pentest-authn
Testing authorized authentication and session handling: credential handling, password reset, MFA, session strength, fixation, lifetime and cookie flags, and JWT weaknesses. Read when testing login, sessions or tokens.
- License 许可
- Apache-2.0
- 所属仓库
- enowdev/enowxcli
- 最近更新
- 2026-10-06
- Stars
- ★ 67
- Forks
- 21
01 前言 Front Matter
- name
- pentest-authn
- description
- Testing authorized authentication and session handling: credential handling, password reset, MFA, session strength, fixation, lifetime and cookie flags, and JWT weaknesses. Read when testing login, sessions or tokens.
03 SKILL.md 正文
Authentication and sessions
Authentication proves who you are; session handling remembers it. Both fail often. Authorized targets only.
Authentication
- Credential handling: is login rate-limited? Does it lock out? Are usernames enumerable through different responses or timing for valid versus invalid users?
- Password reset: is the token long, random, single-use and expiring? Can the reset be pointed at another account? Does the response leak whether an email exists?
- MFA: can it be skipped by going straight to the post-login endpoint? Is the second factor rate-limited against brute force?
Sessions
- Token strength: is the session id long and random, or guessable?
- Fixation: does the session id change on login? If not, a fixed id can be planted.
- Lifetime: does logout invalidate the token server-side, or only drop the cookie? Does the token expire?
- Flags:
HttpOnly,Secure, and a sensibleSameSiteon the cookie.
JWTs, when used
- alg=none: does the server accept a token with the signature removed and the algorithm set to none?
- Weak secret: is an HS256 token signed with a guessable secret?
- Confusion: does the server accept a token signed with the public key as an HMAC secret?
- Claims: is
expchecked? Can a role claim be edited?
Recording
The exact request, the flaw demonstrated, the impact (account takeover is critical), and the fix.
04 同仓库更多 Skills
demo-skill
Project-scope demo skill for tests.
writing
Writing words people read: the specific thing instead of claims, words to drop, sentences, interface copy (buttons, labels, errors, empty states, confirmations), page copy, notifications and emails, alt text and link text, numbers and dates, words that translate well, documentation and voice. Read before writing a page's copy, an interface's text or a document.
ui
Designing or restyling an interface: direction, layout, type, colour, icons, components, states, responsive behaviour. Read before building a page, a screen or a set of components.
ui-themes
Light and dark themes, and colour that holds in both: tokens with a value per theme, and what each kind of content needs to stay visible (icons, SVG drawings and line art, logos, photos, screenshots, charts, code, maps, borders, shadows, focus, form controls), switching without a flash, and checking both. Read before building a second theme or a theme toggle, and before any drawing, logo or chart on a page that has two themes.
ui-structure
Structure before styling: the blueprint written before any interface code (the screen's job, the regions its kind of page needs, their order and why, the layout skeleton in numbers, the components and their states), the anatomy and order of a homepage, a dashboard, a list, a detail page, settings, a form, sign-in, pricing, docs, an article and a checkout, and how to turn the blueprint into code (tokens, layout primitives, components, sections, page). Read first, before building or rebuilding any page or screen.
ui-stack-vue
Building interfaces in Vue 3 and Nuxt: project layout, script setup with typed defineProps, defineEmits and defineModel, attribute fallthrough, slots and scoped slots, template refs, ref, reactive and computed, watch versus watchEffect, composables and VueUse, provide and inject, Pinia, keyed v-for, transitions, Nuxt 4 (app directory, pages, layouts, useFetch and useAsyncData keys, $fetch in handlers, server routes, runtime config, useSeoMeta, NuxtImg, middleware), VeeValidate forms, Reka UI and Nuxt UI, testing, vue-tsc, and the traps. Read when the project uses Vue or Nuxt.