Authentication Vulnerabilities

Recursos cross-platform para Authentication Vulnerabilities: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar Authentication Vulnerabilities de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 33 retos en 3 plataformas — 4 HackTheBox · 27 PortSwigger · 2 TryHackMe. 4 con writeup en español, 4 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — 2FA bypass using a brute-force attack (Apprentice) · 🇬🇧
2. PortSwigger — 2FA simple bypass (Apprentice) · 🇬🇧
3. PortSwigger — Authentication bypass via information disclosure (Apprentice) · 🇬🇧
4. PortSwigger — Authentication bypass via OAuth implicit flow (Apprentice) · 🇬🇧
5. PortSwigger — Broken brute-force protection, multiple credentials per request (Apprentice) · 🇬🇧
6. PortSwigger — Host header authentication bypass (Apprentice) · 🇬🇧

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/authentication

​

Máquinas HTB que practican Authentication Vulnerabilities (4)

Máquina	SO	Dificultad	Writeup
Cache	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Epsilon	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Helpline	Windows	HARD	🇪🇸 🇬🇧 📹
NodeBlog	Linux	EASY	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican Authentication Vulnerabilities (27)

Lab	Dificultad	Topic	Oficial
2FA bypass using a brute-force attack	APPRENTICE	Authentication Vulnerabilities	Abrir
2FA simple bypass	APPRENTICE	Authentication Vulnerabilities	Abrir
Authentication bypass via information disclosure	APPRENTICE	Information Disclosure	Abrir
Authentication bypass via OAuth implicit flow	APPRENTICE	OAuth Authentication	Abrir
Broken brute-force protection, multiple credentials per request	APPRENTICE	Authentication Vulnerabilities	Abrir
Host header authentication bypass	APPRENTICE	HTTP Host Header Attacks	Abrir
JWT authentication bypass via algorithm confusion	APPRENTICE	JWT (JSON Web Tokens)	Abrir
JWT authentication bypass via algorithm confusion with no exposed key	APPRENTICE	JWT (JSON Web Tokens)	Abrir
JWT authentication bypass via flawed signature verification	APPRENTICE	JWT (JSON Web Tokens)	Abrir
JWT authentication bypass via unverified signature	APPRENTICE	JWT (JSON Web Tokens)	Abrir
Password reset broken logic	APPRENTICE	Authentication Vulnerabilities	Abrir
Username enumeration via different responses	APPRENTICE	Authentication Vulnerabilities	Abrir
2FA broken logic	PRACTITIONER	Authentication Vulnerabilities	Abrir
Authentication bypass via encryption oracle	PRACTITIONER	Business Logic Vulnerabilities	Abrir
Authentication bypass via flawed state machine	PRACTITIONER	Business Logic Vulnerabilities	Abrir
Broken brute-force protection, IP block	PRACTITIONER	Authentication Vulnerabilities	Abrir
Brute-forcing a stay-logged-in cookie	PRACTITIONER	Authentication Vulnerabilities	Abrir
JWT authentication bypass via jku header injection	PRACTITIONER	JWT (JSON Web Tokens)	Abrir
JWT authentication bypass via jwk header injection	PRACTITIONER	JWT (JSON Web Tokens)	Abrir
JWT authentication bypass via kid header path traversal	PRACTITIONER	JWT (JSON Web Tokens)	Abrir
JWT authentication bypass via weak signing key	PRACTITIONER	JWT (JSON Web Tokens)	Abrir
Offline password cracking	PRACTITIONER	Authentication Vulnerabilities	Abrir
Password brute-force via password change	PRACTITIONER	Authentication Vulnerabilities	Abrir
Password reset poisoning via middleware	PRACTITIONER	Authentication Vulnerabilities	Abrir
Username enumeration via account lock	PRACTITIONER	Authentication Vulnerabilities	Abrir
Username enumeration via response timing	PRACTITIONER	Authentication Vulnerabilities	Abrir
Username enumeration via subtly different responses	PRACTITIONER	Authentication Vulnerabilities	Abrir

​

Rooms TryHackMe que practican Authentication Vulnerabilities (2)

Room	Dificultad	Tipo	Acceso	Oficial
Advent of Cyber 3 (2021)	EASY	Walkthrough	🟢 Free	Abrir
Authentication Bypass	EASY	Walkthrough	🔵 VIP	Abrir

---

← Volver al glosario completo

Última actualización: 2026-08-17