CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-ato

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

80

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-signal hunting playbook: executable payloads for every ATO path, explicit OOB validation and false-positive discipline, and clear chaining to sibling skills. It assumes Claude's competence and avoids concept padding, with only minor cross-section restatement in the chains section.

DimensionReasoningScore

Conciseness

Lean and tactical throughout — copy-paste payloads, false-positive killers, and validation notes with no exposition of concepts Claude already knows (no "what is a JWT" filler); every line earns its place. The Related-Skills section restates some primitives, but that restatement serves explicit chaining rather than padding.

3 / 3

Actionability

Fully executable guidance per path — concrete `curl`/`ffuf`/`hashcat`/`python3 -c jwt.encode` commands with real headers, payloads, and wordlists, plus exact response checks (e.g. `-fr "invalid"`, `AADSTS50076` claims-parsing caveat).

3 / 3

Workflow Clarity

Each path follows an attack → validate → false-positive-check sequence with explicit validation checkpoints ("Confirmation = OOB", "Validate: demonstrate real takeover of test account B", "False-positive killer/check"), and the Severity Gate plus reproducibility walkthrough provide a feedback loop for the destructive/takeover-class operation — so the workflow-clarity cap for missing validation does not apply.

3 / 3

Progressive Disclosure

No bundle files exist (references/, scripts/, assets/ absent) and none are referenced; the single-file body is organized into clearly signaled one-level sections (Path 1–9, Severity Gate, Related Skills & Chains) with no nested-reference indirection, matching the well-organized-sections bar.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, specific description that names nine concrete ATO paths, their chains, and explicit validation/trigger guidance in third person. It cleanly satisfies the what/when/which-skill bar with no fluff.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across nine distinct ATO paths with specific sub-flaws ("host-header injection redirects token", "predictable/numeric token", "alg:none / RS256->HS256 key confusion", "dangling-CNAME takeover at redirect_uri") rather than vague language.

3 / 3

Completeness

Explicitly answers both what ("9 distinct paths to ATO, plus chains") and when via a literal "Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT" clause, satisfying the top anchor.

3 / 3

Trigger Term Quality

Good coverage of natural terms users would say — "account takeover", "ATO", "password reset", "email change", "MFA", "OAuth", "session", "JWT", "Critical" — matching the rubric's good example breadth.

3 / 3

Distinctiveness Conflict Risk

A clearly bounded ATO-taxonomy niche with distinct triggers and explicit hand-offs to sibling skills ("per hunt-mfa-bypass", "crypto details → hunt-jwt-crypto"), so it is unlikely to trigger for the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.