Authentication Vulnerabilities

AIPTx thoroughly tests authentication mechanisms and session management to identify weaknesses that could lead to unauthorized access.

Authentication Testing

Broken Authentication

Vulnerability	Risk	AIPTx Detection
Credential stuffing	High	Rate limit testing
Brute force	High	Account lockout analysis
Default credentials	Critical	Common credential testing
Weak passwords	Medium	Policy enforcement testing
Password reset flaws	High	Token analysis, workflow testing

Credential Testing

AIPTx tests for:

Default Credentials - Common username/password combinations
Weak Passwords - Policy enforcement verification
Password Recovery - Secure reset flow validation
Account Enumeration - Response differentiation analysis

Example Finding

{
  "title": "Account Enumeration via Login Response",
  "severity": "medium",
  "endpoint": "POST /api/auth/login",
  "description": "Different error messages reveal valid usernames",
  "poc": {
    "valid_user": {"response": "Invalid password", "status": 401},
    "invalid_user": {"response": "User not found", "status": 404}
  },
  "remediation": "Use generic error message: 'Invalid credentials'"
}

Session Management

Session Vulnerabilities

Session Fixation

Tests if session IDs are regenerated after authentication

Session Hijacking

Validates session token security and transmission

Session Timeout

Verifies proper session expiration

Concurrent Sessions

Tests session management across multiple logins

Session Token Analysis

AIPTx analyzes session tokens for:

Token Entropy: 256 bits ✅
Predictability: None detected ✅
Secure Flag: Present ✅
HttpOnly Flag: Present ✅
SameSite: Strict ✅
Expiration: 24 hours ✅

Attribute	Purpose	AIPTx Check
`Secure`	HTTPS only	✅
`HttpOnly`	No JavaScript access	✅
`SameSite`	CSRF protection	✅
`Path`	Cookie scope	✅
`Domain`	Domain scope	✅

JWT Security

JWT Vulnerabilities

Vulnerability	Description	CVSS
Algorithm confusion	None algorithm attack	9.8
Weak signing key	Brute-forceable secrets	9.1
Missing expiration	Tokens never expire	7.5
Sensitive data in payload	PII in token	5.3

Testing Methodology

Algorithm Analysis

// Algorithm None attack
{
  "alg": "none",
  "typ": "JWT"
}

Key Brute Force
- Common secrets testing
- Dictionary attack on HS256

Claim Manipulation

{
  "sub": "admin",
  "role": "administrator",
  "exp": 9999999999
}

Example Finding

{
  "title": "JWT Algorithm Confusion Vulnerability",
  "severity": "critical",
  "description": "Server accepts tokens with 'none' algorithm",
  "poc": {
    "original_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
    "exploit_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiJ9.",
    "result": "Admin access granted without valid signature"
  }
}

OAuth/OIDC Testing

OAuth Vulnerabilities

Open Redirect - Redirect URI validation bypass
CSRF - State parameter missing or weak
Token Leakage - Tokens in URLs or logs
Scope Escalation - Requesting unauthorized scopes

Testing Flow

Multi-Factor Authentication

MFA Bypass Testing

Attack	Description	Test
Code brute force	Rate limit on 2FA codes	✅
Code reuse	Same code multiple uses	✅
Backup code abuse	Predictable backup codes	✅
Session after 2FA	Auth without completing 2FA	✅
Device trust bypass	Remember device manipulation	✅

Example Finding

{
  "title": "MFA Bypass via Direct API Access",
  "severity": "critical",
  "description": "API endpoints accessible without completing MFA",
  "poc": {
    "step1": "Complete username/password auth",
    "step2": "Skip MFA prompt, call /api/user directly",
    "result": "User data returned without MFA verification"
  }
}

Password Reset Flaws

Vulnerabilities Tested

Token Predictability - Weak random generation
Token Expiration - Long-lived or no expiration
Token Reuse - Single-use enforcement
Account Takeover - Host header injection
Rate Limiting - Brute force protection

Host Header Attack

POST /api/password-reset HTTP/1.1
Host: evil.com
Content-Type: application/json

{"email": "[email protected]"}

Vulnerable Response:

Reset link: https://evil.com/reset?token=abc123

Remediation Guidelines

Secure Session Management

// Session configuration
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,
    httpOnly: true,
    sameSite: 'strict',
    maxAge: 3600000 // 1 hour
  }
}));

// Regenerate session on login
req.session.regenerate((err) => {
  req.session.user = user;
});

Secure JWT Implementation

// Use strong algorithm
const token = jwt.sign(
  { sub: user.id, role: user.role },
  process.env.JWT_SECRET,
  {
    algorithm: 'RS256',
    expiresIn: '1h',
    issuer: 'your-app'
  }
);

// Verify with explicit algorithm
jwt.verify(token, publicKey, {
  algorithms: ['RS256'],
  issuer: 'your-app'
});

Secure Password Reset

// Generate secure token
const token = crypto.randomBytes(32).toString('hex');

// Store with expiration
await db.passwordResets.create({
  userId: user.id,
  token: hashToken(token),
  expiresAt: Date.now() + 3600000 // 1 hour
});

// Use internal URL for reset link
const resetUrl = `${process.env.APP_URL}/reset?token=${token}`;

Getting Started

Usage

Vulnerability Coverage

Integrations

Reports & Compliance

Advanced

Authentication Vulnerabilities

Authentication Vulnerabilities

Authentication Testing

Broken Authentication

Credential Testing

Example Finding

Session Management

Session Vulnerabilities

Session Fixation

Session Hijacking

Session Timeout

Concurrent Sessions

Session Token Analysis

JWT Security

JWT Vulnerabilities

Testing Methodology

Example Finding

OAuth/OIDC Testing

OAuth Vulnerabilities

Testing Flow

Multi-Factor Authentication

MFA Bypass Testing

Example Finding

Password Reset Flaws

Vulnerabilities Tested

Host Header Attack

Remediation Guidelines

​Authentication Vulnerabilities

​Authentication Testing

​Broken Authentication

​Credential Testing

​Example Finding

​Session Management

​Session Vulnerabilities

Session Fixation

Session Hijacking

Session Timeout

Concurrent Sessions

​Session Token Analysis

​Cookie Security

​JWT Security

​JWT Vulnerabilities

​Testing Methodology

​Example Finding

​OAuth/OIDC Testing

​OAuth Vulnerabilities

​Testing Flow

​Multi-Factor Authentication

​MFA Bypass Testing

​Example Finding

​Password Reset Flaws

​Vulnerabilities Tested

​Host Header Attack

​Remediation Guidelines

Authentication Vulnerabilities

Authentication Testing

Broken Authentication

Credential Testing

Example Finding

Session Management

Session Vulnerabilities

Session Token Analysis

Cookie Security

JWT Security

JWT Vulnerabilities

Testing Methodology

Example Finding

OAuth/OIDC Testing

OAuth Vulnerabilities

Testing Flow

Multi-Factor Authentication

MFA Bypass Testing

Example Finding

Password Reset Flaws

Vulnerabilities Tested

Host Header Attack

Remediation Guidelines