...
npx skills add https://github.com/uphiago/recon-skills --skill hunt-session-uphiago
Please help me install this Agent Skill. Skill: hunt-session Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-session Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-session-uphiago
Web applications often have subtle session management flaws that lead to persistent account takeover (ATO), which are frequently missed in standard security assessments and can result in critical data breaches or unauthorized access. This skill eliminates guesswork from identifying these high-impact vulnerabilities with proven, field-validated testing methodologies.
Use the hunt-session skill to test a target web application's session handling for fixation, invalidation gaps, and cookie attribute flaws following the provided two-session validation workflow.
High-intent search queries and answers about installing and using this skill.
Session fixation and invalidation gaps are tested by enforcing a two-session validation rule with body-diff checks and negative controls, verifying whether attacker sessions persist through victim password resets or logout events to confirm real account takeover vectors.
Validating JWT security misconfigurations during penetration testing requires testing JWT-based session systems against refresh-token reuse and predictable session IDs, applying negative control testing to ensure only exploitable flaws survive validation.
The best way to eliminate false positives when testing OAuth session linkage gaps is to enforce a strict two-session validation rule using both attacker and victim sessions alongside body-diff checks and negative control testing.
Yes, this approach is specifically designed for bug bounty workflows and penetration testing, systematically targeting authentication flows to catch persistent account takeover vectors and produce evidence-backed reports meeting program quality standards.
DBSC downgrade vulnerability testing covers high-impact session flaw classes including session fixation, logout invalidation gaps, refresh-token reuse, JWT misconfigurations, predictable session IDs, cookie attribute weaknesses, and OAuth/SSO linkage gaps.
giosuetedeschi-specIntercept and modify HTTP traffic to test web application security.
uphiagoIdentify high-severity OAuth vulnerabilities enabling account takeover and authentication bypass.
amano--Intercept HTTP traffic and test web applications for security vulnerabilities.
cameronapakManage Bknd user sessions with JWT-based lifecycles and auto-renewal.
