Testing for Bypassing Authentication

The goal of an authentication schema is to validate the identity of the user being authenticated. Examining the authentication function starts with understanding how the authentication process validates the user account. When an authentication schema is vulnerable, attackers are able to bypass the authentication process.

There are multiple methods that can be used to bypass the authentication schema. Some of the methods to bypass include (but are not limited to) intercepting authentication requests if the application utilizes weak encryption, not correctly implementing input validation (which makes injection attacks possible), predicting session IDs if they follow a certain pattern, and misconfigurations.

Getting ready

To prepare for this recipe, Juice Shop must be running, and ZAP should be intercepting the traffic between the browser and Juice Shop.

How to do it…

In this recipe, we will bypass the authentication schema by...