Authentication Testing (FIND/EXPLOIT — OWASP A07)
Overview
Break "are you who you say you are?" Account takeover (ATO) is the crown-jewel attack — one
auth flaw often unlocks everything. Test the whole identity lifecycle, not just the login form.
Core principle: Auth is a flow, not a page. Bugs live in reset, refresh, federation, and
state transitions — not just the password check.
Applies when / Skip when
- Applies when: the app has any identity mechanism — login, sessions, accounts, tokens/JWT,
OAuth/SSO, password reset, or MFA.
- Skip when: the app is entirely anonymous with no authentication → N/A.
- If N/A: report "authentication-testing: N/A — no authentication surface" and stop.
⚠️ Authorization
Use your own accounts/app. Do not credential-stuff real users or third parties. Brute-force
only your own test accounts, throttled.
Surfaces to test (the whole lifecycle)
- Registration — username/email enumeration, weak password policy, duplicate/normalization.
- Login — rate limiting, lockout, error-message enumeration, default creds.
- Session — token entropy, fixation (rotate on login?), invalidation on logout/reset, cookie flags.
- Password reset — token entropy/expiry/reuse, host-header poisoning of reset links, user-id swap.
- MFA/2FA — bypass via flow skip, response tampering, backup-code abuse, OTP brute/rate, race.
- OAuth/OIDC/SAML/SSO —
redirect_uri validation, state/CSRF, token leakage, SAML signature.
- JWT —
alg:none, algorithm confusion, weak secret, signature not verified, no expiry/revocation.
See references/auth-attacks.md for concrete recipes per surface.
Quick reference — high-value bugs
| Bug |
Test |
Impact |
| User enumeration |
Different response/timing for valid vs invalid user |
Targeted attacks |
| No rate limit |
Many login/OTP attempts succeed |
Brute-force / ATO |
| Session fixation |
Session id unchanged after login |
Hijack |
| Reset poisoning |
Host/X-Forwarded-Host controls reset link domain |
ATO via stolen token |
| Reset id swap |
Reset for victim using your token/flow |
ATO |
| MFA bypass |
Skip step / tamper "mfa":false / reuse code |
ATO past 2FA |
| OAuth open redirect |
redirect_uri to attacker domain leaks code/token |
ATO |
| JWT forgery |
alg:none / HS-RS confusion / weak secret accepted |
Full impersonation |
Output
Findings with the exact flow and request, which lifecycle stage, and whether it yields ATO.
Note chains (e.g. enumeration + no-rate-limit + weak reset = full ATO) for vulnerability-chaining.
Hand-off
Reproduce on the running app via active-pentest; combine into ATO chains in
vulnerability-chaining; fix via security-hardening (bcrypt/argon2, CSPRNG tokens,
session rotation, strict redirect_uri, verified JWT signatures, rate limits + MFA).
Common mistakes
- Testing only the login box — reset and federation flows are softer and just as fatal.
- Decoding a JWT and assuming it's verified — prove the signature is checked (tamper it).
- Treating MFA as unbreakable — most bypasses are logic flaws in the flow, not the crypto.
- Ignoring timing/error differences that quietly enable user enumeration.
1---2name: authentication-testing3description: Use when testing login, sessions, password reset, OAuth/OIDC/SAML/SSO, MFA, and JWTs for weaknesses that lead to account takeover — credential attacks, session fixation, reset-token poisoning, MFA bypass, and token forgery. On apps you own or are authorized to test.4---56# Authentication Testing (FIND/EXPLOIT — OWASP A07)78## Overview9Break "are you who you say you are?" Account takeover (ATO) is the crown-jewel attack — one10auth flaw often unlocks everything. Test the whole identity lifecycle, not just the login form.1112**Core principle:** Auth is a *flow*, not a page. Bugs live in reset, refresh, federation, and13state transitions — not just the password check.1415## Applies when / Skip when16- **Applies when:** the app has any identity mechanism — login, sessions, accounts, tokens/JWT,17 OAuth/SSO, password reset, or MFA.18- **Skip when:** the app is entirely anonymous with no authentication → N/A.19- **If N/A:** report "authentication-testing: N/A — no authentication surface" and stop.2021## ⚠️ Authorization22Use your own accounts/app. Do **not** credential-stuff real users or third parties. Brute-force23only your own test accounts, throttled.2425## Surfaces to test (the whole lifecycle)261. **Registration** — username/email enumeration, weak password policy, duplicate/normalization.272. **Login** — rate limiting, lockout, error-message enumeration, default creds.283. **Session** — token entropy, fixation (rotate on login?), invalidation on logout/reset, cookie flags.294. **Password reset** — token entropy/expiry/reuse, **host-header poisoning** of reset links, user-id swap.305. **MFA/2FA** — bypass via flow skip, response tampering, backup-code abuse, OTP brute/rate, race.316. **OAuth/OIDC/SAML/SSO** — `redirect_uri` validation, `state`/CSRF, token leakage, SAML signature.327. **JWT** — `alg:none`, algorithm confusion, weak secret, signature not verified, no expiry/revocation.3334See `references/auth-attacks.md` for concrete recipes per surface.3536## Quick reference — high-value bugs37| Bug | Test | Impact |38|-----|------|--------|39| User enumeration | Different response/timing for valid vs invalid user | Targeted attacks |40| No rate limit | Many login/OTP attempts succeed | Brute-force / ATO |41| Session fixation | Session id unchanged after login | Hijack |42| Reset poisoning | `Host`/`X-Forwarded-Host` controls reset link domain | ATO via stolen token |43| Reset id swap | Reset for victim using your token/flow | ATO |44| MFA bypass | Skip step / tamper `"mfa":false` / reuse code | ATO past 2FA |45| OAuth open redirect | `redirect_uri` to attacker domain leaks code/token | ATO |46| JWT forgery | `alg:none` / HS-RS confusion / weak secret accepted | Full impersonation |4748## Output49Findings with the exact flow and request, which lifecycle stage, and whether it yields ATO.50Note chains (e.g. enumeration + no-rate-limit + weak reset = full ATO) for `vulnerability-chaining`.5152## Hand-off53Reproduce on the running app via **`active-pentest`**; combine into ATO chains in54**`vulnerability-chaining`**; fix via **`security-hardening`** (bcrypt/argon2, CSPRNG tokens,55session rotation, strict `redirect_uri`, verified JWT signatures, rate limits + MFA).5657## Common mistakes58- Testing only the login box — reset and federation flows are softer and just as fatal.59- Decoding a JWT and assuming it's verified — *prove* the signature is checked (tamper it).60- Treating MFA as unbreakable — most bypasses are logic flaws in the *flow*, not the crypto.61- Ignoring timing/error differences that quietly enable user enumeration.
mn-youssef