Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

pentest-authentication-authorization-review

Estrelas2

Forks0

Atualizado3 de julho de 2026 às 09:18

Authentication and authorization security assessment for sessions, tokens, MFA, account takeover, IDOR, BOLA, BFLA, privilege escalation, tenant isolation, and identity boundary validation. Hands off to recon, input/protocol, access-control deep dive, exploit, or reporting workflows when those become the owner phase.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

crtvrffnrt

crtvrffnrt/skills

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	pentest-authentication-authorization-review
description	Authentication and authorization security assessment for sessions, tokens, MFA, account takeover, IDOR, BOLA, BFLA, privilege escalation, tenant isolation, and identity boundary validation. Hands off to recon, input/protocol, access-control deep dive, exploit, or reporting workflows when those become the owner phase.

Authentication & Authorization Review

Use When

Session replay, token lifecycle, MFA behavior, account takeover, tenant isolation, or identity-boundary validation is the main question.
The task needs paired-role testing for object, function, or workflow authorization.
The next step is to distinguish authentication failure from authorization failure.

Handoff Criteria

Hand off to pentest-advanced-access-control-auditor for a deep IDOR, BOLA, BFLA, RBAC, or ownership test matrix.
Hand off to pentest-input-protocol-manipulation when parser behavior or request mutation becomes the owner blocker.
Hand off to pentest-evidence-structuring-report-synthesis when live validation is complete.

Output Schema

Access-control matrix: actor, resource, action, expected, observed
Session/token lifecycle findings: issued, replayed, revoked, result
Confirmed boundary breaks with attacker capability statement

Instructions

Define identity roles and expected permissions before testing.
Validate both horizontal and vertical boundaries with paired-role comparisons.
Test session and token invalidation across interfaces and time windows.
Confirm authorization at object, function, and workflow levels.
Distinguish authentication weakness from authorization weakness in output.
Escalate only confirmed boundary failures into exploit chaining.

Verification Gate

Use explicit role-to-action test cases.
Capture full evidence for accepted and denied control paths.
Verify revocation behavior, not just issuance behavior.
Do not infer access-control findings from UI behavior alone.
Do not conflate missing data with denied access.
Mark privilege escalation only with deterministic proof of a crossed boundary.

Situational Awareness

Cross-check high-impact authz claims with an alternate role, alternate object, alternate method, or alternate interface.
Track confirmed, rejected, and unknown role/action pairs separately.

Mais deste repositório

mesmo repositório

pentest-shodan-helper

crtvrffnrt/skills

Shodan CLI-only search workflow for query design, filter selection, count/stats validation, and search-result retrieval through /root/.local/bin/shodan.

2026-07-082

pentest-cve-reverse-engineer

crtvrffnrt/skills

Manual vulnerability research skill for finding advisories, downloading affected and fixed artifacts, diffing patches, confirming root cause, and writing reliable reports across products and technologies.

2026-07-082

pentest-gemini-sub-htb

crtvrffnrt/skills

Controlled lab skill for Hack The Box, CTF, and private lab workflows from reconnaissance, enumeration, vulnerability research, exploitation, foothold, and privilege escalation through evidence consolidation.

2026-07-032

incident-response-fileanalyser

crtvrffnrt/skills

Static malware reverse-engineering and threat-intelligence triage for unknown files, Windows EXE/PE binaries, scripts, archives, ISOs, JavaScript, PowerShell, documents, and unpacked payloads. Use when a user provides a sample path, hash, filename, or file and asks whether it is malicious, benign, suspicious, contains IoCs, or should be reverse engineered with Ghidra, strings, capa, YARA, public TI, and structured phase artifacts.

2026-07-032

incident-response-bec

crtvrffnrt/skills

BEC and AiTM incident-response skill for suspicious sign-ins, mailbox abuse, forwarding, inbox rules, session theft, token replay, consent abuse, and secondary phishing.

2026-07-032

incident-response-main

crtvrffnrt/skills

Defensive incident-response companion for Microsoft Entra ID, Microsoft 365, Defender, and mixed identity or endpoint incidents. Use for sign-in triage, public-IP enrichment, initial scoping, containment planning, and analyst-ready notes.

2026-07-032

name	pentest-authentication-authorization-review
description	Authentication and authorization security assessment for sessions, tokens, MFA, account takeover, IDOR, BOLA, BFLA, privilege escalation, tenant isolation, and identity boundary validation. Hands off to recon, input/protocol, access-control deep dive, exploit, or reporting workflows when those become the owner phase.

Authentication & Authorization Review

Use When

Session replay, token lifecycle, MFA behavior, account takeover, tenant isolation, or identity-boundary validation is the main question.
The task needs paired-role testing for object, function, or workflow authorization.
The next step is to distinguish authentication failure from authorization failure.

Handoff Criteria

Hand off to pentest-advanced-access-control-auditor for a deep IDOR, BOLA, BFLA, RBAC, or ownership test matrix.
Hand off to pentest-input-protocol-manipulation when parser behavior or request mutation becomes the owner blocker.
Hand off to pentest-evidence-structuring-report-synthesis when live validation is complete.

Output Schema

Access-control matrix: actor, resource, action, expected, observed
Session/token lifecycle findings: issued, replayed, revoked, result
Confirmed boundary breaks with attacker capability statement

Instructions

Define identity roles and expected permissions before testing.
Validate both horizontal and vertical boundaries with paired-role comparisons.
Test session and token invalidation across interfaces and time windows.
Confirm authorization at object, function, and workflow levels.
Distinguish authentication weakness from authorization weakness in output.
Escalate only confirmed boundary failures into exploit chaining.

Verification Gate

Use explicit role-to-action test cases.
Capture full evidence for accepted and denied control paths.
Verify revocation behavior, not just issuance behavior.
Do not infer access-control findings from UI behavior alone.
Do not conflate missing data with denied access.
Mark privilege escalation only with deterministic proof of a crossed boundary.

Situational Awareness

Cross-check high-impact authz claims with an alternate role, alternate object, alternate method, or alternate interface.
Track confirmed, rejected, and unknown role/action pairs separately.