| name | authenticating |
| description | Authentication testing skill - automates signup, login, 2FA bypass, CAPTCHA solving, and bot detection evasion using Playwright MCP. Tests authentication security controls. Includes behavioral biometrics simulation, OTP handling, and automated account creation for security assessments. |
Authentication Testing
Automated authentication security testing: signup, login, 2FA/OTP bypass, CAPTCHA, bot detection using Playwright.
Quick Start
1. Initialize Playwright
2. Test: signup → login → 2FA → CAPTCHA → bot detection
3. Document findings with evidence
Core Workflows
Account Registration: Navigate → analyze form → generate password (PasswordGenerator) → create account → store credentials (CredentialManager)
Login Security: Test bypasses → credential validation → session tokens → fixation/hijacking
2FA/OTP Bypass: Enable 2FA → test vectors (response manipulation, direct access, parameter removal, code reuse, brute force) → extract OTP from email
CAPTCHA Assessment: Identify type → test server-side validation, token expiration, reusability → bypass vectors
Bot Detection: Stealth mode → human-like behavior (natural mouse, variable typing, random pauses) → test detection
Credential Tools
PasswordGenerator (tools/password_generator.py):
from tools.password_generator import generate_password
password = generate_password(hint_text="8-16 chars, uppercase, lowercase, numbers")
CredentialManager (tools/credential_manager.py):
from tools.credential_manager import CredentialManager
mgr = CredentialManager()
cred_id = mgr.store_credential(target="example.com", username="test", password="pass")
cred = mgr.get_credential("example.com")
See reference/PASSWORD_CREDENTIAL_MANAGEMENT.md.
Playwright Automation
REQUIRED: All browser automation via Playwright MCP.
Human-like: Natural mouse, realistic typing (80-200ms delays), random pauses (500-2000ms), smooth scrolling
Evidence: Screenshots before/after, network logs, console output
Stealth: Hide webdriver, add chrome object, randomize fingerprints
Testing Techniques
CAPTCHA Bypass (11 techniques - reference/CAPTCHA_BYPASS.md):
Missing server validation, empty field, reusable tokens, HTTP header manipulation, content-type conversion, request method, parameter manipulation, OCR, response interception, token expiration, session persistence
2FA Bypass (10 methods - reference/2FA_BYPASS.md):
Response manipulation, direct endpoint access, OTP parameter removal, code reusability, brute force, predictable codes, session persistence pre-2FA, backup code abuse, race condition, OTP leakage
Bot Detection Evasion (reference/BOT_DETECTION.md):
Behavioral biometrics, fingerprint randomization, User-Agent rotation, WebDriver hiding, natural timing, request patterns
Output Structure
outputs/authenticating/<target>/
├── signup/account_created.json + evidence/
├── login/session_tokens.json + evidence/
├── 2fa/bypass_attempts.json + otp_codes.txt + evidence/
├── captcha/bypass_methods.json + evidence/
├── bot_detection/detection_tests.json + behavioral_patterns.md
└── findings/vulnerabilities.json + authentication_report.md + poc_scripts/
Common Vulnerabilities
Critical: Missing 2FA server validation, reusable OTP, direct access without 2FA, client-side CAPTCHA
High: Weak OTP generation, no rate limiting, CAPTCHA token reuse, session persistence pre-2FA
Medium: Weak bot detection, account enumeration, timing attacks, info disclosure
Testing Checklist
Pre: Scope, test accounts, Playwright configured, email access
During: Signup, login, 2FA, CAPTCHA, bot detection, evidence
Post: Findings documented, PoC scripts, CVSS scores, remediation, cleanup
Critical Rules
Always: Test accounts only, document scope, responsible disclosure, clean up
Never: Exceed scope, cause disruption, expose findings before remediation
Tools
Playwright MCP, PasswordGenerator, CredentialManager, Email APIs (IMAP, Gmail), OCR (Tesseract)
Invocation
This is a skill, not a slash command. The orchestrator mounts it for authentication-focused engagements (see Target-Type Routing), or it activates directly when a task involves login, signup, 2FA/OTP, CAPTCHA, or bot-detection testing.
Reference
