skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

hunt-auth-bypass

Detect and exploit authentication bypass vulnerabilities in SAML, JWT, and legacy protocols.

Updated Jul 1, 2026
Search Tags:#JWT#SOAP#authentication bypass#SAML#XMLRPC
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-auth-bypass-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-auth-bypass
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-auth-bypass
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-auth-bypass-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and exploits authentication bypass vulnerabilities in SAML, JWT, and legacy protocols, helping you uncover critical security weaknesses in web applications.

Core Features & Use Cases

  • SAML Vulnerability Detection: Identifies and bypasses SAML authentication weaknesses, such as signature stripping and assertion manipulation.
  • JWT Vulnerability Exploitation: Finds and exploits JWT issues like algorithm confusion and token reuse.
  • Legacy Protocol Bypass: Tests for vulnerabilities in legacy protocols like XMLRPC and SOAP, using methods like multicall for mass authentication bypass.
  • Use Case: When assessing the security of a web application, use this Skill to scan for authentication bypass vulnerabilities in SAML implementations, JWT tokens, and legacy endpoints, potentially leading to account takeovers and privilege escalations.

Quick Start

Use the hunt-auth-bypass skill to scan for SAML authentication bypass vulnerabilities on the target domain 'example.com'.

Frequently Asked Questions about hunt-auth-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit JWT algorithm confusion and token reuse vulnerabilities during a penetration test?▼

To exploit JWT vulnerabilities like algorithm confusion and token reuse, this Skill detects and targets weak token implementations, uncovering critical authentication bypass weaknesses in web applications.

What is the best way to detect SAML signature stripping and assertion manipulation bypasses?▼

Detecting SAML authentication bypasses like signature stripping and assertion manipulation requires analyzing SAML responses for missing signature validations, which this Skill automates for security assessments.

Can I use this to test legacy SOAP and XMLRPC endpoints for mass authentication bypass?▼

Yes, you can test legacy protocols like XMLRPC and SOAP for authentication bypass vulnerabilities, specifically targeting multicall methods to achieve mass bypass on legacy endpoints.

Do I need manual intervention to exploit authentication bypass mechanisms in web applications?▼

Yes, exploiting authentication bypass mechanisms in SAML, JWT, and legacy protocols requires manual intervention and a deep understanding of authentication mechanisms to validate and execute the attacks.

What types of account takeovers can I uncover by scanning for authentication bypass vulnerabilities?▼

Scanning for authentication bypass vulnerabilities in SAML, JWT, and legacy protocols can uncover account takeovers and privilege escalations resulting from flawed authentication implementations.

How do I scan a target domain for SAML authentication bypass vulnerabilities?▼

To scan a target domain for SAML authentication bypass vulnerabilities, initiate the Skill with your target domain and it will identify weaknesses like signature stripping and assertion manipulation.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

auth-sec

Map authentication and authorization test scope for web and API targets.

Official
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-ato

Analyze password reset flaws, MFA bypass, and session fixation for account takeover vulnerabilities.

Community
Advanced
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
devtintdevtint

jwt-attacks

Detect and exploit JWT vulnerabilities including algorithm confusion and weak secrets.

Community
Advanced