skills.rest
jinyimeng01
jinyimeng01COMMUNITY
Explore all skills by this author →
GitHub

bypass-agent

Identify and validate access control bypasses for protected web endpoints.

54|5|Updated May 9, 2026
Search Tags:#jwt#access control#penetration testing#api security#bug bounty#authorization bypass#http testing
One-click install
npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill bypass-agent
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bypass-agent
Source: https://github.com/jinyimeng01/mastermind-bug-bounty/tree/main/agents/bypass
Command: npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill bypass-agent

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security researchers identify and validate access control weaknesses when protected endpoints return unauthorized responses such as 401, 403, or 405.

Core Features & Use Cases

  • Access Control Testing: Guides analysis of blocked endpoints using path manipulation, HTTP method variations, header checks, and token-related validation.
  • JWT and Middleware Analysis: Supports investigation of authentication flows, server-specific behaviors, and authorization implementation weaknesses.
  • Bug Bounty Workflow Support: Helps researchers document bypassed endpoints, techniques used, returned data, and recommended follow-up actions during authorized security assessments.

Quick Start

Use the bypass agent skill to analyze a blocked API endpoint and identify potential authorization bypass techniques.

Frequently Asked Questions about bypass-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find access control bypass paths for API endpoints returning 403 errors?▼

To find access control bypass paths, test blocked endpoints using path manipulation, HTTP method variations, header validation, and token analysis to identify authorization weaknesses and validate bypass opportunities.

What techniques help bypass JWT-based authorization restrictions during penetration testing?▼

Bypassing JWT-based authorization involves analyzing middleware behavior, manipulating tokens, and switching HTTP methods to detect validation flaws and achieve authorization bypass on protected web endpoints.

Can I use this approach to test API security and document bug bounty findings?▼

Yes, you can test API security by validating bypassed endpoints, documenting techniques used, capturing returned data, and generating recommended follow-up actions for structured bug bounty reporting.

How does HTTP method switching help bypass 401 and 405 unauthorized responses?▼

HTTP method switching helps bypass 401 and 405 responses by probing middleware routing discrepancies, allowing testers to identify access control misconfigurations when standard requests are blocked.

What is the best way to safely test authorization bypass without disrupting middleware behavior?▼

Safely test authorization bypass by applying structured workflows for path manipulation and header checks, ensuring you validate discovered bypass results without modifying underlying middleware behavior.

Related Skills

Explore More Software Engineering Skills→
jinyimeng01jinyimeng01
54

auth-bypass

Identify authentication bypass weaknesses in protected web application endpoints.

Community
Advanced
riparinoriparino
1

offensive-xss

Detect and document cross-site scripting vulnerabilities across stored, reflected, DOM-based, and blind contexts.

Community
Advanced
copilot-ldcopilot-ld
1

libweb

Secure Hono HTTP APIs with JWT, CORS, and validation middleware.

Official
Intermediate
zebbernzebbern
5

auth-bypass

Test authentication bypass and access-control weaknesses across API endpoints.

Community
Advanced