Authentication Pentesting: Review the Entire Account Lifecycle

A secure login form is only one part of account security. Password recovery, email changes, remembered devices, and session termination can all change who controls an account. Review these paths together rather than declaring success after a few login attempts.

Draw the account lifecycle

For a fictional document portal, map registration, verification, sign-in, recovery, sign-out, password changes, and changes to recovery methods. Mark the points that establish identity or transfer account control. Use dedicated test accounts with inboxes controlled by the assessment team.

For each transition, ask which existing evidence of identity is required and what happens to old credentials or sessions. A sensitive change should not silently depend on a stale browser session without an appropriate verification step.

Run bounded checks

Agree on a small number of unsuccessful login attempts with the application owner. Observe throttling and monitoring without attempting large password lists or disrupting other users. Compare responses for existing and nonexistent synthetic accounts, including recovery requests, while recognizing that email delivery and background work can affect timing.

Request a reset link, complete one reset, and verify that the same link no longer works. Check expiry using the application's documented policy. Confirm that a reset cannot be applied to a different account by changing client-controlled fields.

Inspect session behavior

After signing out, try the previous session against a harmless authenticated page. It should no longer authorize access. Review whether password changes and account recovery revoke sessions according to the product's security policy.

Inspect cookies for Secure, HttpOnly, and an appropriate SameSite setting. These controls address different browser behaviors; none replaces server-side session validation or CSRF protection. Include mobile or API clients if they share the same account lifecycle.

Write findings around account control

A useful report explains the exact starting condition: an unauthenticated visitor, a stolen session, or an already authenticated user. Describe the observed transition and the account control it grants. Keep reset links, session tokens, and inbox contents out of ordinary tickets.

Retest the entire affected transition after a fix. For example, correcting password reset token reuse should not break normal recovery or leave alternate recovery routes unchecked.

The OWASP Authentication Cheat Sheet describes authentication controls and related defensive practices.