{
  "slug": "auth-testing",
  "title": "Authentication Testing",
  "phase": "Exploitation",
  "description": "Test authentication mechanisms for broken access control, JWT vulnerabilities, IDOR, insecure password reset flows, and OAuth misconfigurations.",
  "difficulty": "high",
  "tags": [
    "testing",
    "authentication",
    "authorization",
    "jwt",
    "idor",
    "oauth",
    "broken-access-control"
  ],
  "tools": [
    "burpsuite",
    "jwt_tool",
    "ffuf",
    "nuclei",
    "oauthscan"
  ],
  "steps": [
    {
      "id": "auth-01",
      "title": "Map authentication surfaces",
      "description": "Identify all authentication-related endpoints before testing begins.",
      "commands": [
        "cat all-urls.txt | grep -iE '(login|signin|auth|token|oauth|sso|saml|password|reset|register|signup)'",
        "nuclei -l live-hosts.txt -t exposures/configs/ -t default-logins/ -o nuclei-auth.txt"
      ],
      "notes": "Include logout, session invalidation, and MFA endpoints in your map."
    },
    {
      "id": "auth-02",
      "title": "JWT analysis and attacks",
      "description": "Decode and test JWT tokens for algorithm confusion, weak secrets, and claim tampering.",
      "commands": [
        "jwt_tool <token> -T",
        "jwt_tool <token> -X a",
        "jwt_tool <token> -X k -pk public.pem",
        "jwt_tool <token> -C -d /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt"
      ],
      "notes": "Check for long-lived tokens with no expiry claim. Test whether revoked tokens are still accepted."
    },
    {
      "id": "auth-03",
      "title": "IDOR and broken object-level authorisation",
      "description": "Test whether object identifiers can be substituted to access another user's resources.",
      "commands": [
        "ffuf -u 'https://target.com/api/users/FUZZ/profile' -w ids.txt -H 'Authorization: Bearer <token>' -mc 200"
      ],
      "notes": "Test numeric IDs, UUIDs, email addresses, and username-based identifiers. Horizontal and vertical privilege escalation are both in scope."
    },
    {
      "id": "auth-04",
      "title": "Password reset flow analysis",
      "description": "Test the password reset process for predictable tokens, host header injection, and race conditions.",
      "commands": [
        "curl -s -X POST https://target.com/forgot-password -d 'email=victim@example.com' -H 'Host: attacker.com'"
      ],
      "notes": "Check whether reset tokens are single-use, time-limited, and invalidated after password change."
    },
    {
      "id": "auth-05",
      "title": "OAuth 2.0 misconfiguration testing",
      "description": "Test OAuth flows for open redirects, state fixation, PKCE bypass, and token leakage.",
      "commands": [
        "curl 'https://target.com/oauth/authorize?response_type=code&client_id=CLIENT_ID&redirect_uri=https://attacker.com'"
      ],
      "notes": "Verify that the state parameter is validated and that redirect_uri is strictly whitelisted, not prefix-matched."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/oauth",
    "https://portswigger.net/web-security/jwt",
    "https://github.com/ticarpi/jwt_tool",
    "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html",
    "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-04-04"
}