auth-sec

Authentication and Authorization Router is a P1 category entry point for security testing of login, session, and authorization boundaries. It is the first stop when a target exposes login, registration, password reset, two-factor authentication, sessions, JWT, OAuth, or SSO, and its job is to decide whether the issue is mainly login mechanics, object-level authorization, browser trust boundaries, or identity protocols before diving into a deeper topic skill.

The skill map routes to focused areas: authentication bypass for login bypass, password reset, 2FA, enumeration, and brute-force protections; IDOR and broken object authorization covering IDOR, BOLA, BFLA, and missing object permissions; JWT and OAuth token attacks such as algorithm confusion, key trust issues, claim abuse, and token forgery; OAuth and OIDC misconfiguration around redirect URI, state, nonce, PKCE, and account binding; CSRF including token handling, SameSite, JSON CSRF, and login CSRF; CORS misconfiguration such as reflected Origin, credentialed cross-origin reads, and allowlist bypass; and SAML SSO assertion attacks like assertion wrapping, signature validation, audience, and ACS boundaries.

The recommended flow is ordered: first confirm the authentication model and session boundaries, then confirm object-level and function-level authorization, then move to token, cross-origin, and protocol details, and finally continue into OAuth, OIDC, or SAML topics if enterprise federation is present. It also points to related categories such as API security, and notes that shared material like default credentials, username variants, wordlist sizing, and port focus is consolidated into the authentication-bypass skill. Use it as the triage step that classifies an authentication or authorization weakness and hands off to the correct deep-topic skill.