iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Auth Testing

By · Reviewed & last updated · Part of Ethical Hacking Tutorial

Auth testing covers signup, login, MFA, password reset, sessions, and authorisation boundaries. Apply OWASP’s ASVS V2 + V3 as a checklist; every web pentest report should include the misses found here.

A practical auth-testing checklist

EXAMPLE
# Pre-flight: written authorisation covers TODAY + this asset.

# 1) ENUMERATION
#    [ ] Sign-up returns SAME message for “email exists” vs “new email”
#    [ ] Login returns SAME message for “unknown email” vs “wrong password”
#    [ ] Password reset returns “if that email exists, we sent a link”
#    [ ] Same RESPONSE TIME for all of the above (timing attacks)

# 2) PASSWORD POLICY (NIST 800-63B)
#    [ ] Minimum length ≥ 8 (12+ better), all chars allowed, paste allowed
#    [ ] No silly composition rules
#    [ ] Stored as argon2id / bcrypt (NEVER sha-anything)
#    [ ] Breach-list check on signup + password change (HIBP)

# 3) RATE LIMITING
#    Test login + reset + signup with Burp Intruder:
#    100 attempts/min → 200 responses?  → no lockout.
#    [ ] Per-IP, per-account, GLOBAL bucket. Lockout on threshold.
#    [ ] Same on /api/login (not just the web form).

# 4) MFA
#    [ ] TOTP / WebAuthn supported
#    [ ] Cannot bypass via “trust this device” cookie tampering
#    [ ] Cannot bypass via password reset (the reset path requires MFA too)
#    [ ] Recovery codes one-time use, regenerable

# 5) SESSION MANAGEMENT
#    [ ] Cookie is HttpOnly + Secure + SameSite=Lax
#    [ ] Session ID rotates on login (anti-fixation)
#    [ ] Idle timeout (≤ 30 min) + absolute timeout (≤ 24h)
#    [ ] Logout invalidates the session SERVER-SIDE (not just client)
#    [ ] Concurrent sessions: list + revoke from settings

# 6) PASSWORD RESET
#    [ ] Single-use token, ≤ 60 min validity
#    [ ] Token bound to email + sufficient entropy (≥ 128 bits)
#    [ ] Using reset DOES NOT log the user in automatically
#    [ ] Notification email goes to the OLD address as well
#    [ ] Cannot enumerate via reset endpoint

# 7) AUTHORISATION (linked to A01)
#    [ ] IDOR sweeps on /users/{id}, /orders/{id}, /files/{id}
#    [ ] /admin/* unreachable for non-admins (test via Burp Repeater)
#    [ ] PUT/PATCH bodies validated — no mass-assignment of role / tenant_id
#    [ ] API endpoints have same authZ as web endpoints

# 8) OAUTH / OIDC (if applicable)
#    [ ] state parameter present + verified (CSRF on OAuth)
#    [ ] redirect_uri is on an allow-list (not partial match)
#    [ ] PKCE for public clients (mobile / SPA)
#    [ ] ID-token signature checked + iss/aud validated

# 9) ACCOUNT TAKEOVER VECTORS
#    [ ] Email change requires re-verification
#    [ ] Password change requires current password (or fresh re-auth)
#    [ ] Critical actions require fresh re-auth (last login < 5 min)
#    [ ] No SSRF in profile-picture / avatar upload

# 10) LOG + ALERT — finally
#    Every auth event should reach the SIEM (login success, fail, MFA enrol, reset request, role change).

Why it matters

Auth is the only thing protecting everything else. A complete auth-testing pass usually finds more “critical/high” findings than the rest of the test combined — budget half a day per release, every release.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Test the OWASP ASVS V2 checklist on YOUR app:
#   - Lockout on brute-force
#   - Password policy (HIBP integration)
#   - MFA enrolment + bypass
#   - Session timeout + rotation on login
#   - Reset flow (single-use, time-bound tokens)
#   - Account enumeration (same response timing for known vs unknown emails)
Try it Yourself »

Discussion

Loading…