vapt-auth

Authentication & Session Testing

When Invoked

The user runs /vapt auth <url> or this skill is triggered as part of Wave 3 during /vapt audit.

Prerequisites

Check for existing context:

• If VAPT-SCAN.md exists → use discovered login pages and auth endpoints
• If VAPT-WAVE2-CONTEXT.md exists → use discovered services requiring auth
• If no context → look for /login, /signin, /auth, /api/auth, /wp-login.php

Phase 1: Authentication Mechanism Analysis

1.1 Identify Auth Type

# Check for login forms
curl -sL <url>/login | grep -i '<form\|<input\|password\|username\|email'

# Check for HTTP auth
curl -sI <url>/admin | grep -i www-authenticate

# Check for API auth
curl -sI <url>/api | grep -i authorization
curl -sI <url>/api | grep -i x-api-key

Classify the authentication mechanism:

• Form-based (username/password)
• HTTP Basic/Digest Auth
• OAuth 2.0 / OpenID Connect
• JWT (Bearer tokens)
• API Key
• SAML/SSO
• Multi-factor authentication

1.2 Password Policy Analysis

If a registration form exists:

1. Attempt to register with weak passwords to discover the policy
2. Check minimum length, complexity requirements
3. Check for password strength meter
4. Check if common passwords are blocked

Phase 2: Brute Force Resistance

2.1 Rate Limiting

Send 10 rapid login attempts with wrong credentials:

for i in $(seq 1 10); do
    curl -s -o /dev/null -w "%{http_code}" -X POST <url>/login -d "username=test&password=wrong$i"
done

Check:

• Does the server rate-limit after N failures?
• Is there an account lockout mechanism?
• Are CAPTCHA/challenge mechanisms triggered?
• Does the error message change (indicating lockout)?

2.2 Username Enumeration

Test if the application reveals valid usernames:

# Compare responses for valid vs invalid usernames
curl -s -X POST <url>/login -d "username=admin&password=wrong"
curl -s -X POST <url>/login -d "username=nonexistent12345&password=wrong"

Compare: response body, status code, response time, headers. Differences indicate username enumeration.