Authentication is the gatekeeper of application security. This category tests every aspect of how users prove their identity, from password policies and credential storage to multi-factor authentication and session management during login. Weak authentication is consistently ranked among the top web application risks because it provides direct access to user accounts and sensitive data. Tests in this category cover credential transport security, brute-force protections, password reset flows, and authentication bypass techniques. For security professionals and cert candidates, deep understanding of authentication weaknesses is essential because these vulnerabilities have the most direct business impact.
OWASP Top 10 Mapping
This testing category relates to the following OWASP Top 10 2021 categories:
Quick Reference
| Test ID | Name | CWEs | Difficulty |
|---|---|---|---|
| WSTG-ATHN-01 | Credential Transport Security | CWE-319, CWE-523 | Intermediate |
| WSTG-ATHN-02 | Default Credentials Testing | CWE-521, CWE-287 | Intermediate |
| WSTG-ATHN-03 | Account Lockout Testing | CWE-307 | Intermediate |
| WSTG-ATHN-04 | Authentication Bypass | CWE-287, CWE-288 | Intermediate |
| WSTG-ATHN-05 | Remember Password Testing | CWE-287, CWE-522 | Intermediate |
| WSTG-ATHN-06 | Browser Cache Testing | CWE-525 | Intermediate |
| WSTG-ATHN-07 | Password Policy Testing | CWE-521 | Intermediate |
| WSTG-ATHN-08 | Security Question Testing | CWE-640 | Intermediate |
| WSTG-ATHN-09 | Password Reset Testing | CWE-640, CWE-620 | Intermediate |
| WSTG-ATHN-10 | Alternative Channel Auth Testing | CWE-287, CWE-306 | Intermediate |
Detailed Test Cases
WSTG-ATHN-01: Credential Transport Security
IntermediateThis test verifies that user credentials (usernames and passwords) are always transmitted over encrypted channels (HTTPS/TLS). Credentials sent over unencrypted HTTP can be intercepted by anyone on the network path between the user and the server.
What to Check
- Verify the login form is served over HTTPS and submits to an HTTPS endpoint
- Check that HTTP-to-HTTPS redirects happen before credentials are submitted
- Test whether login forms can be loaded over HTTP by directly entering the URL
- Confirm that API authentication endpoints require HTTPS
- Verify that HSTS is configured to prevent protocol downgrade attacks
WSTG-ATHN-02: Default Credentials Testing
IntermediateThis test checks whether the application, its infrastructure, or any administrative interfaces still use default credentials that were set during installation. Default credentials are publicly known and are one of the first things attackers try.
What to Check
- Test common default username/password combinations for the identified platform
- Check for admin accounts with well-known defaults (admin/admin, admin/password)
- Review vendor documentation for default credentials specific to the software version
- Test database management interfaces for default database credentials
- Check for service accounts with default or blank passwords
WSTG-ATHN-03: Account Lockout Testing
IntermediateThis test evaluates whether the application has adequate brute-force protection through account lockout mechanisms, rate limiting, or progressive delays. It also checks whether the lockout mechanism itself can be abused to deny legitimate users access.
What to Check
- Determine how many failed attempts trigger an account lockout
- Test whether lockout can be bypassed by changing IP addresses
- Check if lockout applies to all authentication methods (web, API, mobile)
- Verify that lockout notifications are sent to the account owner
- Test whether an attacker can intentionally lock out other users' accounts
WSTG-ATHN-04: Authentication Bypass
IntermediateThis test attempts to bypass the authentication mechanism entirely through techniques like forced browsing, parameter manipulation, SQL injection in login forms, session token prediction, or exploiting flaws in the authentication logic itself.
What to Check
- Test forced browsing to authenticated pages without logging in first
- Manipulate authentication parameters (user role, isAdmin, authentication tokens)
- Test SQL injection in username and password fields
- Check for authentication bypass through HTTP header manipulation
- Test if modifying the response from the server can trick the client into granting access
WSTG-ATHN-05: Remember Password Testing
IntermediateThis test examines how the application implements 'remember me' or 'stay logged in' functionality. Insecure implementations may store credentials in cookies, use predictable tokens, or fail to provide adequate expiration and revocation mechanisms.
What to Check
- Examine remember-me cookies for plaintext or reversible credential storage
- Test whether remember-me tokens are cryptographically random and unpredictable
- Verify that remember-me tokens are invalidated on password change
- Check if remember-me functionality has a reasonable expiration time
- Test whether remember-me tokens are bound to the original client or can be replayed
WSTG-ATHN-06: Browser Cache Testing
IntermediateThis test checks whether sensitive data from authenticated pages is stored in the browser cache, history, or back/forward cache. Cached sensitive content can be accessed by subsequent users of a shared computer or recovered through forensic analysis.
What to Check
- Check for Cache-Control and Pragma headers preventing caching of sensitive pages
- Verify that the back button does not display authenticated content after logout
- Test whether autocomplete is disabled on sensitive form fields (credentials, SSN, credit card)
- Check browser history for sensitive URL parameters
- Verify that no-store directive prevents disk caching of sensitive responses
WSTG-ATHN-07: Password Policy Testing
IntermediateThis test evaluates the application's password policy for minimum complexity requirements, length restrictions, and whether it prevents commonly used passwords. A weak password policy makes brute-force and dictionary attacks much more likely to succeed.
What to Check
- Test minimum and maximum password length requirements
- Check if the application enforces complexity rules (uppercase, lowercase, numbers, special characters)
- Verify that commonly used passwords (password123, qwerty, letmein) are rejected
- Test if the application checks passwords against known breach databases
- Confirm that password history prevents reuse of recent passwords
WSTG-ATHN-08: Security Question Testing
IntermediateThis test evaluates the strength of security questions used for account recovery or additional authentication. Weak security questions have answers that are easily guessed, publicly available, or the same for many users.
What to Check
- Evaluate whether security questions have easily guessable or researchable answers
- Test if the application allows users to set their own questions with trivial answers
- Check if security question answers are case-sensitive
- Verify that brute-force protection applies to security question attempts
- Test whether security questions can be bypassed through other recovery methods
WSTG-ATHN-09: Password Reset Testing
IntermediateThis test examines the password change and reset mechanisms for weaknesses including insecure reset tokens, lack of current password verification during changes, and exploitable password recovery flows that could enable account takeover.
What to Check
- Test whether password change requires the current password for verification
- Analyze password reset tokens for randomness and predictability
- Verify that reset tokens expire within a reasonable timeframe
- Check if reset tokens are single-use and invalidated after password change
- Test for host header injection in password reset emails
WSTG-ATHN-10: Alternative Channel Auth Testing
IntermediateThis test checks whether alternative authentication channels (mobile app, API, legacy interfaces, partner portals) have weaker security controls than the primary web application. Attackers often target the weakest authentication path available.
What to Check
- Identify all authentication channels (web, mobile API, legacy systems, partner portals)
- Compare authentication strength across channels (password policy, MFA, lockout)
- Test if credentials are shared across channels with different security levels
- Check if alternative channels bypass security controls enforced on the primary channel
- Verify that all channels enforce the same session management policies
Relevant Certifications
The following certifications cover authentication testing concepts:
Frequently Asked Questions
What are the most critical authentication vulnerabilities in web applications?
The most critical authentication vulnerabilities include default credentials, weak password policies, missing brute-force protections, insecure password reset mechanisms, and authentication bypass through parameter manipulation. These are commonly exploited because they provide direct access to user accounts and often require minimal technical skill to exploit.
How does WSTG-ATHN differ from WSTG-IDNT and WSTG-SESS?
WSTG-IDNT tests how accounts are created and managed, WSTG-ATHN tests how users prove their identity when logging in, and WSTG-SESS tests how that authenticated state is maintained after login. Together, they cover the full lifecycle of user access: creation, verification, and session persistence.
What is credential stuffing and how does it relate to authentication testing?
Credential stuffing uses username/password pairs leaked from data breaches on other sites to attempt logins on the target application. It exploits password reuse across services. Authentication testing evaluates whether the application has defenses against this attack, including rate limiting, account lockout policies, CAPTCHA challenges, and multi-factor authentication.
CyberFolio
Mastering web security testing? Showcase your skills.
Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.
Build Your Portfolio →