skills.rest
vigolium
vigoliumOFFICIAL
Explore all skills by this author →
Website𝕏@VigoliumGitHub

escalate-auth-bypass

Escalate suspected authentication bypasses into proven admin access, session takeover, or cross-tenant impact findings.

1.1k|155|Updated Mar 8, 2026
Search Tags:#penetration testing#JWT#Authorization#authentication bypass#cwe-287#Privilege escalation#session takeover
One-click install
npx skills add https://github.com/vigolium/vigolium --skill escalate-auth-bypass
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: escalate-auth-bypass
Source: https://github.com/vigolium/vigolium/tree/main/internal/resources/olium/skills/escalate-auth-bypass
Command: npx skills add https://github.com/vigolium/vigolium --skill escalate-auth-bypass

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security testers often find a suspected authentication or authorization weakness but stop at reporting "missing auth check" without demonstrating real impact. This Skill walks you from a suspected auth bypass to a proven, high-impact finding — admin access, token forgery, session takeover, or cross-tenant data read — with concrete reproduction evidence.

Core Features & Use Cases

  • Weakness Classification: Identifies the exact mechanism to attack — missing route auth, weak JWT verification (alg:none, key confusion, weak HMAC secrets), predictable session IDs, or client-controllable privilege fields.
  • Impact Confirmation: Distinguishes a suspicious 200 response from a proven boundary crossing by requiring privileged data exposure or a successful privileged action as proof.
  • Finding Persistence: Records a severity-rated finding (critical/high) with the correct CWE mapping (CWE-287, CWE-863, CWE-639, CWE-345, CWE-347) and an unambiguous reproduction description.
  • Use Case: During an authorized web application assessment, you notice an admin endpoint returns 200 without a session cookie. Use this Skill to confirm the bypass, forge a minimal proof request, map the blast radius, and file a triaged finding.

Quick Start

Use the escalate-auth-bypass skill to turn the suspected JWT verification weakness on this target into a proven admin-access finding.

Frequently Asked Questions about escalate-auth-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prove an authentication bypass instead of just reporting a missing auth check?▼

Confirm the bypass by showing the response contains data the original role could not access, or that a privileged action succeeds. Send the smallest privileged request that proves the boundary was crossed, then record it as the canonical proof in the finding.

How to test a JWT for weak signature verification?▼

Decode the token and inspect alg, iss, aud, and custom claims. Try re-minting with alg:none and an empty signature, signing HMAC with the public key as the secret for key-confusion, or brute-forcing weak HMAC secrets like empty strings or the app name.

What CWE should an auth bypass finding use?▼

Use CWE-287 for missing authentication, CWE-863 for broken authorization checks, CWE-639 for IDOR-style user-controlled keys, CWE-345 for insufficient data verification, and CWE-347 for weak signature verification. Pick the one matching the actual mechanism.

Why does a 200 response not prove an auth bypass?▼

Some applications return 200 with an error like "unauthorized" in the JSON body, or return an empty body that proves nothing. Always read the response body and confirm it contains data or actions the original role could not access.

When should I use IDOR testing instead of auth bypass escalation?▼

If the finding is specifically reading another user's object by changing an identifier, such as an order ID, that is object-level authorization failure. Use the dedicated idor-blast-radius skill instead, since IDOR is a related but distinct pattern.

Related Skills

Explore More Software Engineering Skills→
vercel-labsvercel-labs
41.7k

derive-client

Generates standalone API clients from browser network traffic recorded in HAR files.

Official
Intermediate
Space-DinosaursSpace-Dinosaurs
12

agent-security-auditor

Identify security vulnerabilities in code changes using OWASP Top 10 and CWE patterns.

Official
Advanced
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-fix-review

Review security patches for root-cause coverage and bypass risks.

Official
Advanced
sayseven7sayseven7
11

idor-broken-object-authorization

Compare authenticated requests across users to detect IDOR, BOLA, and BFLA authorization gaps.

Community
Advanced