Broken Authentication

Check List

Methodology

Black Box

Missing Authentication on Sensitive API Endpoint

1

Do not authenticate to the application

2

Directly access a protected API endpoint

GET /api/user/profile HTTP/1.1
Host: target.com

3

If response returns user data without requiring Authorization header, authentication enforcement is missing

4

Test with random token

GET /api/user/profile HTTP/1.1
Host: target.com
Authorization: Bearer randomtoken123

5

If endpoint responds with valid user data or default user context, authentication validation is broken

6

If no 401/403 response is returned for unauthenticated access, Broken Authentication is confirmed

---

Predictable JWT Secret

1

Login and capture JWT

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.payload.signature

2

Decode JWT payload, Identify algorithm

{"alg":"HS256"}

3

Attempt to brute-force weak secret using jwt tool

4

If secret is guessable ("secret", "123456"), generate new token with modified payload:

{"user":"admin","role":"admin"}

5

Sign token with discovered secret, Replace Authorization header

Authorization: Bearer forged_admin_token

6

Access privileged endpoint

GET /api/admin/dashboard HTTP/1.1
Host: target.com
Authorization: Bearer forged_admin_token

7

If access is granted, JWT authentication mechanism is broken

8

If server accepts forged token, Broken Authentication vulnerability is confirmed

---

Session Fixation via API

1

Access login endpoint and intercept response

POST /api/login HTTP/1.1
Host: target.com
Content-Type: application/json

{"username":"user1","password":"Pass123"}

2

Observe returned session token

Set-Cookie: session=abc123; Path=/; HttpOnly

3

Before login, manually set session cookie

Cookie: session=fixedsession123

4

Perform login, If server reuses provided session ID after authentication

Set-Cookie: session=fixedsession123

5

Then session fixation is possible, Use fixed session in another browser

GET /api/user/profile HTTP/1.1
Host: target.com
Cookie: session=fixedsession123

6

If authenticated access is granted, session management is flawed

7

If session ID is not regenerated upon login, Broken Authentication vulnerability is confirmed

---

White Box

Cheat Sheet