Authentication Surface Mapping

Map every authentication mechanism the target exposes. Exploit downstream needs to know exactly how to hold a session (cookie, JWT, API key) and where to attack auth (token theft, race-condition on bcrypt, SSO redirect chain).

1. Login Endpoint Discovery

# Common auth paths
for path in login signin auth authenticate oauth/authorize \
    api/auth api/login admin/login wp-login.php; do
    code=$(curl -s -o /dev/null -w "%{http_code}" "https://<target>/$path")
    [ "$code" != "404" ] && echo "$code https://<target>/$path"
done

2. Auth Mechanism Identification

3. Output for Handoff

Record per mechanism: endpoint, success/fail signals (status code, cookie set, JSON shape), credentials used, observed latency. This feeds the Required session state line in the recon → exploit handoff.