HTB CWPE: Authentication and Session Management Attacks

What this domain tests

Authentication and Session Management Attacks tests whether you can break identity proofing and session lifecycle controls without confusing authentication with authorization. Expect login, registration, password reset, MFA, remember-me tokens, OAuth/OIDC, and JWT handling.

Core rules and concepts

• Map every identity flow: signup, login, logout, reset, email change, MFA enrollment, and token refresh.
• Inspect cookie attributes (Secure, HttpOnly, SameSite, Domain, Path) and whether logout invalidates server-side state.
• Decode JWTs and test signature enforcement, algorithm confusion, weak HMAC secrets, kid injection, and claim trust (role, sub, aud, exp).
• Password-reset poisoning often lives in the Host header, reset link base URL, or token binding to email versus user ID.
• Session fixation succeeds when the pre-auth session ID survives login; rotation must be verified server-side.
• Check refresh tokens, remember-me cookies, and API keys for the same weaknesses as primary sessions.

Worked example

A login returns Authorization: Bearer eyJ... with header {'alg':'HS256'} and payload {'sub':'bob','role':'user'}. You save the token, run hashcat -m 16500 token.txt rockyou.txt, recover the secret s3cr3t, and re-sign a token with 'role':'admin' using the same HMAC. The reasoning is that HS256 is symmetric: if the secret is weak and the server trusts the role claim, signature validation is not enough. You then call /api/admin with the forged token and compare against the original.

Traps that cost marks

• Assuming alg:none works everywhere; many parsers reject it.
• Changing a JWT claim without re-signing and calling it a finding.
• Testing authorization with an admin cookie, which hides broken access control.
• Missing that a reset token is single-use only in the UI, not in the API.