Broken Authentication Testing Agent Skill
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI --skill Broken Authentication TestingWhat comes with it
11 574 bytes besides the instructionThe instruction itself
27 sections, as written by the authorBroken Authentication Testing
Purpose
Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management.
Prerequisites
🧠 Knowledge Modules (Fractal Skills)
1. Required Knowledge
2. Required Tools
3. Required Access
4. Phase 1: Authentication Mechanism Analysis
5. Phase 2: Password Policy Testing
6. Phase 3: Credential Enumeration
7. Phase 4: Brute Force Testing
8. Phase 5: Credential Stuffing
9. Phase 6: Session Management Testing
10. Phase 7: Session Fixation Testing
11. Phase 8: Session Timeout Testing
12. Phase 9: Multi-Factor Authentication Testing
13. Phase 10: Password Reset Testing
14. Common Vulnerability Types
15. Credential Testing Payloads
16. Session Cookie Flags
17. Rate Limiting Bypass Headers
18. Legal Requirements
19. Technical Limitations
20. Scope Considerations
21. Example 1: Account Lockout Bypass
22. Example 2: JWT Token Attack
23. Example 3: Password Reset Token Exploitation
Other skills for the same job
different authors, same section of the catalogue
This skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on configuring and testing network services for penetration testing labs.
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
How to use it
Take dokhacgiakhoa/broken authentication testing from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.