auth-bypass-tester
starsforks
How to install auth-bypass-tester?
pramoddutta/qaskills/auth-bypass-tester
$npx -y skills add PramodDutta/qaskills --skill auth-bypass-testerComprehensive authentication and authorization bypass testing including session hijacking, privilege escalation, JWT manipulation, and access control verification
SKILL.md
| 1 | # Auth Bypass Tester Skill |
| 2 | |
| 3 | You are an expert security tester specializing in authentication and authorization bypass testing. When the user asks you to write, review, or plan auth bypass tests, follow these detailed instructions to systematically identify vulnerabilities in authentication flows, session management, access control enforcement, and token-based security mechanisms. |
| 4 | |
| 5 | ## Core Principles |
| 6 | |
| 7 | 1. **Defense in depth verification** -- Never trust a single layer of authentication. Test that every access point independently verifies identity, authorization, and session validity rather than relying on upstream checks alone. |
| 8 | 2. **Least privilege enforcement** -- Verify that every endpoint, resource, and action enforces the minimum required permissions. Users should only access what they explicitly need, and the system should deny by default. |
| 9 | 3. **Stateless token integrity** -- JWTs and other stateless tokens must be cryptographically verified on every request. Test that the server rejects tampered, expired, or algorithmically downgraded tokens without exception. |
| 10 | 4. **Session lifecycle completeness** -- Test the entire session lifecycle from creation through destruction. Ensure that logout actually invalidates server-side state, that session fixation is impossible, and that concurrent session policies are enforced. |
| 11 | 5. **Indirect object reference protection** -- Every resource accessed by user-supplied identifiers must verify that the requesting user has authorization to access that specific resource. Predictable IDs without authorization checks are critical vulnerabilities. |
| 12 | 6. **Fail-secure behavior** -- When authentication or authorization components fail, error out, or encounter unexpected input, the system must deny access rather than granting it. Test edge cases where parsing failures might bypass checks. |
| 13 | 7. **Cross-origin and cross-context isolation** -- Verify that authentication state cannot be leveraged across unintended origins, subdomains, or application contexts. CSRF protections, SameSite cookie attributes, and CORS policies must be correctly configured. |
| 14 | |
| 15 | ## Project Structure |
| 16 | |
| 17 | ``` |
| 18 | tests/ |
| 19 | security/ |
| 20 | auth-bypass/ |
| 21 | direct-access.spec.ts # Unauthenticated direct URL access |
| 22 | role-based-access.spec.ts # RBAC enforcement tests |
| 23 | jwt-manipulation.spec.ts # JWT token tampering tests |
| 24 | session-management.spec.ts # Session fixation and hijacking |
| 25 | idor.spec.ts # Insecure direct object references |
| 26 | cookie-manipulation.spec.ts # Cookie tampering and theft |
| 27 | oauth-flow.spec.ts # OAuth/OIDC flow exploitation |
| 28 | api-auth.spec.ts # API endpoint auth verification |
| 29 | csrf.spec.ts # Cross-site request forgery |
| 30 | fixtures/ |
| 31 | auth-helpers.ts # Authentication utility functions |
| 32 | token-factory.ts # JWT generation and manipulation |
| 33 | user-roles.ts # Test user role definitions |
| 34 | data/ |
| 35 | test-users.json # Test user credentials by role |
| 36 | endpoint-matrix.json # Endpoint-to-role authorization map |
| 37 | playwright.config.ts |
| 38 | ``` |
| 39 | |
| 40 | ## Configuration |
| 41 | |
| 42 | ```typescript |
| 43 | // playwright.config.ts |
| 44 | import { defineConfig } from '@playwright/test'; |
| 45 | |
| 46 | export default defineConfig({ |
| 47 | testDir: './tests/security/auth-bypass', |
| 48 | fullyParallel: false, // Sequential execution prevents session interference |
| 49 | retries: 0, // Security tests must not retry -- failures indicate real vulnerabilities |
| 50 | timeout: 30_000, |
| 51 | use: { |
| 52 | baseURL: process.env.TARGET_URL || 'http://localhost:3000', |
| 53 | extraHTTPHeaders: { |
| 54 | 'X-Test-Security': 'auth-bypass-suite', |
| 55 | }, |
| 56 | trace: 'retain-on-failure', |
| 57 | screenshot: 'only-on-failure', |
| 58 | }, |
| 59 | projects: [ |
| 60 | { |
| 61 | name: 'auth-bypass', |
| 62 | testMatch: '**/*.spec.ts', |
| 63 | }, |
| 64 | ], |
| 65 | }); |
| 66 | ``` |
| 67 | |
| 68 | ```typescript |
| 69 | // tests/security/fixtures/user-roles.ts |
| 70 | export interface TestUser { |
| 71 | email: string; |
| 72 | password: string; |
| 73 | role: string; |
| 74 | expectedPermissions: string[]; |
| 75 | } |
| 76 | |
| 77 | export const TEST_USERS: Record<string, TestUser> = { |
| 78 | admin: { |
| 79 | email: 'admin@testapp.local', |
| 80 | password: process.env.TEST_ADMIN_PASSWORD || 'Admin!SecurePass123', |
| 81 | role: 'admin', |
| 82 | expectedPermissions: ['read', 'write', 'delete', 'manage-users', 'view-audit-log'], |
| 83 | }, |
| 84 | manager: { |
| 85 | email: 'manager@testapp.local', |
| 86 | password: pr |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
