
You are testing a web application's authentication mechanisms during an authorized penetration test.

**Login Bypass**
- How do you test a login form for SQL injection authentication bypass?
- What is a type juggling vulnerability and in which languages does it appear? (PHP == vs ===)
- What is a mass assignment vulnerability and how does it affect authentication?
- How do you test for authentication bypass via HTTP method tampering?

**Password Reset Flaws**
- What are the most common password reset vulnerabilities? (predictable tokens, host header injection, user enumeration)
- How does a host header injection in password reset emails work?
- How do you test for token expiry and single-use enforcement?
- What is a password reset poisoning attack?

**Multi-Factor Authentication Bypass**
- How do you test for MFA bypass via OTP brute force when rate limiting is absent?
- What is a response manipulation bypass for MFA? (changing failed=true to failed=false)
- How do you test for MFA bypass via account recovery flows?

**Session Management**
- How do you test for predictable session token values?
- What does session fixation mean and how do you test for it?
- How do you test for session token leakage? (Referer header, URL parameters, logs)
- What is a CSRF attack and how do you identify missing CSRF protection?

**OAuth2 & SSO**
- How do you test an OAuth2 flow for open redirect exploitation?
- What is a SAML authentication bypass? (XML signature wrapping)
- How do you test for SSO token reuse across applications?

Output:
- Authentication bypass checklist
- Common vulnerability patterns with example payloads
- Burp Suite workflow for auth testing


Authentication Bypass Techniques


You are performing a REST API security assessment as part of an authorized web application penetration test.

**Discovery & Documentation**
- How do you discover API endpoints when there is no public documentation?
- What does a Swagger/OpenAPI spec reveal and how do you import it into Burp Suite or Postman?
- How do you find hidden or undocumented endpoints through JS analysis, mobile app traffic, and brute force?

**Authentication Testing**
- How do you test JWT security? (none algorithm, weak secret via brute force, algorithm confusion RS256 to HS256)
- How do you test OAuth2 flows for authorization code interception, state parameter bypass, or open redirect?
- What does an API key in a URL, header, or request body mean for security?

**Authorization Testing**
- What is BOLA (Broken Object Level Authorization) / IDOR and how do you test for it systematically?
- How do you test for BFLA (Broken Function Level Authorization)? (accessing admin functions as regular user)
- How do you test for horizontal vs vertical privilege escalation in APIs?

**Input Validation**
- Which injection types are relevant to REST APIs? (SQLi, NoSQLi, command injection via parameters)
- How do you test mass assignment vulnerabilities in JSON payloads?
- What is a Server-Side Request Forgery (SSRF) in an API context and how do you test for it?

**Rate Limiting & Business Logic**
- How do you test for missing rate limiting on authentication, OTP, and sensitive endpoints?
- How do you discover and exploit business logic flaws in API workflows?
- What does HTTP verb tampering allow? (using PUT vs POST vs PATCH)

Output:
- API testing checklist (OWASP API Top 10 aligned)
- JWT attack commands (jwt_tool reference)
- IDOR testing methodology


REST API Security Testing


You are testing a web application for SQL injection vulnerabilities during an authorized penetration test.

**Detection**
- What input vectors should you test for SQL injection? (GET/POST params, HTTP headers, cookies, JSON/XML body)
- What error messages and behaviors indicate SQL injection? (database errors, behavioral differences, time delays)
- How do you distinguish between a genuine SQLi and a WAF-generated error?
- What is the difference between error-based, boolean-based, time-based, and UNION-based SQLi?

**Confirmation**
- How do you confirm boolean-based SQLi without triggering errors? (always-true vs always-false conditions)
- How do you use time delays (SLEEP, WAITFOR DELAY) to confirm blind SQLi?
- What characters typically break SQL syntax and why do different databases respond differently?

**Extraction**
- How does UNION-based extraction work and what must you determine first?
- How do you extract data through error-based SQLi in MySQL, MSSQL, and Oracle?
- How do you enumerate: database names, tables, columns, and data via blind boolean SQLi?

**Escalation**
- How does xp_cmdshell work in MSSQL and what privileges are required?
- How do you write files to disk via SQLi on MySQL with FILE privilege?
- How do you read OS files via SQLi?

**WAF Bypass**
- What encoding techniques bypass WAF signature detection? (URL encoding, case variation, comments, whitespace)
- How do you test if a WAF is present and fingerprint its behavior?

Output:
- Detection methodology per injection type
- sqlmap command reference with tamper scripts
- Manual injection cheat sheet per database (MySQL, MSSQL, PostgreSQL, Oracle)


SQL Injection Testing


You are assessing a web application for Cross-Site Scripting (XSS) vulnerabilities during an authorized penetration test.

**XSS Types & Detection**
- What is the difference between Reflected, Stored, and DOM-based XSS?
- Which type causes greater business impact and why?
- How does XSS differ between HTML context, attribute context, JavaScript context, and URL context?

**Finding Injection Points**
- What inputs should you test first for XSS? (search fields, comments, user profile, error messages)
- How do you test for XSS without triggering alerts? (use harmless markers before payloads)
- How do you identify the reflection context before crafting a payload?

**Payload Construction**
- How do you construct a payload for each context: HTML, attribute, JavaScript, and URL?
- Why does `<script>alert(1)</script>` fail in most modern applications and what do you use instead?
- How do you bypass HTML entity encoding? When does encoding still allow execution?

**Content Security Policy (CSP) Analysis**
- How do you read a CSP header and identify weaknesses?
- What CSP misconfigurations allow XSS despite the policy? (unsafe-inline, unsafe-eval, wildcard sources)
- How do you bypass a CSP that allows `*.cdnprovider.com`?

**Impact Escalation**
- What is the impact chain from a reflected XSS vs a stored XSS?
- How do you use XSS for session hijacking, credential theft, or CSRF?
- How does BeEF framework demonstrate XSS impact during a pentest?

Output:
- Context-based payload cheat sheet
- CSP analysis framework
- Impact description templates per XSS type (for report writing)


Web Security

Authentication Bypass Techniques

REST API Security Testing

SQL Injection Testing

XSS Attack Surface Analysis