メニュー
Use when performing penetration testing targeting authentication bypass vulnerabilities. Keywords: authentication bypass, OTP bypass, 2FA bypass, login bypass, session fixation, default credentials, account takeover, token manipulation
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne, H1, hacktivity, pentest skill, bug bounty, check for updates.
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne, H1, hacktivity, pentest skill, bug bounty, check for updates.
Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation in cloud-native infrastructure. Covers CWE-287/863/269/284/285/862. Keywords: authentication bypass, authorization bypass, RBAC, admission webhook, JWT, OAuth, privilege escalation, Rancher, Kyverno, impersonation, namespace isolation, middleware auth
Use when auditing Go code involving TLS configuration, certificate validation, JWT token parsing, SAML assertion verification, webhook signature checking, or cryptographic operations. Covers CWE-295/347/345. Keywords: InsecureSkipVerify, TLS, mTLS, certificate validation, JWT algorithm, SAML signature, cosign, sigstore, hmac.Equal, X.509, webhook HMAC
Use when auditing Go code involving goroutine management, channel operations, HTTP request handling, resource allocation, or panic recovery. Covers CWE-400/770/476. Keywords: denial of service, goroutine leak, channel deadlock, panic recover, io.ReadAll, resource exhaustion, OOM, HTTP/2 abuse, protobuf, unbounded allocation, rate limiting
Use when auditing Go code involving logging, error handling, HTTP response data, Kubernetes Secret management, or credential storage. Covers CWE-200/532/522/312/552. Keywords: information disclosure, credential leak, log exposure, Kubernetes Secret, json tag, struct formatting, error message, stack trace, Rancher, Argo CD, sensitive data
| name | pentest-auth-bypass |
| description | Use when performing penetration testing targeting authentication bypass vulnerabilities. Keywords: authentication bypass, OTP bypass, 2FA bypass, login bypass, session fixation, default credentials, account takeover, token manipulation |
当对 Web 应用进行认证绕过渗透测试时加载此 Skill。覆盖 OTP 绕过、2FA 绕过、默认凭证等。
高风险功能：
识别信号：
OTP/2FA 绕过：
# 1. OTP 在响应中泄露
POST /api/send-otp → Response: {"otp": "123456", "status": "sent"}
# 2. 响应篡改
真实响应: {"verified": false} → 修改为: {"verified": true}
# 3. 空 OTP / 默认值
POST /api/verify-otp {"otp": ""}
POST /api/verify-otp {"otp": "000000"}
# 4. 暴力破解（无速率限制）
POST /api/verify-otp {"otp": "000001"}
POST /api/verify-otp {"otp": "000002"}
...
# 5. 跳过验证步骤
直接访问 2FA 验证后的页面/API 端点
Token 操纵：
# JWT 算法混淆
{"alg": "none"} → 删除签名
{"alg": "HS256"} → 用 RS256 公钥作为 HMAC 密钥签名
# JWT 信息篡改
修改 payload 中的 user_id、role、email 等字段
# 密码重置 Token
分析 token 结构，检查是否可预测（时间戳、顺序、弱随机）
认证逻辑缺陷：
默认凭证利用：
admin:admin
admin:password
admin:123456
root:root
test:test
# 特定产品默认凭证
Tomcat: tomcat:tomcat
Jenkins: admin:admin
Grafana: admin:admin
会话管理攻击：
is_admin=false → is_admin=trueRace Condition 利用：
OAuth 2.0 攻击向量：
state 参数缺失或固定 → CSRF 攻击窃取授权码code_verifier）redirect_uri 篡改：通过开放重定向或子域接管窃取授权码密码重置 Token 测试方法：
Host 头为攻击者域名，重置链接可能指向攻击者漏洞利用可达到的效果：
严重度判断：
以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。