ZombieMutex

30 results · ↑ ↓ navigate · Enter open · Esc close

Back to all labs

Interactive / Mobile & backend security

What does the server actually trust?

Change an attacker-controlled field. Follow the resulting check through passkey authentication, TLS identity, or object-level API access. All requests and responses are synthetic.

Choose a request or failure

Passkey assertion

A WebAuthn relying party verifies a server-issued challenge, expected origin and RP ID, a registered credential signature, and user verification when required.

Fresh challenge, expected site, registered key, required user verification.

Synthetic request / evidence

POST /auth/passkey/verify
origin: https://zombiemutex.example
rpId: zombiemutex.example
challenge: fresh-and-single-use
credential: registered • signature valid • UV set
200 • authenticated session issued; API permissions checked separately

Ordered server / client checks

  1. 1. Challenge

    Passed

    Client → server · Relying party

    Match the one-time, unexpired challenge issued for this ceremony, then consume it atomically.

  2. 2. Origin + RP ID

    Passed

    Browser origin → server · Relying party

    Check clientDataJSON.origin against the expected origin and authData.rpIdHash against SHA-256 of the expected RP ID.

  3. 3. Credential signature

    Passed

    Authenticator → server · Relying party

    Use the stored public key for this credential ID to verify the authenticator data and client-data hash; bind that credential to the correct account.

  4. 4. User verification policy

    Passed

    Authenticator flags → policy · Relying party

    Check the UP flag and, if the ceremony requires user verification, the UV flag. Authentication is not authorization.

Trust-model limitation: A passkey signs an authentication assertion, not an API authorization decision. A zero or non-increasing signCount needs authenticator-aware risk handling, not a universal hard failure. All values, verdicts and traces are generated locally, with no real TLS handshake, WebAuthn signature verification, API request, or credential collection.

Specifications and implementation guidance

The attestation lab covers Apple App Attest and Google Play Integrity separately. These links provide the actual vendor contracts; the browser scenarios above are deliberately simplified.

Continue to App Attest / Play Integrity ↗