Ways To Bypass Authentication ;
Ways To Bypass Authentication.
1:) Direct page request;
:)a.k.a forced browsing.
:)successful authentication => Redir to /admin.
:)functionality is inappropriately protected , just go to:
https//your.target.site/admin.
2. Parameter Modification;
:) When authentication is verified via fixed parameters.
"authenticated" = "yes"
"logged_in" = true
"is_admin"= true
3. Session ID Prediction;
:) Cookies, tokens, etc.
:) If ID is predictable => can be bruteforced/guessed.
4. SQL Injection
:)improper input sanitization
admin' or '1'='1
More payloads: https://gist.github.com/spenkk/2cd2f7eeb9cac92dd550855e522c558f.
:)Use Intruder with default or custom payloads in Burp Suite.
5:) Default accounts ;
admin/admin
root/admin
admin/password
6. Weak Password Change/Reset Feature ;
:)Current password not required.
:)Host header poisoning: https://0xn3va.gitbook.io/cheat-sheets/web-application/broken-authentication.
Video link:
Thank you !
Comments
Post a Comment