skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-ato

Tests eleven account takeover paths across password reset, OAuth, JWT, and session flows.

Updated Sep 6, 2026
Search Tags:#oauth#jwt#penetration testing#bug bounty#password reset#account takeover#host header injection
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-ato-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ato
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-ato
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-ato-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Bug bounty hunters and penetration testers need a systematic taxonomy to find account takeover (ATO) vulnerabilities, which are a destination class spanning many primitives rather than a single bug. This Skill enumerates 11 distinct ATO paths with concrete payloads, validation steps, and severity gates so testers can demonstrate real takeover of a second test account. ## Core Features & Use Cases - Password Reset Attack Paths: Covers Host-header poisoning, Referer token leaks, predictable token brute-forcing with ffuf, and token expiry/reuse/cross-account flaws. - Identity & Session Primitives: Tests email change without re-auth, JWT manipulation (alg:none, RS256-to-HS256 confusion, kid injection, weak-secret cracking with hashcat), session fixation, and password change without step-up. - OAuth & SSO Chains: Exploits lax redirect_uri validation combined with dangling-CNAME subdomain takeover to steal authorization codes, plus pre-account and magic-link takeover paths. - Use Case: During a bug bounty engagement, you find a password-change endpoint that accepts a new password with no current-password challenge. Chain it with a stolen cookie to set a new password on test account B, then validate full ATO from a clean browser to justify Critical severity. ## Quick Start Use the hunt-ato skill to test the target's password reset and email change flows for account takeover paths against my two test accounts.

Frequently Asked Questions about hunt-ato

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for account takeover via password reset poisoning?▼

Send the forgot-password request with a swapped Host or X-Forwarded-Host header pointing to a Burp Collaborator domain you control. Confirm by reading the actual reset email that lands at your host, since many apps reflect the header but pin the real link domain server-side.

How to exploit JWT algorithm confusion for account takeover?▼

Fetch the server's public key from the JWKS endpoint, convert it to PEM, and re-sign a forged token using HS256 with that public key as the HMAC secret. Validate by reaching a privileged endpoint as the victim identity, since decoding alone is not impact.

What makes an account takeover finding Critical severity?▼

Critical ATO requires zero or low victim interaction, such as Host-header reset poisoning, JWT forgery to a victim endpoint, or auth-code theft via lax redirect_uri. Paths needing a click drop to High, and phishing-dependent chains rate Medium.

Why was my password reset rate-limit report rejected?▼

A rate-limit-only finding on the forgot-password endpoint is routinely rejected because the impact is request flooding, not token compromise. You must demonstrate actual token guessing, such as brute-forcing a 6-digit numeric reset code, to show account takeover impact.

Can subdomain takeover lead to OAuth account takeover?▼

Yes, when the OAuth provider accepts wildcard subdomain redirect_uri values and a dangling CNAME exists on an enumerated subdomain. Claim the deprovisioned host, serve a callback that logs the authorization code, and exchange the captured code for the victim's token.

Related Skills

Explore More Software Engineering Skills→
marcboggsmarcboggs

hunt-ato

Tests nine account takeover paths including password reset flaws, OAuth misconfigurations, and MFA bypass chains.

Community
Intermediate
Wyl-cmdWyl-cmd
6

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.

Community
Intermediate
sixscripts-aisixscripts-ai

SQL Injection Testing

Identify and demonstrate SQL injection vulnerabilities across MySQL, MSSQL, PostgreSQL, and Oracle.

Community
Advanced
dallaydallay
53

cursor-skill

Automate cursor movement, clicks, and drags at absolute coordinates.

Official
Basic