The newest Authentication resources are on the Authentication page. For a reading order instead of a date order, see the Authentication learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2023-10-24 2023 | Spoofing Microsoft 365 Like Its 1995 advanced 6 min read | Technique for spoofing Microsoft 365 emails by leveraging Microsoft Direct Send and Exchange Online Protection (EOP) settings. This method allows sending emails from internal or external addresses to other internal recipients within an organization by utilizing the mail.protection.outlook.com smart host and port 25, effectively bypassing many third-party mail gateways and landing emails directly in the inbox. The technique can be executed via PowerShell commands and easily rotated IP addresses, such as through Azure Cloud Shell. |
| 2023-10-17 2023 | enumerating 24 million users intermediate 14 min read Recon | Library for enumerating Microsoft OneDrive users, achieving the enumeration of 24 million users. This method leverages simple HTTP requests to identify valid users without requiring authentication or leaving visible logs, making it effective for large-scale data gathering. The project highlights Microsoft's stance that user enumeration is not a security vulnerability, and it details the infrastructure setup using VPS servers, a database, and web interfaces, along with tools like AAD-Internals and TREVORspray for tenant and domain information discovery. |
| 2023-10-09 2023 | What is OAuth (The Modern Guide) beginner 69 min read API Sec | Guide to OAuth 2.0, this resource details real-world integrations and implementations beyond the core specifications. It covers eight common OAuth modes including local, third-party, and enterprise login/registration, as well as service authorization and machine-to-machine authentication. The guide differentiates OAuth from SAML, clarifying its role as an authorization system with authentication layered on top via OpenID Connect. It provides practical guidance for developers on selecting the appropriate OAuth mode for their specific application needs. |
| 2023-09-20 2023 | Episode 99: OAuth 2 and Authentication Choices for Your Python Project beginner 2 min read Python | Talk about authentication systems and OAuth 2 for Python projects, covering setup, device grants, social login, and privacy concerns. It mentions FusionAuth, oauthlib, Django OAuth Toolkit, Flask-Login, and relevant RFCs like 6749 and 6750, as well as OpenID Connect. → realpython.com |
| 2023-09-20 2023 | How to Authenticate using Keys BasicAuth OAuth2 inPython intermediate 1 min read Python | Library for authenticating Python applications using Keys, BasicAuth, and OAuth2. This resource details implementing these authentication methods, focusing on practical application for developers seeking secure and robust authorization strategies. |
| 2023-09-06 2023 | Results of Major Technical Investigations for Storm-0558 Key Acquisition news Secrets | Analysis of Storm-0558 key acquisition details significant technical investigations into the incident. This MSRC blog post, authored by the Japan Security Team, offers deep technical analysis and strategic guidance related to the security program, policy changes, and research that contributed to understanding how the critical Storm-0558 key was acquired. |
| 2023-09-03 2023 | GitHub - dirkjanm/adidnsdump: Active Directory Integrated DNS dumping by any authenticated user intermediate AuthZ | Library for Active Directory Integrated DNS dumping, allowing any authenticated user to enumerate and export all DNS records in Domain or Forest DNS zones for internal network reconnaissance. It requires impacket and dnspython for functionality and can be installed via pip or from Git. The tool supports direct network use or operation via an implant using proxychains with the `--dns-tcp` option. |
| 2023-09-01 2023 | Spraying the Microsoft Cloud intermediate AuthZ | Adversaries continue to probe and make entry via the cloud perimeter of organisations. Multi-Factor Authentication (MFA) and additional… |
| 2023-05-21 2023 | JWT (Json Web Token) Audience aud versus Client_Id - What's the difference? beginner 3 min read JWT | Reference explaining the JWT `aud` (Audience) claim, detailing its purpose in identifying intended recipients according to RFC 7519. It highlights that the `aud` claim is optional and application-specific, requiring recipients to validate if their identifier is present in the claim's string or array values. The entry clarifies that `aud` differs from OAuth Client ID and provides an example of using it to distinguish between access and refresh tokens. → stackoverflow.com |
| 2023-05-21 2023 | Authentication authorization and security in SharePoint beginner 4 min read AuthZ | Reference document detailing SharePoint's robust authentication and authorization framework. It covers role-based security management at website, list, folder, and item levels, supporting unique permissions. SharePoint integrates with external systems like Windows authentication (Kerberos, NTLM) and ASP.NET Forms-based authentication, enabling claims-based identity for cross-platform compatibility and single sign-on. The system leverages membership and role providers, with custom authentication relying on a security token service to generate user tokens based on validated credentials and group memberships. |
| 2023-05-09 2023 | Seven Common Ways To Bypass Login Page intermediate AuthZ | Seven Common Ways To Bypass Login Page https://ift.tt/8PI0ers |
| 2023-04-13 2023 | OWASP Proactive Controls 2023/2024 v1 beginner API Sec AuthZ | OWASP Proactive Controls 2023/2024 v1 https://ift.tt/xVAnFY5 → docs.google.com |
| 2023-04-10 2023 | How to Implement OAuth 2.0 Login for Python Flask Web Server Applications intermediate 4 min read API Sec Python | Walkthrough of implementing OAuth 2.0 single sign-on for Python Flask web applications using Google. This guide details enabling Google APIs, creating OAuth Client IDs, securely storing credentials, and configuring Flask with libraries like `Flask-OAuthlib` and `oauthlib`. It covers setting up redirect URIs, environment variables for `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`, and essential Flask application code for handling the Google login flow and user information retrieval. |
| 2023-04-05 2023 | OAuth 2.0 beginner 4 min read API Sec | Library documentation for OAuth 2.0 within the Google APIs Client Library for Python. It details acquiring client IDs, secrets, and utilizing the `google-auth-oauthlib` library for authorization flows, including `InstalledAppFlow` for local applications. The entry outlines the purpose of `Flow` classes in obtaining credentials, handling browser redirects, exchanging authorization codes for `Credentials` objects, and applying these credentials to API calls. It also mentions `google-auth` for credentials management and service account usage. |
| 2022-05-17 2022 | Favorite tweet by @nillkitty beginner | Favorite tweet: What's all this Kerberos nonsense that happens (or doesn't) when you type your password into Windows? https://t.co/sPI2DIbWU7 — Nill (@nillkitty) May 17, 2022 |
| 2021-12-25 2021 | Social Sign-in beginner | Social Sign-in |
| 2021-12-05 2021 | EthPress Web3 Login beginner 8 min read | Plugin that enables cryptocurrency wallet logins for WordPress, supporting MetaMask and WalletConnect for EVM-compatible blockchains. It creates standard user accounts and can restrict access to WooCommerce products, pages, and posts based on NFT ownership (ERC-721, ERC-1155) via the EthPress NFT Access Add-On. The plugin includes local signature verification and provides hooks for custom logic. |
| 2021-11-23 2021 | Hacking OAuth Applications intermediate 3 min read API Sec | Talk on "Hacking OAuth Applications" details common vulnerabilities within the OAuth 2.0 authorization framework. It highlights attacks exploiting the `state` parameter, redirect URI manipulation (including localhost and parameter pollution), and host header injection to steal access tokens or authorization codes. The talk also covers bypassing email verification for account impersonation and issues arising from improper session management post-logout. |
| 2021-11-03 2021 | Introducing CookieMonster: a tool for breaking stateless authentication intermediate 4 min read JWT | Tool for detecting and breaking stateless authentication in web applications. CookieMonster, written in Go, supports JWTs and session cookies from frameworks like Django, Flask, and Laravel. It can be used via its API in automation pipelines or its CLI for manual testing, and it offers a -resign option to modify cookie contents after unsigning. The tool is designed for high performance, enabling real-time scanning of thousands of requests per second. |
| 2021-10-25 2021 | What can I do with Open Redirect with OAuth? intermediate 2 min read | Technique detailing how open redirects in OAuth services or integrated applications can be exploited. The technique illustrates two scenarios: an open redirect in the OAuth service's `redirect_uri` parameter, allowing an attacker to capture the access token directly, and an open redirect within the company's application that is used in the `redirect_uri`, leading to a chained redirect to an attacker-controlled domain. The writeup provides a specific example involving a `TARGET` parameter for redirection. |
| 2021-10-14 2021 | These are the security issues with JWT beginner 4 min read JWT | Writeup on JWT security issues, detailing limitations like the inability to revoke tokens after issuance, leading to potential persistent access even after server-side permission changes. It highlights risks associated with client-side storage, such as XSS vulnerabilities when using localStorage or unprotected cookies, and discusses OWASP's recommendations for hardened cookies and CSRF countermeasures. The writeup emphasizes that JWTs are best suited for stateless applications and can be problematic for features requiring immediate logouts or dynamic permission adjustments. |
| 2021-10-10 2021 | New CS proposal: Avoiding password and sensitive shared data transmission #685 intermediate 2 min read Secrets | Cheat Sheet proposal detailing how to avoid transmitting passwords and sensitive shared data. This concept leverages HMAC to authenticate users without ever sending passwords to the server, mitigating transmission-based attacks. The objective is to educate developers that passwords need not leave the user's device for server-side validation, except for initial password generation. Related to transmission and server-side processing, this proposal complements existing password storage guidance and draws inspiration from IETF RFC 2104. |
| 2021-09-13 2021 | The Wonderful World of Tokens and Claims: CWT beginner JWT | The Wonderful World of Tokens and Claims: CWT |
| 2021-09-12 2021 | draft-ietf-oauth-rar-07 beginner 22 min read | Internet-Draft detailing OAuth 2.0 Rich Authorization Requests, introducing the `authorization_details` parameter. This parameter allows OAuth clients to specify fine-grained authorization requirements using JSON data structures, moving beyond the static and coarse-grained scope parameter. It supports requests for specific actions, datatypes, locations, identifiers, and privileges, enabling more precise consent for use cases like payment initiation and granular data access, as illustrated with examples for `payment_initiation` and `account_information` types. |
| 2021-09-07 2021 | CISA adds single-factor authentication to its catalog of 'Bad Practices' news 1 min read | Catalog entry detailing CISA's addition of single-factor authentication to its "Bad Practices" list. This entry highlights the inadequacy of single-factor authentication for remote or administrative access, contrasting it with CISA's recommended multi-factor authentication approach. The catalog also includes practices like using unsupported software and default credentials, and is open to community submissions for additional detrimental configurations. |
| 2021-07-19 2021 | Where to Store the JSON Web Token (JWT)? intermediate JWT | Storing JSON Web Tokens (JWTs) securely is crucial for application security. Common storage locations include HTTP-only cookies and browser local storage. HTTP-only cookies offer better protection against Cross-Site Scripting (XSS) attacks, as JavaScript cannot access them. Local storage, while convenient for client-side applications, is more vulnerable to XSS. Other options like session storage (cleared on tab close) and memory storage (lost on refresh) have their own trade-offs. The choice depends on the application's security requirements and the specific threat model. |
| 2021-06-21 2021 | OAuth 2.0 Token Binding intermediate API Sec | OAuth 2.0 Token Binding enhances security by binding access tokens to the transport layer security (TLS) connection. This prevents tokens from being reused if intercepted, mitigating risks like token theft and replay attacks. By ensuring a token can only be used with the specific TLS session it was issued for, it strengthens the overall security posture of OAuth 2.0 deployments. This mechanism provides a crucial layer of defense against various attack vectors targeting token authentication. |
| 2021-05-24 2021 | Understanding SAML beginner 10 min read | Reference detailing SAML concepts, focusing on federated identity for web-based authentication. It explains the roles of Service Providers (SP) and Identity Providers (IdP), the SAML request and response mechanisms, and the asynchronous, browser-brokered authentication flow. The entry highlights key configuration elements like certificates and endpoints, and mentions the utility of open-source SAML toolkits for implementation, especially for ISVs supporting multiple IdPs. |
| 2021-05-14 2021 | The Right Way To Hash a Password or Create an Encryption Key: PBKDF2 bcrypt and scrypt beginner | This content discusses secure password hashing and encryption key generation using PBKDF2, bcrypt, and scrypt. These methods are designed to be computationally intensive, making brute-force attacks significantly harder. The article likely explains the strengths and weaknesses of each algorithm, guiding readers on choosing the most appropriate one for their security needs. The primary focus is on preventing unauthorized access by properly hashing sensitive data. |
| 2021-05-14 2021 | Creating an Authentication API with GolangUsing Gin & Nrok intermediate API Sec | This content likely details how to build an authentication API using Golang, the Gin web framework, and Nrok for local testing and exposure. It probably covers fundamental aspects of authentication API development, such as user registration, login, and potentially token management. The focus would be on practical implementation steps, demonstrating how to combine these technologies to create a functional and secure authentication system. |
| 2021-05-10 2021 | Kerberos Authentication and Kerberoasting Explained! intermediate | This content explains Kerberos authentication, a network authentication protocol widely used in Windows environments. It also details "Kerberoasting," a common cyberattack that exploits Kerberos. Attackers target Kerberos service accounts by requesting service tickets for accounts that are not human users but instead are service accounts. By then attempting to crack the password hashes of these service tickets offline, attackers can gain credentials for powerful service accounts, leading to potential system compromise. |