wstg-authentication

Follow the OWASP WSTG authentication testing methodology, which covers ten test cases from credential transport encryption to alternative channel weaknesses. Test each area systematically: HTTPS enforcement, default credentials, lockout thresholds, bypass techniques, and password reset token randomness.

WSTG-ATHN includes ten tests: encrypted credential transport, default credentials, weak lockout, authentication schema bypass, vulnerable remember password, browser cache weaknesses, weak password policy, weak security questions, weak password change or reset, and weaker authentication in alternative channels.

Test forced browsing to protected pages without a session, modify client-supplied parameters like authenticated=yes or role=admin, analyze session IDs for predictability, and try SQL injection payloads such as ' OR '1'='1 on login forms. Gray-box review can reveal type-juggling flaws in authentication logic.

Verify reset tokens are cryptographically random and time-limited, confirm the old password is required for changes, check that user identifiers cannot be modified to target other accounts, and ensure CSRF protection exists on password change endpoints. Tokens that are sequential or never expire are exploitable.

Common patterns include HTTPS only on login pages while session cookies leak over HTTP, client-side authentication decisions, verbose error messages enabling username enumeration, sequential session or reset tokens, and staging environments with weaker security than production.