Broken Authentication

---
name: Broken Authentication Testing
description: This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
metadata:
  author: zebbern
  version: 4.1.0-fractal
---

# Broken Authentication Testing

## Purpose

Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management.

## Prerequisites

## 🧠 Knowledge Modules (Fractal Skills)

### 1. [Required Knowledge](./sub-skills/required-knowledge.md)
### 2. [Required Tools](./sub-skills/required-tools.md)
### 3. [Required Access](./sub-skills/required-access.md)
### 4. [Phase 1: Authentication Mechanism Analysis](./sub-skills/phase-1-authentication-mechanism-analysis.md)
### 5. [Phase 2: Password Policy Testing](./sub-skills/phase-2-password-policy-testing.md)
### 6. [Phase 3: Credential Enumeration](./sub-skills/phase-3-credential-enumeration.md)
### 7. [Phase 4: Brute Force Testing](./sub-skills/phase-4-brute-force-testing.md)
### 8. [Phase 5: Credential Stuffing](./sub-skills/phase-5-credential-stuffing.md)
### 9. [Phase 6: Session Management Testing](./sub-skills/phase-6-session-management-testing.md)
### 10. [Phase 7: Session Fixation Testing](./sub-skills/phase-7-session-fixation-testing.md)
### 11. [Phase 8: Session Timeout Testing](./sub-skills/phase-8-session-timeout-testing.md)
### 12. [Phase 9: Multi-Factor Authentication Testing](./sub-skills/phase-9-multi-factor-authentication-testing.md)
### 13. [Phase 10: Password Reset Testing](./sub-skills/phase-10-password-reset-testing.md)
### 14. [Common Vulnerability Types](./sub-skills/common-vulnerability-types.md)
### 15. [Credential Testing Payloads](./sub-skills/credential-testing-payloads.md)
### 16. [Session Cookie Flags](./sub-skills/session-cookie-flags.md)
### 17. [Rate Limiting Bypass Headers](./sub-skills/rate-limiting-bypass-headers.md)
### 18. [Legal Requirements](./sub-skills/legal-requirements.md)
### 19. [Technical Limitations](./sub-skills/technical-limitations.md)
### 20. [Scope Considerations](./sub-skills/scope-considerations.md)
### 21. [Example 1: Account Lockout Bypass](./sub-skills/example-1-account-lockout-bypass.md)
### 22. [Example 2: JWT Token Attack](./sub-skills/example-2-jwt-token-attack.md)
### 23. [Example 3: Password Reset Token Exploitation](./sub-skills/example-3-password-reset-token-exploitation.md)