---
id: 2317
title: "Hacking without credentials"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/hacking-without-credentials"
published_at: "2007-07-23T08:18:00Z"
tags: ["attack-surface", "reconnaissance", "web-security", "authentication", "penetration-testing", "portswigger", "recon", "viewstate", "logic-flaws", "login-security"]
phying_url: "https://phying.com/item/2317"
lang: en
---

# Hacking without credentials

## Summary

When a web app exposes only a login form, Dafydd Stuttard lists ways in: fingerprint the stack, brute-force hidden paths, mine HTML comments, tamper with ViewState, and probe login logic flaws.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2007-07-23T08:18:00Z
- **Original:** https://portswigger.net/blog/hacking-without-credentials
- **Phying News:** https://phying.com/item/2317