Authentication / ATO
Account takeover is a chain. Inventory every step of how an identity becomes a session.
Tags: ato, oauth, 2fa, session
Checklist
- Register — Email canonicalisation, unverified login, takeover of unclaimed emails, invite tokens.
- Login — Response manipulation, JSON vs form, default credentials on staging, user enumeration.
- Reset / magic link — Host header, token in URL/Referer, token reuse, token entropy, race, next= redirect.
- Session — Fixation, cookie flags, parent-domain cookie, logout does not kill refresh tokens.
- OAuth / OIDC / SAML — redirect_uri, state, PKCE, mixed response_type, email-claim linking, SAML XML.
- MFA — Response tamper, brute without lockout, backup codes, race, skip on one of the apps.
- Email / phone change — Change then confirm vs confirm then change. Swap the victim's email onto your account.
- Remember me / devices — Long-lived tokens in localStorage, device cookies, trusted-device list IDOR.