Testing playbook · advanced
Account Takeover
Chain weaknesses in auth, reset, and session flows to seize another user's account.
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.
Every step requires authorization. Review side effects before running commands against a live system.
Map every auth surface
Login, register, password reset, email/phone change, OAuth, MFA, and 'remember me'. Each is a candidate.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Attack password reset
Test host-header poisoning of reset links, token predictability/reuse, and reset-token leakage in responses.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Abuse response manipulation / OAuth
Look for client-side auth decisions, OAuth redirect_uri flaws, and pre-account-takeover via unverified email.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Bypass MFA
Check for OTP brute-force (no rate limit), response tampering, and backup-code enumeration.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes
Common guidance
- Host-header poisoning on reset emails is still shockingly common.
- Race conditions in reset/verify flows can bypass single-use tokens.
Related tools
Mapped workflow tools
Sources
References
Version history: normalized permanent page created 2026-08-20.