What problem does it solve?
Account takeover bugs rarely live in the login form itself; they hide in password reset, email change, magic-link, SSO, and cross-device login flows that scanners miss. This Skill provides a systematic methodology for finding and confirming ATO vulnerabilities during authorized penetration tests, so findings are proven with concrete post-auth evidence rather than guessed.
Core Features & Use Cases
- Nine ATO Variant Coverage: Tests Unicode/normalization email collisions, reusable reset and magic links, pre-account-takeover, host-header poisoning, response manipulation, open redirects, session persistence, QR/device-code abuse, and privileged-parameter IDOR in recovery flows.
- Confirmation Guidance: Each variant includes explicit steps to confirm a real hit (e.g., verifying the session resolves to the victim's userId) and avoid false positives from cosmetic UI changes.
- Structured Reporting: Outputs findings in a consistent format with severity, OWASP category, reproduction steps, evidence tables, impact, and remediation advice.
- Use Case: During an authorized web app assessment, you intercept a password-reset request in Burp Suite, poison the Host header, and confirm the reset link points to your controlled domain, proving token leakage and full account takeover.
Quick Start
Ask the agent to test the target application's password reset and email change flows for account takeover vulnerabilities using my two authorized test accounts.
