Web Authentication Attacks
Course Description
Authentication is the gateway to applications. Learn to attack OAuth, SAML, JWT, and other authentication mechanisms.
Course Structure
Modules
Module 1: Authentication Fundamentals (5h)
- Authentication types
- Session management
- Token-based auth
- Multi-factor auth
Module 2: Password Attacks (6h)
- Brute force techniques
- Password spraying
- Credential stuffing
- Password reset flaws
Module 3: OAuth/OIDC Attacks (7h)
- OAuth flow analysis
- State parameter bypass
- Token theft
- Scope manipulation
- Redirect URI manipulation
Module 4: SAML Attacks (6h)
- SAML basics
- Signature bypass
- XXE in SAML
- Assertion manipulation
Module 5: JWT Attacks (6h)
- Algorithm confusion
- Signature bypass
- Key confusion
- Token hijacking
Module 6: Session Management (5h)
- Session fixation
- Session hijacking
- Cookie attacks
- Token reuse
Module 7: MFA Bypass (5h)
- OTP bypass
- SMS interception
- App vulnerabilities
- Backup code abuse
Tools
| Tool | Purpose |
|---|---|
| Burp Suite | Request analysis |
| jwt_tool | JWT testing |
| SAMLRaider | SAML testing |
| Hydra | Brute force |
📄️ Overview
Authentication bypass: OAuth, SAML, SSO, and session management attacks