Authentication & Authorization Research

Purpose: Deep understanding of auth vulnerabilities for bug bounty hunting
Priority: CRITICAL (identified as primary gap in H1 infrastructure)
Last Updated: December 28, 2025

Why This Matters

From your GAP_ANALYSIS_2025.md: - IDOR/BAC: $5K-$50K payouts, +29% YoY growth - Auth Bypass: $10K-$100K payouts, rising trend - Current tooling: ❌ CRITICAL GAP

This section builds the knowledge needed to leverage: - h1-auth-agent - auth_specialist.py - idor-hunt.sh

Contents

Core Concepts

1. Authentication Fundamentals
2. Authorization Models
3. Session Management

Attack Techniques

1. Password Reset Attacks
2. JWT Vulnerabilities
3. OAuth/OIDC Attacks
4. MFA Bypass
5. IDOR/BAC Testing
6. Session Attacks

Tools & Testing

1. Testing Methodology
2. Tool Reference

Case Studies

• Case Studies Index

Quick Reference

Authentication Attack Priority

Authorization Attack Priority

Key Principles

Authentication Security (OWASP)

1. Password Requirements
2. With MFA: Minimum 8 characters
3. Without MFA: Minimum 15 characters
4. Maximum: At least 64 characters

5. Allow all characters including unicode/whitespace

6. MFA Effectiveness

7. "Prevents 99.9% of account compromises" - Microsoft

8. Session Management

9. Regenerate session ID after authentication
10. Minimum 64 bits of entropy
11. HttpOnly, Secure, SameSite cookie flags

Authorization Security (OWASP)

1. Core Principles
2. Deny by default
3. Validate on every request
4. Server-side validation only

5. Least privilege

6. Preferred Models

7. ABAC (Attribute-Based) over RBAC (Role-Based)
8. ReBAC (Relationship-Based) for complex hierarchies

Testing Checklist

AUTHENTICATION TESTING
□ Test for username enumeration
□ Check password policy enforcement
□ Test account lockout mechanism
□ Verify session token randomness
□ Check for default credentials
□ Test password reset flow
□ Test JWT implementation
□ Test OAuth redirect_uri
□ Test 2FA bypass methods

AUTHORIZATION TESTING
□ Test all IDs for IDOR
□ Test horizontal privilege escalation
□ Test vertical privilege escalation
□ Check admin endpoints with user tokens
□ Test HTTP method variation
□ Check for mass assignment
□ Verify consistent authorization

Navigation

• Previous: 00_foundation
• Next: 02_api_security
• Main: Knowledge Base README