| name | hunt-auth |
| description | Auth bypass and ATO hunting - legacy protocol matrix (XMLRPC, SharePoint /_vti_bin/, EWS, Citrix, etc.), JWT manipulation, password reset poisoning, SAML auth bypass, session fixation. Wiki-first, FIND schema output. |
Hunt: Auth Bypass & Account Takeover
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "authentication bypass account takeover password reset poisoning session fixation legacy protocol" via wiki-search MCP
Hub: [[web-moc]] (live index). Primary page: [[authentication-attacks]]. Payload arsenal: wiki/payloads/{auth-bypass,jwt,oauth-saml,session,mfa-bypass,crypto}.md.
Anchors: [[session-management-attacks]], [[mfa-bypass]].
Attack surface (ranked)
Probe in this order; a higher entry is more often unguarded than a cleverer payload on the main form is likely to land.
- Legacy protocol endpoints (matrix below) - a second door to the same credential store, frequently with no rate limit, MFA, or CAPTCHA. Probe first on any custom/branded login.
- Password reset flows - host-header poisoning, token in Referer, token reuse/expiry, reset that does not invalidate live sessions.
- Session and MFA - fixation, missing rotation on privilege change, MFA-optional endpoints, JWT manipulation.
Legacy Protocol Matrix (Probe First on Any Custom-Branded Login)
When a target has a custom/branded login UI, ALWAYS probe the platform's legacy protocol endpoints. These often accept native credentials with NO rate limit, NO MFA, NO CAPTCHA.
| Target tech | Legacy endpoint | Bypass surface |
|---|
