Broken Authentication: Credential Attacks & Registration Bypass

OWASP A07:2021 — Identification and Authentication Failures covers weaknesses that allow an attacker to impersonate another user or bypass the authentication gate entirely.

Authentication is the first control protecting every privileged resource in a web application. When it fails, everything behind it becomes accessible.

Two attack classes you will practise in this lesson

1 — Credential Stuffing (no rate limiting)

An attacker who obtains a list of common or previously-leaked passwords can test them against a login endpoint one after another. If the application imposes no rate limit and no account lockout, there is nothing to slow the attack down. Tools like Hydra and Burp Suite Intruder can submit thousands of guesses per second.

What this lesson simulates: a single-target brute-force against the admin account where you will manually try passwords from a short wordlist — the same workflow an automated tool would perform at scale.

2 — Username Normalization Flaw (registration bypass)

Many applications apply different normalisation rules at different stages:

• Registration checks for duplicate usernames using an exact string match (spaces and case preserved).
• Profile lookup strips and lowercases the username before querying.

This inconsistency means registering alice (trailing space) passes the uniqueness check — because 'alice ' ≠ 'alice' — but the subsequent profile lookup resolves to the original alice account.

Real-world impact

Ready? Open the right panel to see the vulnerable SecureVault Employee Portal, then click Continue below.