What problem does it solve?
Password reset and account recovery flows often contain authentication flaws like username enumeration, leaked reset tokens, and token replay that manual testers miss. This Skill provides a structured testing methodology to systematically find and prove these broken-auth primitives during authorized bug hunting engagements.
Core Features & Use Cases
- Five Detection Patterns: Tests username enumeration via response differences, reset tokens exposed in API responses, token replay after use, missing IP/session binding, and absent rate limiting.
- Proof Criteria: Defines measurable evidence for each finding, such as response diffs between valid and invalid emails or a second successful use of a consumed token.
- Chain Handoff: Distinguishes recovery-flow primitives from the full account-takeover chain, handing off to related skills like hunt-ato for escalation.
- Use Case: During an authorized web app assessment, you test the forgot-password endpoint with valid and invalid emails, compare responses to confirm enumeration, then attempt token replay to demonstrate a High-severity flaw.
Quick Start
Ask Claude to test the target's forgot-password endpoint for username enumeration, token exposure, token replay, and rate limiting using this skill.
