hunt-auth-bypass
starsforks
How to install hunt-auth-bypass?
elementalsouls/claude-bughunter/hunt-auth-bypass
$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-auth-bypassHunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control
SKILL.md
| 1 | ## Crown Jewel Targets |
| 2 | |
| 3 | Auth bypass is consistently one of the highest-paying vulnerability classes in bug bounty because it directly violates the most fundamental security control. High-value targets include: |
| 4 | |
| 5 | - **SSO/SAML implementations** at enterprise SaaS companies (Slack, Okta, OneLogin integrations) — payouts regularly in the $5K–$25K+ range |
| 6 | - **Admin panels and partner/internal portals** — subdomain-separated admin surfaces like `partners.shopify.com`, `admin.company.com` |
| 7 | - **Third-party auth plugin integrations** — WordPress plugins (OneLogin, WP-SAML-Auth), Drupal SSO modules, any CMS with pluggable auth |
| 8 | - **XMLRPC endpoints** on WordPress — often forgotten, bypasses standard WP auth flows entirely |
| 9 | - **OAuth callback flows** — state parameter mishandling, redirect_uri mismatches |
| 10 | - **API authentication layers** — especially where auth was bolted on after the fact |
| 11 | |
| 12 | **Asset priority:** Targets with federated identity (SAML, OAuth, OIDC) connected to large user populations. Partner/reseller portals are particularly juicy because they often have elevated permissions and less security scrutiny than the main product. |
| 13 | |
| 14 | --- |
| 15 | |
| 16 | ## Attack Surface Signals |
| 17 | |
| 18 | **URL patterns to hunt:** |
| 19 | ``` |
| 20 | /xmlrpc.php |
| 21 | /wp-login.php |
| 22 | /saml/ |
| 23 | /sso/ |
| 24 | /auth/saml/callback |
| 25 | /oauth/callback |
| 26 | /partners.* |
| 27 | /admin.* |
| 28 | /?wc-api= |
| 29 | /api/v*/auth |
| 30 | /login?redirect= |
| 31 | /accounts/login |
| 32 | ``` |
| 33 | |
| 34 | **Response headers signaling SSO:** |
| 35 | ``` |
| 36 | X-Frame-Options: SAMEORIGIN (common on SSO portals) |
| 37 | Set-Cookie: SAMLResponse= |
| 38 | Location: https://idp.company.com/saml |
| 39 | WWW-Authenticate: Bearer realm="partners" |
| 40 | ``` |
| 41 | |
| 42 | **JS patterns indicating federated auth:** |
| 43 | ```javascript |
| 44 | // Look for in page source |
| 45 | samlRequest |
| 46 | RelayState |
| 47 | SAMLResponse |
| 48 | onelogin |
| 49 | shibboleth |
| 50 | okta |
| 51 | passport.js authenticate |
| 52 | ``` |
| 53 | |
| 54 | **Tech stack signals:** |
| 55 | - WordPress + any SSO plugin → check XMLRPC separately |
| 56 | - Shopify Partner API exposure → cross-tenant privilege escalation risk |
| 57 | - Any app advertising "SSO enabled" or "Login with [Enterprise IdP]" |
| 58 | - Separate subdomains for admin/partner that share session cookies with main domain |
| 59 | - Applications using `SimpleSAMLphp`, `ruby-saml`, `python-saml` |
| 60 | |
| 61 | **Burp passive scan triggers:** |
| 62 | - `SAMLResponse` in any POST body |
| 63 | - `openid_connect` or `id_token` in responses |
| 64 | - Cookie domains set to `.company.com` (wildcard) |
| 65 | |
| 66 | --- |
| 67 | |
| 68 | ## Step-by-Step Hunting Methodology |
| 69 | |
| 70 | 1. **Map all authentication entry points** |
| 71 | - spider the target for every login surface: main login, admin login, API login, partner portal, mobile API endpoints |
| 72 | - check `robots.txt`, JS files, and the wayback machine for forgotten endpoints like `/xmlrpc.php` |
| 73 | |
| 74 | 2. **Identify the auth mechanism per entry point** |
| 75 | - Is it forms-based, SAML, OAuth, API key, session token? |
| 76 | - For WordPress: always probe `/xmlrpc.php` even if the main login is SSO-protected |
| 77 | |
| 78 | 3. **Test XMLRPC independently of SSO** |
| 79 | - If site uses SSO (e.g., OneLogin), manually POST to `/xmlrpc.php` |
| 80 | - XMLRPC uses WordPress-native credentials, not SSO — test with `system.listMethods` first, then `wp.getUsersBlogs` |
| 81 | |
| 82 | 4. **Enumerate SAML implementation** |
| 83 | - Capture a valid SAMLResponse via Burp |
| 84 | - Decode the Base64 payload, inspect the XML |
| 85 | - Test signature stripping, comment injection, and XML wrapping attacks |
| 86 | - Test if SP validates the signature at all (send unsigned assertion) |
| 87 | |
| 88 | 5. **Test cross-portal session/token reuse** |
| 89 | - Log into `partners.shopify.com` type portals |
| 90 | - Attempt to use the issued token/cookie against the main admin portal |
| 91 | - Look for shared cookie domains, shared JWT secrets, or API tokens that work across contexts |
| 92 | |
| 93 | 6. **Fuzz auth parameters** |
| 94 | - Null/empty passwords, `password[]=array`, SQL in username field |
| 95 | - Try `admin`/`admin`, `test`/`test` on staging subdomains |
| 96 | - Modify `role`, `is_admin`, `user_type` in JWTs (none algorithm, weak secret) |
| 97 | |
| 98 | 7. **Check redirect and state parameters** |
| 99 | - Does remov |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
