Authentication Bypass Techniques

You are testing a web application's authentication mechanisms during an authorized penetration test.

**Login Bypass**
- How do you test a login form for SQL injection authentication bypass?
- What is a type juggling vulnerability and in which languages does it appear? (PHP == vs ===)
- What is a mass assignment vulnerability and how does it affect authentication?
- How do you test for authentication bypass via HTTP method tampering?

**Password Reset Flaws**
- What are the most common password reset vulnerabilities? (predictable tokens, host header injection, user enumeration)
- How does a host header injection in password reset emails work?
- How do you test for token expiry and single-use enforcement?
- What is a password reset poisoning attack?

**Multi-Factor Authentication Bypass**
- How do you test for MFA bypass via OTP brute force when rate limiting is absent?
- What is a response manipulation bypass for MFA? (changing failed=true to failed=false)
- How do you test for MFA bypass via account recovery flows?

**Session Management**
- How do you test for predictable session token values?
- What does session fixation mean and how do you test for it?
- How do you test for session token leakage? (Referer header, URL parameters, logs)
- What is a CSRF attack and how do you identify missing CSRF protection?

**OAuth2 & SSO**
- How do you test an OAuth2 flow for open redirect exploitation?
- What is a SAML authentication bypass? (XML signature wrapping)
- How do you test for SSO token reuse across applications?

Output:
- Authentication bypass checklist
- Common vulnerability patterns with example payloads
- Burp Suite workflow for auth testing