hunt-ato

Name: hunt-ato
Availability: InStock
Author: entrovyx

Identify and validate account takeover vulnerabilities in OAuth, JWT, and password reset flows.

3|1|Updated Jul 2, 2026

Search Tags:#authentication #vulnerability #oauth #jwt #pentesting #ato #offsec

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-ato-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-ato
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-ato
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-ato-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the complexity of identifying and validating account takeover (ATO) vulnerabilities, which are often misidentified as simple bugs rather than critical impact chains.

Core Features & Use Cases

Taxonomy-Driven Hunting: Provides 12 distinct attack paths including password reset poisoning, JWT manipulation, and OAuth device code abuse.
Impact Validation: Guides the operator through the necessary steps to prove a critical finding by demonstrating cross-account takeover.
Use Case: When testing a password reset flow, use this skill to determine if the application is vulnerable to host-header injection or predictable token generation, and follow the validation steps to confirm a full account takeover.

Quick Start

Use the hunt-ato skill to analyze the current target for potential password reset poisoning and JWT manipulation vulnerabilities.

Frequently Asked Questions about hunt-ato

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I systematically hunt for account takeover vulnerabilities across different authentication mechanisms?▼

To systematically hunt for account takeover vulnerabilities, you follow a taxonomy of 12 distinct attack paths targeting OAuth, JWT, and password reset flows. This approach provides structured primitives to identify critical impact chains rather than misidentifying them as simple bugs.

What is the best way to validate impact when testing an account takeover path?▼

The best way to validate an account takeover path is by demonstrating a cross-account takeover scenario. You must adhere to strict validation protocols to confirm critical impact by proving you can compromise a different user's account.

How do I check if a password reset flow is vulnerable to host-header injection?▼

You check for password reset poisoning by analyzing the target's token generation and header handling. The hunting process determines if the application uses predictable tokens or accepts host-header injection to manipulate reset links.

Can I use this approach for offensive security operations targeting OAuth device code abuse?▼

Yes, you can use this for offensive security operations targeting OAuth device code abuse. It provides structured primitives to manually hunt and validate exploitation paths across diverse authentication mechanisms.

Why are account takeover vulnerabilities often misidentified as simple bugs?▼

Account takeover vulnerabilities are often misidentified as simple bugs because their critical impact is only realized through chained exploitation. Identifying them requires structured hunting across authentication mechanisms to prove full cross-account takeover.