reset mechanisms secure?
• Is session handling secure?
• Are alternative authentication channels equally protected?

This checklist ensures no major area is missed during testing.

---

9. Authentication Attack Methodology

A structured approach is critical. Random testing is inefficient.

Step 1: Identify Authentication Mechanisms

• What type of authentication is used?
• Where are login endpoints?

---

Step 2: Test Credential Policies

• Password strength
• Rate limiting
• Account lockout

---

Step 3: Attempt Authentication Bypass

• SQL injection
• Logic flaws
• Direct access

---

Step 4: Analyze Session Management

• Token randomness
• Expiration
• Fixation

---

Step 5: Evaluate Token Security

• JWT validation
• Cookie security

---

Step 6: Test Password Reset

• Token strength
• Abuse scenarios

---

Step 7: Test MFA

• Bypass techniques
• Enrollment flaws

---

Step 8: Test OAuth / SSO

• Redirect validation
• Token leakage

---

Step 9: Document Findings

• Clear impact
• Reproducible steps
• Practical fixes