auth_attack

What problem does it solve?

This Skill detects and demonstrates various authentication vulnerabilities in web applications, allowing security professionals to identify and address potential weaknesses.

Core Features & Use Cases

• Account Enumeration: Detects possible valid usernames by analyzing response differences.
• Password Spray: Attempts common passwords across valid accounts to bypass account lockout.
• Login Logic Bypass: Tests for SQL injection, NoSQL injection, and type juggling vulnerabilities in login forms.
• Password Reset Attack: Exploits host header injection and token prediction to bypass password reset.
• MFA/2FA Bypass: Demonstrates methods to bypass multi-factor authentication and two-factor authentication.
• Session Hijacking: Exploits session fixation and session reuse vulnerabilities.

Quick Start

Run the auth_attack skill on a target URL to scan for authentication vulnerabilities.