In addition to the subpages here, you should look into the following topics for attacking authentication methods:
Loose comparisons
Last updated 4 years ago