api-auth-and-jwt-abuse
starsforks
How to install api-auth-and-jwt-abuse?
shulkwisec/bb-huge/api-auth-and-jwt-abuse
$npx -y skills add ShulkwiSEC/bb-huge --skill api-auth-and-jwt-abuseAPI authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.
SKILL.md
| 1 | # SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass. |
| 4 | |
| 5 | ## 1. TOKEN TRIAGE |
| 6 | |
| 7 | Inspect: |
| 8 | |
| 9 | - `alg`, `kid`, `jku`, `x5u` |
| 10 | - role, org, tenant, scope, or privilege claims |
| 11 | - issuer and audience mismatches |
| 12 | - reuse of mobile and web tokens across products |
| 13 | |
| 14 | ## 2. QUICK ATTACK PICKS |
| 15 | |
| 16 | | Pattern | First Test | |
| 17 | |---|---| |
| 18 | | `alg:none` acceptance | unsigned token with trailing dot | |
| 19 | | RS256 confusion | switch to HS256 using public key as secret | |
| 20 | | `kid` lookup trust | path traversal or injection in `kid` | |
| 21 | | remote key fetch trust | attacker-controlled `jku` or `x5u` | |
| 22 | | weak secret | offline crack with targeted wordlists | |
| 23 | |
| 24 | ## 3. HIDDEN FIELDS AND BATCH ABUSE |
| 25 | |
| 26 | ### Mass assignment field picks |
| 27 | |
| 28 | ```text |
| 29 | role |
| 30 | isAdmin |
| 31 | admin |
| 32 | verified |
| 33 | plan |
| 34 | tier |
| 35 | permissions |
| 36 | org |
| 37 | owner |
| 38 | ``` |
| 39 | |
| 40 | ### Rate limit and batch abuse picks |
| 41 | |
| 42 | ```text |
| 43 | X-Forwarded-For: 1.2.3.4 |
| 44 | X-Real-IP: 5.6.7.8 |
| 45 | Forwarded: for=9.9.9.9 |
| 46 | ``` |
| 47 | |
| 48 | GraphQL or JSON batch abuse candidates: |
| 49 | |
| 50 | - arrays of login mutations |
| 51 | - bulk object fetches with varying IDs |
| 52 | - repeated password reset or verification calls in one request |
| 53 | |
| 54 | ## 4. RATE LIMIT BYPASS FAMILIES |
| 55 | |
| 56 | ```text |
| 57 | X-Forwarded-For |
| 58 | X-Real-IP |
| 59 | Forwarded |
| 60 | User-Agent rotation |
| 61 | Path case / slash variants |
| 62 | ``` |
| 63 | |
| 64 | ## 5. NEXT ROUTING |
| 65 | |
| 66 | - For GraphQL batching and hidden parameters: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md) |
| 67 | - For default credential and brute-force planning: [authentication bypass](../authbypass-authentication-flaws/SKILL.md) |
| 68 | - For full JWT and OAuth depth: [jwt oauth token attacks](../jwt-oauth-token-attacks/SKILL.md) |
| 69 | - For OAuth or OIDC configuration flaws in browser and SSO flows: [oauth oidc misconfiguration](../oauth-oidc-misconfiguration/SKILL.md) |
| 70 | - For credentialed browser reads and origin trust bugs: [cors cross origin misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md) |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
