Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.

SKILL: Authentication Bypass — Expert Attack Playbook AI LOAD INSTRUCTION : Expert authentication bypass techniques. Covers SQL injection based login bypass, password reset flaws, token predictability, account enumeration, brute force bypass, and multi factor auth bypass. Distinct from JWT/OAuth (covered in ../jwt oauth token attacks/SKILL.md). Focus on the login mechanism itself. 0. AUTHORIZED CREDENTIAL TEST PLANNING After reducing routing entries, default credentials, username variants, port focus, and wordlist sizing are handled here in one place. Service first tiny sets Service Type First Usernames First Passwords phpMyAdmin root , admin empty, root , phpmyadmin , admin FTP ftp , admin , test empty, ftp , admin , 123456 SSH root , admin , service account names root , admin , seasonal variants MySQL root , mysql empty, root , mysql Tomcat / Java admin tomcat , admin , manager tomcat , admin , s3cret WebLogic weblogic , admin weblogic , welcome1 , admin Username classes Class Examples Generic admins admin , administrator , root , test , guest Support / ops dev , ops , sysadmin , service , backup Name based firstname , lastname , f.lastname , first.last Mail derived left side of corporate email formats Product based tomcat , weblogic , jenkins , gitlab Wordlist sizing and port focus Scenario Preferred Size Why Default admin panel 5 to 50 passwords Defaults beat giant lists here Internal service with known product vendor specific small set Better signal than generic lists Consumer login with weak controls Top 20 or Top 100 Fast verification Rate limited login tiny list + header/rotation strategy Preserve attempts Offline hash cracking large dictionaries Online brute rules do not apply Prioritize common ports and service surfaces: 80/443/8080/8443 admin panels, 22 SSH, 21 FTP, and 3306/5432/6379/27017 data or management services. 1. SQL INJECTION LOGIN BYPASS Classic but still found in legacy systems, custom ORMs, and raw query code: Test each field separately — only one field may be vulnerable. 2. PASSWORD RESET VULNERABILITIES Guessable / Predictable Reset Tokens Check if reset token is based on: Test : Request 3 consecutive reset emails, compare token patterns. Reset Token Not Expiring Reset Token Reuse Host Header Injection in Reset Email When application generates reset URL using Host header: → Reset email sent to victim with link pointing to attacker.com/reset?token=VICTIM TOKEN → Victim clicks → token captured by attacker Test : Send password reset with modified Host: , check email for where reset link points. Password Reset Token in Referer Password Change Without Current Password 3. ACCOUNT ENUMERATION Identifying valid usernames/emails enables targeted attacks: Error Message Difference Response Time Difference Password Reset Flow Registration Endpoint 4. BRUTE FORCE BYPASS Lockout After N Attempts Then Resets IP Based Lockout Bypass Username Cycling vs Password Cycling Credential Stuffing Use breached credentials from HaveIBeenPwned datasets against target: 5. MULTI FACTOR AUTHENTICATION BYPASS Session Cookie Before 2FA Completion 2FA Code Brute Force 2FA on Critical Actions Not On Login 2FA Backup Code Abuse 2FA Code Reuse 6. OAUTH / SSO ACCOUNT TAKEOVER PATTERNS Email Claim Trust Password Doesn't Apply After SSO Link 7. USERNAME / PASSWORD FIELD MANIPULATION Long Password DoS → Bypass Null Byte in Username Unicode Normalization 8. SESSION MANAGEMENT FLAWS Session Not Invalidated on Logout Session Not Regenerated on Privilege Change Predictable Session Tokens 9. AUTHENTICATION TESTING CHECKLIST 10. PASSWORD RESET ATTACK MATRIX (22 Patterns) Pattern Description 1 Predictable reset token Token based on timestamp, user ID, or sequential number 2 Token not bound to user Use token generated for user A to reset user B 3 Token in response body Reset token returned in HTTP response (not just email) 4 Token in URL parameter Reset link token visible in Referer header to external resources 5 No token expiration Token remains valid indefinitely 6 Token reuse Same token works multiple times 7 Short/brute forceable token 4 6 digit numeric code without rate limiting 8 Password reset via host header Host: attacker.com → reset link sent with attacker's domain 9 Registration overwrites existing account Register with same email → overwrites password 10 Step skip (frontend only) Jump directly to "set new password" step via URL 11 Response manipulation Change {"status":"fail"} to {"status":"success"} in proxy 12 Verification code in response SMS/email code returned in API response 13 Parallel session reset Start reset for A, complete with B's session 14 Email/phone parameter pollution email=victim@x.com&email=attacker@x.com 15 Unicode normalization admin@target.com vs ADMIN@target.com vs Unicode confusables 16 SQL injection in reset Email field injectable in reset query 17 IDOR on reset endpoint Change user ID in reset confirmation request 18 Cross protocol reset Mobile API doesn't validate same token as web 19 Default security questions Guessable answers, no rate limit 20 Token generation race condition Multiple simultaneous requests generate same token 21 Logout doesn't invalidate reset After password change, old sessions still work 22 Reset link cached by CDN/proxy Public cache stores reset link with token 11. CAPTCHA/VERIFICATION BYPASS PATTERNS (20 Methods) Method How 1 Remove captcha parameter Delete captcha field from request 2 Send empty captcha captcha= or captcha=null 3 Reuse previous captcha Same captcha value works multiple times 4 Captcha not bound to session Use captcha solved in session A for session B 5 Server side validation missing Captcha checked client side only 6 Response manipulation Intercept and change response to bypass 7 Change request method POST→GET or vice versa may skip captcha check 8 JSON content type Switch from form to JSON — captcha handler may not process 9 OCR bypass Simple captchas solvable with tesseract/ML 10 Audio captcha weakness Audio often simpler than visual 11 SMS code in response Verification code returned in API response body 12 SMS code predictable Sequential or time based codes 13 No rate limit on code verification Brute force 4 6 digit code 14 Code not bound to phone/email Use code sent to phone A on account B 15 Code doesn't expire Old codes remain valid 16 Null byte in phone number +1234567890%00 bypasses dedup but delivers to same number 17 Case sensitivity Email: Admin@X.com vs admin@x.com 18 Space/encoding in identifier user@x.com vs user@x.com (trailing space) 19 Concurrent requests Race condition: send verify before captcha loads 20 Third party captcha bypass Misconfigured reCAPTCHA site key allows any domain 12. INSECURE RANDOMNESS — TOKEN PREDICTION UUID v1 (Time Based — Predictable!) MongoDB ObjectId PHP uniqid() PHP mt rand() Recovery Tools guidtool — UUID v1 reconstruction AethliosIK/reset tolkien — Automated token prediction for password resets openwall/php mt seed — PHP mt rand seed recovery sandwich — Token timestamp analysis

authbypass-authentication-flaws