Almost every web application on the internet requires an authentication mechanism to let their customers log in. Once a user is authenticated, he or she can perform any action with a particular role assigned (Access controls). These actions can vary from posting a comment on social media to handling an entire corporate enterprise and thereby results in the demand of a robust authentication mechanism with solid access control systems. The mechanism cannot be same for different businesses, the type of authentication is directly linked to the business logic. However, when developers design custom authentication systems, incorporating features like rate limiting, password resets, new user registration, and logins, the promise of ironclad security is not always fulfilled. This paper emphasizes on attacking single factor authentication systems (form based) which are designed on the idea of ‘flaws in design of authentication mechanisms’ to resist attacks against them. No system is secure if the most common software development practices are not followed, no matter how cutting-edge a website's tech stack may be, adherence to fundamental software development best practices is paramount for security. A compelling case study demonstrates how the implementation of a rate-limiting mechanism, designed with both user experience and security in mind, can inadvertently lead to full account takeovers through phishing attacks. As we dissect various attack vectors, from creating custom captchas to exploiting flawed authentication functions, this paper sheds light on the critical importance of robust authentication systems in an ever-evolving digital landscape.