scan-fase-11

Identify authentication and authorization bypass weaknesses via header, path, and parameter manipulation.

Updated Mar 11, 2026

Search Tags:#authorization #authentication #web-security #pentest #auth-bypass #path-traversal #header-manipulation

Ready to run

npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-11

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scan-fase-11
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-11
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-11

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The skill helps security testers identify authentication and authorization bypass vulnerabilities by systematically applying header manipulations, path tricks, and protected-route testing across modern web apps.

Core Features & Use Cases

Header-based bypass testing (11.1) using X-Original-URL, X-Rewrite-URL, and related headers to access protected routes.
Path and extension bypass techniques (11.2) including path normalization, URL encoding, and traversal to reach restricted endpoints.
Protected routes discovery and testing (11.3) to determine which routes are accessible without authentication and which require authorization, across admin, dashboard, API, and debug paths.
Extended techniques and adaptive strategies for layered bypass attempts, enabling comprehensive coverage across architectures.

Quick Start

Invoke with /scan-fase-11 {url} after initial reconnaissance to begin auth bypass testing against the target application.

Frequently Asked Questions about scan-fase-11

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for authentication bypass using header manipulation on protected routes?▼

Path traversal bypass testing manipulates URL paths using normalization, encoding tricks, and directory traversal sequences against restricted endpoints. This skill applies these parameter manipulations to protected routes to detect authorization bypass vulnerabilities in various architectures.

What is the best way to discover protected routes that are accessible without authentication?▼

Discovering protected routes accessible without authentication involves probing admin, dashboard, API, and debug paths to determine access requirements. This skill tests these common components to map which restricted endpoints permit unauthenticated access across different architectures.

Can I use this skill to test authorization bypass across different web app architectures?▼

Yes, you can test authorization bypass across different web app architectures using this skill. It enforces a disciplined workflow with adaptive payloads tailored for layered bypass attempts, providing thorough documentation and clear severity guidance to prioritize remediation across varied systems.

Why does header manipulation sometimes fail to bypass authentication on protected endpoints?▼

Header manipulation fails to bypass authentication when the backend architecture does not honor headers like X-Original-URL for routing decisions. This skill mitigates blind spots by combining header tricks with path normalization and parameter manipulation for comprehensive coverage.