domains / families / security / hunt-auth-bypass

hunt-auth-bypass

combined

Hunting skill for auth bypass vulnerabilities. Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core hunting methodology (Crown Jewel Targets, Attack Surface Signals, and the 8-step Step-by-Step Hunting Methodology), but each contains material steps the other lacks. The uphiago copy includes a detailed Legacy-Protocol Matrix for probing legacy endpoints (WordPress XMLRPC, REST, SharePoint, etc.) that is absent from the sickn33 copy. The sickn33 copy includes a mandatory authorization confirmation gate and a specific SSH certificate-authority trust forgery technique that are absent from the uphiago copy. Crowning one would hide these real alternatives.