Week 04 · Auth & Session ULTIMATE · 7 days × 180 min
Every login is an ATO attempt.
Enum → reset/OTP → session/JWT → OAuth → MFA/rate-limit → SAML/WebAuthn → logging. End with a publication-quality report draft. Self-registered accounts only, no destructive auth.
0:00–0:15 Enum vectors + reset-token leak points cold
List error/timing/lockout enum + token via Host/Referer/ Niagara. Read OWASP Forgot-Password sheet § token delivery/expiry/reuse/binding ONLY + WSTG weak-reset § objectives ONLY.
Why this matters ▼
What it is
Enum tells who exists; reset flow tells how to steal them. GitLab $35k = no-interaction reset.
Done-when
Vectors + 4 leak points listed.
0:15–1:05 PortSwigger enum + reset-poison labs (Host/Referer)
Do lab-username-enumeration-via-different-responses (msg diff) + password-reset-broken-logic (token not tied) + Host-header reset-poisoning ATO lab — IN ORDER. Poison via
Host: evil + X-Forwarded-Host, check Referer leak. YT:password reset poisoning Host header.Why this matters ▼
H1
Search hacktivity
GitLab password reset token— token tied to user? expiry? reuse? binding?Done-when
Enum matrix + reset-flow map (delivery/expiry/reuse/binding).
1:05–2:00 GitLab $35k + Host-poison + OTP rate math (10^6)
Read H1 GitLab no-interaction reset summary + 1 Host-poison ATO — flaw family ONLY + PATT Rate-limit OTP section (0000–9999 + header rotation) ONLY. Compute: 10^6 ÷ rate = time; rotation divides it.
Why this matters ▼
Pattern
Reset flaws: poisoning, token leak, no-expiry, reuse, no-binding. OTP: no-limit + rotation bypass.
Done-when
Families + math in notes.
2:00–2:35 Reset-flow map template + rate-limit map
Fill template per OWASP Auth sheet § password section ONLY: delivery/expiry/reuse/binding/rate. Log lockout + rotation behavior.
Why this matters ▼
Done-when
Template + map saved, reusable all week.
2:35–3:00 Reset families test + gaps
Recite 5 families cold. Triage gaps (JWT/OAuth/MFA preview).
Why this matters ▼
Done-when
Recited + gaps assigned.
0:00–0:15 JWT parts + HS256 vs RS256 vs none
Decode one token on jwt.io (header/payload/signature panes) ONLY. State confusion: RS→HS with public key as HMAC secret. Read PortSwigger JWT topic intro § alg confusion ONLY.
Why this matters ▼
Done-when
Parts + confusion explained cold.
0:15–1:05 JWT labs: none → weak secret → confusion → JWKS spoof → kid
Do lab-jwt-authentication-bypass-via-unverified-signature (strip → alg:none) + weak-secret (hashcat -m 16500 rockyou) + jwk-header-injection (jku→attacker JWKS, kid traversal) IN ORDER. YT:
portswigger JWT none algorithm jwks exploit. HackTricks JWT page § alg/kid/jku ONLY.Why this matters ▼
H1
Search hacktivity
JWT weak secret— secret1/admin/123456 +kid: ../../keytraversal. Hammer JWKS-spoof chain = jku to attacker file.Done-when
4 bypasses + matrix (alg/kid/jku/lifetime/storage).
1:05–2:00 JWKS-spoof priv-esc + cross-service relay + fixation/rotation
Read H1 JWT relay case (token accepted across services) — audience check ONLY + test cookie fixation + rotation on privilege change per WSTG Session headings ONLY.
Why this matters ▼
Pattern
Missing aud/iss + long lifetime + localStorage = theft + replay. Fixation = session not rotated.
Done-when
Relay note + fixation/rotation results.
2:00–2:35 JWT matrix: alg/kid/jku/lifetime/storage/audience
Consolidate matrix. Add nuclei http/misconfiguration/jwt.yaml dry-run on lab ONLY.
Why this matters ▼
Done-when
Matrix saved for live hunt.
2:35–3:00 HS vs RS test + gaps
Explain confusion with key roles. Triage gaps (OAuth next).
Why this matters ▼
Done-when
Recited + matrix archived.
0:00–0:15 Code flow + redirect_uri + state + PKCE + nonce roles
Diagram the flow, then read PortSwigger OAuth topic §爷爷 flow + implicit vs code ONLY + WSTG ATHZ-05 OAuth § objectives ONLY.
Why this matters ▼
Done-when
Flow + 4 params cold.
0:15–1:05 OAuth labs: redirect_uri + state + open-redirect chain
Do lab-oauth-authentication-bypass-via-oauth-implicit-flow (token via redirect_uri + open-redirect chain) + 1 state-fixation lab. Bypass table:
//evil%2f.. ?next= /*.target. YT:OAuth account takeover redirect_uri state.Why this matters ▼
H1
Search hacktivity
OAuth account takeover disclosed— code to attacker URI + missing state + dynamic registration logo_uri/jwks_uri SSRF.Done-when
Bypass table + 2 lab solves.
1:05–2:00 Token theft via Referer/postMessage/history + Frans Rosen
Test leak channels on lab. Read HackTricks OAuth § Dynamic Client Registration ONLY + skim Frans Rosen OAuth research index (detectify labs) headings ONLY.
Why this matters ▼
Done-when
3 leak channels + registration note.
2:00–2:35 OAuth checklist: redirect/state/PKCE/referer/postMessage/nonce
Consolidate + nuclei oauth-open-redirect.yaml dry-run lab ONLY.
Why this matters ▼
Done-when
Checklist saved.
2:35–3:00 PKCE purpose + leak paths test + gaps
Explain PKCE (code_intercept) + 3 leak paths. Triage gaps (MFA next).
Why this matters ▼
Done-when
Recited + checklist archived.
0:00–0:15 Bypass families: reuse/skip/tamper/backup + math
List families + compute 10^6 ÷ limit. Read PortSwigger MFA topic § 2FA-simple-bypass (direct nav) ONLY.
Why this matters ▼
Done-when
Families + math cold.
0:15–1:05 MFA labs: reuse + step-skip + response-tamper + Turbo OTP race
Do 2FA-simple-bypass + 1 response-tamper lab. Turbo Intruder OTP 20-request race demo on lab ONLY (never full 10^6 on live). YT:
2FA bypass race condition bug bounty. X:MFA bypass OTP race.Why this matters ▼
H1
Search hacktivity
race condition 2FA bypass— single-packet gate + parallel timing table (Week 10 executes).Done-when
3 bypasses + 20-req race log.
1:05–2:00 Rate-limit bypass: header rotation + method/param variants
Test
X-Forwarded-For: 127.0.{1-255}rotation + null-byte + method override per PATT Rate-limit table ONLY on lab (broken-brute-force-ip-block lab). Note lockout + backup-code abuse.Why this matters ▼
Done-when
Rotation + 2 variants logged with lockout behavior.
2:00–2:35 MFA + rate-limit matrices (headers/methods/backup)
Consolidate matrices. Add backup-code + downgrade
?mfa=falserow.Why this matters ▼
Done-when
Matrices saved.
2:35–3:00 Step-skip + lockout test + gaps
Recite skip + rotation logic. Triage gaps (SAML next).
Why this matters ▼
Done-when
Recited + matrices archived.
0:00–0:15 Assertion parts + XSW idea + WebAuthn ceremony
Sketch Issuer/NameID/Conditions/Audience/Signature. Read HackTricks SAML attacks § XSW variants list ONLY + WebAuthn ceremony (challenge → authenticator → origin check) summary ONLY.
Why this matters ▼
Done-when
Parts + XSW + ceremony cold.
0:15–1:05 SAML Raider drills: wrap / comment / audience / replay (lab)
Install SAMLRaider (Burp ext) — XSW wrap + cert-bypass + NameID tamper panes ONLY. Drill: duplicate assertion, comment-in-NameID, audience removal, replay. YT:
SAML Raider XSW walkthrough.Why this matters ▼
Done-when
4 drills + screenshots (lab).
1:05–2:00 SAML-wrap ATO + audience-not-validated + WebAuthn downgrade
Read HackTricks SAML 1 wrap-ATO + 1 audience-missing case — tampered node ONLY + test
userVerification=preferreddowngrade idea (no secret theft).Why this matters ▼
Done-when
2 patterns + downgrade note.
2:00–2:35 SAML map: signature/audience/replay/binding + ceremony notes
Consolidate map. Note binding (POST vs Redirect) + clock-skew.
Why this matters ▼
Done-when
Map saved.
2:35–3:00 XSW idea + passkey abuse test + gaps
Explain XSW in 3 sentences + 1 workflow abuse (not theft). Triage gaps.
Why this matters ▼
Done-when
Recited + map archived.
0:00–0:15 Policy controls + provisioning priv-esc + A09 logging
List weak-policy signals +
admin provisions admin?+ unlogged auth events. Read OWASP Auth sheet § policy + WSTG Identity headings ONLY.Why this matters ▼
Done-when
3 lists cold.
0:15–1:05 Weak-policy + provision-admin-as-admin + deprovisioning (lab)
Test short/123456/no-lockout + invite-link reuse + removed-user session still valid (lab). Log which auth events produce no log entry.
Why this matters ▼
H1
Search hacktivity
org takeover provisioning invite— invite reuse + default-admin patterns.Done-when
Policy + provisioning + deprovision results.
1:05–2:00 Org-takeover via provisioning + logging-failure impact
Read H1 1 org/provisioning-takeover + 1 logging-gap (auth attacks invisible) — abused step ONLY.
Why this matters ▼
Done-when
2 patterns with abused-step note.
2:00–2:35 Policy + provisioning + log-coverage checklist
Consolidate 3 checklists. Note remediation lines for report (Day 7).
Why this matters ▼
Done-when
Checklists saved.
2:35–3:00 A09 why-matters test + gaps
Explain why missing logs upgrade auth bugs. Triage gaps.
Why this matters ▼
Done-when
Recited + checklists archived.
0:00–0:15 Week recall: reset/session/OAuth/MFA surfaces
List 4 surfaces + 1 test each from memory. Check WSTG checklist Identity+Session rows ONLY.
Why this matters ▼
Done-when
4×1 recited + tick.
0:15–1:05 Reset + MFA + session probes on VDP (self-accounts, gentle)
Probe reset/OTP/session on own VDP accounts. Archive transcripts (redacted). No brute beyond 20 requests, no victim accounts, no lockout abuse.
Why this matters ▼
X
Accounts: @Alra3ees @farah_hawaa for ATO threads (read-only today).
Done-when
Probes + transcripts (gentle, redacted).
1:05–2:00 2 accepted ATO reports: remediation wording study
Read H1 hacktivity
OAuth account takeover disclosed2 accepted — copy remediation sentences ONLY. Note CVSS vectors.Why this matters ▼
Done-when
2 remediation quotes + vectors.
2:00–2:35 Draft 1 report: impact + repro + remediation + CVSS
Use EdOverflow bugbounty-templates structure (title/summary/steps/impact/remediation) ONLY. Score via first.org calculator base ONLY. Peer-check readability vs accepted reports.
Why this matters ▼
Done-when
Draft with 4 sections + vector (unsubmitted or VDP-ready).
2:35–3:00 Report parts + CVSS refine + gaps to Week 05
Recite parts. Refine vector (what moves it). Assign gaps (XSS/session-theft) to Week 05.
Why this matters ▼
Done-when
Recited + draft archived + gaps assigned.