skills.rest
n4igme
n4igmeCOMMUNITY
Explore all skills by this author →
Website𝕏@nevrectlGitHub

vuln-authn-session

Detect authentication and session management flaws from threat-model.md and recon.md.

Updated Jun 23, 2024
Search Tags:#session-management#threat-model#authenticate#security-scanner#bug-bounty#vulnerability-reporting
One-click install
npx skills add https://github.com/n4igme/randscript --skill vuln-authn-session
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-authn-session
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/scode/vuln-authn-session
Command: npx skills add https://github.com/n4igme/randscript --skill vuln-authn-session

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams identify authentication and session management vulnerabilities in web applications as part of bug bounty workflows, reducing time to discovery and remediation.

Core Features & Use Cases

  • Map authentication flows across login, token issuance, refresh, and logout to identify gaps.
  • Inspect token handling (JWTs, cookies) and storage mechanisms to verify proper rotation and invalidation.
  • Check protections (rate limits, lockouts, secure flags) and verify logout actually destroys sessions.
  • Output and append findings to assessment/vulnerabilities.md for traceability and remediation.

Quick Start

Run vuln-authn-session against threat-model.md and recon.md to generate and append findings to assessment/vulnerabilities.md.

Frequently Asked Questions about vuln-authn-session

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify authentication and session management vulnerabilities in web applications?▼

To identify authentication and session management vulnerabilities, map authentication flows across login, token issuance, refresh, and logout. Inspect token handling and storage mechanisms to verify proper rotation and invalidation for security gaps.

How do I check if JWT tokens and session cookies are properly invalidated on logout?▼

Check if logout actually destroys sessions by inspecting token handling for JWTs and cookies. Verify proper rotation, invalidation, and secure flags to ensure session handling weaknesses are detected and remediated.

What protections should I verify to prevent broken authentication during a vulnerability scan?▼

Verify protections like rate limits, lockouts, and secure flags to prevent broken authentication. Map token issuance and refresh flows to identify gaps in session handling and validate findings against threat models.

Can I use threat-model-driven workflows to detect session management flaws?▼

Yes, you can apply threat-model-driven workflows to detect session management flaws. Read priority targets from threat-model.md and recon.md, validate findings, and append results to assessment/vulnerabilities.md for traceability.

What is the best way to document authentication vulnerabilities for bug bounty reporting?▼

Append validated findings to assessment/vulnerabilities.md to document authentication vulnerabilities for bug bounty reporting. This ensures traceability and remediation by outputting detected broken auth and JWT issues.

Related Skills

Explore More Software Engineering Skills→
n4igmen4igme

vuln-file-path

Detect file upload and path traversal vulnerabilities in codebases.

Community
Intermediate
n4igmen4igme

sc3-vuln-scan

Orchestrate vulnerability scanners to produce a unified vulnerabilities.md report.

Community
Advanced
riftzen-bitriftzen-bit

springboot-security

Identify and remediate security misconfigurations in Java Spring Boot services.

Community
Advanced
zinohomezinohome
1

auth-module-builder

Implement JWT authentication with login, registration, session management, and CSRF protection.

Community
Advanced