2FA simple bypass
Direct navigation to the account page bypasses the pending second-factor step after valid password authentication.
taxonomy / category
Authentication
Posts following the same line of inquiry.
Broken brute-force protection, IP block
Alternating valid and invalid login attempts resets the IP-based failure counter and permits continued password guessing.
Brute-forcing a stay-logged-in cookie
A stay-logged-in cookie encodes the username alongside an unsalted MD5 password hash. Recomputing that predictable token for password candidates yields a valid cookie for Carlos's account.
Offline password cracking
A stolen persistent-login cookie reveals a weak password hash that can be cracked offline and reused for authentication.
Password reset broken logic
The reset submission trusts its username field instead of binding the new password to the account that requested the token.
Password reset poisoning via middleware
Attacker-controlled forwarded-host metadata poisons the emailed reset URL and sends Carlos reset token to the exploit server.
Username enumeration via account lock
Account lockout becomes the oracle: repeated failures trigger a warning only for a real username, after which a controlled password test completes the lab.
Username enumeration via different responses
Distinct POST /login messages separate unknown users from valid accounts with wrong passwords, providing a direct response-text signal for enumeration.
2FA Broken Logic: Brute-Forcing a User-Bound Verification Code
The lab's two-step login flow does not securely bind the second-factor check to the account authenticated during the password step. Instead, /login2 uses a client-controlled verify cookie to decide whose code is being checked.
Username enumeration via response timing
Response-time differences reveal when a username reaches password verification, enabling reliable account enumeration.
Username enumeration via subtly different responses
A single punctuation difference in the login error reveals whether a username exists, even though the two responses otherwise look identical.