hunt-auth-bypass SKILL.md skillA
hunt-auth-bypass from galact-byte/galact-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add galact-byte/galact-skills/hunt-auth-bypass@git:20260806.1b94651Pins git:20260806.1b94651 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- galact-byte/galact-skills
- Path
skills/hunt-auth-bypass/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260806.1b94651, committed Aug 6, 2026
- Size
- 4,332 bytes
- Repository stars
- 7
- License
- a license file GitHub does not identify
在授权渗透测试中挖掘认证/授权绕过（authentication & authorization bypass）。当目标的登录、SSO/OAuth/SAML、2FA、会话、密码重置、邮箱验证等鉴权环节可能被逻辑缺陷或解析差异绕过时使用——典型场景：SAML 签名/entityId 绕过、OAuth `response_type`/`redirect_uri` 篡改窃取 token、邮箱规范化/预验证绕过、2FA 可预测/可跳过、会话类型混淆。适用目标类型 Web / REST API / SSO。触发场景包括用户说"测下认证绕过""这个 SAML/OAuth 有没有问题""能不能跳过 2FA""邮箱验证能绕吗"。输出：绕过路径 + 越权访问证据的 finding（含 killed 记录）。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# hunt-auth-bypass · 认证/授权绕过猎杀 只解决**认证与授权绕过一类**：登录、SSO（SAML/OAuth/OIDC）、2FA、会话、密码重置、邮箱验证等环节的逻辑缺陷与解析差异。这类漏洞**高度依赖业务流程**，脚本只做入口枚举与已知模式探测，真正判定靠**能否以他人身份/越权访问**为客观标准，多数验证需人工按流程走。 绕过认证会触及他人账户，风险与合规敏感。默认只在**自己控制的测试账户**间验证（A 账户能否越权访问 B 的资源/身份），不碰真实用户数据。已知模式与真实报告见 `reference.md`。 ## Scope（授权范围） **先确认授权。** 落实：授权目标、可用的测试账户（至少 2 个，用于验证越权）、允许触碰的鉴权环节、明确禁止访问真实用户数据。任一不清楚就停下问。 ## Goal 判定鉴权环节能否被绕过达成**以他人身份登录 / 越权访问 / 跳过 2FA / 接管账户**，给出可复现路径与越权证据。 ## Workflow `scope-check → recon → hunt → validate → report`。 ### 1. scope-check - **动作**：写 `evidence/scope.txt`（含测试账户）。 - **命令**：`bash tools/recon.sh <target> --scope-only`。 - **终止条件**：scope 与测试账户明确，否则 KILL。 ### 2. recon - **动作**：识别鉴权面——登录/注册/重置端点、SSO 类型（SAML/OAuth/OIDC，看 `SAMLResponse`/`response_type`/`redirect_uri`/`id_token`）、2FA 机制、会话 cookie 结构。 - **输出**：`recon/endpoints.json`（鉴权入口 + 机制指纹）。 - **命令**：`bash tools/recon.sh <target>`。 - **终止条件**：至少识别出一种鉴权机制。 ### 3. hunt - **动作**：按 `reference.md` 对识别出的机制跑已知模式检查：OAuth `response_type=code id_token`/`response_mode=fragment` 篡改、`redirect_uri` 宽松匹配、SAML 签名剥离/`entityId` 尾随空格、邮箱规范化差异、2FA 可预测/可跳过。多数产出"待人工按流程验证"的结构化清单。 - **输出**：`candidates.json`。 …
Read the whole file at its exact version.
How to install
mdr add galact-byte/galact-skills/hunt-auth-bypass@sha256:0875c3cc92b52255The line at the top of this page pins the label git:20260806.1b94651, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_qx4scm6t46fxputz)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 6, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4332 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
galact-byte/galact-skills · 7 stars · license a license file GitHub does not identify · pushed 2026-10-12 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_qx4scm6t46fxputz GET https://markdownregistry.com/api/v1/resolve?ref=galact-byte/galact-skills/hunt-auth-bypass GET https://markdownregistry.com/api/v1/blob/0875c3cc92b522555ed25a52774b7eaa129f83bd462ebd41d4ca23950cab9de6
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from galact-byte/galact-skills
Every file in galact-byte/galact-skills