Can I use this for automated brute-force testing?

Yes, the skill includes workflows for using tools like Hydra and Burp Suite to test for account lockout mechanisms and rate-limiting.

Does it cover modern authentication methods like JWT?

Yes, it includes specific phases for analyzing and attacking JSON Web Tokens, including algorithm manipulation and token-based session flaws.

What is broken authentication testing?

It is the process of identifying flaws in how an application manages user identity, credentials, and session state to prevent unauthorized access.

How does this skill help with OWASP compliance?

It provides standardized testing methodologies specifically designed to detect vulnerabilities listed in the OWASP Top 10, such as Broken Authentication.

Is multi-factor authentication (MFA) testing included?

Absolutely. The skill covers MFA enrollment security, OTP brute-forcing, and common bypass techniques used by attackers.

Broken Authentication Security Testing

Name: Broken Authentication Security Testing
Author: claudiodearaujo

byclaudiodearaujo

•

Security & Testing

Identifies and evaluates authentication and session management vulnerabilities in web applications to prevent unauthorized access and identity theft.

The Broken Authentication Testing skill provides a comprehensive framework for security professionals and developers to assess the robustness of application login and session mechanisms. Covering critical OWASP vulnerabilities, it guides users through testing password policies, credential enumeration, brute-force protections, multi-factor authentication (MFA) bypasses, and session management flaws like fixation or insufficient timeouts. By following these structured methodologies, teams can proactively secure their authentication pipelines against common attack vectors like credential stuffing and account takeover, ensuring sensitive user data remains protected.

Key Features

011 GitHub stars

02Comprehensive password policy and enforcement evaluation

03Detailed session management analysis including entropy and timeouts

04Credential enumeration and brute-force protection testing

05Automated workflows for password reset and JWT vulnerability detection

06Multi-factor authentication (MFA) bypass and enrollment testing

Use Cases

01Performing a security audit on a new web application login system

02Testing session token security and multi-factor authentication implementations

03Validating the effectiveness of account lockout and rate-limiting policies

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add claudiodearaujo/sistema-de-narra-o-de-livro broken-authentication

For use in Claude.ai and ChatGPT

Download Skill