authentication

Name: authentication
Author: ShulkwiSEC

18stars5forks

How to install authentication?

shulkwisec/bb-huge/authentication

$npx -y skills add ShulkwiSEC/bb-huge --skill authentication

Installs into the current project.

Summary

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Files · 1

View on GitHub

SKILL.md

1	# Authentication — Complete Deep Dive
2
3	> Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads,
4	> bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
5
6	## When to Use
7	- BSCP certification prep
8	- Real-world bug bounty hunting
9	- Building exploitation chains
10	- Understanding bypass techniques
11
12	## Prerequisites
13	- Burp Suite Professional
14	- Burp Collaborator / interactsh
15	- Browser with proxy configured
16
17
18	## Workflow
19	### Phase 1: Reconnaissance
20	- Identify input vectors, parameters, and application behavior.
21	### Phase 2: Exploitation
22	- Apply standard lab payloads.
23	### Phase 3: Zero-Day Escalation
24	- Fuzz filters, bypass WAFs, and chain with other vulns.
25
26	## Lab Playbooks
27
28	### Lab 1: Username enum different responses 🟢 APPRENTICE
29	Burp Intruder with username wordlist. Check response length/content difference: `Invalid username` vs `Incorrect password`.
30	---
31
32	### Lab 2: 2FA simple bypass 🟢 APPRENTICE
33	After login, skip `/login2` (2FA page) and navigate directly to `/my-account`.
34	---
35
36	### Lab 3: Password reset broken logic 🟢 APPRENTICE
37	```http
38	POST /forgot-password?temp-forgot-password-token=TOKEN HTTP/1.1
39
40	temp-forgot-password-token=TOKEN&username=carlos&new-password-1=hacked&new-password-2=hacked
41	```
42	Change `username` to victim. Token validation doesn't check user ownership.
43	---
44
45	### Lab 4: Subtly different responses 🟡 PRACTITIONER
46	Check for trailing period: `Invalid username or password` vs `Invalid username or password.`
47	---
48
49	### Lab 5: Response timing 🟡 PRACTITIONER
50	Long password → longer response time for valid usernames (bcrypt hash computed). Use `X-Forwarded-For: 1.1.1.§1§` to bypass IP lock.
51	---
52
53	### Lab 6: Broken brute-force IP block 🟡 PRACTITIONER
54	Login with valid creds every 2 attempts to reset the IP counter. Alternate: valid→attack→valid→attack.
55	---
56
57	### Lab 7: Username enum via account lock 🟡 PRACTITIONER
58	Locked account = account exists. Send 5 attempts for each username. Locked response = valid user.
59	---
60
61	### Lab 8: 2FA broken logic 🟡 PRACTITIONER
62	```http
63	POST /login2 HTTP/1.1
64	Cookie: verify=carlos
65
66	mfa-code=§1234§
67	```
68	Change `verify` cookie to victim, brute force 4-digit MFA code.
69	---
70
71	### Lab 9: Stay-logged-in cookie crack 🟡 PRACTITIONER
72	Cookie = Base64(`username:MD5(password)`). Decode, crack MD5 hash.
73	---
74
75	### Lab 10: Offline password cracking 🟡 PRACTITIONER
76	Steal cookie via XSS → decode Base64 → crack MD5 hash offline with hashcat.
77	---
78
79	### Lab 11: Password reset poisoning middleware 🟡 PRACTITIONER
80	```http
81	POST /forgot-password HTTP/1.1
82	X-Forwarded-Host: EXPLOIT-SERVER
83
84	username=carlos
85	```
86	Reset link sent to carlos uses your host → steal reset token.
87	---
88
89	### Lab 12: Brute-force via password change 🟡 PRACTITIONER
90	Password change function reveals different errors for wrong vs correct current password. Brute force current password via this oracle.
91	---
92
93	### Lab 13: Multiple credentials per request 🔴 EXPERT
94	```json
95	{"username":"carlos","password":["123456","password","qwerty",...]}
96	```
97	Send password array — server tries all in one request, bypassing rate limiting.
98	---
99
100	### Lab 14: 2FA brute force 🔴 EXPERT
101	Macro in Burp: auto-login → auto-get 2FA page → brute force code → repeat. Set session handling rule to use macro.
102	---
103
104
105	## Blue Team Detection
106	- Monitor access logs for anomalous payloads.
107	- Implement strict input validation and parameterized queries where applicable.
108	- Create WAF rules masking generic attack patterns.
109
110	## Zero-Day Research
111	When standard technique fails:
112	1. Identify the filter/WAF
113	2. Fuzz with Burp Intruder custom wordlists
114	3. Search GitHub/Twitter for new bypasses
115	4. Chain with other vulns for escalation
116	5. Try encoding variants: URL, double-URL, unicode, hex
117
118
119	## Key Concepts
120	\| Concept \| Description \|
121	\|---------\|-------------\|
122	\| PortSwigger Vectors \| Standardized approaches to vulnerability classes. \|
123	\| Payload Encoding \| Modifying payloads to bypass basic string matching WAFs. \|
124
125
126	## Output Format
127	```
128	Vulnerability Deep-Dive Report
129	==============================
130	Target Vector: [Endpoint]
131	Bypass Technique: [Explanation of bypass]
132	Payload Used: [Payload]
133	Impact Explanation: [Impact]
134	```
135
136	## 🔵 Blue Team
137	- Deploy robust WAF rules to detect anomalies.
138	- Monitor logs for unusual access patterns.
139
140	## 🛡️ Remediation & Mitigation Strategy
141	- Input Validation: Sanitize and strictly type-check all inputs.
142	- Least Privilege: Constrain component execution bounds.
143
144
145	## 📚 Shared Resources
146	> For cross-cutting methodology applicable to all vulnerability classes, see:
147	> - [`

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

authentication

18stars5forks

View on GitHub

How to install authentication?

shulkwisec/bb-huge/authentication

$npx -y skills add ShulkwiSEC/bb-huge --skill authentication

Installs into the current project.

Summary

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Files · 1

View on GitHub

SKILL.md

1	# Authentication — Complete Deep Dive
2
3	> Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads,
4	> bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
5
6	## When to Use
7	- BSCP certification prep
8	- Real-world bug bounty hunting
9	- Building exploitation chains
10	- Understanding bypass techniques
11
12	## Prerequisites
13	- Burp Suite Professional
14	- Burp Collaborator / interactsh
15	- Browser with proxy configured
16
17
18	## Workflow
19	### Phase 1: Reconnaissance
20	- Identify input vectors, parameters, and application behavior.
21	### Phase 2: Exploitation
22	- Apply standard lab payloads.
23	### Phase 3: Zero-Day Escalation
24	- Fuzz filters, bypass WAFs, and chain with other vulns.
25
26	## Lab Playbooks
27
28	### Lab 1: Username enum different responses 🟢 APPRENTICE
29	Burp Intruder with username wordlist. Check response length/content difference: `Invalid username` vs `Incorrect password`.
30	---
31
32	### Lab 2: 2FA simple bypass 🟢 APPRENTICE
33	After login, skip `/login2` (2FA page) and navigate directly to `/my-account`.
34	---
35
36	### Lab 3: Password reset broken logic 🟢 APPRENTICE
37	```http
38	POST /forgot-password?temp-forgot-password-token=TOKEN HTTP/1.1
39
40	temp-forgot-password-token=TOKEN&username=carlos&new-password-1=hacked&new-password-2=hacked
41	```
42	Change `username` to victim. Token validation doesn't check user ownership.
43	---
44
45	### Lab 4: Subtly different responses 🟡 PRACTITIONER
46	Check for trailing period: `Invalid username or password` vs `Invalid username or password.`
47	---
48
49	### Lab 5: Response timing 🟡 PRACTITIONER
50	Long password → longer response time for valid usernames (bcrypt hash computed). Use `X-Forwarded-For: 1.1.1.§1§` to bypass IP lock.
51	---
52
53	### Lab 6: Broken brute-force IP block 🟡 PRACTITIONER
54	Login with valid creds every 2 attempts to reset the IP counter. Alternate: valid→attack→valid→attack.
55	---
56
57	### Lab 7: Username enum via account lock 🟡 PRACTITIONER
58	Locked account = account exists. Send 5 attempts for each username. Locked response = valid user.
59	---
60
61	### Lab 8: 2FA broken logic 🟡 PRACTITIONER
62	```http
63	POST /login2 HTTP/1.1
64	Cookie: verify=carlos
65
66	mfa-code=§1234§
67	```
68	Change `verify` cookie to victim, brute force 4-digit MFA code.
69	---
70
71	### Lab 9: Stay-logged-in cookie crack 🟡 PRACTITIONER
72	Cookie = Base64(`username:MD5(password)`). Decode, crack MD5 hash.
73	---
74
75	### Lab 10: Offline password cracking 🟡 PRACTITIONER
76	Steal cookie via XSS → decode Base64 → crack MD5 hash offline with hashcat.
77	---
78
79	### Lab 11: Password reset poisoning middleware 🟡 PRACTITIONER
80	```http
81	POST /forgot-password HTTP/1.1
82	X-Forwarded-Host: EXPLOIT-SERVER
83
84	username=carlos
85	```
86	Reset link sent to carlos uses your host → steal reset token.
87	---
88
89	### Lab 12: Brute-force via password change 🟡 PRACTITIONER
90	Password change function reveals different errors for wrong vs correct current password. Brute force current password via this oracle.
91	---
92
93	### Lab 13: Multiple credentials per request 🔴 EXPERT
94	```json
95	{"username":"carlos","password":["123456","password","qwerty",...]}
96	```
97	Send password array — server tries all in one request, bypassing rate limiting.
98	---
99
100	### Lab 14: 2FA brute force 🔴 EXPERT
101	Macro in Burp: auto-login → auto-get 2FA page → brute force code → repeat. Set session handling rule to use macro.
102	---
103
104
105	## Blue Team Detection
106	- Monitor access logs for anomalous payloads.
107	- Implement strict input validation and parameterized queries where applicable.
108	- Create WAF rules masking generic attack patterns.
109
110	## Zero-Day Research
111	When standard technique fails:
112	1. Identify the filter/WAF
113	2. Fuzz with Burp Intruder custom wordlists
114	3. Search GitHub/Twitter for new bypasses
115	4. Chain with other vulns for escalation
116	5. Try encoding variants: URL, double-URL, unicode, hex
117
118
119	## Key Concepts
120	\| Concept \| Description \|
121	\|---------\|-------------\|
122	\| PortSwigger Vectors \| Standardized approaches to vulnerability classes. \|
123	\| Payload Encoding \| Modifying payloads to bypass basic string matching WAFs. \|
124
125
126	## Output Format
127	```
128	Vulnerability Deep-Dive Report
129	==============================
130	Target Vector: [Endpoint]
131	Bypass Technique: [Explanation of bypass]
132	Payload Used: [Payload]
133	Impact Explanation: [Impact]
134	```
135
136	## 🔵 Blue Team
137	- Deploy robust WAF rules to detect anomalies.
138	- Monitor logs for unusual access patterns.
139
140	## 🛡️ Remediation & Mitigation Strategy
141	- Input Validation: Sanitize and strictly type-check all inputs.
142	- Least Privilege: Constrain component execution bounds.
143
144
145	## 📚 Shared Resources
146	> For cross-cutting methodology applicable to all vulnerability classes, see:
147	> - [`

People who liked this also viewed

6 picks

Type