From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Authentication bypass

Authentication bypass

From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Start my 1-month free trial Buy for my team

Authentication bypass

“

- In this lesson, we're going to discuss authentication bypass attacks. An authentication bypass attack is any attack that exploits how user logins are obtained or processed within a web application. There are many different forms of authentication bypass attacks that can be used, including spoofing, on-path or man-in-the-middle attacks, password spraying, credential stuffing and broken authentication exploits. First, we have spoofing. Spoofing is a software-based attack where an attacker attempts to assume the identity of a user, a process, an address, or other unique identifier, in order to bypass authentication mechanisms. Spoofing is extremely useful in bypassing authentication mechanisms that rely on IP addresses or MAC addresses for source validation. For example, if your wireless network uses Mac filtering as its form of authenticating users before they connect to the network, you can easily bypass this by spoofing your own MAC address to the value of another authorized user's…

Contents