Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes …

API Abuse Authentication says who the user is. Authorization says what that user may do. With APIs it is most often the second step where things fail.

Account Takeover The defense rests mostly on two-factor authentication — when a password leaks, the attacker is still stopped at the second factor, with the caveat that weaker f …

Credential stuffing … s never used on more than one service. Two-factor authentication matters too, because it blocks the reuse of stolen credentials. Giving every service its own pa …

Infostealer … ackers access to accounts protected by two-factor authentication.

MFA Fatigue … social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a conf …

Pass-the-Hash … raphic fingerprint — the hash. With older Windows authentication (NTLM), the password is not required to prove identity; the hash is enough. Pass-the-hash abuse …

Phishing … hnical: mail filtering, link checking, two-factor authentication that makes a stolen password unusable. Human: through training. The habit being built is to che …

Session Hijacking … they slip into a session that has already passed authentication and carry on operating the service in your name.

Spear Phishing … h another channel (a call, in person), two-factor authentication, and the rule that urgency and authority in a message are a sign to verify rather than to compl …

Token Theft Two-factor authentication does not close the book on stolen access and stolen identity — the second factor protects the login, not the record that the user pass …