🧭 Authentication Bypass - Attack Hub

45 techniques across 10 categories. Click any card to open the guided guide, or use the sidebar to explore in depth. Every technique includes step-by-step instructions, exact commands, and "why it works" explanations.

πŸš€ New to auth bypass? Start with the Intercept Guide to learn how to capture login requests, then use the Request Parser to auto-generate attack commands from your captured request.
⚑ All 45 Techniques - Click to open guided guide

πŸ“Š Attack Category Map

Attack Surface Coverage
Quick Start Checklist

πŸ“‘ How to Intercept Login Requests

Before you can attack an authentication system, you need to capture the login request. This guide covers Burp Suite, browser DevTools, and curl - step by step.

πŸ”΄ Burp Suite (Best)
πŸ”΅ Browser DevTools
⚫ Curl + Wireshark
🟒 mitmproxy
βœ“ Recommended: Burp Suite Community Edition is free and the industry standard for intercepting web requests. Download from portswigger.net/burp/communitydownload
πŸ“₯ Burp Suite Setup - Step by Step
1
Install & Launch Burp Suite
Download Burp Suite Community from portswigger.net. Launch and select "Temporary project" β†’ "Use Burp defaults" β†’ "Start Burp".
2
Configure Browser Proxy
Burp listens on 127.0.0.1:8080 by default. Set your browser proxy to this address.

Firefox: Settings β†’ Network Settings β†’ Manual proxy β†’ HTTP Proxy: 127.0.0.1, Port: 8080
Chrome: Use FoxyProxy extension or system proxy settings.
3
Install Burp CA Certificate
Browse to http://burpsuite in your proxied browser β†’ Download CA certificate β†’ Import into browser's certificate store. This allows intercepting HTTPS.
4
Enable Interception
In Burp: Proxy tab β†’ Intercept tab β†’ Click "Intercept is off" to toggle it ON (button turns orange).
5
Submit the Login Form
Go to the target login page in your browser. Fill in username/password and click Login. Burp will freeze the request.
6
Copy the Raw Request
In Burp, right-click the intercepted request β†’ "Copy to clipboard" OR select all text in the request panel. This is your raw HTTP request to paste into the Request Parser.
7
Forward or Drop
Click "Forward" to let the request through (normal login), or "Drop" to discard it. Turn Intercept OFF after capturing to resume normal browsing.
πŸ’‘ Pro Tips - Burp Tricks
Right-click β†’ Send to Repeater
Replay modified requests without intercepting again - best for manual testing
Right-click β†’ Send to Intruder
Mark parameters with §§ and automate fuzzing with a wordlist - perfect for brute force
HTTP History tab (Proxy)
See ALL requests without enabling intercept - less disruptive for browsing
Target β†’ Site Map
Auto-maps all endpoints seen during browsing - discover hidden login pages
Comparer tab
Compare two responses byte-by-byte - detect subtle differences in boolean blind tests

🎯 Brute Force Command Generator

Configure your target and generate ready-to-run commands for hydra, ffuf, medusa, and curl. Also generates rate-limited and evasive variants.

βš™ Target Configuration
Target URL
HTTP Method
Username Field Name
Password Field Name
Content Type
Failure String (in response)
Success String (in response)
Target Username (or FUZZ for both)
Extra Headers (one per line, Header: Value)
Threads / Rate
Delay between requests (ms)

πŸ“š Common Wordlists

πŸ“‹ Request Parser β†’ Auto Attack Generator

Paste any raw HTTP intercepted request. The parser will identify authentication fields, detect the structure, and generate targeted attack commands automatically.

How to get a raw request: Use Burp Suite β†’ Intercept β†’ copy the request text. Or use DevTools β†’ Network β†’ Right-click β†’ Copy as cURL, then paste the cURL command here too.
πŸ“₯ Paste Raw HTTP Request

πŸ’‰ SQL Injection Login Bypass

Inject SQL into login fields to manipulate the underlying query logic and authenticate without valid credentials.

Why it works: When user input is inserted directly into a SQL query without parameterization, injected syntax changes the query's logic. SELECT * FROM users WHERE username='INPUT' becomes exploitable.
β‘  Basics
β‘‘ Payloads
β‘’ Injection Contexts
β‘£ WAF Bypass
β‘€ Guided Guide
1
Find the Injection Point
Test each field with a single quote '. A SQL error, blank page, or different response = injectable.
2
Understand the Query Structure
Common login query: SELECT * FROM users WHERE username='INPUT' AND password='INPUT2'
Your goal: make the WHERE clause always return true, or comment out the password check.
3
Choose Your Bypass Strategy
A) Comment out password: admin'-- - β†’ removes AND password=... check
B) OR bypass: ' OR 1=1-- - β†’ makes WHERE always true
C) Close and subvert: ' OR '1'='1 β†’ always-true string comparison
4
Test Comment Styles
MySQL: -- - or #  |  MSSQL: --  |  Oracle: --  |  PostgreSQL: --
5
Handle Parentheses
If standard payloads fail, the query may use parens: WHERE (username='X' AND active=1). Try: admin')-- -

πŸ”§ Parameter Manipulation Attacks

Manipulate request parameters to escalate privileges, skip authentication, or confuse backend parsers.

β‘  Auth Param Manip
β‘‘ Missing Params
β‘’ Param Pollution
β‘£ JSON/Array Tricks
1
Intercept the Authentication Response
Capture the login response with Burp Suite. Look for parameters like role, isAdmin, access_level, permissions.
2
Identify Trust Boundaries
The bug: server reads role/admin status from request params that the client controls, rather than from the database. Common in poorly designed APIs.
3
Modify the Parameter
In Burp Repeater, change the value and resend. Watch if the response changes or if you get access to admin functionality.
Common Privilege Escalation Parameters

🌐 HTTP Request Manipulation Attacks

Manipulate HTTP methods, headers, and the Host header to bypass authentication logic that relies on request metadata.

β‘  Verb Tampering
β‘‘ Header Injection
β‘’ Host Header
1
Why HTTP Verb Tampering Works
Access controls are often configured per-method. A rule blocking POST /admin may not block GET /admin or HEAD /admin.
2
In Burp: Change the Method
Intercept the request β†’ Right-click β†’ "Change request method" to switch POST↔GET. Or manually edit the method field.
3
Test Unusual Methods
Try HEAD (server processes but returns no body), OPTIONS, PUT, PATCH, DELETE, CONNECT.
Verb Tampering Commands

🧠 Authentication Logic Flaws

Exploit incorrect logical checks, client-side controls, step skipping, and broken state machines in multi-step authentication flows.

β‘  Auth Logic Flaw
β‘‘ Client-Side Auth
β‘’ Step Skipping
β‘£ State Machine
1
Identify the Auth Logic
Look for: response checking both username AND password, but the code has an OR instead of AND. Or: successful validation returns a value that equals false in PHP's loose comparison.
2
Test Edge Cases
Try: empty password, null values, very long inputs, special chars like %00, arrays instead of strings, type confusion.
3
PHP Loose Comparison Exploits
PHP's == does type juggling. "0e123" == "0e456" is TRUE (both are 0^exp = 0). Submit a password whose MD5 starts with 0e to bypass hash comparison.
Logic Flaw Payloads

πŸͺ Session Attacks

Exploit session management weaknesses: fixation, hijacking, predictable IDs, and replay attacks.

β‘  Session Fixation
β‘‘ Session Hijacking
β‘’ Predictable IDs
β‘£ Session Replay
1
Get a Pre-Login Session ID
Visit the site before logging in. Note the session cookie value (e.g. PHPSESSID=abc123).
2
Force the Victim to Use Your Session
Send victim a link with your session ID embedded: https://target.com/login?PHPSESSID=abc123 or via Set-Cookie injection in MITM scenario.
3
Wait for Victim to Authenticate
When victim logs in with the fixed session ID, your session ID becomes authenticated. Use PHPSESSID=abc123 to access their account.
4
Test if Server Regenerates Session on Login
A secure app regenerates the session ID after authentication. If your pre-login ID remains the same after login = vulnerable to fixation.
Session Fixation Test Commands

πŸ”’ Cookie Manipulation Attacks

Modify, decode, and forge cookies to gain unauthorized access or escalate privileges.

β‘  Cookie Manipulation
β‘‘ Base64 Tampering
β‘’ Unsigned Cookies
β‘£ Live Decoder

πŸ”‘ JWT Token Attacks

Exploit JSON Web Token implementation flaws: none algorithm, signature bypass, key confusion, and secret cracking.

β‘  Decode & Analyze
β‘‘ None Algorithm
β‘’ Key Confusion
β‘£ Secret Cracking
β‘€ Forge Token
1
Identify a JWT Token
JWTs look like: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiam9obiJ9.SIGNATURE
Three Base64url-encoded parts separated by dots: Header.Payload.Signature
2
Decode Without Verification
Any JWT can be decoded without the secret - only verification requires the secret. The payload is just Base64url encoded JSON.
πŸ”„ Live JWT Decoder
JWT Token
Header
-
Payload
-
Analysis

πŸ“± Multi-Factor Authentication Bypass

Bypass OTP codes, exploit race conditions, reuse codes, and skip MFA steps entirely.

β‘  OTP Brute Force
β‘‘ OTP Reuse
β‘’ Race Condition
β‘£ MFA Step Skip
1
Check for Rate Limiting
Submit wrong OTPs and count: does the app lock after N attempts? Does it reset with a new session? If no rate limit = brute-forceable.
2
6-Digit OTP Space: 1,000,000 codes
4-digit = 10,000 codes. 6-digit = 1,000,000 codes. TOTP 6-digit is time-based (30s window) so you have ~1-2 codes valid at once. SMS codes may last longer.
3
Generate OTP Wordlist + Attack
Generate all N-digit numeric codes and use ffuf/Burp Intruder to enumerate them.
OTP Brute Force Commands

πŸ”„ Password Reset Attacks

Exploit token prediction, host header poisoning, link manipulation, and IDOR in password reset flows.

β‘  Token Prediction
β‘‘ Reset Poisoning
β‘’ Link Manipulation
β‘£ IDOR Reset
1
Request Multiple Reset Tokens for Your Own Account
Request 5-10 password reset emails for your account at different times. Collect all tokens from the emails.
2
Analyze Token Structure
Look for: timestamp-based tokens, sequential numbers, short tokens (4-8 hex chars), tokens based on username+timestamp MD5.
3
Enumerate If Predictable
If token follows a pattern, enumerate the token space around your known good token to find ones generated for other users.
Token Analysis & Enumeration

πŸšͺ Access Control Bypass

Directly access protected pages, escalate privileges via parameter tampering, and manipulate authorization headers.

Forced Browsing - Direct Access to Protected Resources
Privilege Escalation via Parameter Tampering
Authorization Header Manipulation

⚑ API Authentication Attacks

Exploit broken API authentication, bypass endpoint auth, and find token leakage in API responses.

API Endpoint Auth Bypass
Broken API Auth Patterns
Token Leakage - Where to Look

πŸ— Infrastructure-Level Bypass

Exploit reverse proxy misconfigurations, IP-based authentication, and cache poisoning.

Reverse Proxy Misconfiguration
IP-Based Auth Bypass Headers
Cache-Based Auth Bypass

🧬 Advanced & Bonus Techniques

Race conditions, Unicode bypass, null byte injection, case sensitivity, and legacy endpoint discovery.

Race Condition Login Bypass
Unicode & Encoding Attacks
Null Byte Injection
Case Sensitivity Bypass
Legacy Endpoint Discovery
Guided Guide