🔓 Authentication Bypass Attack Flow
OWASP #7 - Circumventing Login Mechanisms
flowchart TD
A[👤 Attacker] -->|1. Target login system| B[🔍 Reconnaissance]
B -->|2. SQL Injection in login| C[💉 SQLi: ' OR '1'='1]
B -->|3. Default credentials| D[🔑 admin/admin]
B -->|4. JWT manipulation| E[🎫 Token Tampering]
B -->|5. Session fixation| F[🍪 Fixed Session ID]
B -->|6. Password reset exploit| G[📧 Reset Token Abuse]
C -->|7. Bypass SQL check| H[✅ Authentication Success]
D -->|8. Unchanged defaults| H
E -->|9. Modify claims| H
F -->|10. Hijack session| H
G -->|11. Reset victim password| H
H -->|12. Gain unauthorized access| I[👑 Full System Access]
I -->|13. Access user data| A
I -->|14. Privilege escalation| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style D fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
J[🔒 Defense:
MFA] -.->|Second factor| H
K[🛡️ Defense:
Rate Limiting] -.->|Prevent brute force| B
L[⚙️ Defense:
Secure Tokens] -.->|Strong JWT| E
style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
SQL Injection in Authentication: Bypass login via SQL injection.
Username: admin' OR '1'='1'--
Password: anything
Query: SELECT * FROM users WHERE username='admin' OR '1'='1'--' AND password='...'
2
Default Credentials: Try common default usernames/passwords.
admin/admin, root/root, admin/password, admin/123456
Default creds from vendor documentation
3
JWT Token Manipulation: Tamper with JWT to elevate privileges.
Change algorithm to "none"
Modify claims: {"role": "admin", "user_id": 1}
Exploit weak signing key (brute force HS256)
4
Session Fixation: Force victim to use attacker's session ID.
http://bank.com/login?session_id=ATTACKER_SESSION
After victim logs in, attacker uses the same session
5
Password Reset Token Abuse: Exploit weak reset mechanisms.
Predictable tokens: timestamp-based, sequential
No expiration on reset links
Token leakage via Referer header
6
OAuth Misconfiguration: Exploit OAuth flow vulnerabilities.
Redirect URI manipulation
State parameter not validated (CSRF)
7
Logic Flaws: Exploit authentication flow bugs.
Multi-step login: Skip steps by direct URL access
Conditional checks: if(password_correct || DEBUG_MODE)
8
Credential Stuffing: Use leaked credentials from other breaches.
Password reuse across sites
Automated tools with credential databases
🛡️ Defense Mechanisms
✅ Multi-Factor Authentication (MFA):
Require second factor (OTP, biometric, hardware key).
TOTP (Google Authenticator), SMS OTP, WebAuthn/FIDO2
✅ Strong Password Policies:
Enforce complex passwords and prevent common passwords.
Min 12 chars, uppercase, lowercase, numbers, symbols
Check against breached password databases (HaveIBeenPwned)
✅ Secure Session Management:
Generate strong, random session IDs. Regenerate on login.
HttpOnly, Secure, SameSite cookies
Regenerate session ID after authentication
✅ Secure JWT Implementation:
Use strong signing algorithms and verify signatures.
Use RS256 instead of HS256 when possible
Never trust "alg: none"
Set short expiration times
✅ Rate Limiting & Account Lockout:
Prevent brute force and credential stuffing.
Lock account after 5 failed attempts
CAPTCHA after 3 failures
Progressive delays between attempts
✅ Secure Password Reset:
Use cryptographically random, time-limited tokens.
Token: 32+ random bytes, expires in 15 minutes
Single-use tokens, invalidate after password change
✅ Force Password Changes:
Require changing default credentials on first login.
Detect default passwords, force immediate change