Authentication / ATO
Account takeover is a chain. Inventory every step of how an identity becomes a session.
Tags: ato, oauth, 2fa, session
Checklist
- Register: Email canonicalisation, unverified login, takeover of unclaimed emails, invite tokens.
- Login: Response manipulation, JSON vs form, default credentials on staging, user enumeration.
- Reset / magic link: Host header, token in URL/Referer, token reuse, token entropy, race, next= redirect.
- Session: Fixation, cookie flags, parent-domain cookie, logout does not kill refresh tokens.
- OAuth / OIDC / SAML: redirect_uri, state, PKCE, mixed response_type, email-claim linking, SAML XML.
- MFA: Response tamper, brute without lockout, backup codes, race, skip on one of the apps.
- Email / phone change: Change then confirm vs confirm then change. Swap the victim's email onto your account.
- Remember me / devices: Long-lived tokens in localStorage, device cookies, trusted-device list IDOR.