⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION
Broken Auth
Broken Authentication
Weak credentials, no rate limiting, predictable sequential session tokens, no lockout policy, and session fixation vulnerabilities.
> Show hints
- [1] Login with admin/admin — no lockout after failed attempts
- [2] Session tokens are sequential: SESS_ADMIN_001, SESS_USER_002, etc.
- [3] Try guessing tokens in the session hijack panel
- [4] Run the brute force simulator — no rate limiting stops it
[1] Weak Credential Login
No lockout. No rate limiting. Weak default credentials. Plaintext comparison.
[2] Session Token Hijack
Tokens are sequential and predictable. Guess a valid token to hijack a session.
[3] Brute Force Simulator
No rate limiting or lockout. Simulates dictionary attack against admin account.