Comprehensive Authentication Guide

ATTACK VECTORS:
├── Credential Stuffing
│   ├── Breach databases (HaveIBeenPwned)
│   ├── Password reuse across sites
│   └── Automated login attempts
├── Brute Force Attacks
│   ├── Dictionary attacks
│   ├── Rule-based mutations
│   └── Hybrid attacks
└── Password Reset Flows
    ├── Weak reset tokens
    ├── Token reuse vulnerabilities
    ├── Account enumeration
    └── Email interception for ATO (Post SMTP CVE-2025-24000 — Subscriber+ reads reset emails via broken REST API permissions)

BYPASS METHODS:
├── Social Engineering
│   ├── MFA fatigue (push spam)
│   ├── Vishing (voice phishing)
│   └── SIM swapping
├── Technical Bypasses
│   ├── Session fixation
│   ├── MFA enrollment abuse
│   ├── Backup code exploitation
│   └── Race conditions
├── Adversary-in-the-Middle (AiTM)
│   ├── Real-time phishing (Evilginx, Tycoon 2FA, Evilproxy, Mamba 2FA)
│   ├── Session cookie interception and replay
│   ├── Token replay
│   └── Cloudflare Workers as transparent proxy (IOActive research)
├── Authentication Downgrade Attacks
│   ├── JSON config manipulation — flip FIDO2 isDefault:false, push isDefault:true
│   ├── CSS injection to hide passkey/FIDO2 UI options
│   ├── Browser User-Agent spoofing (e.g., Safari on Windows) to trigger Entra ID fallback
│   └── WebAuthn immediate mediation abuse for non-WebAuthn fallback steering
├── Conditional Access Policy (CAP) Bypasses
│   ├── IP whitelisting bypass (VPN, Zscaler pivoting)
│   ├── Geo-whitelisting bypass (VPN/location spoofing)
│   ├── User-agent whitelisting bypass (custom UA strings)
│   ├── Cloud tooling bypasses (ROADtools, BloodHound, AADInternals)
│   └── Non-MFA hosts (legacy protocols, password reset portals)
└── Machine-Based Attacks
    ├── Session token theft from memory (Cobalt Strike BOFs)
    ├── OTP keylogging / seed QR code theft
    ├── Okta Terrify — extract passwordless keys from compromised endpoint
    └── Stolen/unlocked devices

SSRF ATTACK SURFACE VIA DYNAMIC REGISTRATION:
├── logo_uri — Server fetches logo image → SSRF on /authorize
├── jwks_uri — Server fetches JWK set for client_assertion validation → Blind SSRF
├── sector_identifier_uri — Server fetches redirect_uri list → SSRF on registration or authorization
├── request_uris — Whitelisted request_uri values → SSRF on /authorize via request_uri param
│   (Even without dynamic registration, test request_uri on /authorize directly)
└── Discovery: GET /.well-known/openid-configuration
    ├── registration_endpoint
    ├── request_uri_parameter_supported
    └── require_request_uri_registration

CVE-2021-26715: SSRF via logo_uri in MITREid Connect
ForgeRock OpenAM: SSRF via request_uri + redirect_uri Session Poisoning

SECURITY CONTROLS:
├── Authorization Server
│   ├── Strict redirect URI validation (exact match, no wildcards)
│   ├── State parameter enforcement
│   ├── PKCE for public clients
│   ├── Short-lived authorization codes (single use)
│   └── Disable Dynamic Client Registration if not needed
├── Resource Server
│   ├── Token introspection
│   ├── Scope validation
│   ├── Audience verification
│   └── Rate limiting
├── Client Application
│   ├── Secure token storage (never in browser history/URL)
│   ├── Token refresh handling with expiry
│   ├── CSRF protection via state parameter
│   ├── PKCE code_verifier/code_challenge
│   └── TLS everywhere
└── Non-Human Identity Governance
    ├── Monitor OAuth app registrations and consent grants
    ├── Audit token scopes vs actual usage
    ├── Enforce refresh token expiry (no null expiry)
    └── Vendor breach monitoring for third-party OAuth apps

XSW ATTACK TAXONOMY:
├── Classic XSW
│   ├── Move signed element, inject forged element in original location
│   ├── Application processes forged data, signature validates against hidden original
│   └── 8+ documented XSW variants in USENIX "On Breaking SAML" research
├── Parser Differential Exploits
│   ├── ruby-saml: REXML + Nokogiri dual parser → different XPath results
│   │   ├── CVE-2025-25291 / CVE-2025-25292 (ruby-saml < 1.18.0)
│   │   ├── CVE-2024-45409 (ruby-saml signature bypass by ahacker1)
│   │   └── Exploited in GitLab — sign in as any user with single valid signature
│   ├── Attribute pollution — parser-specific attribute handling differences
│   ├── REXML namespace confusion — without DTDs
│   └── Void Canonicalization — novel technique (PortSwigger "The Fragile Lock")
├── Signature Exclusion / Comment Injection
│   ├── Removing Signature element entirely
│   ├── XML comment injection between signature elements
│   └── Bypassing signature validation in libraries that don't enforce presence
├── Encrypted Assertion Bypass
│   ├── GitHub Enterprise: signature extracted pre-decryption, inner assertion signature never validated
│   │   ├── CVE-2024-4985 / CVE-2024-9487
│   │   └── Forge assertion inside encrypted envelope, only outer response signature checked
│   └── samlify (Node.js): CVE-2025-47949 — Signature Wrapping with unsigned assertion extraction
└── Improper Cryptographic Signature Verification
    ├── FortiGate FortiCloud SSO: CVE-2025-59718 / CVE-2025-59719 (CVSS 9.8)
    │   ├── SAML response signature not validated → forged SAMLResponse grants super_admin
    │   ├── Endpoint: POST /remote/saml/login
    │   ├── Actively exploited in the wild (Arctic Wolf, CISA KEV)
    │   └── Affects FortiOS, FortiProxy, FortiSwitchManager, FortiWeb
    └── CWE-347 pattern: system checks temporal claims but skips signature verification

SAML TESTING WORKFLOW (using SAML Raider):
├── Setup
│   ├── Install SAML Raider Burp extension
│   ├── Import/clone X.509 certificates
│   └── Capture SAML Response in proxy
├── Signature Wrapping Tests
│   ├── Apply all 8 XSW variants from SAML Raider
│   ├── Test with both signed Response and signed Assertion
│   └── Test with cloned/self-signed certificates
├── Signature Removal
│   ├── Remove Signature element entirely
│   ├── Remove SignatureValue content
│   └── Test if SP accepts unsigned assertions
├── Assertion Manipulation
│   ├── Modify NameID to target user
│   ├── Modify role/group attributes
│   ├── Change audience restriction
│   └── Alter temporal conditions (NotBefore/NotOnOrAfter)
├── XML-Level Attacks
│   ├── XXE injection in SAML Response
│   ├── XML comment injection in NameID
│   ├── DTD-based attacks (if not blocked)
│   └── Namespace confusion / attribute pollution
└── Certificate Tests
    ├── Clone IdP certificate, self-sign assertion
    ├── Test if SP validates certificate chain
    └── Test if SP accepts any valid signature (not just from trusted IdP)

SYNCED PASSKEY ATTACK SURFACE:
├── Cloud Account Compromise
│   ├── iCloud/Google account takeover → all synced passkeys compromised
│   ├── Recovery workflow abuse → authorize new device with stolen credentials
│   └── Personal cloud account on corporate device → passkeys leak to personal devices
├── Authentication Downgrade
│   ├── AiTM proxy spoofs unsupported browser → Entra ID disables passkey option
│   ├── User steered to SMS/OTP/push → captured by proxy
│   └── WebAuthn immediate mediation abused to offer weak fallback
├── Browser Extension Attacks
│   ├── webAuthenticationProxy API — intercept navigator.credentials.create()/get()
│   ├── Content script DOM injection — manipulate passkey UI elements
│   ├── DOM-based extension clickjacking — trigger autofill and exfiltration
│   └── Malicious extension forces password fallback or re-registration
└── Help Desk Social Engineering
    └── Recovery process = real control point attackers target

CLOUDFLARE ROLLOUT TIMELINE:
├── 2018: Distributed YubiKey 5 Nano + YubiKey 5 NFC to all employees
├── 2020: Selective enforcement via Cloudflare Access (Zero Trust proxy)
│   ├── OAuth2 integration with IdP, enforce "swk" (security key) AMR value
│   └── Incremental rollout — one service at a time
├── Feb 2021: Full enforcement — disabled all TOTP/SMS
│   ├── Triggered by social engineering phone calls to employees
│   └── Offline recovery process for lost keys (distribute 2 keys per employee)
├── SSH via Cloudflare Tunnel: cloudflared + Access policies enforce FIDO2 for SSH
└── Result: Zero successful phishing attacks post-deployment

SESSION ATTACKS:
├── Session Hijacking
│   ├── Network sniffing
│   ├── Cross-site scripting (XSS)
│   ├── Malware/browser compromise
│   └── AiTM reverse proxy cookie interception (Evilginx, Tycoon 2FA)
├── Session Fixation
│   ├── Pre-authentication session reuse
│   ├── URL-based session ID
│   └── Missing session regeneration
├── Session Timing
│   ├── Concurrent sessions
│   ├── Logout handling
│   └── Session timeout bypass
└── Session Token Portability
    ├── Stolen session cookies replayed from different device/IP
    ├── Impossible travel detection evasion
    └── Post-compromise MFA device registration for persistence

COMMON BYPASS PATTERNS:
├── Authentication Logic Flaws
│   ├── Boolean bypass (admin=true)
│   ├── SQL injection in auth queries
│   ├── LDAP injection
│   └── Authentication timing attacks
├── Protocol-Specific Issues
│   ├── JWT manipulation (alg=none, missing signature verification, JWE mix-up)
│   ├── OAuth state bypass / parameter injection
│   ├── SAML signature bypass (XSW, parser differential, encrypted assertion)
│   └── Kerberos attacks (Golden/Silver tickets)
├── Framework-Specific Bypasses
│   ├── Next.js middleware bypass (CVE-2025-29927) — set x-middleware-subrequest header
│   ├── WordPress REST API permission flaws (Post SMTP CVE-2025-24000)
│   └── Grafana open redirect + CSPT → XSS → account takeover (CVE-2025-6023)
├── Predictable Token Generation
│   ├── Zendesk Android SDK — SHA-1(REDACTED-{AccountID}-{HardcodedSecret}) → zero-click mass ATO
│   ├── Sequential ID enumeration + static secrets
│   └── No rate limiting on token validation endpoints
└── Implementation Weaknesses
    ├── Default credentials
    ├── Weak password policies
    ├── Missing rate limiting
    ├── Insecure session handling
    └── AI-generated code with insufficient input sanitization (Okta nextjs-auth0 OAuth injection)

FRAMEWORK SECURITY:
├── Spring Security
│   ├── Method-level security
│   ├── CSRF protection
│   └── Session management
├── ASP.NET Identity
│   ├── Identity configuration
│   ├── Cookie authentication
│   └── External providers
├── Express.js/Passport
│   ├── Strategy configuration
│   ├── Session security
│   └── Middleware order
├── Next.js
│   ├── Never rely solely on middleware for auth (CVE-2025-29927)
│   ├── Verify auth in Server Components, Page Routes, and API Routes
│   └── Block x-middleware-subrequest header from external requests
├── WordPress
│   ├── REST API permission callbacks must check capabilities, not just login status
│   ├── Audit plugins exposing sensitive data via REST endpoints
│   └── Post SMTP pattern: get_logs_permission() → is_user_logged_in() is insufficient
└── Node.js SAML (samlify)
    ├── Upgrade to >= 2.10.0 to fix Signature Wrapping (CVE-2025-47949)
    └── Use single XML parser for validation + processing

TESTING ARSENAL:
├── Credential Attacks
│   ├── Hydra (brute force)
│   ├── Medusa (parallel login)
│   ├── Patator (modular brute forcer)
│   └── MFASweep (CAP misconfiguration discovery)
├── OAuth/JWT Testing
│   ├── jwt_tool (JWT manipulation)
│   ├── Burp JWT Editor
│   ├── request_uri SSRF testing via /authorize
│   └── Dynamic Client Registration fuzzing
├── SAML Testing
│   ├── SAML Raider (Burp extension) — 8 XSW variants, cert cloning, assertion editing
│   ├── SAMLReq (CLI tool)
│   ├── Manual XML manipulation
│   └── Parser differential toolkit (PortSwigger "The Fragile Lock")
├── MFA Bypass Testing
│   ├── Evilginx (AiTM reverse proxy)
│   ├── Cloudflare Workers PoC (IOActive auth downgrade)
│   └── ROADtools / AADInternals (Azure AD CAP bypass)
└── Passkey / WebAuthn Testing
    ├── Browser extension permission auditing (webAuthenticationProxy)
    ├── Downgrade scenario simulation (UA spoofing, CSS injection)
    └── Device-bound vs synced credential policy verification