> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/websec/authentication-bypass.md).

# Authentication Bypass

Bypassing logins!

## Exploitation

Look out for these:

* Weak credentials that can be brute forced.
* 2FA measures that aren't well secured.
  * For example, a 2FA measure that has a 6 digit PIN but has unlimited tries for it, allowing for brute force.
* Phishing or Social Engineering Attacks to gain passwords.
* SQL Injection, XSS or other vulnerabilities.
* Lack of account lockout after repeated failed attempts (anti-brute forcing mechanisms)

When testing for this, I ask myself the following questions:

* How does the authentication verify the user
* What kind of parameters are being passed upon sending a POST request to login?
* What is being used to **authenticate a user and save their login session?**
  * Are cookies like JWT used?
  * Can I poison the web cache or smuggle a HTTP request into the backend?
* Is there any other information being processed and passed into the web application?
  * For example, are any other parameters, like userID being used?
* Is the website running an outdated version of software that has known exploits for it?
* Are there Web Application Firewalls or Intrusion Detection that would trigger upon entering of special characters into the database?

## Example

This is a web application uses a JWT token to authenticate a session.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e8394009379d286d161b23b42c265dc5293fef1b%2Fimage.png?alt=media)

JWT Tokens are basically `base64` encoded strings separated into 3 different portions, the header, payload and signature. If one has the private string / key used by the server, the signature (and hence token) can be forged.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b7e428378a012ce95a77e8a71f407d214b27493e%2Fimage.png?alt=media)

This particular application runs on Flask, and `flask-unsign` can be used to brute force the cookie:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-18c112ae43108255012f04e9359b4d2b09a533f8%2Fimage.png?alt=media)

This allows me to forge any token and hence pass in any data I want. In this case, the username `blue` was the admin of the page, hence I created a cookie for that user and logged in.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b7e0feff0fa1b12075d01c5a4aec5ef3355b0ce0%2Fimage.png?alt=media)

The swopping of cookies done using Javascript in the browser console with `developer.cookie='cookiehere'`.