mcpbeat

Broken Authentication Testing

dokhacgiakhoa/broken authentication testing

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.

4k tokens
context cost
the whole folder, loaded on every use
24
files
instructions only
0
copies elsewhere
how many repositories repackaged it
505
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository 
npx skills add https://github.com/Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI --skill Broken Authentication Testing

What comes with it

11 574 bytes besides the instruction
sub-skills/common-vulnerability-types.md
sub-skills/credential-testing-payloads.md
sub-skills/example-1-account-lockout-bypass.md
sub-skills/example-2-jwt-token-attack.md
sub-skills/example-3-password-reset-token-exploitation.md
sub-skills/legal-requirements.md
sub-skills/phase-1-authentication-mechanism-analysis.md
sub-skills/phase-10-password-reset-testing.md
sub-skills/phase-2-password-policy-testing.md
sub-skills/phase-3-credential-enumeration.md
sub-skills/phase-4-brute-force-testing.md
sub-skills/phase-5-credential-stuffing.md
sub-skills/phase-6-session-management-testing.md
sub-skills/phase-7-session-fixation-testing.md
sub-skills/phase-8-session-timeout-testing.md
sub-skills/phase-9-multi-factor-authentication-testing.md
sub-skills/rate-limiting-bypass-headers.md
sub-skills/required-access.md
sub-skills/required-knowledge.md
sub-skills/required-tools.md
sub-skills/scope-considerations.md
sub-skills/session-cookie-flags.md
sub-skills/technical-limitations.md

The instruction itself

27 sections, as written by the author

Broken Authentication Testing

Purpose

Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management.

Prerequisites

🧠 Knowledge Modules (Fractal Skills)

1. Required Knowledge

2. Required Tools

3. Required Access

4. Phase 1: Authentication Mechanism Analysis

5. Phase 2: Password Policy Testing

6. Phase 3: Credential Enumeration

7. Phase 4: Brute Force Testing

8. Phase 5: Credential Stuffing

9. Phase 6: Session Management Testing

10. Phase 7: Session Fixation Testing

11. Phase 8: Session Timeout Testing

12. Phase 9: Multi-Factor Authentication Testing

13. Phase 10: Password Reset Testing

14. Common Vulnerability Types

15. Credential Testing Payloads

16. Session Cookie Flags

17. Rate Limiting Bypass Headers

18. Legal Requirements

19. Technical Limitations

20. Scope Considerations

21. Example 1: Account Lockout Bypass

22. Example 2: JWT Token Attack

23. Example 3: Password Reset Token Exploitation

How to use it

Copy the folder

Take dokhacgiakhoa/broken authentication testing from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.