技能 broken-authentication-testing

📦

broken-authentication-testing

Name: broken-authentication-testing
Author: sickn33

v1.1 内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问

评估失效身份验证风险

身份验证缺陷可能使账户、会话和重置流程面临被接管的风险。此技能可指导授权测试人员完成结构化检查和报告。

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "broken-authentication-testing" from https://skillstore.io/skills/sickn33-broken-authentication-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-broken-authentication-testing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/sickn33-broken-authentication-testing.md 已签名 manifest GET /api/skills/sickn33-broken-authentication-testing/manifest 已签名 lockfile GET /api/skills/sickn33-broken-authentication-testing/lockfile

测试它

正在使用“broken-authentication-testing”。评估登录流程中的用户名枚举。

预期结果:

发现：有效用户名和无效用户名的登录响应不同。
影响：攻击者可以在密码攻击前识别真实账户。
修复：使用一致的响应消息并规范化响应时间。

正在使用“broken-authentication-testing”。审查会话 cookie 设置。

预期结果:

观察：会话 cookie 包含 Secure 和 HttpOnly 标志。
缺口：缺少 SameSite，这可能会增加跨站请求风险。
建议：根据产品需求将 SameSite 设置为 Lax 或 Strict。

正在使用“broken-authentication-testing”。总结密码重置风险。

预期结果:

风险区域：重置令牌必须随机、短时有效、一次性使用并绑定到账户。
所需证据：令牌有效期、重复使用行为和账户绑定检查。
修复：使已使用的令牌失效，并拒绝跨账户重置尝试。

安全审计

高风险

v4 • 2026/7/6 打开版本化报告

Most external-command detections are false positives caused by Markdown code fences, not executable backtick usage. Several network and blocker findings are confirmed because the skill provides actionable guidance for credential attacks, rate-limit evasion, MFA bypass, session fixation, and password reset account takeover testing. No prompt injection attempt was found in SKILL.md.

已扫描文件

477

分析行数

复核项

已忽略误报

已确认安全问题 (11)

高

SKILL.md:112

System reconnaissance

"/login:username=^USER^&password=^PASS^:Invalid credentials"

The Hydra form string supports automated password attempts against a login endpoint. It is actionable brute-force guidance despite the authorized-testing framing.

高

SKILL.md:263

System reconnaissance

- Previous valid OTP reuse

The OTP reuse item identifies a concrete MFA bypass condition. The use is dual-use and can support unauthorized access if misapplied.

高

SKILL.md:307

System reconnaissance

# Try changing user parameter while using valid token

The instruction to change a user parameter while using a valid token targets password reset authorization logic. This can support account takeover.

高

SKILL.md:260-261

Network reconnaissance

- Skip MFA step by direct URL access

The text recommends skipping the MFA step through direct URL access and response modification. This is actionable authentication bypass guidance.

高

SKILL.md:141-160

Credential Stuffing And Evasion Guidance

The skill instructs testing with breached credential pairs and includes detection evasion steps such as slow rates, IP rotation, randomized user agents, and delays.

The guidance explicitly combines credential stuffing with evasion techniques. Written authorization is mentioned elsewhere, but the operational abuse content is clear.

高

SKILL.md:253-277

MFA Bypass And OTP Attack Workflow

The skill describes OTP brute force, direct MFA step skipping, response modification, OTP reuse, and API version downgrade testing to bypass MFA controls.

The cited section provides multiple concrete MFA bypass techniques and validation steps. These techniques are dual-use but clearly actionable.

高

SKILL.md:216-225

Session Fixation Account Takeover Scenario

The skill gives an attacker workflow where a victim logs in with a fixed attacker-controlled session and the attacker gains an authenticated session.

The section is framed as an attacker scenario and explains the victim interaction needed for session takeover. This is direct exploitation context.

高

SKILL.md:305-314 SKILL.md:464-466

Password Reset Account Takeover Testing

The skill includes reset-token user manipulation, host header injection, and admin email parameter tampering to test whether another account can be reset.

The cited steps target password reset authorization and email routing flaws that can lead to account takeover. The examples are specific and operational.

显示全部 11 条已确认问题

中

SKILL.md:90

System reconnaissance

# Compare responses for valid vs invalid usernames

The text instructs comparing valid and invalid username responses. This is useful for authorized testing but can enable username enumeration.

中

SKILL.md:91

System reconnaissance

# Invalid: "Invalid username" vs Valid: "Invalid password"

The text gives example differential errors for valid and invalid usernames. This can help enumerate accounts before credential attacks.

中

SKILL.md:286-287

Network reconnaissance

# Recovery process

The recovery-process checks can expose ways to disable MFA through account recovery. Legitimate testing is possible, but the business-logic abuse risk is real.

能力复核项 (13)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

SKILL.md:222

Hardcoded URL

https://target.com/login?SESSIONID=attacker_session

The URL appears inside an attacker session-fixation workflow involving a victim login. This is actionable account takeover guidance if used outside an authorized lab.

高

SKILL.md:306

Hardcoded URL

https://target.com/reset?token=abc123&user=victim

The reset URL demonstrates changing a user parameter while using a valid reset token. That pattern can support password reset account takeover testing or abuse.

高

SKILL.md:465

Hardcoded URL

https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com

The reset URL changes the email parameter to an admin account and asks whether an admin password can be reset. This is direct account takeover guidance.

中

SKILL.md:371

Hardcoded IP address

X-Forwarded-For: 127.0.0.1