skills.rest
devtint
devtintCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

auth-testing

Test API authentication for OAuth 2.0, API keys, sessions, and MFA bypasses.

Updated Feb 23, 2026
Search Tags:#authentication#penetration testing#session management#mfa#api security#oauth2
One-click install
npx skills add https://github.com/devtint/API_PENTEST --skill auth-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-testing
Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/auth-testing
Command: npx skills add https://github.com/devtint/API_PENTEST --skill auth-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, hashlib, urllib3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill systematically tests API authentication mechanisms for weaknesses, protecting against unauthorized access and data breaches.

Core Features & Use Cases

  • Comprehensive Auth Testing: Covers OAuth 2.0, API keys, session management, and MFA.
  • Vulnerability Identification: Detects issues like weak credential handling, session fixation, and MFA bypasses.
  • Use Case: Before deploying a new API, use this Skill to ensure that all login flows, token refreshes, and multi-factor authentication steps are robust and cannot be easily bypassed.

Quick Start

Use the auth-testing skill to test the login endpoint '/api/login' for default credentials.

Frequently Asked Questions about auth-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test my API for broken authentication vulnerabilities?▼

Testing for broken authentication involves validating OAuth 2.0 flows, API keys, session management, and MFA bypasses to identify credential stuffing and session fixation. You need valid test credentials and target API network access.

Can I detect multi-factor authentication bypasses in my login flows?▼

Yes, you can detect multi-factor authentication bypasses by systematically testing login endpoints and token refreshes. This identifies insecure password reset mechanisms and validates that MFA steps cannot be easily bypassed.

How do I check OAuth 2.0 flows for session fixation issues?▼

You can check OAuth 2.0 flows by systematically testing session management mechanisms for weaknesses. This identifies session fixation vulnerabilities and ensures token refreshes remain robust against unauthorized access.

Does API security testing require valid test credentials for the target?▼

Yes, API security testing requires valid test credentials and network access to the target API. This allows comprehensive evaluation of authentication mechanisms including API key security and password reset functionality.

What is the best way to secure API authentication against the OWASP API2 category?▼

The best way to secure API authentication against OWASP API2 is to comprehensively test all login flows. This identifies weak credential handling, session fixation, and MFA bypasses before deploying a new API.

Related Skills

Explore More Software Engineering Skills→
heximaoheximao

aws-wechat-article-publish

Create, schedule, and publish WeChat articles via the official WeChat API.

Community
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-ato

Analyze password reset flaws, MFA bypass, and session fixation for account takeover vulnerabilities.

Community
Advanced
Adam-GuerinAdam-Guerin
1

web-security-testing

Automate web application security testing against OWASP Top 10 vulnerabilities.

Community
Advanced
aquariuscookaquariuscook

security-testing

Identify OWASP Top 10 vulnerabilities using SAST, DAST, and dependency scanning.

Community
Advanced