Authentication and Session Testing
Test login bruteforcing, session fixation, JWT weaknesses, and insecure remember-me tokens.
Authentication and Session Testing is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Authentication Testing Scope
Authentication testing covers: login bruteforcing, credential stuffing, session management weaknesses, JWT vulnerabilities, insecure remember-me tokens, and password reset flaws. These often yield full account takeover.
Username Enumeration
Different error messages for invalid username vs invalid password leak valid usernames. Look for response time differences, message text, HTTP status codes, and redirect URLs.
# Test login with:
# Valid user, wrong pass → "Incorrect password"
# Invalid user → "User not found"
# This confirms valid usernames!
# Time-based: longer response for valid users
# (bcrypt hash computed only for valid users)Login Bruteforcing with Burp Intruder
Use Intruder with Sniper or Pitchfork attack to brute-force login. Mark the password field as a payload position, load a wordlist, and filter responses by status code or length difference.
# In Burp Intruder:
# 1. Send login request to Intruder
# 2. Mark: username=admin&password=§PASS§
# 3. Attack type: Sniper
# 4. Payload: passwords.txt from SecLists
# 5. Filter: 302 redirects = successCredential Stuffing
Credential stuffing uses username:password pairs from leaked databases (Have I Been Pwned) against new targets. Effective because users reuse passwords across services.
# Tools:
# Hydra for HTTP login forms
hydra -L users.txt -P passwords.txt \
192.168.1.100 http-post-form \
"/login:user=^USER^&pass=^PASS^:Invalid"Session Token Analysis
Capture session tokens and analyze: predictability (sequential IDs), length (short = guessable), encoding (base64-decode to see structure), and entropy (run through Burp Sequencer).
# Burp Sequencer:
# Proxy > HTTP History
# Right-click login response
# Send to Sequencer
# Start live capture → AnalyzeSession Fixation
Session fixation occurs when the server does not rotate the session ID after login. Test by noting the pre-login session ID and checking if it remains the same after authentication.
JWT Testing
JSON Web Tokens carry authentication claims. Test for: algorithm confusion (alg:none), weak secret brute-force, and header injection. jwt.io decodes JWTs for inspection.
# Decode JWT
echo "eyJ..." | base64 -d
# None algorithm attack:
# Modify header: {"alg":"none"}
# Remove signature
# Encode and submit
# Brute force HS256 secret:
john --format=HMAC-SHA256 token.txtPassword Reset Flaws
Common reset flaws: guessable reset tokens (short or sequential), host header injection (token sent to attacker domain), token reuse (same token valid multiple times), and no expiry.
# Test host header injection:
# Modify Host: header in reset request:
Host: attacker.com
# If token arrives at attacker.com = vulnerability
# Test token entropy:
# Collect multiple tokens
# Check for patterns or short lengthRemember-Me Token Security
Remember-me tokens should be: cryptographically random, long (128+ bits), stored hashed server-side, single-use, and tied to the user account. Test for predictability and reuse.
Multi-Factor Authentication Bypasses
Common MFA bypasses: response manipulation (change failed to success), direct URL access after partial auth, brute-forcing short OTPs without rate limiting, and SIM swapping (social, not technical).
Account Lockout Testing
Test if repeated failed logins trigger lockout. No lockout = brute-force risk. Too-aggressive lockout = denial of service risk. Check if lockout resets after timeout or requires admin action.
Quick Check
What JWT attack changes the algorithm field to "none" to bypass signature verification?
Summary: Authentication and Session Testing
Authentication testing covers the full chain from initial login to session management. Look for username enumeration, absent lockout, predictable tokens, JWT algorithm confusion, password reset injection, and MFA bypasses. A single flaw in this chain can mean full account takeover for any user.
Frequently asked questions
Is the “Authentication and Session Testing” lesson free?
Yes — the full text of “Authentication and Session Testing” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Authentication and Session Testing”?
Test login bruteforcing, session fixation, JWT weaknesses, and insecure remember-me tokens. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Authentication and Session Testing” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Burp Suite Proxy and Intercepting Requests
- Testing for Injection Vulnerabilities
- Authentication and Session Testing
- File Upload and SSRF Vulnerabilities