What is authentication?

• Authentication is the process of verifying the identity of a user or client. Websites are potentially exposed to anyone who is connected to the internet. This makes robust authentication mechanisms integral to effective web security.

There are three main types of authentication:

1. Something you know, such as a password or the answer to a security question. These are sometimes called "knowledge factors".
2. Something you have, This is a physical object such as a mobile phone or security token. These are sometimes called "possession factors".
3. Something you are or do. For example, your biometrics or patterns of behavior. These are sometimes called "inherence factors".

What is the difference between authentication and authorization?

• Authentication is the process of verifying that a user is who they claim to be. Authorization involves verifying whether a user is allowed to do something.

• For example, authentication determines whether someone attempting to access a website with the username Carlos123 really is the same person who created the account.

• Once Carlos123 is authenticated, their permissions determine what they are authorized to do. For example, they may be authorized to access personal information about other users, or perform actions such as deleting another user's account.

How do authentication vulnerabilities arise?

Most vulnerabilities in authentication mechanisms occur in one of two ways:

1. The authentication mechanisms are weak because they fail to adequately protect against brute-force attacks.
2. Logic flaws or poor coding in the implementation allow the authentication mechanisms to be bypassed entirely by an attacker. This is sometimes called "broken authentication".

What is Rate Limiting?

• Rate limiting is used to control the amount of incoming and outgoing traffic to or from a network. If the number of requests you make exceeds that limit, then an error will be triggered. The reasoning behind implementing rate limits is to allow for a better flow of data and to increase security by mitigating attacks such as DDoS.

What is No Rate Limiting Vulnerability?

• No rate limit means there is no mechanism to protect against requests you made in a short frame of time. So try to send lots of requests, if it is not blocking you then you can consider it as vulnerability.
• What is No Rate Limit Vulnerability - https://www.youtube.com/watch?v=iYgJI88ALew

Why Password Reset Page?

• Most of the web application provides users “ password reset “ functionality via email. This functionality has given which allow users to recover their account, generate a new password, and repair their own problems. so let’s start and learn how to look for bugs in this function.

1. No rate limit at signup page

How To Hunt:

1. Enter your details in signup form and submit the form
2. Capture the signup request and send it to intruder
3. add $$ to email parameter
4. In the payload add different email address
5. Fire up intruder and check whether it return 200 ok
6. Refferance link - https://hackerone.com/reports/905692

2. HTML Injection vulnerability

How To Hunt:

1. Create your account Edit your name to html tag and save it.
2. Request for a signup and check your email.
3. You will notice the tag getting executed
4. HTML injection are usually considered as low to medium severity bugs but you can escalate the severity by serving a link tag by using for redirect user in malicious website.
5. Refferance Link - https://hackerone.com/reports/502926

3. Reflected XSS on Signup Page and Login page

1. Go to https://example.com/signup
2. Just fill up the signup form and don't submit.
3. Open burp suite and configure it to intercept the submit request.
4. Submit the form.
5. Change the value of email parameter from a valid email address to <img src=xonerror=alert(document.domain)>
6. Forward the request and turn intercept off.
7. Go to browser and Tadaa! XSS Triggers.
8. Refferance Link - https://hackerone.com/reports/119090

Note - This form throws an error that "[EMAIL ADDRESS]: email doesn't appear to be a valid email address" where [EMAIL ADDRESS] is actually<img src=xonerror=alert(document.domain)>

1. Go to the target website
2. Just fill up the signup form and don't submit.
3. Open burp suite and configure it to intercept the submit request.
4. Submit the form.
5. Change the value of email parameter from a valid email address to <img src=xonerror=alert(document.domain)>
6. Forward the request and turn intercept off.
7. Go to browser and Tadaa! XSS Triggers.
8. Payload for Username field : <svg/onload=confirm(1)>
9. Payload for Email field : “><svg/onload=confirm(1)>”@x.y

4. Email Verfication Bypass leads to account takeover

1. Try registering any email address without verifying it.
2. Try registering an account again, but this time with a different method, such as ‘sign up with Google’ from same email address.
3. see it will be successfully bypasses the Email verification methods.
4. What happens here is, now the attacker can easily log in using the victim's account which bypasses the verification methods.
5. Refferance - https://hackerone.com/reports/1074047

5. No rate limiting on password reset

Rate limiting is used to control the amount of incoming and outgoing traffic to or from a network. Basically, no rate limit means there is no mechanism to protect against requests you made in a short frame of time. So try to send lots of requests, if it is not blocking you then you can consider it as vulnerability.

How To Hunt:

1. Go to https://example.com/resetPassword/
2. Enter the email then click reset password
3. Intercept this request in burp suite
4. Send it to the intruder and repeat it by 50 times
5. You will get 200 OK status
6. Reference link - https://hackerone.com/reports/838572

6. Password or email change function

1. IF you try to change password and see email parameter in password change request, Try changing your email to victim email.

7. Account takeover due to Improper Rate limit

1. Usually, If we reset our password on https://example.com/ that time we got a password reset link on the email. And through that password reset link, we can reset our password.
2. But, I noticed that if we add another email in the request of forgot password through Burpsuite then both person will get the same password reset token in their email.
3. So, an attacker can takeover any account without the user's interaction.

8. Email Verification code bypass in account registration process.

How To Hunt:

1. First visit your website on sign up page.
2. Enter your email and create a password.
3. Enter name and mobile phone, then sign up.
4. Then request for verification code on email.
5. Enter wrong verification code and intercept request using Burp suite.
6. After intercepting the request, I changed the status from "False" to "True". {"status":false to "status":true}
7. Boom!! Verification code bypassed.
8. Finally, the account was created with the wrong verification code.
9. Refferance Link - https://hackerone.com/reports/1406471
10. Refferance Link - https://hackerone.com/reports/1181253

9. Email Verification Bypass by bruteforcing Attack

How To Hunt:

1. Attacker creates a account with victim's email ID Ex: [email protected]
2. Now he doesn't know the verification code.
3. Attacker will start brute force attack to get the correct verification code.
4. Once Attacker gets the verification code.
5. Finally, the account was created account using victim Email.
6. Refferance Link - https://hackerone.com/reports/1394984
7. Refferance Link - https://hackerone.com/reports/64666

10. Email verification bypass after signup

How To Hunt:

1. Sing up on the web application as [email protected]
2. You will receive a confirmation email on [email protected], do not open that link now.
3. The application may ask for confirming your email, check if it allows navigating to account settings page.
4. On settings page check if you can change the email.
5. If allowed, change the email to [email protected].
6. Now you will be asked to confirm [email protected] by opening the confirmation link received on [email protected], insted of opening the new link go to [email protected] inbox and open the previous received link.
7. If the application verifies [email protected] by using perivious verification link received on attacker mail, then this is a email verification bypass.
8. Refferance Link - https://hackerone.com/reports/1040047

11. Password Reset Link not expiring after changing the email

• when a user request changing password then he get a password reset link to reset the password, that’s the normal behaviour but it also should expire after some period of time. If it is not expiring and you can use the password reset link multiple times to reset the password. Then you can consider it as vulnerability.

How To Hunt:

1. Send the password reset link to your email.
2. Don`t open the password link just copy it and paste into any editor.
3. Open your account.
4. Go to your account settings.
5. Under account, you will see Account Overview.
6. Go to the Email and password Option and change the email and verify it.
7. After changing the email go to your password reset link which you copied.
8. Change your password.
9. Reference link - https://hackerone.com/reports/685007

12. Password Reset Link not expiring after changing password

How To Hunt:

1. First You need to create an account with a Valid Email Address
2. After Creating An Account log out from your Account and Navigate to Forgot Password Page
3. Request a Password Reset Link for your Account
4. Use The Password Reset Link And Change The Password, After Changing the Password Login to Your Account
5. Now Use The Old Password Reset Link To Change The Password Again
6. If You Are Able to Change Your Password Again Than This Is a Bug
7. Reference link - https://hackerone.com/reports/898841

13. Denial of service when entering a long password

• Normally passwords have 8–12–24 or up to 48 digits. if there is no word limit while keeping a password you can consider it as vulnerability. you can check when you setting the password while changing passwords or creating accounts as a long string which can lead to DOS.

How to Hunt:

1. Go Sign up page and Forgot password page
2. Fill the form and enter a long string in password
3. Click on enter and you’ll get 500 Internal Server error if it is vulnerable.
4. Reference link - https://hackerone.com/reports/840598
5. Reference link - https://hackerone.com/reports/738569

14. Old Session Does Not Expire After Password Change

How To Hunt:

1. create An account On Your Target Site
2. Login Into Two Browser With Same Account(Chrome, FireFox.You Can Use Incognito Mode As well).
3. Change You Password In Chrome, On Seccessfull Password Change Referesh Your Logged in Account In FireFox/Incognito Mode.
4. If you'r still logged in Then This Is a Bug
5. Refferance Link - https://hackerone.com/reports/1069392

15. Session Hijacking

How To Hunt:

1. Create your account
2. Login your account
3. Use cookie editor extension in browser
4. Copy all the target cookies
5. Logout your account
6. Paste that cookies on another browser in cookie editor extension
7. Refresh page if you are logged in than this is a session hijacking
8. Refferance Link - https://hackerone.com/reports/1201396

16. Password reset token leak via referer

• The HTTP referrer is an optional HTTP header field that identifies the address of the webpage which is linked to the resource being requested. The Referer request-header contains the address of the previous web page from which a link to the currently requested page was followed. So it is possible that the password reset token is leaking via referrer request-header.

How To Hunt:

1. Go to terget website and request for password reset
2. Now check your email you will get your password reset link
3. Now just copy the link and go to the private mode and paste the link
4. Don't change the password before that click on any external links like social media links for avaliable one same website.
5. Capture that request in burp suite.
6. You will find reset token in referer header.
7. Reference link - https://hackerone.com/reports/751581

17. Full account takeover through reset password

1. Navigate to: https://app.upchieve.org/resetpassword
2. Then, enter the victim's email address
3. Intercept this request
4. Now, add your email also in the JSON body. like this: {"email":["[email protected]","[email protected]"]}
5. Forward this request
6. Now victim and you will receive the same password reset link
7. By using that link which you just received in your email
8. You can fully takeover the victim's account by reset password.
9. Refferance - https://hackerone.com/reports/1175081

Example Payloads

• email=[email protected]&email=[email protected]
• email=[email protected]%0a%0dcc:[email protected]
• {"email":["[email protected]","[email protected]"]}
• email=[email protected],[email protected]
• email=[email protected]|[email protected]
• email=[email protected]%[email protected]

18. Password Reset link hijacking via Host Header Poisoning

• Password reset poisoning is a technique whereby an attacker manipulates a vulnerable website into generating a password reset link pointing to a domain under their control. This behaviour can be leveraged to steal the secret tokens required to reset arbitrary users’ passwords and, ultimately, compromise their accounts.

How To Hunt:

1. Intercept the password reset request in Burp Suite
2. Add or edit the following headers in Burp Suite : Host: attacker.com, X-Forwarded-Host: attacker.com
3. Forward the request with the modified header
4. Look for a password reset URL based on the host header like : https://attacker.com/reset-password.php?token=TOKEN
5. Refferance link - https://hackerone.com/reports/226659

19. Authentication Bypass leads to account takeovers.

How To Hunt:

• Check out Auth Bypass method, there is a method for OTP bypass via response manipulation, this can leads to account takeovers.

1. Enter the wrong auth code / Password
2. Capture a auth request in burpsuite and send it to repeater
3. Check for the resoponse
4. Change the respone by manipulating the following parameters

• {“code”:”invalid_credentials”} -> {“code”:”valid_credentials”}
• {“verify”:”false”} -> {“verify”:”true”}

20. Insufficient account process validation leads to account takeover

How To Hunt:

1. Create an account on the website.
2. Go to profile section. And Change & update your details in the name parameter and before saving it Open Burp suite, turn the proxy on and then click on Save.
3. Now capture the request in Burp suite and send it to the Repeater tab.
4. Now log out from the website and go back to the Burp suite.
5. Now change the details email & name parameters and click on "Go" in the repeater tab.
6. Now you will be able to see 200 ok response from the web server.
7. Now, login into your account and go to the Profile section to confirm

21. OTP Bypass on Register account via Response manipulation

How To Hunt:

First Method

1. Register account with mobile number and request for OTP.
2. Enter incorrect OTP and capture the request in Burpsuite.
3. Do intercept response to this request and forward the request.
4. response will be {"verificationStatus":false,"mobile":9072346577","profileId":"84673832"}
5. Change this response to {"verificationStatus":true,"mobile":9072346577","profileId":"84673832"}
6. And forward the response.
7. You will be logged in to the account.

Second Method

1. Go to login and wait for OTP pop up.
2. Enter incorrect OTP and capture the request in Burpsuite.
3. Do intercept response to this request and forward the request.
4. response will be error
5. Change this response to success
6. And forward the response.
7. You will be logged in to the account.

Third Method

1. Register 2 accounts with any 2 mobile number(first enter right otp)
2. Intercept your request
3. click on action -> Do intercept -> intercept response to this request.
4. check what the message will display like status:1
5. Follow the same procedure with other account but this time enter wrong otp
6. Intercept respone to the request
7. See the message like you get status:0
8. Change status to 1 i.e, status:1 and forward the request if you logged in means you just done authentication bypass.

22. Bypassing OTP in registration forms by repeating the form submission multiple times using repeate

How To Hunt:

1. Create an account with a non-existing phone number
2. Intercept the Request in BurpSuite
3. Send the request to the repeater and forward
4. Go to Repeater tab and change the non-existent phone number to your phone number
5. If you got an OTP to your phone, try using that OTP to register that non-existent number

23. Host Header Injection

How To Hunt:

1. The first step is to test what happens when you supply an arbitrary, unrecognized domain name via the Host header.

2. Receiving an Invalid Host header response, you might find that your request is blocked as a result of some kind of security measure. that time an attacker use this technique to bypass the security measure to perform host header attack.

• Host: vulnerable-website.com:attacker-website.com
• Host: attacker-website.com.vulnerable-website.com

3. Inject duplicate Host headers

• Host: vulnerable-website.com
• Host: attacker-website.com

4. Supply an absolute URL

• GET https://vulnerable-website.com/ HTTP/1.1
• Host: attacker-website.com

5. Add line wrapping

• GET /example HTTP/1.1
  • Host: attacker-website.com
• Host: vulnerable-website.com

7. Inject host override headers

• GET /example HTTP/1.1
• Host: vulnerable-website.com
• X-Forwarded-Host: attacker-website.com

8. Refferance Link - https://hackerone.com/reports/13286

15 different methods for 2FA Bypass Techniques

1. Response Manipulation

• In response if "success":false
• Change it to "success":true

2. Status Code Manipulation

• If Status Code is 4xx
• Try to change it to 200 OK and see if it bypass restrictions

3. 2FA Code Leakage in Response

• Check the response of the 2FA Code Triggering Request to see if the code is leaked.

4. JS File Analysis

• Rare but some JS Files may contain info about the 2FA Code, worth giving a shot

5. 2FA Code Reusability

• Same code can be reused

6. Lack of Brute-Force Protection

• Possible to brute-force any length 2FA Code

7. Missing 2FA Code Integrity Validation

• Code for any user account can be used to bypass the 2FA

8. CSRF on 2FA Disabling

• No CSRF Protection on disabling 2FA, also there is no auth confirmation

9. Password Reset Disable 2FA

• 2FA gets disabled on password change/email change

10. Backup Code Abuse

• Bypassing 2FA by abusing the Backup code feature
• Use the above mentioned techniques to bypass Backup Code to remove/reset 2FA reset restrictions

11. Clickjacking on 2FA Disabling Page

• Iframing the 2FA Disabling page and social engineering victim to disable the 2FA

12. Iframing the 2FA Disabling page and social engineering victim to disable the 2FA

• If the session is already hijacked and there is a session timeout vulnerbility

13. Bypass 2FA with null or 000000

• Enter the code 000000 or null to bypass 2FA protection.

Steps:-

1. Enter “null” in 2FA code
2. Enter 000000 in 2FA code
3. Send empty code - Someone found this in grammarly
4. Open new tab in same browser and check if other API endpoints are accessible without entering 2FA

14. Google Authenticator Bypass Steps:-

1. Set-up Google Authenticator for 2FA
2. Now, 2FA is enabled
3. Go on password reset page and change your password
4. If you are website redirect you to your dashboard then 2FA (Google Authenticator) is bypassed

15. Bypassing OTP in registration forms by repeating the form submission multiple times using repeater Steps :-

1. Create an account with a non-existing phone number
2. Intercept the Request in BurpSuite
3. Send the request to the repeater and forward
4. Go to Repeater tab and change the non-existent phone number to your phone number
5. If you got an OTP to your phone, try using that OTP to register that non-existent numbe

Rate Limit Bypass Techniques

There are two ways to do that

1. Customizing HTTP Methods

• If the request goes on GET try to change it to POST, PUT, etc.,

• If you wanna bypass the rate-limit in API's try HEAD method.

• Host: bing.com

• X-Host: bing.com

• X-Forwarded-Server: bing.com

• X-HTTP-Host-Override: bing.com

• Forwarded: bing.com

• X-Forwarded: bing.com

• X-Forwarded-By: bing.com

• X-Forwarded-For: bing.com

• X-Forwarded-For-Original: bing.com

• X-Forwarder-For: bing.com

• X-Forward-For: bing.com

• X-Forwarded-Host: bing.com

• X-Remote-Addr: bing.com

2. Adding Headers to Spoof IP

• Host: 127.0.0.1
• X-Host: 127.0.0.1
• X-Forwarded-Server: 127.0.0.1
• X-HTTP-Host-Override: 127.0.0.1
• Forwarded: 127.0.0.1
• X-Forwarded: 127.0.0.1
• X-Forwarded-By: 127.0.0.1
• X-Forwarded-For: 127.0.0.1
• X-Forwarded-For-Original: 127.0.0.1
• X-Forwarder-For: 127.0.0.1
• X-Forward-For: 127.0.0.1
• X-Forwarded-Host: 127.0.0.1
• X-Remote-Addr: 127.0.0.1
• X-Original-Remote-Addr: 127.0.0.1
• X-Original-Url: 127.0.0.1
• X-Proxy-Url: 127.0.0.1
• X-Rewrite-Url: 127.0.0.1
• X-Real-Ip: 127.0.0.1
• X-Remote-Addr: 127.0.0.1
• X-Custom-IP-Authorization:127.0.0.1
• X-Originating-IP: 127.0.0.1
• X-Remote-IP: 127.0.0.1

Bypass Rate Limit when there’s a CAPTCHA

You must have encountered a Google CAPTCHA while testing Website. These are some ways with the help of which you can bypass it.

1. Try Removing CAPTCHA Parameter from the body of the Request.
2. Try adding some String of the same length as that of the Parameter.
3. Keep the Intercept ON, Send Request to Intruder. Sometimes, It may give unexpected results.

Bypassing Rate Limit with some Characters

1. Adding Null Byte ( %00 ) at the end of the Email can sometimes Bypass Rate Limit.
2. Try adding a Space Character after a Email. ( Not Encoded )
3. Some Common Characters that help bypassing Rate Limit : %0d , %2e , %09 , %20

What is the impact of vulnerable authentication?

• The impact of authentication vulnerabilities can be severe. If an attacker bypasses authentication or brute-forces their way into another user's account, they have access to all the data and functionality that the compromised account has. If they are able to compromise a high-privileged account, such as a system administrator, they could take full control over the entire application and potentially gain access to internal infrastructure.

• Even compromising a low-privileged account might still grant an attacker access to data that they otherwise shouldn't have, such as commercially sensitive business information. Even if the account does not have access to any sensitive data, it might still allow the attacker to access additional pages, which provide a further attack surface. Often, high-severity attacks are not possible from publicly accessible pages, but they may be possible from an internal page.

How to mitigate No Rate Limiting ?

• Implement Captcha: Captcha is a common system to verify a human is a human on websites and can stop brute force attacks in progress
• Implement X-Rate-Limiting Header: We can set rate limiting with this header.

Thanks For Reading 😊

Profile Links:

• Youtube channel - https://www.youtube.com/@suresh_shankar/
• Linkedin - https://www.linkedin.com/in/bug-hunter-suresh/