skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-auth-bypass

Identify authentication bypass vulnerabilities in SAML, JWT, OAuth, and XMLRPC endpoints.

1.1k|191|Updated Jun 24, 2026
Search Tags:#jwt#red-team#penetration-testing#auth-bypass#saml#bug-bounty#xmlrpc
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-auth-bypass-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-auth-bypass
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-auth-bypass
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-auth-bypass-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Authentication bypass is one of the highest-paying and most common high-severity vulnerability classes in bug bounty and penetration testing, but it is difficult to systematically identify across diverse authentication stacks (SAML, JWT, OAuth, XMLRPC, legacy endpoints) without missing common, field-validated bypass patterns that lead to full account takeover or privilege escalation.

Core Features & Use Cases

  • Comprehensive auth bypass coverage: Includes techniques for SAML signature stripping/XML wrapper attacks, JWT algorithm confusion, XMLRPC SSO bypass, cross-portal token reuse, and legacy protocol endpoint bypasses for common platforms.
  • Legacy-Protocol Matrix: A ready-to-use reference mapping 20+ common tech stacks (WordPress, SharePoint, Atlassian, Drupal, etc.) to their often-overlooked native authentication endpoints that bypass SSO, MFA, and UI-level access controls.
  • Field-validated methodology: Step-by-step hunting workflow, payload patterns, and 12 real-world disclosed bug bounty case studies with payouts up to $25K+, plus validation gates to ensure findings are reproducible and high-impact.

Quick Start

Use the hunt-auth-bypass skill to systematically test a target's SAML, JWT, XMLRPC, and legacy authentication endpoints for bypass vulnerabilities, starting with the Legacy-Protocol Matrix to identify overlooked native auth surfaces that bypass SSO and MFA controls.

Frequently Asked Questions about hunt-auth-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find authentication bypass vulnerabilities in SAML and JWT tokens?▼

Hunt authentication bypass vulnerabilities by applying structured payload patterns for SAML signature stripping, JWT algorithm confusion, and XMLRPC SSO bypass against target endpoints to confirm exploitable account takeover or privilege escalation.

How do I bypass SSO and MFA controls on enterprise platforms like SharePoint and Atlassian?▼

Bypass SSO and MFA controls by targeting often-overlooked native legacy authentication endpoints using a Legacy-Protocol Matrix that maps 20+ enterprise tech stacks like WordPress, SharePoint, Atlassian, and Drupal to their native auth surfaces.

What is JWT algorithm confusion and how does it lead to account takeover?▼

JWT algorithm confusion is an authentication bypass technique manipulating token signature verification logic, enabling forged valid tokens that lead to full account takeover and privilege escalation in SSO-enabled applications and partner portals.

Does this auth bypass hunting methodology work for bug bounty engagements?▼

Yes, this auth bypass hunting methodology is built for bug bounty and red team engagements, providing structured workflows, reusable payload patterns, and 12 real-world disclosed case studies with payouts up to $25K+ to validate exploitable flaws.

Can I test cross-portal token reuse and XMLRPC bypasses in enterprise SaaS applications?▼

Test cross-portal token reuse and XMLRPC SSO bypasses in enterprise SaaS platforms and CMS installations using provided validation gates to confirm reproducible, high-impact authentication bypass flaws with concrete account takeover impact.

What are the limitations when hunting for legacy protocol authentication bypasses?▼

Limitations when hunting legacy protocol authentication bypasses include the necessity to accurately map native endpoints across 20+ diverse tech stacks and apply validation gates to confirm reproducible impact, avoiding false positives during red team engagements.

Related Skills

Explore More Software Engineering Skills→
Kisilev13Kisilev13

hunt-auth-bypass

Identify and exploit authentication bypass vulnerabilities in web applications.

Community
Advanced
uphiagouphiago
1.1k

hunt-oauth

Identify high-severity OAuth vulnerabilities enabling account takeover and authentication bypass.

Community
Advanced
uphiagouphiago
1.1k

saml-sso-attack

Identify and exploit SAML SSO authentication bypass vulnerabilities during penetration tests.

Community
Intermediate
pdparchitectpdparchitect
13

hunt-auth-bypass

Identify and validate authentication bypass vulnerabilities across SSO, SAML, OAuth, JWT, and legacy endpoints.

Community
Advanced