Skip to main content

Broken Authentication

Lab: OWASP Juice Shop
Scenario: Broken Authentication
Difficulty: Beginner
Estimated Time: 45 minutes

Learning Objectives​

By the end of this scenario, you will be able to:

  • Identify authentication vulnerabilities
  • Understand common authentication bypass techniques
  • Recognize weak session management
  • Implement proper authentication controls
  • Understand the impact of broken authentication

Setup​

Prerequisites​

  • OWASP Juice Shop lab running at CSN Labs
  • Web browser (Chrome/Firefox recommended)
  • [Recommended] Burp Suite for intercepting requests

Initial Configuration​

  1. Navigate to the Juice Shop application
  2. Open browser developer tools (F12)
  3. Familiarize yourself with the login and registration pages

Scenario Story​

You are testing an e-commerce application's authentication system. The application allows users to register accounts and log in. Your goal is to identify weaknesses in the authentication mechanism that could allow unauthorized access or account compromise.

Step-by-Step Walkthrough​

Step 1: Explore the Authentication Flow​

Navigate to the login page and observe the authentication mechanism.

Expected Output: You should see a login form with email and password fields.

What to Observe:

  • How the login request is sent (form submission, AJAX, etc.)
  • What parameters are sent in the request
  • The response from the server
  • Any cookies or tokens set after authentication

Step 2: Analyze the Login Request​

Use browser developer tools (Network tab) to capture the login request, or use Burp Suite to intercept it.

What to Look For:

  • Are credentials sent in plain text?
  • Is there any client-side validation?
  • What happens on successful vs failed login?
  • Are session tokens properly secured?

Step 3: Test for Common Vulnerabilities​

Try the following tests:

  1. SQL Injection in Login:

    • Email: admin' OR '1'='1
    • Password: anything

  2. Weak Password Policy:

    • Try registering with weak passwords
    • Test password complexity requirements

  3. Account Enumeration:

    • Try logging in with known email addresses
    • Observe different error messages for existing vs non-existing accounts

Why This Works​

Broken authentication occurs when:

  • Weak password policies allow easily guessable passwords
  • Session management is flawed (predictable tokens, no expiration)
  • Credentials are transmitted insecurely
  • Authentication logic has flaws (SQL injection, logic errors)
  • Account recovery mechanisms are weak

Defender Notes​

How to Detect​

  • Monitor Failed Login Attempts: Track patterns of failed authentication
  • Watch for Brute Force: Multiple failed attempts from same IP
  • Analyze Session Tokens: Check if tokens are predictable or reused
  • Review Authentication Logs: Look for unusual patterns or successful logins after many failures

How to Prevent​

  1. Strong Password Policies: Enforce complex passwords with minimum length and complexity requirements
  2. Multi-Factor Authentication (MFA): Require additional verification beyond passwords
  3. Secure Session Management:
    • Use cryptographically secure random session tokens
    • Set appropriate session timeouts
    • Implement secure cookie flags (HttpOnly, Secure, SameSite)
  4. Rate Limiting: Limit login attempts to prevent brute force attacks
  5. Secure Password Storage: Always hash passwords using strong algorithms (bcrypt, Argon2)
  6. Prevent Account Enumeration: Use generic error messages that don't reveal if an account exists
  7. Use Parameterized Queries: Prevent SQL injection in authentication logic

Try These Variations​

Easy​

  • Test password reset functionality
  • Try to enumerate valid user accounts
  • Test for SQL injection in login forms

Medium​

  • Attempt to bypass authentication using API endpoints
  • Test session fixation vulnerabilities
  • Try to hijack sessions through XSS

Hard​

  • Attempt to crack password hashes (if obtained)
  • Test for JWT token vulnerabilities
  • Try to exploit OAuth implementation flaws

Evidence Checklist​

Capture screenshots of:

  • Login page and form structure
  • Network request showing authentication flow
  • Successful authentication bypass (if found)
  • Session tokens or cookies set after login
  • Any error messages that reveal information
  • Burp Suite request/response (if used)

Next Steps​