PT2 · Module 2
Authentication Attacks
Reach past the login screen through user enumeration, credential attacks, session hijacking, JWT forgery, OAuth flow abuse, and MFA bypass. End with chaining auth primitives into account takeover.
5 resources Last updated October 4, 2026
The login screen is a filter, not a wall. This module covers every way to reach past it: enumerating accounts the application never meant to confirm, cracking the credential layer, hijacking or forging the tokens that gate protected routes, predicting server-generated secrets, and bypassing MFA controls. Each primitive is small on its own; chained together, they produce the critical finding PT2 rewards.
Where To Start
Login enumeration precedes every credential attack. The same form that returns a generic error on login often leaks account validity on the password-reset endpoint, through response-time deltas, or via differing status codes on the registration flow. Automate the comparison, do not eyeball it. Default credentials and leaked breach-dump pairs are tried before any computationally expensive attack.
Credentials And Lockout
Brute force, password spraying, and credential stuffing differ only in the ratio of users to passwords. Weak brute-force protection fails through proxy-header spoofing (lockout keyed on X-Forwarded-For), per-user-only throttling with no per-IP ceiling, or race conditions in the lockout counter itself.
Tokens And Sessions
Session fixation, predictable session IDs, and tokens that survive logout extend the window for stolen-token replay. JWT weaknesses are structural: alg:none acceptance, RS256 to HS256 downgrade with the public key as the HMAC secret, weak signing secrets cracked offline, and kid injection into the key-lookup path. Server-generated random tokens that use mt_rand(), uniqid(), or a seeded Random instance fall to seed recovery.
MFA Bypass
Logic flaws dominate: skipping the verification step by submitting the final request directly, replaying one account's TOTP code into another session, and brute-forcing short numeric codes when rate limiting is only applied per account.
Chaining
Login enumeration gives the user list; password spraying gives one account; a weak JWT secret or a flipped alg claim escalates that account to admin. That full chain is the finding, not each step alone.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 5 min readWeak Random Token GenerationFocus on #Identifying Weak Token Generation #PHP mt_rand() Seed Cracking #Step 1: Collect a Token #Step 2: Crack the Seed #Step 3: Predict Future Tokens #Timestamp-Based Token Prediction #PHP uniqid() Weakness #Python random Module State Recovery #Java java.util.Random Seed Prediction #Entropy Analysis with Burp Sequencer
Practice
Apply the module hands-on.
- Enumeration & Brute Force TryHackMe Easy
- Session Management TryHackMe Easy
- JWT Security TryHackMe Easy
- OAuth Vulnerabilities TryHackMe Medium
- Multi-Factor Authentication TryHackMe Easy
- Hammer TryHackMe Medium
- Secret HackTheBox Easy
- Unicode HackTheBox Medium
- JWT authentication bypass via jku header injection PortSwigger Hard
- Authentication bypass via OAuth implicit flow PortSwigger Medium