Auth Bypass labs
Authentication Bypass
What is Auth Bypass?
Authentication Bypass is any technique that lets you access an account or resource without passing the legitimate authentication flow: flaws in JWT, OAuth, password reset, magic links, MFA and race conditions on login.
Why practice Auth Bypass?
Account takeover is the holy grail of bug bounty: immediate P1 and bounties starting at $1,000 and climbing past $50,000 in large programs. The attack surface keeps growing (passwordless, magic links, social login) and devs keep making the same mistakes.
What will you learn with the Auth Bypass labs?
You'll learn full JWT auditing (alg=none, kid injection, jwk header, HS/RS key confusion), OAuth pitfalls (missing state, loose redirect_uri, code reuse), MFA bypass via response manipulation, and password reset poisoning via Host header.
Types of Auth Bypass we cover
- JWT alg=none
You change the header to `{"alg":"none"}` and remove the signature. Outdated libs accept it.
- JWT kid injection
The `kid` field is concatenated into a path/SQL. You inject to point at a known file (e.g. /dev/null → empty secret).
- OAuth state missing
Without state, CSRF in the callback lets you link accounts. An account hijack vector.
- Password reset poisoning
The reset email uses the Host header without validation. Attacker sends `Host: evil.com` → the reset token lands with the attacker.
- MFA bypass
The `/verify-mfa` endpoint doesn't check the session, or response manipulation: you change `{verified:false}` → `true`.
How do you find and exploit Auth Bypass?
A practical playbook — from recon to proof of concept.
- 1
Map the auth flows
Login, registration, password reset, magic link, MFA and social login. Each is a surface with its own flaws.
POST /login · POST /forgot-password · POST /verify-otp · /oauth/callback - 2
Audit the JWT
Decode the token and try alg=none (empty signature) and the RS256→HS256 algorithm confusion by signing with the public key as the HMAC secret.
header {"alg":"none"} no signature · sign HS256 using the server's public key - 3
Crack weak secrets
If the JWT uses HS256 with a poor secret, crack it offline and sign arbitrary tokens (change the role to admin).
hashcat -a 0 -m 16500 jwt.txt rockyou.txt - 4
Attack the password reset
Poison the reset link with a malicious Host/X-Forwarded-Host; when the victim requests a reset, the token travels to your domain.
POST /forgot-password Host: evil.com → link with token points to evil.com - 5
Break OAuth
Check whether the state parameter is missing (account-linking CSRF) or whether redirect_uri is loose enough to steal the authorization code.
/oauth/authorize?...&redirect_uri=https://evil.com/cb (no state) - 6
Skip MFA
Test whether the endpoint after MFA trusts an already-valid session without verifying it, or manipulate the verifier's response.
Response: {"mfa":false} → change to {"mfa":true} · go straight to /dashboard after the first factor
Learn the theory
Academy: Authentication Bypass
Loading labs...
View in full catalog →Frequently asked questions
What is an Authentication Bypass?
It's any technique that lets you reach an account or resource without completing the legitimate authentication flow: flaws in JWT, OAuth, password recovery, magic links or MFA that end in account takeover.
How is an Authentication Bypass exploited?
It depends on the flaw: with JWT alg=none or weak secrets you forge tokens; with password reset poisoning you divert the reset token to the attacker; with OAuth without state you link accounts; and with response manipulation you skip MFA.
How do you find Auth Bypass in bug bounty?
Audit every identity flow: decode and manipulate JWTs, try poisoning the reset with the Host header, check whether OAuth validates state and redirect_uri, and verify whether the MFA step truly blocks access to the final resource.
How do you prevent an Authentication Bypass?
Pin the JWT algorithm on the server and use strong secrets, generate unpredictable reset tokens bound to the user and never use the request Host to build links, validate state and redirect_uri in OAuth, and verify MFA server-side at every step.
Difference between Authentication Bypass and Broken Access Control?
Authentication Bypass breaks the 'who you are' (you get in as another user or without a login). Broken Access Control breaks the 'what you can do' once authenticated (you reach resources or functions that aren't yours).
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Auth Bypass in real labs
Every Auth Bypass lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime