[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78HJB8YAXF37AGE2B676PFX":3,"skill-same:01M78HJB8YAXF37AGE2B676PFX":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":13,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":33,"install":34,"resources":47},"01M78HJB8YAXF37AGE2B676PFX","ato-methodology",null,"Account Takeover decision tree — 9 canonical ATO paths, chaining patterns (IDOR→ATO, XSS→ATO, OAuth→ATO), MFA bypass entry points.","dnzengou\u002Fevo-decepticon","dnzengou","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F7807581?v=4","01M75KKJA3F5ZP7CA10MB2AEXC","01M78GP0FED2V1CDPB1N6G0CTH",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fato-methodology\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: ato-methodology\ndescription: Account Takeover decision tree — 9 canonical ATO paths, chaining patterns (IDOR→ATO, XSS→ATO, OAuth→ATO), MFA bypass entry points.\nmetadata:\n  when_to_use: \"ato account takeover hijack chain password reset email change\"\n  mitre_attack: T1078, T1110, T1528, T1539\n  subdomain: authentication\n  upstream_ref: skills\u002F_corpus\u002Fpayloads\u002FAccount Takeover\u002F\n---\n\n# Account Takeover (ATO) Methodology\n\nATO is an outcome, not a vuln class. Reach it via 9 canonical paths.\n\n## 1. Password reset flaws\n- Token in URL leaked to Referer (3rd-party CDN, analytics)\n- Token guessable (timestamp + user_id, sequential int, predictable RNG)\n- Token-no-expiry → reuse forever\n- Reset accepts arbitrary email param (mass-assignment style)\n- Token not invalidated after password change\n- \"Forgot username\" flows revealing existence\n\n## 2. Email change without re-auth\n`POST \u002Fapi\u002Fusers\u002Fme\u002Femail {email: ...}` without verifying current password.\nOr with verification but verification token leaks.\n\n## 3. Session fixation\nServer accepts attacker-set session cookie. Victim's actions bind to attacker's session.\n\n## 4. JWT-based ATO\nSee `skills\u002Fexploit\u002Fweb\u002Fjwt\u002FSKILL.md` — alg confusion, weak secret, kid injection.\n\n## 5. OAuth-based ATO\nSee `skills\u002Fexploit\u002Fweb\u002Foauth\u002FSKILL.md` — redirect_uri bypass + open-redirect chain → code to attacker.\n\n## 6. IDOR-based ATO\n- `PATCH \u002Fapi\u002Fusers\u002F\u003Cid>` w\u002Fo auth check → change victim's email\u002Fpassword\n- `GET \u002Fapi\u002Fusers\u002F\u003Cid>\u002Fsessions` → harvest victim's session tokens\n\n## 7. XSS-based ATO\nStored XSS on victim-visible page → exfil cookie \u002F session token to attacker.\n\n## 8. CSRF on critical state\n- CSRF on password change endpoint (no anti-CSRF token)\n- CSRF on email change\n- CSRF on MFA disable\n\n## 9. MFA bypass\n- TOTP code accepted multiple times w\u002F short delay (race)\n- TOTP code accepted from past N-step (clock skew abuse)\n- Backup-code flow doesn't enforce TOTP\n- \"Trust this device\" w\u002Fo re-auth on critical action\n- Account recovery bypasses MFA entirely\n- Phone-number takeover (SIM swap) → SMS 2FA hijack\n\n## Chain table\n\n| Primary vuln | Chain partner | Outcome |\n|---|---|---|\n| Open redirect | OAuth redirect_uri allowlist | OAuth code → attacker → ATO |\n| XSS (reflected) | session cookie not HttpOnly | Cookie exfil → ATO |\n| XSS (stored) | victim views page | Cookie \u002F session-storage exfil → ATO |\n| IDOR on email change | reset flow | Change victim's email, reset, login |\n| CSRF on password change | predictable URL | Phishing email triggers password change |\n| Predictable reset token | weak RNG audit | Generate victim's token offline → reset |\n| OAuth state missing | account linking by email | Attacker pre-creates account, links victim's OAuth → ATO |\n| JWT alg=none | server accepts | Mint admin JWT → ATO |\n| Email change w\u002Fo re-auth + ATO of email | full account graph | Standard playbook for multi-tenant SaaS |\n\n## Decision tree\n\n```\nHas user MFA enabled?\n├── No → Standard password-reset attacks (paths 1-3, 6, 8)\n└── Yes →\n    Bypass MFA available?\n    ├── Yes (path 9) → MFA bypass → standard reset\n    └── No → Look for paths 5, 7 (OAuth, XSS) that bypass MFA by design\n              OR path 4 (JWT) that doesn't touch the MFA flow\n              OR account-linking via OAuth (path 5) which often skips MFA\n```\n\n## PoC framing\n\nEvery ATO PoC should:\n- Attacker creates own account\n- Demonstrate victim's account is fully controllable (login as victim, change their email, post as them)\n- Capture video or step-by-step screenshots\n- Show no destructive action taken on victim's actual data — just proof of access\n\n## Severity\n\nATO is always Critical (9.8-10.0) when fully achieved. Severity downgrade only when:\n- Requires user interaction (click malicious link) — High 8-9 typically\n- Requires multiple vulns to chain — capture the chain in single report\n- Limited to specific user types — caveat in impact\n\n## Cross-references\n- Upstream: `skills\u002F_corpus\u002Fpayloads\u002FAccount Takeover\u002F`\n- JWT: `skills\u002Fexploit\u002Fweb\u002Fjwt\u002FSKILL.md`\n- OAuth: `skills\u002Fexploit\u002Fweb\u002Foauth\u002FSKILL.md`\n- IDOR: `skills\u002Fanalyst\u002Fidor.md`\n- XSS: `skills\u002Fexploit\u002Fweb\u002Fxss.md`\n- Open redirect: `skills\u002Fexploit\u002Fweb\u002Fopen-redirect\u002FSKILL.md`\n","# Account Takeover (ATO) Methodology\n\nATO is an outcome, not a vuln class. Reach it via 9 canonical paths.\n\n## 1. Password reset flaws\n- Token in URL leaked to Referer (3rd-party CDN, analytics)\n- Token guessable (timestamp + user_id, sequential int, predictable RNG)\n- Token-no-expiry → reuse forever\n- Reset accepts arbitrary email param (mass-assignment style)\n- Token not invalidated after password change\n- \"Forgot username\" flows revealing existence\n\n## 2. Email change without re-auth\n`POST \u002Fapi\u002Fusers\u002Fme\u002Femail {email: ...}` without verifying current password.\nOr with verification but verification token leaks.\n\n## 3. Session fixation\nServer accepts attacker-set session cookie. Victim's actions bind to attacker's session.\n\n## 4. JWT-based ATO\nSee `skills\u002Fexploit\u002Fweb\u002Fjwt\u002FSKILL.md` — alg confusion, weak secret, kid injection.\n\n## 5. OAuth-based ATO\nSee `skills\u002Fexploit\u002Fweb\u002Foauth\u002FSKILL.md` — redirect_uri bypass + open-redirect chain → code to attacker.\n\n## 6. IDOR-based ATO\n- `PATCH \u002Fapi\u002Fusers\u002F\u003Cid>` w\u002Fo auth check → change victim's email\u002Fpassword\n- `GET \u002Fapi\u002Fusers\u002F\u003Cid>\u002Fsessions` → harvest victim's session tokens\n\n## 7. XSS-based ATO\nStored XSS on victim-visible page → exfil cookie \u002F session token to attacker.\n\n## 8. CSRF on critical state\n- CSRF on password change endpoint (no anti-CSRF token)\n- CSRF on email change\n- CSRF on MFA disable\n\n## 9. MFA bypass\n- TOTP code accepted multiple times w\u002F short delay (race)\n- TOTP code accepted from past N-step (clock skew abuse)\n- Backup-code flow doesn't enforce TOTP\n- \"Trust this device\" w\u002Fo re-auth on critical action\n- Account recovery bypasses MFA entirely\n- Phone-number takeover (SIM swap) → SMS 2FA hijack\n\n## Chain table\n\n| Primary vuln | Chain partner | Outcome |\n|---|---|---|\n| Open redirect | OAuth redirect_uri allowlist | OAuth code → attacker → ATO |\n| XSS (reflected) | session cookie not HttpOnly | Cookie exfil → ATO |\n| XSS (stored) | victim views page | Cookie \u002F session-storage exfil → ATO |\n| IDOR on email change | reset flow | Change victim's email, reset, login |\n| CSRF on password change | predictable URL | Phishing email triggers password change |\n| Predictable reset token | weak RNG audit | Generate victim's token offline → reset |\n| OAuth state missing | account linking by email | Attacker pre-creates account, links victim's OAuth → ATO |\n| JWT alg=none | server accepts | Mint admin JWT → ATO |\n| Email change w\u002Fo re-auth + ATO of email | full account graph | Standard playbook for multi-tenant SaaS |\n\n## Decision tree\n\n```\nHas user MFA enabled?\n├── No → Standard password-reset attacks (paths 1-3, 6, 8)\n└── Yes →\n    Bypass MFA available?\n    ├── Yes (path 9) → MFA bypass → standard reset\n    └── No → Look for paths 5, 7 (OAuth, XSS) that bypass MFA by design\n              OR path 4 (JWT) that doesn't touch the MFA flow\n              OR account-linking via OAuth (path 5) which often skips MFA\n```\n\n## PoC framing\n\nEvery ATO PoC should:\n- Attacker creates own account\n- Demonstrate victim's account is fully controllable (login as victim, change their email, post as them)\n- Capture video or step-by-step screenshots\n- Show no destructive action taken on victim's actual data — just proof of access\n\n## Severity\n\nATO is always Critical (9.8-10.0) when fully achieved. Severity downgrade only when:\n- Requires user interaction (click malicious link) — High 8-9 typically\n- Requires multiple vulns to chain — capture the chain in single report\n- Limited to specific user types — caveat in impact\n\n## Cross-references\n- Upstream: `skills\u002F_corpus\u002Fpayloads\u002FAccount Takeover\u002F`\n- JWT: `skills\u002Fexploit\u002Fweb\u002Fjwt\u002FSKILL.md`\n- OAuth: `skills\u002Fexploit\u002Fweb\u002Foauth\u002FSKILL.md`\n- IDOR: `skills\u002Fanalyst\u002Fidor.md`\n- XSS: `skills\u002Fexploit\u002Fweb\u002Fxss.md`\n- Open redirect: `skills\u002Fexploit\u002Fweb\u002Fopen-redirect\u002FSKILL.md`\n",{"name":5,"metadata":23,"description":7},{"subdomain":24,"when_to_use":25,"mitre_attack":26,"upstream_ref":27},"authentication","ato account takeover hijack chain password reset email change","T1078, T1110, T1528, T1539","skills\u002F_corpus\u002Fpayloads\u002FAccount Takeover\u002F","main","376de63e2b186eeb9856476ae89186e62b1d3fbe","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fato-methodology","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon","https:\u002F\u002Fgithub.com\u002Fdnzengou","2026-11-09 16:34:40",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add dnzengou\u002Fevo-decepticon --skill ato-methodology",{"tool":40,"command":41},"bunx","bunx skills add dnzengou\u002Fevo-decepticon --skill ato-methodology",{"tool":43,"command":44},"pnpm","pnpm dlx skills add dnzengou\u002Fevo-decepticon --skill ato-methodology","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fato-methodology\u002FSKILL.md",true,[],[49,56,63,70,77,84],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":18},"01M78JAX15GZR5Q5S7RMPWFX43","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":18},"01M78JARXE0ZER8P81SFD024YP","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":18},"01M78JANJNH8VMR0CK1Y6AM74G","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":18},"01M78JAFCYR2BAJF7KH0ZCXREA","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":18},"01M78JAAQ5T08FR9MY5SFNRWBM","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":18},"01M78JA6799JQZE0M9B21HRMGY","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]