Authbypass Authentication Flaws

Comprehensive playbook for testing authentication mechanisms during security assessments. Covers the full spectrum: SQL injection login bypasses, password reset token flaws, account enumeration via timing and error messages, brute force evasion techniques, and MFA bypass vectors like session cookies set before 2FA completion. Also includes practical credential testing strategies with service-specific default lists and port prioritization. The structure is methodical, each section has concrete payloads and test cases you can run immediately. This is focused on the login flow itself, not JWT or OAuth token attacks which are handled separately. Good reference when you need to systematically test auth controls and document findings.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill authbypass-authentication-flaws --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Authentication Bypass — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert authentication bypass techniques. Covers SQL injection-based login bypass, password reset flaws, token predictability, account enumeration, brute force bypass, and multi-factor auth bypass. Distinct from JWT/OAuth (covered in ../jwt-oauth-token-attacks/SKILL.md). Focus on the login mechanism itself.

0. AUTHORIZED CREDENTIAL TEST PLANNING

After reducing routing entries, default credentials, username variants, port focus, and wordlist sizing are handled here in one place.

Service-first tiny sets

Service Type	First Usernames	First Passwords
phpMyAdmin	`root`, `admin`	empty, `root`, `phpmyadmin`, `admin`
FTP	`ftp`, `admin`, `test`	empty, `ftp`, `admin`, `123456`
SSH	`root`, `admin`, service account names	`root`, `admin`, seasonal variants
MySQL	`root`, `mysql`	empty, `root`, `mysql`
Tomcat / Java admin	`tomcat`, `admin`, `manager`	`tomcat`, `admin`, `s3cret`
WebLogic	`weblogic`, `admin`	`weblogic`, `welcome1`, `admin`