Pentest Auth Bypass

核心功能：验证认证机制的暴力破解抵抗性、会话完整性及MFA执行情况，遵循PTES、OWASP等合规标准测试，生成规范可复现的结果。典型场景：授权的Web应用渗透测试，排查认证相关缺陷。输入为范围文件、目标参数等，输出JSON格式的检测报告、有效会话数据等，需明确授权才可执行，支持dry-run预演。

0x-professor

热度 96.93

最近更新 2026-05-11 17:27:54

分类：安全依赖：代码执行 / 读写文件应用场景：报告撰写 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add pentest-auth-bypass

Metadata

name: pentest-auth-bypass
description: Test authentication and session management controls for bypass and account takeover scenarios.

Pentest Auth Bypass

Stage

PTES: 5
MITRE: T1110, T1550

Objective

Validate brute-force resistance, session integrity, and MFA enforcement.

Required Workflow

Validate scope before any active action and reject out-of-scope targets.
Run only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK.
Write findings in canonical finding_schema format with reproducible PoC notes.
Honor dry-run mode and require explicit --i-have-authorization for live execution.
Export deterministic artifacts for downstream skill consumption.

Execution

python skills/pentest-auth-bypass/scripts/auth_bypass.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run

Outputs

auth-findings.json
valid-sessions.json
auth-attack-report.json

References

references/tools.md
skills/autonomous-pentester/shared/scope_schema.json
skills/autonomous-pentester/shared/finding_schema.json

Legal and Ethical Notice

WARNING AUTHORIZED USE ONLY
This skill executes real security testing tools against live targets.
Use only with written authorization.