hunt-ato

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable taxonomy with executable payloads and rigorous validation/confirmation guidance at every step. Main weakness is mild redundancy between the per-path sections and the closing chains section.

Suggestions

Trim the 'Related Skills & Chains' section to net-new chain compositions only, removing primitives already detailed in the per-path sections to reduce redundancy.

Consider moving the JWT attack mechanics (alg:none, RS256->HS256, kid injection) fully into the referenced hunt-api-misconfig skill rather than duplicating the payload block here.

Add a one-line 'Prerequisites / load with' pointer at the top naming the sibling skills this taxonomy expects, so the cross-skill handoffs read as deliberate progressive disclosure rather than inline repetition.

Dimension	Reasoning	Score
Conciseness	Dense and assumes Claude's competence (no explanations of JWT/host-header basics), but the 'Related Skills & Chains' section restates primitives already covered in the path sections, adding noticeable redundancy.	4 / 5
Actionability	Copy-paste-ready executable payloads throughout — ffuf brute-force commands, python jwt.encode snippets, hashcat -m 16500, curl JWK fetch, dig CNAME checks — covering the common cases for every path.	5 / 5
Workflow Clarity	Each path has explicit validation checkpoints ('Validate', 'Confirmation = OOB', 'False-positive killer', 'Discipline') and a severity gate with feedback loops, satisfying the destructive-operation validation requirement.	5 / 5
Progressive Disclosure	Well-organized into per-path sections with clearly signaled one-level-deep handoffs to sibling skills (hunt-idor, hunt-mfa-bypass, hunt-oauth, etc.); no bundle files exist, so structure is appropriately single-file, though some cross-skill detail could be delegated further.	4 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that crisply states what the skill does and when to use it, with clear niche boundaries reinforced by sibling-skill references. Slightly jargon-dense but appropriate for its security-testing audience.

Dimension	Reasoning	Score
Specificity	Lists 9 concrete ATO paths with specific primitives (host-header injection, predictable tokens, JWT alg confusion, redirect_uri takeover) plus explicit chains and validation steps — comprehensive concrete coverage rather than vague language.	5 / 5
Completeness	Explicitly answers both what ('Hunt account takeover taxonomy — 9 distinct paths ... plus chains' with validation) and when ('Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT ...').	5 / 5
Trigger Term Quality	Strong domain-natural triggers ('password reset / email change / MFA / OAuth / session / JWT', 'ATO chains', 'chaining primitives toward Critical') that a security tester would actually say, but jargon-dense with a few common synonyms (e.g. 'account hijack') absent, just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	Clear ATO niche with distinct triggers and explicit boundary delineation via sibling-skill handoffs (hunt-mfa-bypass, hunt-jwt-crypto), keeping conflict risk minimal.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ato/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.