Authentication schemes in web applications
Before getting into the specific penetration testing concepts, let's review how authentication is done in modern web applications.
Platform authentication
When using platform authentication, users send their credentials in every request's header, using the Authorization variable. Even when they have to submit their credentials only once, the browser or the system stores them and uses them when required.
There are several different types of platform authentication. The most common ones are discussed in the following subsections.
Basic
With this type of platform authentication, the username and password are sent attached to the Authorization header and encoded using base64. This means that anybody who sees the request's header is able to decode the credentials to cleartext, as base64 encoding is not a cryptographic format.
The following screenshots show how login information is sent in base64 and how it can be decoded:
You can use Burp Suite's Decoder to...
