CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-mfa-bypass

Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.

68

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete, executable commands and scripts, but it suffers from a redundant dual-list structure that hurts both conciseness and organization. Workflow sequencing is reasonable but lacks consistent validation checkpoints and feedback loops.

Suggestions

Consolidate the 'Autonomous Testing Priority' pattern list and the '19. MFA / 2FA BYPASS' list into a single canonical enumeration so skip-MFA and OTP-replay are not described twice in different wording — this directly tightens conciseness and progressive_disclosure.

Add a consistent validation/proof checkpoint to every pattern (e.g. an explicit 'Confirm bypass when…' line as Pattern 1 and the Proof section already do) so workflow_clarity is uniform rather than implicit on some patterns.

Reorganize the file so the most automatable workflow-first patterns flow into the detailed payload patterns under one numbered scheme, removing the '19.' artifact heading that suggests the section was lifted from a larger document.

DimensionReasoningScore

Conciseness

The body is dense and technical with no concept padding, but it presents two parallel pattern lists ('Autonomous Testing Priority' patterns 1–4 and '19. MFA / 2FA BYPASS' patterns 1–7) that re-cover skip-MFA and OTP-replay in different wording, which is redundant token spend. It is mostly efficient but could be tightened by consolidating the duplicative lists.

2 / 3

Actionability

Provides fully executable guidance — an ffuf brute-force command with rate-evasion flags, a curl skip-MFA test, a complete async Python race script, and concrete digit-by-digit prefix-oracle steps — matching the 'copy-paste ready' anchor.

3 / 3

Workflow Clarity

Steps are numbered and most patterns carry observable success conditions ('If the response returns user data → Critical', a 'Proof:' line), but validation is inconsistent across the two parallel lists and there are no error-recovery feedback loops, leaving checkpoints implicit in places.

2 / 3

Progressive Disclosure

Single file with no bundle references and clear section headers, but the dual pattern-list structure (Autonomous Priority vs section 19) is confusing rather than cleanly organized, and at ~130 lines it exceeds the simple-skill threshold where sectioning alone would earn a 3.

2 / 3

Total

9

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that concretely enumerates the bypass patterns, detection, and validation, and includes an explicit 'Use when' trigger. It is concise relative to its information density and clearly scoped to the MFA/2FA bypass niche.

DimensionReasoningScore

Specificity

Enumerates seven concrete bypass patterns with specific actions (e.g. 'MFA-step skip via direct navigation to post-login URL', 'brute-force the 6-digit OTP without rate limit (10^6 attempts)') plus concrete detection and validation steps, matching the 'lists multiple specific concrete actions' anchor.

3 / 3

Completeness

Clearly answers both what (seven patterns, detection, validation) and when via the explicit 'Use when hunting auth bypass, MFA flows, chaining primitives toward ATO' trigger clause.

3 / 3

Trigger Term Quality

Uses natural terms a user hunting auth would actually say — 'MFA / 2FA bypass', 'OTP', 'auth bypass', 'MFA flows', 'ATO', 'rate limit' — giving good coverage of common variations.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear MFA/2FA-bypass niche with distinct triggers and third-person imperative voice; the broad 'auth bypass' phrase is a mild overlap with a sibling skill but the MFA framing keeps it distinguishable.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.