pentest-auth

name	pentest-auth
description	Authentication and session security testing. JWT, OAuth, sessions, brute force.
user-invocable	true
allowed-tools	["Bash","Agent","Read"]

/pentest-auth — Authentication & Session Testing

Test a target application's authentication mechanisms including JWT token security, OAuth implementation, session management, and brute force resistance.

Input

The target URL is provided via $ARGUMENTS. If no URL is provided, ask the user for one.

Steps

1. Parse the target URL from $ARGUMENTS.

2. Delegate to auth-agent using the Agent tool. The agent performs the following:

   Phase 1 — Passive Analysis (no consent needed):

   pentest -k -j -o ./findings auth jwt <url>
   pentest -k -j -o ./findings auth oauth <url>
   pentest -k -j -o ./findings auth session <url>
   

   • If JWT tokens were found during a previous bundle scan (check ./findings/ for bundle results), extract and analyze them for:
     • Algorithm confusion vulnerabilities (none, HS256 vs RS256)
     • Weak signing keys
     • Sensitive data in payload
     • Missing expiration claims
   • Analyze OAuth endpoints for misconfigurations (open redirects, state parameter usage)
   • Check session management (cookie flags, session fixation, timeout policies)

   Phase 2 — Active Testing (requires explicit consent):

   Before running brute force tests, ask the user:

   Brute force testing will send multiple login attempts to the target. This may lock out accounts or trigger rate limiting. Do you want to proceed? (yes/no)

   If the user consents:

   pentest -k -j -o ./findings auth brute --active --yes <url>
   

3. Read the JSON outputs from ./findings/ to gather all results.

4. Present findings covering:

   • JWT vulnerabilities (algorithm issues, weak keys, information disclosure)
   • OAuth misconfigurations (redirect URI validation, state parameter, scope issues)
   • Session management weaknesses (missing Secure/HttpOnly flags, predictable session IDs)
   • Brute force results (if run): rate limiting effectiveness, account lockout policies

Notes

• Phase 1 (JWT, OAuth, session analysis) is passive and safe.
• Phase 2 (brute force) is active and requires explicit user consent.
• Use -k to skip SSL verification for targets with self-signed certs.
• Use -j for machine-readable JSON output.
• Use -o ./findings to persist results for later reporting.