Exploiting identification and authentication failures

Sometimes, a web application may not be configured to handle user authentication and allows unauthorized users, such as threat actors, to gain access to restricted resources. If a web application authentication mechanism is poorly designed, then threat actors can perform various types of attacks such as brute force, password spraying, and credential stuffing and use default user credentials as a way to gain access to the web application and web server. Sometimes, web administrators use default configurations, default user accounts, and even weak passwords, which simplify the attack that's being performed by the threat actor.

During a web application penetration test, it's important to test for identification and authentication failures and determine whether the web application can be exploited due to identification and authentication failures. In the following sub-section, you will learn how to test authentication...