auth-bypass

Identify authentication bypass weaknesses in protected web application endpoints.

54|5|Updated May 9, 2026

Search Tags:#authentication #jwt #access control #web security #api testing #bypass #bug bounty

Ready to run

npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill auth-bypass-jinyimeng01

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-bypass
Source: https://github.com/jinyimeng01/mastermind-bug-bounty/tree/main/skills/auth_bypass
Command: npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill auth-bypass-jinyimeng01

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security professionals identify and assess authentication and access-control bypass weaknesses across web applications and APIs by providing structured testing strategies.

Core Features & Use Cases

Bypass Technique Coverage: Covers path manipulation, HTTP method switching, header-based bypasses, protocol downgrade scenarios, and middleware-specific access-control testing.
Attack Surface Analysis: Provides payload categories and validation approaches for API authentication, JWT handling, CDN/WAF behavior, and response comparison analysis.
Use Case: A bug bounty researcher can use this Skill to systematically investigate whether protected endpoints expose unintended access through alternate paths, headers, or request variations.

Quick Start

Use the auth-bypass skill to analyze a protected endpoint and identify potential authentication bypass test cases for an authorized security assessment.

Frequently Asked Questions about auth-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for authentication bypass vulnerabilities in protected web endpoints?▼

Authentication bypass testing identifies access-control weaknesses in protected endpoints by applying structured methodologies covering HTTP variations, header manipulation, and path manipulation for authorized security assessments.

What techniques are used to bypass JWT authentication and API access control?▼

JWT authentication bypass and API access control testing involve payload category analysis, token manipulation, and response comparison verification to detect unintended access paths in web applications.

How does HTTP header manipulation expose access control bypass paths?▼

HTTP header manipulation exposes access control bypass paths by altering request headers to trigger middleware-specific access-control failures, protocol downgrades, and CDN or WAF behavior discrepancies.

Can I use this approach for bug bounty assessments and API security reviews?▼

Yes, this bypass testing methodology applies directly to bug bounty assessments, API security reviews, and penetration testing workflows to systematically investigate protected endpoints for authorization validation flaws.

What is the best way to analyze response-based verification for authorization bypass?▼

Response-based verification for authorization bypass requires comparing server responses across alternate request paths, HTTP methods, and manipulated headers to confirm unintended access to protected resources.