Authentication Bypass
Bypasses in JWT, 2FA, OTP and login mechanisms
Quick answer
What is Authentication Bypass?
Authentication vulnerabilities let you access other people's accounts without valid credentials. They include JWT attacks, 2FA bypass, OTP brute force, token manipulation and flaws in OAuth flows.
Severity
Critical
Frequency
Common
Payloads
11
Steps
6
Severity
Critical
Frequency
Common
Payloads
11
Authentication is the first line of defense. Flaws range from weak tokens to broken logic in multi-step flows (register → verify → login). Misconfigured JWTs are a favorite target because a single flaw lets you forge valid tokens for any user.
Where to look
JWT tokens
Decode with jwt.io — check the algorithm, claims and expiry. Look for sensitive data in the payload.
OTP/2FA flow
Verification and password-reset endpoints. Try brute force, null values, code reuse.
OAuth/SSO
Login flows with Google, GitHub, etc. Can you skip 2FA via OAuth? Is the state param validated?
Password reset
Is the token predictable? Does it expire? Does it invalidate previous sessions? Can it be resent to another email?
Session cookies
HttpOnly? Secure? SameSite? Is the value predictable or forgeable?
Methodology
Map the full flow
Map: register → verify → login → session → refresh → logout. Every step is a vector.
Decode the JWT
jwt.io to inspect claims. Look for: alg, role, userId, exp, iss. Any sensitive data in the payload?
Test JWT algorithms
Swap RS256→HS256 (use the public key as the HMAC secret). Try alg:none. Inject a JWK into the header.
Test OTP
Rate limiting? Try 000000, null, empty string. Does the code appear in the response or headers?
Check 2FA bypass
Does OAuth skip 2FA? Can it be disabled without re-authenticating? Are backup codes reusable?
Test password reset
Is the token long and random? Does it expire? Is it invalidated after use? Can it be resent to another email?
Real-world case
Account Takeover via OTP brute force + email normalization
Discover inconsistent normalization
The OTP-generation endpoint accepts 'User@email.com' but the verification one accepts 'USER@email.com' — both map to the same user.
Generate email permutations
A Python script with itertools to generate every capitalization variation of the victim's email.
Distributed brute force
A 4-digit OTP = 10,000 combinations. No rate limiting → try 4 codes per email variation.
Account Takeover
In ~12 minutes the correct code is found. The victim's password is changed.
Lesson: Two weak bugs (inconsistent normalization + no rate limiting) combined produce a full Account Takeover. Always test normalization consistency across endpoints.
Payloads
JWT none algorithm
{"alg":"none","typ":"JWT"}.{"sub":"admin"}. (firma vacía)OTP null bypass
{"email": "victim@email.com", "code": null}Empty OTP
{"email": "victim@email.com", "code": ""}Email normalization
Victim@Email.COM vs victim@email.com vs VICTIM@email.com
Password reset token reuse
Usar el mismo token de reset dos veces — ¿funciona?
Advanced payloads(account required)
jwt_tool — all tests
python3 jwt_tool.py <TOKEN> -M at -t "https://target.com/api/me" -rh "Authorization: Bearer"
Algorithm confusion RS256→HS256
Extraer clave pública del servidor → usarla como secreto HMAC → firmar JWT con HS256
JWK header injection
{"alg":"RS256","jwk":{"kty":"RSA","n":"...","e":"AQAB"}} ← tu propia clave públicaKID path traversal
{"alg":"HS256","kid":"../../../dev/null"} → firma con string vacío2FA device trust leak
machine_id en OAuth batch API = datr cookie → setear cookie → bypass 2FA en recovery
Response manipulation
Interceptar respuesta → cambiar "role":"user" → "role":"admin"
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
jwt_tool
Full JWT testing suite: automatically tries every known attack.
python3 jwt_tool.py <TOKEN> -M at
jwt.io
Visual JWT decoder. Paste the token and see header, payload and signature.
https://jwt.io/
Burp Intruder
OTP brute force with sequential numeric payloads.
Intruder → Sniper → Payload: Numbers 0000-9999
Tips
Always decode the JWT
Many JWTs carry sensitive data in the payload: emails, roles, internal IDs.
4 digits = brute-forceable
10,000 combinations. With no rate limiting you can try them all in minutes.
OAuth can skip 2FA
If the app allows Google login and doesn't re-validate 2FA afterwards, it's a direct bypass.
Refresh tokens without rotation
If the refresh token doesn't change after use, a stolen token grants permanent access.
Check sessions after reset
Changing the password should invalidate ALL active sessions. If it doesn't, that's a bug.
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Authentication Bypass with real labs
Apply these techniques in safe environments based on real bug bounty reports.