Broken User Authentication

What Is Broken User Authentication?

An endpoint can check a credential correctly and still never defend the check against automation: no attempt limit, no lockout, no rate limiting. When the credential is a 6-digit code, an attacker walks the whole space one request at a time. You'll start a sign-in holding only a target's email, watch a wrong code answer 200 with nothing counting, then script your way to a live session. The fix tracks failed attempts in server-side state, returns 429 at the limit, consumes a code on match, and keeps expiry short.

What You'll Learn in Broken User Authentication

• Recognize broken user authentication where an endpoint validates a credential correctly but places no limit on attempts, so it falls to brute force
• Understand that a short numeric code (an OTP or sign-in code) is only secret while the number of guesses is bounded, and that an unthrottled endpoint hands an attacker the whole code space one request at a time
• Distinguish this from token theft, token forging, and object-level access flaws; here the credential check is correct and the missing control is anti-automation on the endpoint
• Apply the fix: count failed attempts in server-side state keyed to the account, lock out after a threshold and return 429, consume codes on use, and keep codes short-lived
• Audit every sign-in, verification, and password-reset endpoint for a missing attempt limit, since one unthrottled authentication step is enough for account takeover

Broken User Authentication — Training Steps

1. One code stands guard

   Kelvo is a consumer money app, and it signs people in with a 6-digit code emailed to their address, no password. Enter your email, Kelvo sends a code, you type it back, you are in. Bob does not have a code. What he has, from a breached mailing list, is one customer's email address: renata.voss@gmail.com. He opens the Kelvo sign-in page to see exactly what he is up against.

2. Trigger the code

   Bob starts a sign-in for the account he is targeting. He types the victim's email and asks Kelvo to send the code. The code lands in Renata's inbox, not his, but Kelvo now shows him the screen that asks for it. That screen, and the request behind it, are what he studies next.

3. Watch the request

   The code entry screen is in front of Bob now. He does not have Renata's real code, but before he tries to crack it he wants to see how the screen checks a code and where it sends it. He types a wrong code and submits, then watches the request his browser makes in the Network panel.

4. The endpoint, in plain sight

   Bob's browser sent the code to Kelvo's API, and the Network panel captured the whole request. It hands him the one thing he needs to attack this without the screen: the exact endpoint that checks codes.

5. The brute-force script

   With the endpoint in hand, Bob does not guess by hand. He opens the short script he will run against it: a loop that submits every possible code to Kelvo's verify endpoint until one comes back accepted.

6. How the loop works

   The whole attack is a handful of lines. Walk through what each part does, and why nothing on the vulnerable server stops it.

7. Walk every code

   Bob runs the script against Kelvo's verify endpoint. It fires the same request over and over, incrementing the code each time, and waits for one to come back accepted.

8. A code that works

   The script ran unopposed and found a code that the server accepts.

9. Use the code

   Bob takes the code his script found and sends it to the endpoint one more time by hand, to confirm the account is his and see what he now holds.

10. A live session, from six digits

    The endpoint accepted the guessed code and handed back a real session.