Test Web App Authentication & Session Security

This skill identifies and exploits authentication and session management vulnerabilities in web applications - broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover and unauthorized access. It runs a ten-phase methodology: mapping the authentication type and endpoints; testing password policy strength (minimum length, complexity, common weak passwords, username-as-password); credential enumeration by comparing responses for valid versus invalid usernames across error messages, timing, response codes, and password-reset flows; brute force testing with Hydra or Burp Intruder, checking for account lockout, rate limiting, and CAPTCHA defenses; credential stuffing with known email:password pairs from breaches via Burp Intruder's Pitchfork attack, including detection-evasion considerations; session management testing - capturing and analyzing session tokens for sequential patterns, low entropy, or embedded timestamps; session fixation testing (checking whether a session ID issued before login remains valid after login, which is vulnerable, versus a fresh session being assigned, which is secure); session timeout testing (idle timeout, absolute timeout, and logout functionality); multi-factor authentication testing, including OTP brute force, OTP bypass, and API version downgrade attacks (illustrated with a crAPI example - if /api/v3/check-otp rate-limits, an older, less-secured API version may not); and password reset testing, covering token security, token manipulation (changing the target user parameter while reusing a valid token), and host header injection so a reset email points to an attacker-controlled domain.

Use this to systematically assess an application's authentication and session handling for weaknesses across password policy, credential enumeration, brute force resistance, session token quality, MFA, and password reset flows.

This requires explicit written authorization for testing, target application URL and test account credentials, and prerequisite knowledge of HTTP/session mechanics, authentication types (SFA/2FA/MFA), and cookie/token handling, plus tools like Burp Suite (Professional or Community) and Hydra. Only test with explicit written authorization, never test with real breached credentials, never access actual user accounts, and document all testing activity. Technical limitations to expect: CAPTCHA can block automated testing, rate limiting affects brute-force timing, MFA significantly raises attack difficulty, and some vulnerabilities require victim interaction to exploit. Test accounts and environments may behave differently than production, some features may be disabled in test environments, and third-party authentication may be out of scope - production testing warrants extra caution.

Input is the target application's authentication endpoints, test credentials, and written testing authorization. Output is a documented set of findings across the ten phases, plus reference material: common vulnerability types, credential testing payloads (default credentials, common passwords, breached-credential databases), session cookie security flags to check, and rate-limiting bypass headers. Three worked examples illustrate the methodology end to end: bypassing an account lockout via IP rotation (X-Forwarded-For header) or username case manipulation; a JWT "none" algorithm attack (decoding a captured token, changing {"alg":"HS256"} to {"alg":"none"}, stripping the signature, and resubmitting); and password reset token exploitation (testing token reuse, expiration after 24+ hours, character modification, and whether an admin's password can be reset using a test user's token by manipulating the user parameter).

Built around Burp Suite (Intruder for brute force and credential stuffing with the Pitchfork attack type), Hydra for form-based brute force, custom wordlists, and browser developer tools for session/cookie inspection.

Authorized penetration testers and security engineers assessing an application's authentication and session management with explicit written authorization.

hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  target.com http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"