🎉 Buy MoT Professional Membership, get MoTaCon free! 🎉

Joerg Sievers

Test Service Specialist

Award Star

Passionately testing for ~30 years

🎂 MoTaBirthday | April 13, 2017

Broken Authentication Broken Authentication means that a web application’s login system or session management is flawed, letting attackers bypass authentication and gain unauthorized access to sensitive accounts—sometimes even administrative ones. Attackers exploit these issues through methods like stolen or weak credentials, brute-force attacks, or hijacking session identifiers. [1][2] Problem Areas Credential Management: Weak or default passwords, poor password storage (no hashing/salting), or flaws in password recovery make it easier for attackers to steal or guess passwords.  Session Management: Vulnerabilities in how sessions are created, tracked, or terminated can lead to session hijacking—where attackers impersonate users by stealing session IDs, often through poorly protected browser cookies or unexpired sessions. [3]  Tips for Testers Test for Common Weaknesses  Try default and weak passwords (“password”, “admin”, “123456”, etc.) and check the application’s password policies.  Attempt brute-force and credential stuffing attacks (within allowed scope) to verify protections.  Check Session Management  Confirm that session tokens are not leaked in URLs and are changed after login.  Validate session termination: users should be logged out everywhere after logging out or timing out.  Explore Forgot-Password and Recovery Flows  Test for predictable, non-expiring, or re-usable reset tokens.  Check for error messages or flow differences that might leak whether an account exists.  What New Security Testers Should Know Broken authentication is one of the most impactful vulnerabilities, often leading to data breaches or account takeovers—even on major platforms. Sources (Thanks to Perplexety AI for supporting the search [4]):  Port Swigger (Home of BurpSuite, well know security tool)  Bright Security  OWASP API2:2023 Broken Authentication  Prompt

💡What's next? View ways to contribute

Badges (9)

Stars (3)

⭐️ Earn more stars ⭐️

Events (2)

Not registered for any upcoming events

Activity (16)

Est 2017

This badge is awarded to those that joined the MoTaverse in 2017.

Badge Award

11 days ago

Visited an Observatory link

2025 - The Year in Review

Community Star

8 months ago

Started a conversation on The Club

39c3 - Chaos Communication Congress Hamburg, Germany - Are you there?

Community Star

10 months ago

Picture Perfect

This badge is awarded to members who update their profile with a new photo.

Badge Award

12 months ago

99 and Counting

This badge is awarded to members who visit the Ministry of Testing site 99 times

Badge Award

12 months ago

Contributions (1)

Glossary Term (1)

💡What's next? View ways to contribute