Hacking Passkeys: How They Work, How They Fail, How to Secure Them
Understand the mechanics, exploit implementation flaws, and learn how to secure passkey authentication.
Join our free live webinar hosted by CQURE Academy, featuring:
Paula Januszkiewicz - CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT.
Artur Kalinowski - Cybersecurity Expert, Penetration Tester.
Passkeys replace passwords and protect access to websites, applications, and enterprise services. Built on public key cryptography, they provide resistance to phishing and password theft. Accounts protected by passkeys can still be hacked when implementation mistakes undermine these protections.
This technical webinar takes you inside passkey authentication. We will explain registration and authentication ceremonies, examine WebAuthn assertions, and inspect what individual fields contain. You will understand which data is signed, how it is encoded, where encryption applies, and what the server must validate before granting access.
A central part of the webinar is the testing method itself: JavaScript monkey patching and WebAuthn API mocking. We will intercept browser credential API calls and supply responses from a simulated authenticator, allowing us to modify assertion fields and sign the resulting data with test credentials. This gives us control over the inputs needed to investigate server validation beyond simply modifying intercepted traffic in Burp Suite.
Through practical demonstrations, we will show which fields and trust assumptions to test, how implementation flaws can lead to account takeover, and how to prevent those failures.
Pentesters will learn a practical approach to testing complex authentication flows. Developers and defenders will learn which controls matter and how to verify that their passkey implementation protects the right account, under the right conditions.
Sign up to understand how passkeys work, learn how they can be attacked, and make informed decisions about using them securely.
Sign up now!