Broken Authentication

You'll be able to

• ✓Identify broken authentication patterns: weak credentials, no lockout
• ✓Exploit username enumeration to target valid accounts
• ✓Perform credential brute force against login forms with Hydra
• ✓Bypass authentication using parameter manipulation and default accounts

Lessons

1. 1No Rate Limiting. 150 Million Spotify Accounts Targeted in One Night.
2. 2How Authentication Systems Fail
3. 3No Rate Limiting — Brute Force & Credential Stuffing
4. 4Your Turn: Try the ObviousHANDS-ON
5. 5Insecure Password Reset
6. 6Tool — curl for Brute Forcing
7. 7Tool: Hydra — Login Brute Forcer
8. 8Module quiz
9. 9Hands-on Lab: Exploit ChirperHANDS-ON