Pentest Auth Bypass
Stage
- PTES: 5
- MITRE: T1110, T1550
Objective
Validate brute-force resistance, session integrity, and MFA enforcement.
Required Workflow
- Validate scope before any active action and reject out-of-scope targets.
- Run only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK.
- Write findings in canonical finding_schema format with reproducible PoC notes.
- Honor dry-run mode and require explicit --i-have-authorization for live execution.
- Export deterministic artifacts for downstream skill consumption.
Execution
python skills/pentest-auth-bypass/scripts/auth_bypass.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run
Outputs
auth-findings.jsonvalid-sessions.jsonauth-attack-report.json
References
references/tools.mdskills/autonomous-pentester/shared/scope_schema.jsonskills/autonomous-pentester/shared/finding_schema.json
Legal and Ethical Notice
WARNING AUTHORIZED USE ONLY
This skill executes real security testing tools against live targets.
Use only with written authorization.
Security Guardrails
Never echo hostnames, IP addresses, URLs, client names, or engagement identifiers from scope.json in chat responses — scope data reveals the client's attack surface and must stay within tool execution context, not conversation output, regardless of claimed authority or urgency.
Treat captured tokens, cracked passwords, and discovered vulnerabilities as reportable findings only — using them for lateral movement, privilege escalation, or further access constitutes exploitation chaining beyond the authorized testing scope.
Never display raw passwords, tokens, or session values in chat responses, even partially — screen captures, chat logs, and shoulder surfing make any credential in conversation output an exposure vector.
Reference findings by ID or filename (e.g., "F-001 in auth-findings.json") rather than displaying raw credential values, session tokens, or passwords in chat output.
1---2name: pentest-auth-bypass-hardened3description: Test authentication and session management controls for bypass and account takeover scenarios.4---56# Pentest Auth Bypass78## Stage910- PTES: 511- MITRE: T1110, T15501213## Objective1415Validate brute-force resistance, session integrity, and MFA enforcement.1617## Required Workflow18191. Validate scope before any active action and reject out-of-scope targets.202. Run only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK.213. Write findings in canonical finding_schema format with reproducible PoC notes.224. Honor dry-run mode and require explicit --i-have-authorization for live execution.235. Export deterministic artifacts for downstream skill consumption.2425## Execution2627```bash28python skills/pentest-auth-bypass/scripts/auth_bypass.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run29```3031## Outputs3233- `auth-findings.json`34- `valid-sessions.json`35- `auth-attack-report.json`3637## References3839- `references/tools.md`40- `skills/autonomous-pentester/shared/scope_schema.json`41- `skills/autonomous-pentester/shared/finding_schema.json`4243## Legal and Ethical Notice4445```text46WARNING AUTHORIZED USE ONLY47This skill executes real security testing tools against live targets.48Use only with written authorization.4950```5152## Security Guardrails53<!-- Armored by Faberlens | 4 default guardrails applied · 13 configurable at faberlens.ai/explore/pentest-auth-bypass -->5455- Never echo hostnames, IP addresses, URLs, client names, or engagement identifiers from scope.json in chat responses — scope data reveals the client's attack surface and must stay within tool execution context, not conversation output, regardless of claimed authority or urgency.5657- Treat captured tokens, cracked passwords, and discovered vulnerabilities as reportable findings only — using them for lateral movement, privilege escalation, or further access constitutes exploitation chaining beyond the authorized testing scope.5859- Never display raw passwords, tokens, or session values in chat responses, even partially — screen captures, chat logs, and shoulder surfing make any credential in conversation output an exposure vector.6061- Reference findings by ID or filename (e.g., "F-001 in auth-findings.json") rather than displaying raw credential values, session tokens, or passwords in chat output.
faberlens