Insecure Login Logout Password Recovery

1. Insecure Login: -
1. Check the source of the login page.
2. Passwords can be hardcoded.
3. If not, then there could be a client side function for validating passwords.
4. These functions could be written in javascript.
5. We can execute these functions with the help of scratchpad available in the firefox browser. Need to modify that function a bit to get an output.
6. Bruteforce - create a dictionary with “ cewl ” tool.
2.  Insecure Logout: -
1. Back button browsing after logout. ( Sometime application sends login page while logout, does not log out people)
2. Check all cookies, have they expired or not?
3. Password recovery: - 
1. Asking email -
1. Sometimes applications print the password on page once email ID is given.
2. Mailinator.com is an online application, go there and enter the email ID name like: -
1. Suppose you used email - varun111@mailinator.com at password recovery email field.
2. Go to mailinator.com, use varun111 email box and there you check the password.
3. Sometimes link is also visible in the “varun111” emailbox,  instead of password