authentication
starsforks
How to install authentication?
transilienceai/communitytools/authentication
$npx -y skills add transilienceai/communitytools --skill authenticationAuthentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
SKILL.md
| 1 | # Authentication |
| 2 | |
| 3 | Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection. |
| 4 | |
| 5 | ## Techniques |
| 6 | |
| 7 | | Type | Key Vectors | |
| 8 | |------|-------------| |
| 9 | | **Auth Bypass** | Default credentials, logic flaws, response manipulation | |
| 10 | | **ADFS/SAML** | Golden SAML, token signing cert theft, assertion manipulation, SAML wrapping | |
| 11 | | **JWT** | Algorithm confusion, key injection, claim tampering, token forging | |
| 12 | | **OAuth** | Redirect manipulation, CSRF, token leakage, scope abuse | |
| 13 | | **Password** | Brute force, credential stuffing, password policy bypass | |
| 14 | | **2FA Bypass** | Response manipulation, direct endpoint access, code reuse, race conditions | |
| 15 | | **CAPTCHA Bypass** | Missing server validation, token reuse, OCR, parameter manipulation | |
| 16 | | **Bot Detection** | Behavioral biometrics simulation, fingerprint randomization, stealth mode | |
| 17 | |
| 18 | ## Tools |
| 19 | |
| 20 | **PasswordGenerator** (`tools/password_generator.py`): |
| 21 | ```python |
| 22 | from tools.password_generator import generate_password |
| 23 | password = generate_password(hint_text="8-16 chars, uppercase, numbers") |
| 24 | ``` |
| 25 | |
| 26 | **CredentialManager** (`tools/credential_manager.py`): |
| 27 | ```python |
| 28 | from tools.credential_manager import CredentialManager |
| 29 | mgr = CredentialManager() |
| 30 | mgr.store_credential(target="example.com", username="test", password="pass") |
| 31 | ``` |
| 32 | |
| 33 | ## Workflow |
| 34 | |
| 35 | 1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA) |
| 36 | 2. Test bypass vectors per technique type |
| 37 | 3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses) |
| 38 | 4. Capture evidence (screenshots, network logs, tokens) |
| 39 | 5. Document findings with PoC scripts |
| 40 | |
| 41 | ## Reference |
| 42 | |
| 43 | - `reference/authentication*.md` - Auth bypass techniques, payloads, and resources |
| 44 | - `reference/jwt*.md` - JWT attack techniques and cheat sheets |
| 45 | - `reference/oauth*.md` - OAuth vulnerability testing |
| 46 | - `reference/scenarios/password-attacks/*.md` - Password attack vectors (spray, stuffing, cracking, PtH) |
| 47 | - `reference/adfs-exploitation.md` - ADFS, Golden SAML, federation attacks |
| 48 | - `reference/scenarios/2fa/*.md` - 2FA bypass methods |
| 49 | - `reference/CAPTCHA_BYPASS.md` - 11 CAPTCHA bypass techniques |
| 50 | - `reference/BOT_DETECTION.md` - Bot detection evasion strategies |
| 51 | - `reference/PASSWORD_CREDENTIAL_MANAGEMENT.md` - Tool usage guide |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
