skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-auth-bypass

Detects authentication bypass vulnerabilities across SAML, JWT, SSO, and legacy protocol endpoints.

Updated Sep 6, 2026
Search Tags:#jwt#penetration testing#sso#saml#bug bounty#authentication bypass#xmlrpc
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-auth-bypass-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-auth-bypass
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-auth-bypass
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-auth-bypass-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Bug bounty hunters and security testers often miss authentication bypass vulnerabilities because SSO enforcement on the main login UI hides forgotten legacy endpoints, misconfigured SAML signature validation, and cross-portal token trust issues that require a systematic methodology to uncover. ## Core Features & Use Cases - Legacy-Protocol Matrix: Maps branded login UIs to legacy endpoints (WordPress XMLRPC, SharePoint Authentication.asmx, Atlassian REST auth, Exchange EWS) that accept native credentials without MFA, rate limits, or lockouts. - SAML and JWT attack playbooks: Provides concrete payloads for signature stripping, XML comment injection, XSW parser differentials, alg-confusion, and audience-confusion attacks, grounded in 12 disclosed bug bounty reports. - Gate 0 validation and impact framing: Enforces a three-question impact check and supplies real payout-backed examples so findings are reported with reproducible, high-severity evidence. - Use Case: While testing an enterprise SaaS target with SSO enforced, use this Skill to probe /xmlrpc.php and /saml/callback, strip a captured SAMLResponse signature, and confirm account takeover before writing the report. ## Quick Start Load the hunt-auth-bypass skill and walk the Legacy-Protocol Matrix against my target's login surface to find auth bypass entry points.

Frequently Asked Questions about hunt-auth-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for authentication bypass on a target with SSO enforced?▼

Probe legacy endpoints that bypass the SSO-gated UI, such as /xmlrpc.php on WordPress or /_vti_bin/Authentication.asmx on SharePoint. These often accept native credentials with no MFA, rate limit, or lockout, independent of the main login flow.

How to test SAML signature validation on a service provider?▼

Capture a valid SAMLResponse, decode the Base64 XML, then strip the Signature element entirely or inject XML comments into the NameID. If the SP accepts the modified assertion, you can impersonate any user including administrators.

What is the difference between this skill and hunt-jwt-crypto or hunt-saml?▼

This skill owns the cross-protocol auth-bypass taxonomy and JWT only inside SSO/SAML/token-trust chains. Standalone JWT crypto forging (alg:none, kid/jku) belongs to hunt-jwt-crypto, and assertion-layer SAML attacks like XSW belong to hunt-saml.

Does WordPress XMLRPC bypass SSO and MFA protections?▼

Yes. XMLRPC uses WordPress-native credentials rather than the SSO flow, so plugins like OneLogin that only gate wp-login.php leave /xmlrpc.php open. The system.multicall method also enables batched credential attempts in a single request.

Why do partner portals lead to cross-tenant privilege escalation?▼

Partner and admin portals often share session cookies, JWT secrets, or token-validation backends. A token issued in the lower-trust partner context is accepted by admin endpoints because verification checks only the signature, not the issuance context or audience.

What evidence is required before reporting an auth bypass finding?▼

Apply the Gate 0 check: state what the attacker can do (authenticate as another user or elevate role), what the victim loses (account takeover, admin access), and reproduce the full chain from a fresh session in under 10 minutes.

Related Skills

Explore More Software Engineering Skills→
chenchunrunchenchunrun
1

redteam-recon-enterprise

Automate enterprise reconnaissance to map assets, tech stacks, and attack surfaces.

Community
Advanced
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
cybersecwomancybersecwoman
5

hunt-ato

Identify and analyze account takeover vulnerabilities in web applications.

Community
Advanced
elementalsoulselementalsouls
4.0k

hunt-jwt-crypto

Detect and exploit JWT signature forgery flaws including alg:none and RS256-to-HS256 key confusion.

Community
Advanced