A07 — Identification & Authentication Failures Insecure

These insecure demos highlight common auth design mistakes: no rate limits, session fixation, predictable reset tokens, weak/bypassable MFA, and insecure remember-me.

Attack 1 Attack 2 Attack 3 Attack 4 Attack 5

Uses shared DB tables (a07_*). Seed data in db/seed.sql. Compare with the Secure version.

Attack 1 — Brute-force / Rate Limiting

no limit, generic responses

Vulnerable idea: unlimited attempts, generic error messages, no jitter/backoff. "alice@example.com/alice@example.com"

Attack 2 — Session Fixation & Cookie Flags

no regenerate; weak flags

Vulnerable idea: don’t rotate the session ID on login and set cookies without HttpOnly, Secure, or proper SameSite.

Begin (pre-login SID)

Who am I?

Attack 3 — Password Reset Tokens

predictable token + plaintext + long TTL + reuse

Vulnerable idea: predictable tokens, stored in plaintext, long TTL, and multi-use.

Attack 4 — MFA (TOTP-style)

bypassable / trivial code

Vulnerable idea: mark MFA “passed” via query flag/cookie or accept trivial codes (e.g., 000000).

Begin MFA (insecure)

Attack 5 — Remember-Me (Persistent Login)

raw token in cookie; no expiry/rotation

Vulnerable idea: store user_id or raw token in cookie; trust it blindly forever.

Set Remember-Me (insecure)

Validate Remember-Me Clear