Map and chain security primitives to validate account takeover vulnerabilities.
npx skills add https://github.com/pdparchitect/rook --skill hunt-ato-pdparchitect
Please help me install this Agent Skill. Skill: hunt-ato Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-ato Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-ato-pdparchitect
This skill addresses the complexity of identifying and chaining account takeover (ATO) vulnerabilities, which often involve multi-step logic flaws that are difficult to track manually.
Use the hunt-ato skill to analyze the current authentication workflow for potential account takeover chains and provide a validation plan.
High-intent search queries and answers about installing and using this skill.
To identify account takeover vulnerabilities, systematically test password reset, email change, MFA, and OAuth mechanisms to map complex attack paths and chain security primitives for critical impact validation.
An account takeover chain combines security primitives like cookie theft, password oracles, and missing step-up authentication to escalate low-impact bugs into critical account takeovers during authentication flow audits.
Yes, you can test OAuth misconfigurations and password reset poisoning by applying a structured taxonomy of nine distinct account takeover paths to systematically validate vulnerabilities in authentication workflows.
The best way to escalate low-impact authentication bugs is chain analysis, mapping complex attack paths by combining primitives like cookie theft and missing step-up authentication to demonstrate critical account takeover.
You need to audit MFA and email change mechanisms during web application security audits when testing authentication flows for privilege escalation research and validating multi-step logic flaws.
rajeshygEnforce input validation, sanitization, and secure storage rules for web applications.
EntroVyxIdentify and validate account takeover vulnerabilities in OAuth, JWT, and password reset flows.
jokken79Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.
langbyyiIdentifies high-severity business logic vulnerabilities in web applications.
