Authentication Bypass

Target Recon Testing Checklist

• 1.Audit API routes lacking session checks (e.g. /admin/users accessible without login).
• 2.Check JWT token parameters - test "alg": "none" signature bypasses.
• 3.Analyze OTP inputs - test predictable sequence codes or lack of rate limits.
• 4.Examine OAuth callbacks - can redirect variables be tampered with to leak codes?

Testing Parameters & Payloads

Authorization: Bearer <tampered-jwt>

Cookie: user_role=admin; is_authenticated=true

POST /api/verify-otp [body: {"code": 1111}] (brute forcing codes)

Mitigation & Safe Development Guidelines

• Implement a centralized authentication checker layer that rejects requests by default.
• Enforce strong signature verification on all JSON Web Tokens (JWT).
• Rate-limit authentication attempts (e.g., maximum 5 OTP trials before account lock).