api-auth-and-jwt-abuse

The api-auth-and-jwt-abuse skill is a focused security-testing playbook for probing how APIs establish and trust request identity. It targets JSON Web Tokens, bearer tokens, API keys, and the weaker signals some services rely on, walking a tester through token triage before any exploitation. Triage inspects header fields such as alg, kid, jku, and x5u, along with role, org, tenant, scope, and privilege claims, and looks for issuer or audience mismatches and tokens reused across mobile and web products.

From triage it moves to a set of quick attack picks: accepting alg:none unsigned tokens, RS256-to-HS256 algorithm confusion using the public key as the HMAC secret, path traversal or injection through the kid lookup, attacker-controlled remote key fetching via jku or x5u, and offline cracking of weak signing secrets. Beyond token forgery it covers mass-assignment field candidates such as role, isAdmin, admin, verified, plan, tier, permissions, org, and owner, plus batch-abuse patterns like arrays of login mutations or repeated password-reset calls in a single request.

A dedicated section enumerates rate-limit bypass families, including spoofed X-Forwarded-For, X-Real-IP, and Forwarded headers, User-Agent rotation, and path case or slash variants. The skill is deliberately scoped as a routing hub: when findings point elsewhere it hands off to sibling skills for full JWT and OAuth depth, OAuth/OIDC misconfiguration, GraphQL and hidden parameters, authentication bypass, and CORS trust bugs. Use it when the identity boundary of an API is the thing under test rather than deep protocol internals.