How do I install the API Auth Attacks skill?

Run npx skillmds@latest add noorqureshi/api-auth-attacks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is API Auth Attacks safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with API Auth Attacks?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is API Auth Attacks free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published API Auth Attacks?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

API Auth Attacks by noorqureshi — Agent Skill

Name: API Auth Attacks
Author: NoorQureshi

API Auth Attacks

Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.

NoorQureshi 4635daa 2.0 KB Updated Sep 17, 2026

File contents

API authentication attacks

When it applies

An API authenticates requests via tokens/keys/sessions. Auth is the gate; weaknesses here open everything behind it.

Why it works

APIs sprawl (many endpoints, versions, clients) so authentication is applied inconsistently: some routes forgot it, tokens are long-lived or weakly signed, keys leak client-side, and error/timing differences enable enumeration and brute force.

Method

No-auth endpoints: replay requests with the token removed; probe /v1 vs /v2, /internal, /debug, and undocumented routes (Swagger/OpenAPI) for missing auth.
Token weaknesses: JWT issues (→ web-auth-jwt: alg confusion, weak secret, none); long/ non-expiring tokens; predictable session ids; token accepted in URL (logged/leaked).
Key leakage: hunt keys in JS bundles, mobile apps, git (→ code-review-secrets-detection), and test their privilege/scope.
Brute/enumeration: username enumeration via login/reset differences; weak rate limits on login/OTP (→ web-race-conditions for OTP windows).
Auth logic: password reset token predictability/leak, 2FA bypass, "remember me" tokens.

Gotchas

Test every version and verb — the fix may exist only on the newest route.
A leaked key must be live and privileged to matter — validate scope, don't over-collect.
Rate-limit "bypass" via parallelism or header rotation is reportable on many programs.

Verify success

Authenticated access without valid credentials (no-auth route, forged/replayed token, or a live leaked key performing a privileged action).

References

OWASP API Security Top 10 (API2); PortSwigger auth labs.

---name: api-auth-attacksdescription: Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.---# API authentication attacks## When it appliesAn API authenticates requests via tokens/keys/sessions. Auth is the gate; weaknesses here openeverything behind it.## Why it worksAPIs sprawl (many endpoints, versions, clients) so authentication is applied inconsistently:some routes forgot it, tokens are long-lived or weakly signed, keys leak client-side, anderror/timing differences enable enumeration and brute force.## Method1. **No-auth endpoints**: replay requests with the token removed; probe `/v1` vs `/v2`, `/internal`, `/debug`, and undocumented routes (Swagger/OpenAPI) for missing auth.2. **Token weaknesses**: JWT issues (→ `web-auth-jwt`: alg confusion, weak secret, none); long/ non-expiring tokens; predictable session ids; token accepted in URL (logged/leaked).3. **Key leakage**: hunt keys in JS bundles, mobile apps, git (→ `code-review-secrets-detection`), and test their privilege/scope.4. **Brute/enumeration**: username enumeration via login/reset differences; weak rate limits on login/OTP (→ `web-race-conditions` for OTP windows).5. **Auth logic**: password reset token predictability/leak, 2FA bypass, "remember me" tokens.## Gotchas- Test every version and verb — the fix may exist only on the newest route.- A leaked key must be *live and privileged* to matter — validate scope, don't over-collect.- Rate-limit "bypass" via parallelism or header rotation is reportable on many programs.## Verify successAuthenticated access without valid credentials (no-auth route, forged/replayed token, or a liveleaked key performing a privileged action).## ReferencesOWASP API Security Top 10 (API2); PortSwigger auth labs.

Frequently asked questions