What is broken authentication in web security?

Broken authentication refers to vulnerabilities in an application's login and session management mechanisms that allow attackers to compromise passwords, keys, or session tokens to assume user identities.

How does this skill help with OWASP compliance?

It provides structured methodologies to test for vulnerabilities listed in the OWASP Top 10, specifically focusing on 'Identification and Authentication Failures' (formerly Broken Authentication).

Does it support multi-factor authentication (MFA) testing?

Yes, it includes specific phases for testing MFA enrollment, OTP bypass techniques, and API version downgrade attacks to ensure multi-layered security is effective.

Can I use this for automated brute-force testing?

Yes, the skill includes detailed workflows for using tools like Hydra and Burp Suite to simulate brute-force and credential stuffing attacks while testing account lockout policies.

Broken Authentication Security Testing

Name: Broken Authentication Security Testing
Author: claudiodearaujo

byclaudiodearaujo

•

Security & Testing

Identifies and evaluates authentication and session management vulnerabilities in web applications to prevent unauthorized access and account takeovers.

This skill provides a comprehensive framework for security professionals and developers to audit web application authentication mechanisms against OWASP standards. It guides users through critical testing phases, including password policy evaluation, credential stuffing simulations, session fixation analysis, and multi-factor authentication (MFA) bypass testing. By identifying weaknesses in token entropy, lockout policies, and reset workflows, it helps teams harden their security posture and protect sensitive user data from identity theft and unauthorized system access.

Key Features

01Comprehensive MFA and password reset workflow auditing

021 GitHub stars

03Automated credential stuffing and brute-force simulation techniques

04Detailed username enumeration and account lockout testing

05In-depth session management and token entropy analysis

06Standardized security reporting with actionable remediation guidance

Use Cases

01Validating the robustness of multi-factor authentication (MFA) implementations

02Conducting penetration tests on web application login systems

03Auditing session handling and token security for regulatory compliance

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add claudiodearaujo/sistema-de-narra-o-de-livro broken-authentication

For use in Claude.ai and ChatGPT

Download Skill