Manually Breaking Authentication — A Full Walkthrough (CWE-307, CWE-330, CWE-640)

A fully manual security assessment of three broken-authentication bugs — no scanners, just a proxy-backed browser and raw HTTP evidence, mapped end-to-end to CWE and OWASP.

Automated scanners are great at pattern-matching known vulnerability classes. They're much weaker at authentication flaws that look completely legitimate at the HTTP level — a 200, a 401, a token — and only become a bug once you understand how the value was generated. This walkthrough is a fully manual assessment of three such bugs in a deliberately vulnerable login system, captured start to finish with nothing but a proxy-backed browser and a network tab.

The bugs

Bug

Manually Breaking Authentication — A Full Walkthrough (CWE-307, CWE-330, CWE-640)

Related reading

Hardening my own Nmap web UI: the security holes I shipped, and what actually…

Manually Proving and Documenting an IDOR (CWE-639) — A Full Walkthrough

4 Security Bugs I Found in My Own Auth System (And How I Fixed Them)

The Pentester’s Guide to Finding CBC Bit Flipping Vulnerabilities

Learning OWASP A01 and A02: Broken Access Control and Security Misconfiguration

From CVE Matching to Exploit Validation: How Vulnerability Scanners Are Evolving