SKILL.md
Authentication Testing (FIND/EXPLOIT — OWASP A07)
Overview
Break "are you who you say you are?" Account takeover (ATO) is the crown-jewel attack — one auth flaw often unlocks everything. Test the whole identity lifecycle, not just the login form.
Core principle: Auth is a flow, not a page. Bugs live in reset, refresh, federation, and state transitions — not just the password check.
Applies when / Skip when
- Applies when: the app has any identity mechanism — login, sessions, accounts, tokens/JWT,
OAuth/SSO, password reset, or MFA.
- Skip when: the app is entirely anonymous with no authentication → N/A.
- If N/A: report "authentication-testing: N/A — no authentication surface" and stop.
⚠️ Authorization
Use your own accounts/app. Do not credential-stuff real users or third parties. Brute-force only your own test accounts, throttled.
Surfaces to test (the whole lifecycle)
- Registration — username/email enumeration, weak password policy, duplicate/normalization.
- Login — rate limiting, lockout, error-message enumeration, default creds.
- Session — token entropy, fixation (rotate on login?), invalidation on logout/reset, cookie flags.
- Password reset — token entropy/expiry/reuse, host-header poisoning of reset links, user-id swap.
- MFA/2FA — bypass via flow skip, response tampering, backup-code abuse, OTP brute/rate, race.
- OAuth/OIDC/SAML/SSO —
redirect_urivalidation,state/CSRF, token leakage, SAML signature. - JWT —
alg:none, algorithm confusion, weak secret, signature not verified, no expiry/revocation.
See references/auth-attacks.md for concrete recipes per surface.
Quick reference — high-value bugs
| Bug | Test | Impact |
|---|---|---|
| User enumeration | Different response/timing for valid vs invalid user | Targeted attacks |
| No rate limit | Many login/OTP attempts succeed | Brute-force / ATO |
| Session fixation | Session id unchanged after login | Hijack |
| Reset poisoning | Host/X-Forwarded-Host controls reset link domain |
ATO via stolen token |
| Reset id swap | Reset for victim using your token/flow | ATO |
| MFA bypass | Skip step / tamper "mfa":false / reuse code |
ATO past 2FA |
| OAuth open redirect | redirect_uri to attacker domain leaks code/token |
ATO |
| JWT forgery | alg:none / HS-RS confusion / weak secret accepted |
Full impersonation |
Output
Findings with the exact flow and request, which lifecycle stage, and whether it yields ATO. Note chains (e.g. enumeration + no-rate-limit + weak reset = full ATO) for vulnerability-chaining.
Hand-off
Reproduce on the running app via active-pentest; combine into ATO chains in vulnerability-chaining; fix via security-hardening (bcrypt/argon2, CSPRNG tokens, session rotation, strict redirect_uri, verified JWT signatures, rate limits + MFA).
Common mistakes
- Testing only the login box — reset and federation flows are softer and just as fatal.
- Decoding a JWT and assuming it's verified — prove the signature is checked (tamper it).
- Treating MFA as unbreakable — most bypasses are logic flaws in the flow, not the crypto.
- Ignoring timing/error differences that quietly enable user enumeration.