Enumerate and validate 9+ account takeover attack paths for web applications.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-ato-uphiago
Please help me install this Agent Skill. Skill: hunt-ato Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-ato Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-ato-uphiago
This skill solves the problem of incomplete or low-severity account takeover findings during penetration tests by providing a complete taxonomy of 9+ distinct ATO attack paths, chaining guidance, and validation steps to demonstrate full, reproducible takeover of a second test account for critical severity ratings.
Use the hunt-ato skill to enumerate all possible account takeover paths for the target application, validate each finding with out-of-band confirmation, and chain primitives to demonstrate full takeover of a second test account for a critical severity rating.
High-intent search queries and answers about installing and using this skill.
Account takeover chaining combines low-severity primitives like cookie theft and no-step-up password changes to demonstrate persistent, full takeover of a victim account. This approach validates attack paths using out-of-band confirmation to achieve critical severity ratings.
Common OAuth account takeover paths include lax redirect_uri validation, dangling subdomain takeover at the redirect_uri, and OAuth device code flow abuse. These vulnerabilities allow attackers to intercept authorization codes and fully compromise victim accounts.
Password reset poisoning validation requires out-of-band confirmation steps and false-positive mitigation checks. You must demonstrate reproducible account takeover of a second test account to ensure findings are accepted by bug bounty platforms and clients.
JWT manipulation can achieve account takeover by altering token claims to impersonate victims. This skill provides taxonomy covering JWT manipulation alongside eight other distinct ATO primitives for comprehensive penetration testing coverage.
Account takeover testing applies to SSO systems and API endpoints where high-impact risks exist. The methodology covers OAuth implementations, web applications, and API endpoints with reproducible validation steps for critical-severity findings.
Account takeover findings often receive low severity ratings when testers lack comprehensive attack chaining and out-of-band validation. Using a complete taxonomy of nine distinct ATO primitives with reproducible demo accounts ensures critical severity acceptance.
cybersecwomanIdentify and analyze account takeover vulnerabilities in web applications.
Ap6packConverts security findings into formatted bug bounty submissions and client engagement reports.
pdparchitectAnalyze DNS records and HTTP fingerprints to detect subdomain takeover vulnerabilities.
langbyyiIdentifies high-severity business logic vulnerabilities in web applications.
