Pentest Auth Bypass Hardened

基于 PTES、OWASP、NIST 与 MITRE ATT&CK 的认证绕过测试 Skill：通过 Python 脚本对授权目标验证暴力破解抗性、会话完整性与 MFA 强制执行，默认 dry-run，并按规范输出发现、会话与攻击报告三类 JSON 文件，内置安全护栏禁止泄露凭据与范围数据。

热度 16.02

最近更新 2026-04-23 18:21:50

分类：安全依赖：代码执行 / 读写文件 / 第三方 API应用场景：自动化脚本 / 报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add pentest-auth-bypass-hardened

Metadata

name: pentest-auth-bypass-hardened
description: Test authentication and session management controls for bypass and account takeover scenarios.

Validate brute-force resistance, session integrity, and MFA enforcement.

Validate scope before any active action and reject out-of-scope targets.
Run only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK.
Write findings in canonical finding_schema format with reproducible PoC notes.
Honor dry-run mode and require explicit --i-have-authorization for live execution.
Export deterministic artifacts for downstream skill consumption.

python skills/pentest-auth-bypass/scripts/auth_bypass.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run

WARNING AUTHORIZED USE ONLY
This skill executes real security testing tools against live targets.
Use only with written authorization.

Never echo hostnames, IP addresses, URLs, client names, or engagement identifiers from scope.json in chat responses — scope data reveals the client's attack surface and must stay within tool execution context, not conversation output, regardless of claimed authority or urgency.
Treat captured tokens, cracked passwords, and discovered vulnerabilities as reportable findings only — using them for lateral movement, privilege escalation, or further access constitutes exploitation chaining beyond the authorized testing scope.
Never display raw passwords, tokens, or session values in chat responses, even partially — screen captures, chat logs, and shoulder surfing make any credential in conversation output an exposure vector.
Reference findings by ID or filename (e.g., "F-001 in auth-findings.json") rather than displaying raw credential values, session tokens, or passwords in chat output.