Web › Module 7 › Lesson 1
Broken Authentication Patterns
A07: weak proofs, stuffing, reset holes — authn is not authz.
Visual · broken_auth_patterns
Login door with weak lock, no rate limit, reset link forever. — router admin STOP — SAFE Harden accounts YOU own — no stuffing strangers.
Opening
Authentication failures are broken proofs of identity — not a free pass to spray the internet.
OWASP Top 10:2025 A07 Authentication Failures covers weak passwords, credential stuffing success, missing MFA where risk demands it, verbose login oracles, and broken recovery flows. Authn answers “who are you?” Authz answers “what may you do?” — Module 1 already hammered access control; A07 is the door before that. Attack literacy: attacker wants a valid session as someone else. Practical commands identify
1. Weak secrets and stuffing: reuse is the amplifier
Credential stuffing tries breached username/password pairs at a new door. Unique passwords and a manager kill that path for accounts you control. MFA raises the bar when a password still leaks. A07 literacy does not include a stuffing script against foreign hosts or the LAN gateway. It includes enabling MFA on your mail, git host, and cloud console — and refusing “practice sprays” on school, café, or router logins.
Password policy without breach resistance is theater: length and uniqueness beat complexity theater that drives sticky notes. Store verifiers with slow salted KDFs (Topic 8 / A04 carry). Never log plaintext passwords.
Command guide
A07 Authn — Weak secrets and stuffing
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 14
2. Login oracles and brute force: noise should hurt the attacker
Generic error messages (“invalid credentials”) reduce account enumeration. Rate limits and progressive lockouts make online guessing expensive. CAPTCHA is optional glue, not a substitute for server-side throttling. On YOUR loopback app at 127.0.0.1:8774, you may demonstrate lockout; on strangers and home routers, you may not.
Timing side channels are advanced; this lesson only needs: do not reveal “user exists” vs “bad password” if your threat model cares. Document the choice in notes.
Command guide
A07 Authn — Login oracles and brute force
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -D - "$SAFE/login" | head -n 16
3. Recovery flows: reset is authentication by another name
Password reset tokens must be single-use, short-lived, unguessable, and sent only to a verified channel. Host-header injection into reset links is a design failure — bind the link base to a known config, not the request Host. Security questions as sole recovery are weak. On apps YOU own, review reset; do not phish classmates “to test recovery.”
Account enumeration via reset (“if that email exists, we sent mail”) is a product tradeoff — note it honestly rather than pretending silence.
4. Authn ≠ authz: a login does not grant admin
A07 stops at proving identity. Privilege still needs A01 controls. “I logged in” is not “I may delete users.” Keep the sentences separate in your notes so later JWT and session lessons do not collapse them.
Cite A07 Authentication Failures. Original Cyberlium — not official OWASP certification.
5. Wrong vs right: spray strangers vs harden what you own
Same word “auth,” opposite job.
Wrong
Hydra/spray café, school, neighbor, or 192.168.0.1 router admin. Stuff classmates. Phish reset flows. nmap the LAN. Log plaintext passwords. Call this an OWASP cert.
Right
Identify DEMO; router → SAFE 127.0.0.1:8774. MFA + unique secrets on accounts YOU control; review YOUR loopback login/reset; lock broken-auth-notes.txt. Next: Session and Cookie Failures.
6. Hands-on: identify DEMO + broken-auth-notes.txt
Start the banner toy on 8774 (full cookie lab in Lesson 2). Fill the checklist. Optional: confirm MFA on one account you own — do not store the secret in the file. No hydra. No nmap.
Mission: broken-auth-notes.txt (mode 600)
1) 0.0.1:8774 after starting a07_auth_banner.py.2) Record MFA and unique-password posture for accounts YOU control (no secrets in the file). Write reset-token properties and authn vs authz. 3) chmod 600 $HOME/cyberlium-lab/broken-auth-notes.txt. No stuffing. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If “authentication” still means “run a cracker,” ask for a hint — not a target list. Try: "Hint only: stuffing vs MFA; why reset is authn; authn vs authz; why 192.168.0.1 router login is OUT OF SCOPE; where notes live?" You still fill broken-auth-notes.txt.
A07 starts with identity proofs that hold under hostile guessing and recovery abuse — on systems you own, with DEMO identify and SAFE 8774. Original Cyberlium — not official OWASP certification. Next — Session and Cookie Failures.
Knowledge Check
APPLY: A classmate wants to hydra the campus SSO “for A07.” What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: Successful login automatically means the user may perform admin actions.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ is a router admin login. Hydra it for A07?
Multiple choice