𝐋𝐨𝐠𝐢𝐧 𝐭𝐞𝐬𝐭𝐢𝐧𝐠 𝐜𝐡𝐞𝐜𝐤𝐥𝐢𝐬𝐭 :
1. Host header injection on login page
2. Session Expiration ( logout all devices )
3.Improper Session Validation
4. OAuth Bypass (google, OAuth Token Stealing)
#bugbountytip #bugbountytips

5.User enumeration
6.Bruteforce on admin panel login
7.Test for cache management on HTTP (eg Pragma, Expires, Max-age)
8.Test remember me functionality
9.Captcha bypass
10. No rate limit on login page leads to DOS
11.Fuzzing on login page.
12.Bypass admin panel restriction

13.CLRF injection on login page
14.XSS with "/login?next=javascript:alert(1);//"
15.SSRF on login page ( if page contain url function)
16.SignUp password using xss payload & after login it will execute
17.credentials on login page are in the plain text(wireshark)
18. 2FA bypass

19.Session ID Brute Forcing: Maybe sometimes it may work.
20.HTML Injection
21.CRLF injection and CORS
22.Using multiple username at a time

23.Account lockout by using bruteforce
24.Bruteforce
25.Own login resposne for victim
26.OTP bruteforce