Authentication & Session Management Flaws

Analyze authentication flows to identify weaknesses such as insecure credential handling and lack of rate limiting.

Perform username enumeration by analyzing application error messages and response timing.

Execute credential-based attacks (brute-force, password spraying, credential stuffing) using Burp Suite Intruder.

Analyze session token generation to identify weak or predictable identifiers.

Exploit session fixation vulnerabilities to hijack authenticated user sessions.

Test password reset workflows for logic flaws, such as token leakage or parameter tampering, to achieve account takeover.

Identify and exploit insecure multi-factor authentication (MFA) implementations for bypass.

Exploit insecure client-side controls that attempt to enforce authentication or authorization.