In a recent interview I was asked how can you bypass a login page, all it has is Username, password and login button.

I was able to come up with below possible ways,

  1. SQL Injection
  2. Phishing
  3. Stealing cookie
  4. Trying default / easy to guess usernames and passwords

However, the interviewer wasn't satisfied by my answer and was expecting harder ways instead of these easier options.

So I wanted to know how else can a login page be exploited? What exploits am I missing?

closed as too broad by M'vy, schroeder Jan 31 '18 at 9:48

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You're asking for lists of lists. If you can narrow your question down so that there can be a single acceptable answer, we can look at re-opening. – schroeder Jan 31 '18 at 9:49
  • I understand what you are saying but honestly, this is the scenario I was provided with and I am looking for answers exactly like given by @McMatty security.stackexchange.com/a/178775/122309 – ChallengeMe Jan 31 '18 at 13:59

Some thoughts:

  • View the source code for information that may allow you to breach the login page. Developer comments, variables used for authentication
  • View the page to see if its using a known framework with security issues. Find the version number and look up related CVEs
  • Proxy the request across and view the content. Tamper with information being passed across to see if it allows access
  • View the content of cookies if there are any to see if that data allows access (seriously I've come across access=true in the past)
  • Try going around the login page if you can guess some urls, they may have poor access controls on the page you are trying to get to
  • View the site itself for information. Use something like dirbuster to see if there are any directories open to you that relate to the login page. Maybe a user list of plain text password file
  • See what the login page is being hosted on. Maybe there is an exploit on the host platform you can use to gain access or get around the page
  • Use a list of user / passwords from previous breaches to try brute force access

Okay, so you have a Login page with username and password and with login button.

  1. Try to enumerate the usernames by monitoring the errors. Like username already exist (then it will be a problem.).

  2. After you found that You can enumerate the usernames and try to check the password quality. If the password rules are not good then the login page will be in problem ( point 1 + point 2).

  3. Is the login page is in the HTTPS? If it is not then what if the attacker intercepts the response and inject the keylogger.

  4. Is the credentials sent over HTTPS?

  5. Off course default username password.

  6. SQL injection.

  7. When you log in to your account sees the parameters carefully, is there any parameter like User-id. And if there is any then try to IDOR.

and yes there are many more ways available but if I am you then I will give these answers at that time.

Not the answer you're looking for? Browse other questions tagged or ask your own question.