api-auth-and-jwt-abuse

de yaklang

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

Resumen

SKILL.mdLeída en 6fbf0bc

SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits

AI LOAD INSTRUCTION: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.

1. TOKEN TRIAGE

Inspect:

alg, kid, jku, x5u
role, org, tenant, scope, or privilege claims
issuer and audience mismatches
reuse of mobile and web tokens across products

2. QUICK ATTACK PICKS

Pattern	First Test
`alg:none` acceptance	unsigned token with trailing dot
RS256 confusion	switch to HS256 using public key as secret
`kid` lookup trust	path traversal or injection in `kid`
remote key fetch trust	attacker-controlled `jku` or `x5u`
weak secret	offline crack with targeted wordlists

3. HIDDEN FIELDS AND BATCH ABUSE

Mass assignment field picks

role
isAdmin
admin
verified
plan
tier
permissions
org
owner

Rate limit and batch abuse picks

X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9

GraphQL or JSON batch abuse candidates:

arrays of login mutations
bulk object fetches with varying IDs
repeated password reset or verification calls in one request

4. RATE LIMIT BYPASS FAMILIES

X-Forwarded-For
X-Real-IP
Forwarded
User-Agent rotation
Path case / slash variants

5. NEXT ROUTING

For GraphQL batching and hidden parameters: graphql and hidden parameters
For default credential and brute-force planning: authentication bypass
For full JWT and OAuth depth: jwt oauth token attacks
For OAuth or OIDC configuration flaws in browser and SSO flows: oauth oidc misconfiguration
For credentialed browser reads and origin trust bugs: cors cross origin misconfiguration

Archivos 1 archivo

SKILL.mdMarkdown

Instálala a mano

Deska ejecuta esto por ti, para cada agente que elijas. Para ejecutarlo tú en una terminal:

npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse

Más de yaklang

hack yaklangEntry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, authorized pentest, code audit, source-leak mining, middleware audit, SOC triage, detection engineering, incident response, or choosing the right next category skill before any deep topic skill. Also use when the user mentions 安全工程师, 渗透测试, 红队, 蓝队, 代码审计, 源码泄露, SRC. Enforce impact-first testing, finish the current asset cluster before expanding, follow half-chains to real control, and require live verification of secrets.4,000 instalaciones en skills.sh0
android-pentesting-tricks yaklangAndroid pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.3,700 instalaciones en skills.sh0
code-obfuscation-deobfuscation yaklangCode obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.3,700 instalaciones en skills.sh0
sqli-sql-injection yaklangSQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.3,700 instalaciones en skills.sh0
api-sec yaklangEntry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.3,600 instalaciones en skills.sh0

Todas las skills de yaklang