Skills broken-authentication-testing
📦
broken-authentication-testing
v1.1 Content revision r1 High Risk ⚙️ External commands🌐 Network access
Assess Broken Authentication Risks
Authentication flaws can expose accounts, sessions, and reset workflows to takeover. This skill guides authorized testers through structured checks and reporting.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "broken-authentication-testing" from https://skillstore.io/skills/sickn33-broken-authentication-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-broken-authentication-testing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "broken-authentication-testing". Assess a login flow for username enumeration.
Expected outcome:
- Finding: Login responses differ for valid and invalid usernames.
- Impact: Attackers can identify real accounts before password attacks.
- Remediation: Use a consistent response message and normalize timing.
Using "broken-authentication-testing". Review session cookie settings.
Expected outcome:
- Observation: The session cookie includes Secure and HttpOnly flags.
- Gap: SameSite is missing, which may increase cross-site request risk.
- Recommendation: Set SameSite to Lax or Strict based on product needs.
Using "broken-authentication-testing". Summarize password reset risks.
Expected outcome:
- Risk area: Reset tokens must be random, short lived, single use, and account bound.
- Evidence needed: Token lifetime, reuse behavior, and account binding checks.
- Fix: Invalidate used tokens and reject cross-account reset attempts.
Security Audit
High Riskv4 • 7/6/2026 Open versioned report
Most external-command detections are false positives caused by Markdown code fences, not executable backtick usage. Several network and blocker findings are confirmed because the skill provides actionable guidance for credential attacks, rate-limit evasion, MFA bypass, session fixation, and password reset account takeover testing. No prompt injection attempt was found in SKILL.md.
1
Files scanned
477
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (11)
High
System reconnaissance
"/login:username=^USER^&password=^PASS^:Invalid credentials"
The Hydra form string supports automated password attempts against a login endpoint. It is actionable brute-force guidance despite the authorized-testing framing.
High
System reconnaissance
- Previous valid OTP reuse
The OTP reuse item identifies a concrete MFA bypass condition. The use is dual-use and can support unauthorized access if misapplied.
High
System reconnaissance
# Try changing user parameter while using valid token
The instruction to change a user parameter while using a valid token targets password reset authorization logic. This can support account takeover.
High
Network reconnaissance
- Skip MFA step by direct URL access
The text recommends skipping the MFA step through direct URL access and response modification. This is actionable authentication bypass guidance.
High
Credential Stuffing And Evasion Guidance
The skill instructs testing with breached credential pairs and includes detection evasion steps such as slow rates, IP rotation, randomized user agents, and delays.
The guidance explicitly combines credential stuffing with evasion techniques. Written authorization is mentioned elsewhere, but the operational abuse content is clear.
High
MFA Bypass And OTP Attack Workflow
The skill describes OTP brute force, direct MFA step skipping, response modification, OTP reuse, and API version downgrade testing to bypass MFA controls.
The cited section provides multiple concrete MFA bypass techniques and validation steps. These techniques are dual-use but clearly actionable.
High
Session Fixation Account Takeover Scenario
The skill gives an attacker workflow where a victim logs in with a fixed attacker-controlled session and the attacker gains an authenticated session.
The section is framed as an attacker scenario and explains the victim interaction needed for session takeover. This is direct exploitation context.
High
Password Reset Account Takeover Testing
The skill includes reset-token user manipulation, host header injection, and admin email parameter tampering to test whether another account can be reset.
The cited steps target password reset authorization and email routing flaws that can lead to account takeover. The examples are specific and operational.
Show all 11 confirmed findings
Medium
System reconnaissance
# Compare responses for valid vs invalid usernames
The text instructs comparing valid and invalid username responses. This is useful for authorized testing but can enable username enumeration.
Medium
System reconnaissance
# Invalid: "Invalid username" vs Valid: "Invalid password"
The text gives example differential errors for valid and invalid usernames. This can help enumerate accounts before credential attacks.
Medium
Network reconnaissance
# Recovery process
The recovery-process checks can expose ways to disable MFA through account recovery. Legitimate testing is possible, but the business-logic abuse risk is real.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
https://target.com/login?SESSIONID=attacker_session
The URL appears inside an attacker session-fixation workflow involving a victim login. This is actionable account takeover guidance if used outside an authorized lab.
High
Hardcoded URL
https://target.com/reset?token=abc123&user=victim
The reset URL demonstrates changing a user parameter while using a valid reset token. That pattern can support password reset account takeover testing or abuse.
High
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
The reset URL changes the email parameter to an admin account and asks whether an admin password can be reset. This is direct account takeover guidance.
Medium
Hardcoded IP address
X-Forwarded-For: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
Hardcoded IP address
X-Real-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
Hardcoded IP address
X-Originating-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
Hardcoded IP address
X-Client-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
Hardcoded IP address
X-Remote-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
Hardcoded IP address
True-Client-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
Hardcoded IP address
X-Forwarded-For: 192.168.1.1
The private IP is used in an account lockout bypass example that rotates X-Forwarded-For values. The context is evasion of authentication rate limits.
Medium
Hardcoded IP address
X-Forwarded-For: 192.168.1.2
The private IP is used in an account lockout bypass example that rotates X-Forwarded-For values. The context is evasion of authentication rate limits.
Low
Python HTTP libraries
response = requests.get("https://target.com/login")
The Python example performs repeated HTTP requests to a target login endpoint to collect session tokens. This is expected security-testing behavior but still creates network activity against a target application.
Low
Hardcoded URL
response = requests.get("https://target.com/login")
The hardcoded URL is a placeholder in a copyable token-collection example. It is not a hidden callback, but it normalizes active requests against a login endpoint.
Risk Factors
⚙️ External commands (40)
SKILL.md:47-60 SKILL.md:60-64 SKILL.md:64-70 SKILL.md:70-76 SKILL.md:76-81 SKILL.md:81-89 SKILL.md:89-93 SKILL.md:93-102 SKILL.md:102-108 SKILL.md:108-121 SKILL.md:121-125 SKILL.md:125-139 SKILL.md:139-145 SKILL.md:145-160 SKILL.md:160-166 SKILL.md:166-175 SKILL.md:175-179 SKILL.md:179-195 SKILL.md:195-201 SKILL.md:201-214 SKILL.md:214-218 SKILL.md:218-225 SKILL.md:225-231 SKILL.md:231-247 SKILL.md:247-253 SKILL.md:253-277 SKILL.md:277-281 SKILL.md:281-289 SKILL.md:289-295 SKILL.md:295-314 SKILL.md:314-333 SKILL.md:333-355 SKILL.md:355-370 SKILL.md:370-377 SKILL.md:377-405 SKILL.md:405-424 SKILL.md:424-430 SKILL.md:430-445 SKILL.md:445-451 SKILL.md:451-467
Detected Patterns
System reconnaissance×5Network reconnaissance×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-broken-authentication-testing/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-broken-authentication-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-broken-authentication-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-broken-authentication-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-broken-authentication-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). broken-authentication-testing security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-broken-authentication-testing/audits/4BibTeX citation
@techreport{sickn33-sickn33-broken-authentication-testing-2026,
author = {sickn33},
title = {broken-authentication-testing security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-broken-authentication-testing/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "broken-authentication-testing security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-broken-authentication-testing/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-broken-authentication-testing:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Prelaunch Authentication Review
Assess login, reset, and session controls before a web application release.
Penetration Test Planning
Build an authorized test plan for authentication and session management weaknesses.
Remediation Verification
Confirm that password policy, lockout, MFA, and reset fixes work as intended.
Try These Prompts
Plan A Safe Assessment
Create a scoped broken authentication test plan for my authorized application. Include prerequisites, test accounts, safety limits, and report sections.
Review Password Controls
Help me assess password policy and username enumeration risks for this login flow. Focus on observations, safe tests, and remediation.
Evaluate Session Security
Analyze my session handling design for cookie flags, token rotation, idle timeout, absolute timeout, and logout invalidation gaps.
Build An Auth Report
Turn these authorized authentication test notes into a professional report with risk ratings, evidence summaries, impact, and remediation steps.
Best Practices
- Use only authorized targets, scoped test accounts, and approved testing windows.
- Prefer defensive validation and evidence collection over aggressive automation.
- Document impact, reproduction boundaries, and concrete remediation for each finding.
Avoid
- Running credential attacks against production users or unapproved systems.
- Testing with real breached credentials or accessing real user accounts.
- Sharing bypass steps without context, authorization limits, and remediation.
Frequently Asked Questions
Is this skill only for authorized testing?
Yes. It should only be used with written authorization, scoped targets, and approved test accounts.
Can it run tests automatically?
No. It provides methodology and reporting guidance. The user controls any testing tools and target access.
What authentication areas does it cover?
It covers password policies, username enumeration, brute-force defenses, sessions, MFA, and password reset workflows.
Does it support Claude, Codex, and Claude Code?
Yes. The generated metadata lists Claude, Codex, and Claude Code as supported tools.
What evidence should a tester collect?
Collect scoped requests, response differences, session behavior, timestamps, screenshots, and remediation notes.
What are the main safety limits?
Do not test real users, real breached credentials, third-party providers, or production systems without explicit approval.