Results for “token-authentication”
9 skills
mukul975 Testing API Authentication Weaknesses
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws.
24.6k · bundle
mukul975 Testing Mobile API Authentication
Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities.
24.6k · bundle
More results
mukul975 Testing For JSON Web Token Vulnerabilities
Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.
24.6k · bundle
mukul975 Testing JWT Token Security
Assess JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.
24.6k · bundle
zhaoxuya520 Identity Federation
Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.
12.8k · bundle
mukul975 Attacking OAUTH With Device Code Phishing
Execute OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services during authorized red-team engagements.
24.6k · bundle
mukul975 Implementing Canary Tokens For Network Intrusion
Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alerting to Slack, Teams, email, or generic HTTP endpoints.
24.6k · bundle
mukul975 Extracting Credentials From Memory Dump
Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.
24.6k · bundle
mukul975 Performing Initial Access With Evilginx3
Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.
24.6k · bundle