# Authentication Attacks

> Reach past the login screen through user enumeration, credential attacks, session hijacking, JWT forgery, OAuth flow abuse, and MFA bypass. End with chaining auth primitives into account takeover.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

The login screen is a filter, not a wall. This module covers every way to reach past it: enumerating accounts the application never meant to confirm, cracking the credential layer, hijacking or forging the tokens that gate protected routes, predicting server-generated secrets, and bypassing MFA controls. Each primitive is small on its own; chained together, they produce the critical finding PT2 rewards.

## Where To Start

Login enumeration precedes every credential attack. The same form that returns a generic error on login often leaks account validity on the password-reset endpoint, through response-time deltas, or via differing status codes on the registration flow. Automate the comparison, do not eyeball it. Default credentials and leaked breach-dump pairs are tried before any computationally expensive attack.

## Credentials And Lockout

Brute force, password spraying, and credential stuffing differ only in the ratio of users to passwords. Weak brute-force protection fails through proxy-header spoofing (lockout keyed on `X-Forwarded-For`), per-user-only throttling with no per-IP ceiling, or race conditions in the lockout counter itself.

## Tokens And Sessions

Session fixation, predictable session IDs, and tokens that survive logout extend the window for stolen-token replay. JWT weaknesses are structural: `alg:none` acceptance, `RS256` to `HS256` downgrade with the public key as the HMAC secret, weak signing secrets cracked offline, and `kid` injection into the key-lookup path. Server-generated random tokens that use `mt_rand()`, `uniqid()`, or a seeded `Random` instance fall to seed recovery.

## MFA Bypass

Logic flaws dominate: skipping the verification step by submitting the final request directly, replaying one account's TOTP code into another session, and brute-forcing short numeric codes when rate limiting is only applied per account.

## Chaining

Login enumeration gives the user list; password spraying gives one account; a weak JWT secret or a flipped `alg` claim escalates that account to admin. That full chain is the finding, not each step alone.

## Study material

- [Login Page Enumeration](https://hackindex.io/services/web/enumeration/login-page-enumeration.md) (read, core)
- [Authentication Vulnerability Testing](https://hackindex.io/services/web/vulnerability-discovery/authentication-vulnerability-testing.md) (read, core)
- [Weak Random Token Generation](https://hackindex.io/services/web/vulnerability-discovery/weak-random-token-generation.md) (read, core)
- [JWT Vulnerability Testing](https://hackindex.io/services/web/vulnerability-discovery/jwt-vulnerabilities.md) (read, core)
- [JWT Exploitation](https://hackindex.io/services/web/exploitation/jwt-exploitation.md) (read, core)