Mastering Authentication Vulnerabilities - Ultimate Course

In this video, we cover Lab #1 in the Authentication module of the Web Security Academy. This lab is vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and password, which can be found in the following wordlists:

• Candidate usernames

• Candidate passwords

To solve the lab, we enumerate a valid username, brute-force this user's password, then access their account page.

In this video, we cover Lab #2 in the Authentication module of the Web Security Academy. This lab's two-factor authentication can be bypassed. You have already obtained a valid username and password, but do not have access to the user's 2FA verification code. To solve the lab, we access Carlos's account page.

• Your credentials: wiener:peter

• Victim's credentials carlos:montoya

In this video, we cover Lab #3 in the Authentication module of the Web Security Academy. This lab's password reset functionality is vulnerable. To solve the lab, we reset Carlos's password then log in and access his "My account" page.

• Your credentials: wiener:peter

• Victim's username: carlos

In this video, we cover Lab #4 in the Authentication module of the Web Security Academy. This lab is subtly vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and password, which can be found in the following wordlists:

• Candidate usernames

• Candidate passwords

To solve the lab, we enumerate a valid username, brute-force this user's password, then access their account page.

In this video, we cover Lab #5 in the Authentication module of the Web Security Academy. This lab is vulnerable to username enumeration using its response times. To solve the lab, we enumerate a valid username, brute-force this user's password, then access their account page.

• Your credentials: wiener:peter

• Candidate usernames

• Candidate passwords

In this video, we cover Lab #6 in the Authentication module of the Web Security Academy. This lab is vulnerable due to a logic flaw in its password brute-force protection. To solve the lab, we brute-force the victim's password, then log in and access their account page.

• Your credentials: wiener:peter

• Victim's username: carlos

• Candidate passwords

In this video, we cover Lab #7 in the Authentication module of the Web Security Academy. This lab is vulnerable to username enumeration. It uses account locking, but this contains a logic flaw. To solve the lab, we enumerate a valid username, brute-force this user's password, then access their account page.

• Candidate usernames

• Candidate passwords
  

In this video, we cover Lab #8 in the Authentication module of the Web Security Academy. This lab's two-factor authentication is vulnerable due to its flawed logic. To solve the lab, we access Carlos's account page.

• Your credentials: wiener:peter

• Victim's username: carlos

• You also have access to the email server to receive your 2FA verification code.

In this video, we cover Lab #9 in the Authentication module of the Web Security Academy. This lab allows users to stay logged in even after they close their browser session. The cookie used to provide this functionality is vulnerable to brute-forcing.

To solve the lab, we brute-force Carlos's cookie to gain access to his "My account" page.

• Your credentials: wiener:peter

• Victim's username: carlos

• Candidate passwords

In this video, we cover Lab #10 in the Authentication module of the Web Security Academy. This lab stores the user's password hash in a cookie. The lab also contains an XSS vulnerability in the comment functionality. To solve the lab, we obtain Carlos's stay-logged-in cookie and use it to crack his password. Then, we log in as carlos and delete his account from the "My account" page.

• Your credentials: wiener:peter

• Victim's username: carlos

In this video, we cover Lab #11 in the Authentication module of the Web Security Academy. This lab is vulnerable to password reset poisoning. The user carlos will carelessly click on any links in emails that he receives. To solve the lab, we log in to Carlos's account. You can log in to your own account using the following credentials: wiener:peter. Any emails sent to this account can be read via the email client on the exploit server.

In this video, we cover Lab #13 in the Authentication module of the Web Security Academy. This lab is vulnerable due to a logic flaw in its brute-force protection. To solve the lab, brute-force Carlos's password, then access his account page.

• Victim's username: carlos

• Candidate passwords

In this video, we cover Lab #14 in the Authentication module of the Web Security Academy. This lab's two-factor authentication is vulnerable to brute-forcing. You have already obtained a valid username and password, but do not have access to the user's 2FA verification code. To solve the lab, we brute-force the 2FA code and access Carlos's account page.

Victim's credentials: carlos:montoya