auth
Authentication vulnerabilities: bypass, brute force, password reset flaws.
Quick answer
What is auth?
Authentication vulnerabilities: bypass, brute force, password reset flaws.
Articles
7
Beginner
2
Intermediate
5
Advanced
0
Beginner level
2CSRF (Cross-Site Request Forgery) — fully explained with bypasses
CSRF: how it's exploited, common defenses (tokens, SameSite, Origin), bypasses (method change, JSON, double-submit, content-type) and where to hunt it in any app.
Cookie flags — Secure, HttpOnly, SameSite and why they matter
HttpOnly blocks XSS-to-cookie, Secure forces HTTPS, SameSite kills CSRF. How they break and what to report when they're missing on sensitive cookies.
Intermediate level
50-click Account Takeover — OTP brute force + Email Normalization
Two separate flaws look minor. Together, they hand you full ATO knowing only the email. Real bounty: €560 and 12 minutes of exploitation.
JWT — vulnerabilities, bypasses and claim manipulation
alg=none, RS256→HS256 confusion, kid SQLi/path traversal, jku spoofing, secret cracking with hashcat. How to hunt poorly verified JWTs.
OAuth attacks — state CSRF, redirect_uri bypass, code/token leakage
The missing state parameter, poorly validated redirect_uri, response_type confusion. How to steal OAuth tokens and force account linking.
2FA bypass — TOTP brute force, response manipulation, fallback abuse, race conditions
Real 2FA bypass techniques: TOTP brute force, response manipulation (status 200 with no valid token), fallback to email OTP, race conditions in setup.
Password reset — Puny code, header injection, email normalization, host header
Password reset bypass with Unicode confusables, Host header injection, email normalization (gmail + alias), token leakage in referer, response manipulation.
Practice auth with real labs
Apply the techniques in safe environments based on real bug bounty reports.
- hunters training
- 711
- labs from real reports
- 55
- completions
- 1,205
- in bounties practiced
- $213,970
hunters training
labs from real reports
completions
in bounties practiced
Stop reading about bugs and start hunting them
Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime