Authentication Testing (FIND/EXPLOIT — OWASP A07)

Overview

Break "are you who you say you are?" Account takeover (ATO) is the crown-jewel attack — one auth flaw often unlocks everything. Test the whole identity lifecycle, not just the login form.

Core principle: Auth is a flow, not a page. Bugs live in reset, refresh, federation, and state transitions — not just the password check.

Applies when / Skip when

• Applies when: the app has any identity mechanism — login, sessions, accounts, tokens/JWT, OAuth/SSO, password reset, or MFA.
• Skip when: the app is entirely anonymous with no authentication → N/A.
• If N/A: report "authentication-testing: N/A — no authentication surface" and stop.

⚠️ Authorization

Use your own accounts/app. Do not credential-stuff real users or third parties. Brute-force only your own test accounts, throttled.