auth-bypass

Authentication Bypass

What Is Broken and Why

Authentication logic applied only at the login page leaves all downstream pages unprotected. Applications relying on client-supplied flags (authenticated, role, admin) to gate access allow trivial bypass by modifying those values. Predictable session tokens enable forging. Insecure deserialization in cookie handling allows boolean type juggling to short-circuit credential verification. Credentials transmitted over HTTP expose them to passive interception. Browser caching of authenticated responses allows offline credential harvesting from shared machines.

Key Signals

• Login redirect but direct URL access to /dashboard, /admin, /profile returns 200
• Parameters like authenticated=, isAdmin=, role=, debug=, fromtrustIP= in GET/POST/cookies
• Session cookies with sequential, time-based, or partially-static values
• Login form accepting ' OR '1'='1 or similar SQL payloads
• Application serializes auth state into cookies (a:2:{s:11:"autologinid";...})
• Login or registration form submitting over http:// instead of https://
• Absence of Secure flag on session cookies
• No Cache-Control: no-store on pages containing sensitive data
• Set-Cookie not issuing new token after successful authentication (session fixation overlap)

Methodology

1. Map all authenticated endpoints: Spider application; note every URL requiring login.
2. Forced browsing: Without authenticating, request each protected URL directly. Record any that return 200 or partial content.
3. Parameter tampering: Intercept login and post-login requests; add or modify boolean parameters (authenticated=yes, admin=true, debug=true, fromtrustIP=true).
4. Cookie manipulation: Decode cookies (base64, URL, serialization); identify role/auth fields; modify and re-submit.
5. Session prediction: Collect 50+ session tokens under identical conditions; analyze for patterns (incrementing integers, timestamp encoding, partial static prefix).
6. SQL injection on login: Attempt classic payloads in username/password fields.
7. Deserialization probe: If PHP serialized format detected in cookie, craft boolean bypass.
8. Transport test: Replace https:// with http:// for login, registration, and password flows; observe if credentials submit over plain HTTP.
9. Cache test: Log in, log out, press Back; reload authenticated pages; check local cache files.