技能 broken-authentication
📦
broken-authentication
v1.1 内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问
评估失效身份验证风险
身份验证缺陷可能导致账户接管和数据泄露。此技能指导授权测试人员对密码、会话、MFA 和重置流程进行结构化检查。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "broken-authentication" from https://skillstore.io/skills/sickn33-broken-authentication.md and its manifest at https://skillstore.io/api/skills/sickn33-broken-authentication/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“broken-authentication”。 审查限定范围的预发布应用程序的登录、重置和 MFA 流程。
预期结果:
一份结构化评估计划，涵盖测试账户、允许的端点、控制检查、证据需求和安全停止条件。
正在使用“broken-authentication”。 根据测试人员笔记总结会话管理发现。
预期结果:
一份发现摘要，包含受影响的控制、风险评级、观察到的行为、用户影响和修复建议。
正在使用“broken-authentication”。 为身份验证修复准备重新测试检查清单。
预期结果:
一份聚焦于锁定、枚举、MFA 恢复、会话超时、重置令牌绑定和报告证据的检查清单。
安全审计
高风险v4 • 2026/7/6 打开版本化报告
Most external-command detections are Markdown fence false positives, not executable backtick usage. The skill still contains high-risk authentication attack workflows, including brute-force testing, credential-stuffing evasion, MFA bypass, session fixation, JWT forgery, and password-reset account takeover techniques. Publication should require stronger authorization gating and removal or narrowing of offensive execution guidance.
1
已扫描文件
482
分析行数
14
复核项
0
已忽略误报
已确认安全问题 (12)
高
System reconnaissance
"/login:username=^USER^&password=^PASS^:Invalid credentials"
The line is part of a Hydra form-based login attack command using username and password payload markers. This enables credential brute-force testing and is dangerous without authorization.
高
System reconnaissance
- Previous valid OTP reuse
The line names reuse of a previous valid OTP as an MFA bypass technique. That is a direct authentication bypass test with account takeover impact.
高
System reconnaissance
# Try changing user parameter while using valid token
The line instructs changing the user parameter while using a valid reset token. This is a password reset account takeover technique.
高
Network reconnaissance
- Skip MFA step by direct URL access
The line suggests skipping MFA through direct URL access. This is an authentication bypass technique that can lead to account takeover.
高
Credential Attack and Evasion Workflow
The skill provides brute-force and credential-stuffing procedures, including Hydra usage, breached credential pairs, and source IP or user-agent rotation guidance.
The cited sections explicitly cover brute force testing, credential stuffing, credential payloads, and lockout bypass via IP rotation. Authorization language exists, but the procedures are directly usable for account attack workflows.
高
MFA Bypass Workflow
The skill instructs OTP brute forcing, direct URL MFA skipping, response manipulation, empty OTP submission, OTP reuse, and API version downgrade testing.
The MFA section lists multiple concrete bypass methods and payload strategies. These are legitimate in a lab, but harmful if applied outside authorized scope.
高
Account Takeover Through Session and Reset Abuse
The skill describes session fixation and password reset token manipulation workflows that can transfer or reset another user account.
The cited sections describe fixed-session victim login and changing reset user parameters. These are clear account takeover paths when controls are vulnerable.
高
JWT Token Forgery Workflow
The skill walks through modifying a JWT to use the none algorithm, changing the role to admin, and submitting the modified bearer token.
The example gives a complete token forgery flow with role escalation and replay. It is clearly a security test, but it is operationally useful for unauthorized privilege escalation.
显示全部 12 条已确认问题
中
System reconnaissance
# Compare responses for valid vs invalid usernames
The line instructs comparing valid and invalid username responses. This is username enumeration testing and can disclose account existence if used against an unauthorized target.
中
System reconnaissance
# Invalid: "Invalid username" vs Valid: "Invalid password"
The line gives differential error messages for valid and invalid usernames. That is a concrete account enumeration signal.
中
Network reconnaissance
# Recovery process
The recovery-process section asks whether MFA can be disabled via email alone. This is a valid security test, but it also identifies account recovery bypass opportunities.
低
System reconnaissance
username=valid&password=valid
The credentials appear inside a session fixation validation flow. It can be legitimate with test accounts, but it still supports checking whether a fixed session remains usable after login.
能力复核项 (14)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Hardcoded IP address
X-Forwarded-For: 192.168.1.1
The IP is used in an account lockout bypass example with X-Forwarded-For rotation. This directly supports repeated login attempts against a target.
高
Hardcoded IP address
X-Forwarded-For: 192.168.1.2
The IP is the next rotated X-Forwarded-For value in the lockout bypass example. The context is evading authentication protections across attempts.
中
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
The URL adds an admin email parameter to a reset token to test account takeover. This is a concrete password reset abuse pattern despite using a placeholder host.
中
Hardcoded IP address
X-Forwarded-For: 127.0.0.1
The IP appears in a list of spoofed forwarding headers for rate-limit bypass testing. This can help evade account lockout or throttling controls if misused.
中
Hardcoded IP address
X-Real-IP: 127.0.0.1
The IP appears in a spoofed client IP header for rate-limit bypass testing. This can help evade throttling controls when applied to a vulnerable target.
中
Hardcoded IP address
X-Originating-IP: 127.0.0.1
The IP appears in an originating IP header used for rate-limit bypass testing. The context is explicit evasion of authentication rate controls.
中
Hardcoded IP address
X-Client-IP: 127.0.0.1
The IP appears in a client IP header used for rate-limit bypass testing. The technique can weaken brute-force defenses when a target trusts the header.
中
Hardcoded IP address
X-Remote-IP: 127.0.0.1
The IP appears in a remote IP header used for rate-limit bypass testing. This is an evasion technique against authentication rate controls.
中
Hardcoded IP address
True-Client-IP: 127.0.0.1
The IP appears in a True-Client-IP header used for rate-limit bypass testing. It can support bypass attempts if a target trusts forwarded IP values.
低
Python HTTP libraries
response = requests.get("https://target.com/login")
The Python example uses requests in a loop to collect session cookies from a login URL. This is expected for scoped testing, but it can generate network traffic against a target if executed.
低
Hardcoded URL
response = requests.get("https://target.com/login")
The hardcoded login URL appears inside a runnable HTTP request example. It is a placeholder, but it demonstrates live requests to an authentication endpoint.
低
Hardcoded URL
https://target.com/login?SESSIONID=attacker_session
The URL is part of a session fixation attack scenario that sends a fixed session value to a victim. The host is illustrative, but the workflow is an account takeover technique.
低
Hardcoded URL
https://target.com/reset?token=abc123&user=victim
The reset URL is used to demonstrate token and user parameter manipulation. It is a placeholder, but the surrounding workflow tests password reset abuse.
低
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6
The reset link is used as an example token for password reset exploitation testing. The domain is illustrative, but the workflow can be harmful outside authorization.
风险因素
⚙️ 外部命令 (40)
SKILL.md:49-62 SKILL.md:62-66 SKILL.md:66-72 SKILL.md:72-78 SKILL.md:78-83 SKILL.md:83-91 SKILL.md:91-95 SKILL.md:95-104 SKILL.md:104-110 SKILL.md:110-123 SKILL.md:123-127 SKILL.md:127-141 SKILL.md:141-147 SKILL.md:147-162 SKILL.md:162-168 SKILL.md:168-177 SKILL.md:177-181 SKILL.md:181-197 SKILL.md:197-203 SKILL.md:203-216 SKILL.md:216-220 SKILL.md:220-227 SKILL.md:227-233 SKILL.md:233-249 SKILL.md:249-255 SKILL.md:255-279 SKILL.md:279-283 SKILL.md:283-291 SKILL.md:291-297 SKILL.md:297-316 SKILL.md:316-335 SKILL.md:335-357 SKILL.md:357-372 SKILL.md:372-379 SKILL.md:379-407 SKILL.md:407-426 SKILL.md:426-432 SKILL.md:432-447 SKILL.md:447-453 SKILL.md:453-469
检测到的模式
System reconnaissance×6Network reconnaissance×2
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/sickn33-broken-authentication/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-broken-authentication?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-broken-authentication?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-broken-authentication/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-broken-authentication.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
sickn33. (2026). broken-authentication security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-broken-authentication/audits/4BibTeX 引用
@techreport{sickn33-sickn33-broken-authentication-2026,
author = {sickn33},
title = {broken-authentication security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-broken-authentication/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "broken-authentication security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-broken-authentication/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-broken-authentication:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
68
社区
83
规范符合性
你能构建什么
准备身份验证测试计划
在 Web 应用程序评估前，为登录、锁定、密码策略和枚举定义限定范围的检查。
审查会话管理
为应用程序发布评估 cookie 标志、会话重新生成、超时行为和注销处理。
验证修复
重新测试身份验证修复，并通过清晰证据记录先前发现是否已解决。
试试这些提示
开始限定范围的审查
为 [application] 创建授权的失效身份验证测试计划。范围是 [environment]，测试账户是 [accounts]，排除区域是 [limits]。
评估会话控制
审查 [application] 的会话管理控制。重点关注 cookie 标志、令牌重新生成、空闲超时、绝对超时和注销失效。
评估 MFA 和重置流程
评估 [application] 的 MFA 和密码重置安全性。仅使用授权测试账户，并总结风险、所需证据和安全修复指导。
生成执行层报告
将这些身份验证测试笔记整理成一份简明报告，包含范围、发现、严重性、业务影响、证据摘要和修复步骤。
最佳实践
- 在任何评估之前确认书面授权、目标范围和测试账户。
- 测试破坏性身份验证行为时，优先使用预发布或实验室环境。
- 仔细记录证据，并在控制表现出不安全行为时停止测试。
避免
- 在没有明确批准的情况下测试生产用户或真实泄露凭证。
- 在定义限制和监控联系人之前运行暴力破解或绕过测试。
- 报告利用步骤时缺少清晰的修复建议和业务影响说明。
常见问题
此技能评估哪些内容？
它评估密码策略、账户锁定、枚举、会话、MFA 和密码重置控制。
谁应该使用它？
仅供经过培训的测试人员、应用安全团队或获批审计人员用于授权安全测试。
它可以测试生产系统吗？
生产测试需要明确的书面批准、定义好的速率限制、测试账户和监控协调。
它能替代完整的渗透测试吗？
不能。它支持身份验证审查，但更广泛的应用逻辑、基础设施和监控仍需要单独评估。
测试人员应收集哪些证据？
收集限定范围的请求详情、时间戳、受影响的控制、观察到的行为、适当情况下的截图，以及修复验证笔记。
应如何处理高风险测试？
尽可能在预发布环境中运行高风险测试，使用测试账户，设置停止条件，并与系统所有者协调。