Authentication Failures

Weaknesses in how users log in, stay logged in, or recover their account.

## 1 · why it happens

Login looks simple, but the full flow is large: sign-up, login, MFA, sessions, "remember me", password reset, OAuth callbacks. Attackers pick the weakest step.

This is where OSINT about people matters most. Employee names from LinkedIn give usernames; breach data gives reused passwords; together they make password spraying very effective.

# JavaScript

✗ vulnerable

// Reset link built from the Host header
const link = `https://${req.headers.host}/reset?token=${token}`;
await sendMail(user.email, link);

✓ fixed

// Base URL from config, never from the request
const link = new URL(`/reset?token=${token}`, process.env.APP_URL).toString();
await sendMail(user.email, link);

# C#

✗ vulnerable

if (user == null) return BadRequest("User not found");
if (!VerifyPassword(user, password)) return BadRequest("Wrong password");

✓ fixed

// Same message for both - no username enumeration
if (user == null || !VerifyPassword(user, password))
    return Unauthorized("Invalid email or password");
// + lockout / rate limiting (e.g. Identity's lockoutOnFailure: true)

## 2 · how attackers find it from outside

public source	what it tells them
LinkedIn & company website	Employee names → email/username format ([email protected]).
Breach databases	Passwords those people reused elsewhere.
theHarvester	Email addresses and hosts for a domain from public sources in one run.
Login & reset pages	"User not found" vs "wrong password" confirms which accounts exist.

→ all OSINT sources · run them on yourself

## 3 · how it's abused

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.