broken-authentication

仓库创建 2025年6月22日最近提交 1 天前SkillHot 收录 20 天前

▸ 精选理由

对修复常见认证缺陷和防护策略很有帮助

▸ 风险提示

包含攻击性测试方法，应仅在合法授权下执行。

这个 Skill 做什么

检测并利用网站的认证与会话管理缺陷以评估安全风险与修复建议。

系统化检查并利用网站的认证与会话管理缺陷，从弱口令、会话固定到认证绕过和 MFA 配置问题都能覆盖。在你要评估登录、会话或密码策略安全时用得上，适合渗透测试或安全评估阶段。特别之处是结合 OWASP 类别给出可复现的测试方法和具体修复建议，既能验证问题又能指导加固。

▸ 展开 SKILL.md 英文原文

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.

研究检索认证测试会话管理OWASP通用

4.4k

Stars

448

Forks

仓库内 Skill

+70

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/zebbern/claude-code-guide/main/skills/broken-authentication/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/zebbern/claude-code-guide/main/skills/broken-authentication/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Broken Authentication Testing

## Purpose

Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management.

## Prerequisites

### Required Knowledge
- HTTP protocol and session mechanisms
- Authentication types (SFA, 2FA, MFA)
- Cookie and token handling
- Common authentication frameworks

### Required Tools
- Burp Suite Professional or Community
- Hydra or similar brut

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有