소스 정보
- 저장소
- CyberStrikeus/CyberStrike
- 최근 소스 활동
- 2026년 4월 28일 23:54
- 감지된 SKILL.md 언어
- 영어
- 스타
- 1,653
- 포크
- 254
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-athn-10명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-athn-10 |
| description | Testing for Weaker Authentication in Alternative Channel |
| category | authentication |
| owasp_id | WSTG-ATHN-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["authentication","login","credentials","mfa","wstg","athn"] |
| tech_stack | [] |
| cwe_ids | ["CWE-287"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-ATHN-10
Testing for Weaker Authentication in Alternative Channel
Many applications provide multiple access channels (web, mobile, API, legacy interfaces) that may have inconsistent authentication controls. This test identifies scenarios where alternative channels have weaker security than the primary channel, potentially allowing attackers to bypass stronger controls by using a less secure path to the same functionality.
| Channel | Potential Weakness |
|---|---|
| Mobile API | No 2FA, weaker rate limiting |
| Legacy interface | Old auth mechanisms |
| Internal API | No auth assumed |
| Partner API | API key only |
| Dev/staging | Default credentials |
# Find API endpoints
curl -s "https://target.com" | grep -oP 'https?://[a-zA-Z0-9./-]+api[a-zA-Z0-9./-]*'
# Common alternative endpoints
endpoints=(
"https://api.target.com"
"https://mobile-api.target.com"
"https://m.target.com"
"https://legacy.target.com"
"https://old.target.com"
"https://internal.target.com"
"https://admin.target.com"
)
endpoint ;
status=$(curl -s -o /dev/null -w 2>/dev/null)
[ != ];
# Test main web login
echo "=== Main Web ==="
curl -s -X POST "https://target.com/api/login" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"password"}' \
-v 2>&1 | grep -iE "2fa|mfa|otp|verify"
# Test mobile API
echo "=== Mobile API ==="
curl -s -X POST "https://api.target.com/v1/auth/login" \
-H "Content-Type: application/json" \
-H "User-Agent: TargetApp/1.0 (iOS)" \
-d '{"username":"test","password":"password"}' \
-v 2>&1 | grep -iE "2fa|mfa|otp|verify"
# Test legacy endpoint
echo "=== Legacy ==="
curl -s -X POST "https://legacy.target.com/login" \
-d "username=test&password=password" \
-v 2>&1 | grep -iE "2fa|mfa|otp|verify"
# If web requires 2FA but mobile might not
# Web login (with 2FA)
web_response=$(curl -s -X POST "https://target.com/api/login" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"password"}')
echo "Web: $web_response"
# Check if 2FA is required
# Mobile API login (potentially without 2FA)
mobile_response=$(curl -s -X POST "https://api.target.com/v1/auth/login" \
-H "Content-Type: application/json" \
-H "X-App-Version: 1.0" \
-d '{"username":"test","password":"password"}')
echo "Mobile: $mobile_response"
# Check if direct access token is returned
#!/bin/bash
# Compare rate limiting across channels
channels=(
"https://target.com/api/login"
"https://api.target.com/v1/auth/login"
"https://m.target.com/login"
"https://legacy.target.com/login"
)
for channel in "${channels[@]}"; do
echo "=== Testing: $channel ==="
attempts=0
for i in {1..50}; do
status=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$channel" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"wrong"}' 2>/dev/null)
if [ "$status" == "429" ]; then
echo "Rate limited after $i attempts"
break
fi
attempts=$((attempts + 1))
done
if [ "$attempts" -eq 50 ]; then
echo "[WEAK] No rate limiting after 50 attempts"
fi
echo ""
done
#!/bin/bash
# Compare lockout policies
# Test on main channel
echo "=== Main Channel ==="
for i in {1..15}; do
response=$(curl -s -X POST "https://target.com/api/login" \
-H "Content-Type: application/json" \
-d '{"username":"testuser","password":"wrong"}')
if echo "$response" | grep -qi "locked"; then
echo "Locked after $i attempts on main channel"
break
fi
done
# Test on mobile API
echo "=== Mobile API ==="
for i in {1..15}; do
response=$(curl -s -X POST "https://api.target.com/v1/auth/login" \
-H "Content-Type: application/json" \
-d '{"username":"testuser","password":"wrong"}')
if echo "$response" | grep -qi "locked"; then
echo "Locked after $i attempts on mobile API"
break
fi
done
# Compare session security across channels
# Web session
web_session=$(curl -s -X POST "https://target.com/api/login" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"password"}' \
-c - | grep -i "session\|token")
echo "Web session: $web_session"
# Mobile session
mobile_session=$(curl -s -X POST "https://api.target.com/v1/auth/login" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"password"}')
echo "Mobile session: $mobile_session"
# Compare token formats, expiration, etc.
# Check if OAuth is enforced on all channels
# Web (should use SSO)
curl -sI "https://target.com/login" | grep -i "location\|oauth\|sso"
# Mobile API (might allow direct login)
curl -s -X POST "https://api.target.com/v1/auth/login" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"password"}' | head -50
# Legacy (might have different auth)
curl -sI "https://legacy.target.com/login" | grep -i "location\|oauth\|sso"
| Tool | Description | Usage |
|---|---|---|
| Subfinder | Subdomain enumeration | Find alternative endpoints |
| Amass | Asset discovery | Discover channels |
| Burp Suite | Traffic analysis | Identify API patterns |
| Tool | Description |
|---|---|
| Custom scripts | Automated comparison |
| Postman | Multi-channel testing |
#!/usr/bin/env python3
import requests
import time
class MultiChannelTester:
def __init__(self, channels):
"""
channels: dict of channel_name -> base_url
"""
self.channels = channels
self.results = {}
def test_basic_auth(self, username, password):
"""Test if basic auth works on each channel"""
print("[*] Testing basic authentication...")
for name, base_url in self.channels.items():
endpoints = [
f"{base_url}/api/login",
f"{base_url}/api/v1/auth/login",
f"{base_url}/auth/login",
f"{base_url}/login",
]
for endpoint in endpoints:
try:
response = requests.post(
endpoint,
json={"username": username, "password": password},
timeout=10
)
if response.status_code == 200:
self.results[f"{name}_basic_auth"] = {
"endpoint": endpoint,
"success": True,
"requires_2fa": "2fa" in response.text.lower() or "mfa" in response.text.lower()
}
break
except:
pass
def test_2fa_requirement(self, username, password):
"""Check if 2FA is required on each channel"""
print("[*] Testing 2FA requirements...")
for name, base_url in self.channels.items():
try:
response = requests.post(
f"{base_url}/api/login",
json={"username": username, "password": password},
timeout=10
)
requires_2fa = any(x in response.text.lower()
for x in ["2fa", "mfa", "verification", "otp", "code"])
has_token = any(x in response.text.lower()
for x in ["token", "access_token", "session"])
self.results[f"{name}_2fa"] = {
"requires_2fa": requires_2fa,
"direct_token": has_token and not requires_2fa
}
except Exception as e:
self.results[f"{name}_2fa"] = {"error": str(e)}
def test_rate_limiting(self, max_attempts=50):
"""Test rate limiting on each channel"""
print("[*] Testing rate limiting...")
for name, base_url in self.channels.items():
blocked_at = None
for i in range(max_attempts):
try:
response = requests.post(
f"{base_url}/api/login",
json={"username": "test", "password": f"wrong{i}"},
timeout=5
)
if response.status_code == 429:
blocked_at = i + 1
break
except:
break
self.results[f"{name}_rate_limit"] = {
"blocked_after": blocked_at,
"no_limit": blocked_at is None
}
def test_lockout_policy(self, username, max_attempts=15):
"""Test account lockout on each channel"""
print("[*] Testing lockout policy...")
for name, base_url in self.channels.items():
locked_at = None
for i in range(max_attempts):
try:
response = requests.post(
f"{base_url}/api/login",
json={"username": username, "password": f"wrong{i}"},
timeout=5
)
if "locked" in response.text.lower():
locked_at = i + 1
break
except:
break
self.results[f"{name}_lockout"] = {
"locked_after": locked_at,
"no_lockout": locked_at is None
}
def compare_security(self):
"""Compare security levels across channels"""
print("\n=== SECURITY COMPARISON ===\n")
# Find weakest channel
weaknesses = []
for name, base_url in self.channels.items():
# Check 2FA
tfa = self.results.get(f"{name}_2fa", {})
if tfa.get("direct_token"):
weaknesses.append(f"{name}: No 2FA required")
# Check rate limiting
rl = self.results.get(f"{name}_rate_limit", {})
if rl.get("no_limit"):
weaknesses.append(f"{name}: No rate limiting")
# Check lockout
lo = self.results.get(f"{name}_lockout", {})
if lo.get("no_lockout"):
weaknesses.append(f"{name}: No account lockout")
if weaknesses:
print("WEAKNESSES FOUND:")
for w in weaknesses:
print(f" [!] {w}")
else:
print("No significant weaknesses found across channels")
def generate_report(self):
"""Generate full report"""
print("\n" + "=" * 60)
print("MULTI-CHANNEL AUTHENTICATION TEST REPORT")
print("=" * 60 + "\n")
for test_name, result in self.results.items():
print(f"{test_name}:")
for key, value in result.items():
print(f" {key}: {value}")
print()
self.compare_security()
# Usage
channels = {
"web": "https://target.com",
"mobile_api": "https://api.target.com",
"legacy": "https://legacy.target.com",
}
tester = MultiChannelTester(channels)
tester.test_basic_auth("testuser", "password")
tester.test_2fa_requirement("testuser", "password")
tester.test_rate_limiting()
tester.test_lockout_policy("testuser")
tester.generate_report()
# All channels should use the same auth service
from auth_service import AuthService
class CentralizedAuth:
"""Single authentication service for all channels"""
def __init__(self):
self.auth = AuthService()
def authenticate(self, username, password, channel, device_info=None):
"""Authenticate with consistent security across channels"""
# Validate credentials
user = self.auth.verify_credentials(username, password)
if not user:
return None, "Invalid credentials"
# Apply same rate limiting
if not self.auth.check_rate_limit(username, channel):
return None, "Too many attempts"
# Apply same lockout policy
if self.auth.is_locked(username):
return None, "Account locked"
# Require 2FA for ALL channels if enabled
if user.mfa_enabled:
return {"requires_2fa": True, "temp_token": self.auth.create_temp_token(user)}
# Generate session with same security settings
session = self.auth.create_session(
user,
channel=channel,
device_info=device_info,
expiry=self.get_session_expiry(channel) # Same expiry regardless of channel
)
return session, None
# Configuration that applies to all channels
AUTH_CONFIG = {
"max_login_attempts": 5,
"lockout_duration": 900, # 15 minutes
"rate_limit": "10/minute",
"session_expiry": 3600, # 1 hour
"require_2fa": True, # For all channels
}
class AuthMiddleware:
"""Apply consistent auth checks across all channels"""
def __init__(self, config=AUTH_CONFIG):
self.config = config
def check_rate_limit(self, request):
"""Same rate limiting for all channels"""
identifier = self.get_client_identifier(request)
return rate_limiter.check(identifier, self.config["rate_limit"])
def check_lockout(self, username):
"""Same lockout policy for all channels"""
return lockout_manager.is_locked(username)
def require_2fa(self, user, request):
"""2FA required regardless of channel"""
if self.config["require_2fa"] and user.mfa_enabled:
return True
return False
def get_client_identifier(self, request):
"""Consistent client identification"""
# Use combination of IP and user for fair rate limiting
return f"{request.remote_addr}:{request.json.get('username', 'unknown')}"
# API Gateway configuration ensuring consistent security
policies:
authentication:
required: true
methods:
- jwt
- session
rate_limiting:
enabled: true
requests_per_minute: 60
burst: 10
mfa:
required: true
channels:
- web
- mobile
- api
- legacy
routes:
- path: /api/**
policies: [authentication, rate_limiting, mfa]
- path: /v1/auth/**
policies: [authentication, rate_limiting, mfa]
- path: /legacy/**
policies: [authentication, rate_limiting, mfa] # Same policies!
- path: /mobile/**
policies: [authentication, rate_limiting, mfa] # Same policies!
| Finding | CVSS | Severity |
|---|---|---|
| 2FA bypass via alternative channel | 8.8 | High |
| No rate limiting on API channel | 7.5 | High |
| Weaker lockout on mobile API | 6.5 | Medium |
| Different session security | 5.3 | Medium |
| CWE ID | Title | Description |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | Weak channel auth |
| CWE-287 | Improper Authentication | Inconsistent controls |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | Rate limiting gaps |
[ ] All access channels enumerated
[ ] 2FA requirement compared across channels
[ ] Rate limiting compared across channels
[ ] Account lockout compared across channels
[ ] Session token security compared
[ ] OAuth/SSO enforcement checked
[ ] Legacy interfaces tested
[ ] Mobile API tested
[ ] Partner/B2B APIs tested
[ ] Internal endpoints tested
[ ] Findings documented
[ ] Remediation recommendations provided