Broken Authentication & Sessions

Credential attacks, session handling, MFA and password storage.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

8/8

1. 00:00Broken Authentication & Sessions. Credential attacks, session handling, MFA and password storage.
2. 00:05Credential stuffing - reusing breached username/password pairs.
3. 00:10Brute force and password spraying against weak lockout policies.
4. 00:15Session fixation - forcing a known session id onto a victim.
5. 00:20Token leakage - session ids in URLs, logs or referrer headers.
6. 00:25Weak reset flows - guessable tokens, no expiry, user-supplied host.
7. 00:30Reference table: Control, Requirement.
8. 00:35Note: Login responses must not reveal whether the email exists - use one generic failure message for both cases.

• Credential stuffing - reusing breached username/password pairs.
• Brute force and password spraying against weak lockout policies.
• Session fixation - forcing a known session id onto a victim.
• Token leakage - session ids in URLs, logs or referrer headers.
• Weak reset flows - guessable tokens, no expiry, user-supplied host.