authenticating

name	authenticating
description	Authentication testing skill - automates signup, login, 2FA bypass, CAPTCHA solving, and bot detection evasion using Playwright MCP. Tests authentication security controls. Includes behavioral biometrics simulation, OTP handling, and automated account creation for security assessments.

Authentication Testing

Automated authentication security testing: signup, login, 2FA/OTP bypass, CAPTCHA, bot detection using Playwright.

Quick Start

1. Initialize Playwright
2. Test: signup → login → 2FA → CAPTCHA → bot detection
3. Document findings with evidence

Core Workflows

Account Registration: Navigate → analyze form → generate password (PasswordGenerator) → create account → store credentials (CredentialManager)

Login Security: Test bypasses → credential validation → session tokens → fixation/hijacking

2FA/OTP Bypass: Enable 2FA → test vectors (response manipulation, direct access, parameter removal, code reuse, brute force) → extract OTP from email

CAPTCHA Assessment: Identify type → test server-side validation, token expiration, reusability → bypass vectors

Bot Detection: Stealth mode → human-like behavior (natural mouse, variable typing, random pauses) → test detection

Credential Tools

PasswordGenerator (tools/password_generator.py):

from tools.password_generator import generate_password
password = generate_password(hint_text="8-16 chars, uppercase, lowercase, numbers")

CredentialManager (tools/credential_manager.py):

from tools.credential_manager import CredentialManager
mgr = CredentialManager()
cred_id = mgr.store_credential(target="example.com", username="test", password="pass")
cred = mgr.get_credential("example.com")

See reference/PASSWORD_CREDENTIAL_MANAGEMENT.md.

Playwright Automation

REQUIRED: All browser automation via Playwright MCP.

Human-like: Natural mouse, realistic typing (80-200ms delays), random pauses (500-2000ms), smooth scrolling Evidence: Screenshots before/after, network logs, console output Stealth: Hide webdriver, add chrome object, randomize fingerprints

Testing Techniques

CAPTCHA Bypass (11 techniques - reference/CAPTCHA_BYPASS.md): Missing server validation, empty field, reusable tokens, HTTP header manipulation, content-type conversion, request method, parameter manipulation, OCR, response interception, token expiration, session persistence

2FA Bypass (10 methods - reference/2FA_BYPASS.md): Response manipulation, direct endpoint access, OTP parameter removal, code reusability, brute force, predictable codes, session persistence pre-2FA, backup code abuse, race condition, OTP leakage

Bot Detection Evasion (reference/BOT_DETECTION.md): Behavioral biometrics, fingerprint randomization, User-Agent rotation, WebDriver hiding, natural timing, request patterns

Output Structure

outputs/authenticating/<target>/
├── signup/account_created.json + evidence/
├── login/session_tokens.json + evidence/
├── 2fa/bypass_attempts.json + otp_codes.txt + evidence/
├── captcha/bypass_methods.json + evidence/
├── bot_detection/detection_tests.json + behavioral_patterns.md
└── findings/vulnerabilities.json + authentication_report.md + poc_scripts/

Common Vulnerabilities

Critical: Missing 2FA server validation, reusable OTP, direct access without 2FA, client-side CAPTCHA High: Weak OTP generation, no rate limiting, CAPTCHA token reuse, session persistence pre-2FA Medium: Weak bot detection, account enumeration, timing attacks, info disclosure

Testing Checklist

Pre: Scope, test accounts, Playwright configured, email access During: Signup, login, 2FA, CAPTCHA, bot detection, evidence Post: Findings documented, PoC scripts, CVSS scores, remediation, cleanup

Critical Rules

Always: Test accounts only, document scope, responsible disclosure, clean up Never: Exceed scope, cause disruption, expose findings before remediation

Tools

Playwright MCP, PasswordGenerator, CredentialManager, Email APIs (IMAP, Gmail), OCR (Tesseract)

Invocation

This is a skill, not a slash command. The orchestrator mounts it for authentication-focused engagements (see Target-Type Routing), or it activates directly when a task involves login, signup, 2FA/OTP, CAPTCHA, or bot-detection testing.

Reference

• CAPTCHA_BYPASS.md - 11 CAPTCHA techniques
• 2FA_BYPASS.md - 10 2FA/OTP methods
• BOT_DETECTION.md - Bot evasion
• PASSWORD_CREDENTIAL_MANAGEMENT.md - Tool usage