Portswigger Academy Authentication Labs

Introduction

What?

The majority of threats related to the authentication process are associated with passwords and password-based authentication methods. Broken authentication also causes a significant amount of vulnerabilities.

Why?

As well as potentially allowing attackers direct access to sensitive data and functionality, they also expose additional attack surface for further exploits.

How?

• Authentication vulnerabilities

• Username enumeration via different responses

• 2FA simple bypass

• Password reset broken logic

• Username enumeration via subtly different responses

• Username enumeration via response timing

• Broken brute-force protection, IP block

• Username enumeration via account lock

• 2FA broken logic

• Brute-forcing a stay-logged-in cookie

• Offline password cracking

• Password reset poisoning via middleware

• Password brute-force via password change

• Broken brute-force protection, multiple credentials per request

• 2FA bypass using a brute-force attack