hunt-ato

An account takeover vulnerability allows attackers to gain unauthorized access to user accounts. This Skill identifies and analyzes these web security flaws by evaluating 9 distinct attack paths, including password reset flaws, MFA bypass, and OAuth account-link CSRF.

You can identify account takeover attack vectors by analyzing web application authentication and recovery mechanisms. This Skill provides a comprehensive taxonomy of techniques, breaking down paths like email change without re-auth and session-fixation into specific exploitation scenarios.

Yes, you can validate account takeover demonstrations on test accounts. The Skill provides a specific validation method to safely confirm exploitation chains without affecting real users, ensuring your vulnerability analysis is accurately verified.

Yes, this Skill detects JWT manipulation and SSO subdomain takeover paths. It analyzes these specific chain primitives alongside social-recovery question abuse and password change without step-up authentication to map out comprehensive account takeover risks.

The best way to analyze OAuth account-link CSRF vulnerabilities is to break down the chain into underlying mechanisms. This Skill classifies the attack vector and explains how cookie theft and password oracles enable the broader account takeover chain.

You need to analyze password reset flaws when auditing web application authentication boundaries. This Skill maps these specific flaws as an initial account takeover path, connecting them to downstream chain primitives like session-fixation and MFA bypass.