How Authentication Works

What Authentication Actually Is

Authentication answers one question: are you who you claim to be?

The three factors:

MFA combines two or more factors. Bypassing MFA means either compromising a factor or attacking the implementation — not the factor itself.

Password Hashing — Why It Matters

Passwords must never be stored in plaintext. Instead, they're put through a one-way hash function. You can't reverse a hash — but you can hash known passwords and compare.

Common Hash Algorithms

Linux Password Storage

Linux stores hashes in /etc/shadow (root-readable only). /etc/passwd contains user info but not hashes (the x means "look in shadow").

# If you have root or /etc/shadow access:
cat /etc/shadow | grep -v '!\*' | cut -d: -f1,2  # Show hashed accounts
# Copy hash to hashcat:
hashcat -m 1800 hash.txt /usr/share/wordlists/rockyou.txt  # $6$ = mode 1800

Windows Authentication — NTLM

NTLM (NT LAN Manager) is Windows' legacy authentication protocol. Still everywhere.

How NTLM works (challenge/response):

Why NTLM is weak:

• The NT hash is derived directly from the password with no salt
• The challenge/response (NetNTLMv2) can be captured over the network and cracked offline
• Pass-the-Hash: you don't need the password — the hash itself authenticates you in many configurations

Windows Authentication — Kerberos

Kerberos is the modern Windows authentication protocol, used in Active Directory environments. It's ticket-based — no password ever traverses the network.

Kerberos Flow (Simplified)

Kerberos Attack Paths

Web Authentication — Sessions and Tokens

Session Cookies

Traditional web authentication:

1. User submits username + password
2. Server validates, creates session record, generates session ID
3. Session ID sent to browser as cookie
4. Every subsequent request includes the cookie

Attacks: Session fixation, cookie theft (XSS), brute force session IDs if they're weak.

Session ID in a cookie:

JWT (JSON Web Tokens)

JWTs are self-contained tokens. No server session storage needed — the token carries the claims.

Decoded payload:

{
  "user": "admin",
  "role": "user",
  "exp": 1714000000
}

Common JWT attacks:

• Algorithm confusion — change alg: HS256 to alg: none to bypass signature verification
• Weak secret — brute force the HMAC secret (hashcat -m 16500)
• RS256 → HS256 — flip algorithm, sign with the public key as HMAC secret

# Crack JWT secret
hashcat -a 0 -m 16500 token.txt /usr/share/wordlists/rockyou.txt

OAuth 2.0 and SSO

OAuth 2.0 is an authorisation framework, not an authentication protocol — though it's commonly used for both via OIDC (OpenID Connect).

The flow (Authorization Code):

Attack surface:

• Redirect URI manipulation — steal the code by injecting an attacker-controlled redirect
• State parameter bypass — missing CSRF protection in OAuth flow
• Token leakage — access tokens in logs, URLs, Referer headers
• Open redirects — chain with redirect URI validation to exfiltrate codes

MFA — How It Works and Where It Breaks

Credential Storage — Where Passwords Hide

Operational Notes

• NTLM vs NetNTLMv2 — they sound similar but are different. NTLM hash = crackable directly, usable in Pass-the-Hash. NetNTLMv2 = network challenge/response, must be cracked before use, cannot pass-the-hash.
• bcrypt cost factor — $2b$12$ means 2^12 = 4096 iterations. Doubling the cost factor doubles crack time. $2b$10$ is more common and faster to crack.
• Credential stuffing vs brute force — stuffing uses known breached credentials against new targets. Brute force generates all combinations. Stuffing is orders of magnitude more effective in practice.

What to Read Next

• Password Attacks — put this theory into practice with Hashcat, John, and Responder
• Active Directory Enumeration — Kerberos and NTLM attacks in their natural habitat
• Web Application Analysis — session, cookie, and JWT attacks in web application context