hunt-ato

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An excellent hunting playbook: executable commands, rigorous per-path validation, and a severity gate, all tightly written. The only gap is monolithic inlining of 11 paths where a reference split could improve navigability.

Dimension	Reasoning	Score
Conciseness	Dense, code-forward playbook that assumes Claude's competence (ffuf, hashcat, JWK→PEM, OAuth flows) with no padded concept explanations; every section earns its tokens.	5 / 5
Actionability	Copy-paste-ready commands throughout — ffuf with -mc/-fr/-t flags, hashcat -m 16500, python jwt.encode, dig +short — covering the common cases per path with exact payloads.	5 / 5
Workflow Clarity	Each path has explicit validation checkpoints ('Confirmation = OOB', 'False-positive killer', 'Validate by completing the flow into a session on account B') plus an ATO Severity Gate checklist, providing clear feedback loops for a destructive/security workflow.	5 / 5
Progressive Disclosure	Well-organized with per-path headers and a clearly signaled one-level 'Related Skills & Chains' section pointing to sibling skills, but 11 attack paths are inlined monolithically rather than split into reference files.	4 / 5
	Total	19 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, highly specific ATO taxonomy description that crisply answers both what it covers and when to invoke it, with strong natural trigger terms. The only weakness is overlap with closely related sibling skills on shared trigger keywords.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions across all 9 ATO paths (host-header injection, predictable tokens, Referer leak, JWT manipulation, subdomain takeover) plus chains and validation steps — comprehensive coverage matching the top anchor.	5 / 5
Completeness	Explicitly answers both what (the 9-path taxonomy plus chains) and when ('Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical').	5 / 5
Trigger Term Quality	Natural pentest terms a hunter would actually say appear throughout — 'password reset', 'email change', 'MFA', 'OAuth', 'session', 'JWT', 'account takeover', 'ATO' — with synonyms covered.	5 / 5
Distinctiveness Conflict Risk	Clear ATO/account-takeover niche with distinct destination-class framing, but trigger terms (MFA, OAuth, JWT) overlap with sibling hunt-mfa-bypass / hunt-oauth / hunt-jwt skills, creating minor conflict risk rather than minimal.	4 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ato/SKILL.md
Commit: d4b54e1

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.