Authentication Security Testing

This guide treats web authentication and account-recovery workflows as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Create designated identities for each supported role and lifecycle state.

2. 02

   Map enrollment, sign-in, MFA, recovery, password change, and deactivation.

3. 03

   Record rate limits and lockout behavior before negative tests.

4. 04

   Identify federation and step-up authentication boundaries.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Compare responses for synthetic valid and invalid identities without enumerating real users.

2. 02

   Verify recovery requires equivalent assurance and invalidates appropriate sessions.

3. 03

   Confirm MFA cannot be silently downgraded or bypassed through alternate flows.

4. 04

   Test deactivated and suspended identities at each entry point.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log sign-in, recovery, MFA changes, enrollment, and risk decisions.
• Alert on repeated recovery, factor changes, and unusual device or geography.
• Avoid logging passwords, OTP values, or full recovery tokens.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Adopt phishing-resistant MFA for sensitive users.
• Unify rate limits and response behavior across entry points.
• Harden recovery and require reauthentication for factor changes.
• Invalidate sessions after material account changes.