In a recent interview I was asked how can you bypass a login page, all it has is Username, password and login button.
I was able to come up with below possible ways,
- SQL Injection
- Stealing cookie
- Trying default / easy to guess usernames and passwords
However, the interviewer wasn't satisfied by my answer and was expecting harder ways instead of these easier options.
So I wanted to know how else can a login page be exploited? What exploits am I missing?