Authentication Flaws
Broken authentication is one of the most impactful vulnerability classes because it directly leads to account takeover. You will learn how to identify and exploit weak authentication mechanisms including insecure password reset flows, username enumeration, and session management flaws. Testing authentication is a critical part of every web application penetration test.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Test for username enumeration
Navigate to the DVWA Brute Force module and attempt to log in with a valid username (admin) and a wrong password, then with an invalid username and a wrong password. Compare the error messages returned in each case — if the application returns 'Invalid password' for a valid username and 'User not found' for an invalid one, it is leaking information about which usernames exist. Username enumeration is a prerequisite for targeted brute force attacks because it allows an attacker to build a confirmed list of valid accounts before attempting password guessing.
Set up Burp Suite Intruder
Open Burp Suite and configure your browser to use Burp as a proxy (127.0.0.1:8080). Submit a login attempt in DVWA and intercept the request in Burp's Proxy tab. Right-click the intercepted request and select 'Send to Intruder'. In the Intruder tab, go to the Positions subtab and highlight the password value, then click 'Add §' to mark it as the injection point. Set the attack type to Sniper, which will substitute each payload from your wordlist into the marked position one at a time.
Run the brute force
In the Intruder Payloads tab, set the payload type to Simple List and load /usr/share/wordlists/rockyou.txt (or a smaller list like /usr/share/wordlists/metasploit/unix_passwords.txt for faster results). Click 'Start Attack' to begin the brute force. Monitor the results table and sort by Response Length — a successful login will typically return a different response length than a failed one. When you find the correct password, the response will contain a welcome message or redirect to the authenticated area instead of the login error.
Analyze session tokens
Log into DVWA multiple times and capture the PHPSESSID cookie value each time using Burp Suite's Proxy history. Compare the token values across sessions — a secure session token should be long (at least 128 bits), random, and unpredictable. If the tokens follow a pattern (sequential numbers, timestamps, or predictable hashes), they are vulnerable to session prediction attacks. Use Burp Suite's Sequencer tool by right-clicking a response containing a Set-Cookie header and selecting 'Send to Sequencer' to perform a statistical analysis of the token's randomness.
Test session invalidation
Log into DVWA, copy your session cookie value, then log out using the application's logout function. After logging out, manually set your browser's cookie back to the copied value and attempt to access a protected page. If the application accepts the old cookie and grants access, the session was not properly invalidated on the server side — the logout only deleted the client-side cookie but left the server-side session active. Proper session invalidation requires the server to delete or expire the session record in its session store, not just instruct the browser to delete the cookie.