Web › Module 3 › Lesson 5
Lab — Auth Bypass Lab
Practice auth bypass and IDOR checks on DVWA, WebGoat, or your own local vulnerable app—authorized labs only
Opening
Break login—then fix the lesson
This lab walks through ethical authentication testing on deliberately vulnerable training apps. Set up DVWA, OWASP WebGoat, or a Docker lab you control. Never test login bypass on sites you do not own or lack written permission to assess.
1. Step 1 — Spin up an authorized target
Example: run DVWA locally with Dockerdocker run --rm -it -p 8080:80 vulnerables/web-dvwa # Browse to http://127.0.0.1:8080 # Complete setup, set security level to Low for learning
docker run --rm -it -p 8080:80 vulnerables/web-dvwa # Browse to http://127.0.0.1:8080 # Complete setup, set security level to Low for learning
2. Step 2 — Observe weak session handling
Browser DevTools — inspect cookies after loginApplication → Cookies → note session name (e.g., PHPSESSID, session) Check flags: HttpOnly? Secure? SameSite? Network tab → replay a authenticated request in curl:
Application → Cookies → note session name (e.g., PHPSESSID, session) Check flags: HttpOnly? Secure? SameSite? Network tab → replay a authenticated request in curl:
Replay session cookie (your lab only)curl -s -b "PHPSESSID=your_lab_session_id" \\ http://127.0.0.1:8080/vulnerabilities/authbypass/ \\ | head -20
curl -s -b "PHPSESSID=your_lab_session_id" \\ http://127.0.0.1:8080/vulnerabilities/authbypass/ \\ | head -20
3. Step 3 — IDOR spot check
In WebGoat or a custom API lab, log in as user A and note an object ID in a URL or JSON response. Log in as user B and attempt to fetch user A’s object by ID. Document: Did the server return 403/404, or leak data? Write one sentence on the missing authorization check.
Complete auth bypass lab
On an authorized local lab, inspect post-login cookies, replay one authenticated request with curl, and attempt one IDOR-style ID swap between two test accounts. Record what failed open vs what blocked correctly.
Knowledge Check
Ethical auth testing requires:
Multiple choice
Knowledge Check
True or False: Replaying a stolen session cookie on an authorized lab demonstrates session hijacking risk.
True or False