authbypass-authentication-flaws

A structured penetration-testing playbook for probing the authentication layer itself, aimed at security assessments of login flows, password reset and account recovery logic, multi-factor authentication, token predictability, brute-force resistance, and session boundary flaws. The focus is deliberately scoped to the login mechanism and kept distinct from JWT and OAuth token attacks, which the doc routes to a separate companion skill.

Coverage runs across six areas. SQL injection login bypass supplies classic payloads (such as admin'-- and ' OR '1'='1'--) with a reminder to test each field independently. Password reset testing looks for guessable or timestamp-derived tokens, tokens that never expire or can be reused, host header injection that redirects reset links to attacker domains, token leakage through the Referer header, and password changes that omit the current password. Account enumeration examines error-message and response-time differences plus reset and registration endpoints. Brute-force sections describe lockout-reset abuse, IP-based lockout bypass via forged X-Forwarded-For headers, reverse password-spraying, and credential stuffing. Multi-factor bypass covers session cookies issued before 2FA completion, code brute forcing, 2FA enforced only at login, backup-code abuse, and TOTP replay. A final section outlines OAuth/SSO account-takeover patterns such as unverified email-claim trust.

Before hands-on testing, an authorized credential-test planning section consolidates practical guidance: service-first tiny credential sets for phpMyAdmin, FTP, SSH, MySQL, Tomcat, and WebLogic; username classes; and wordlist sizing that favors small default lists over giant dictionaries for admin panels and rate-limited logins. Port and service prioritization (80/443/8080/8443 panels, 22, 21, and common data stores) rounds out the reconnaissance guidance so testing effort is spent where signal is highest.