Authenticated Session Acquisition
Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a...
Install
npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -g -a claude-code -y- Repository
- transilienceai/communitytools600
- Category
- Testing
- Updated
- 3mo ago
- License
- MIT
- Context cost
- Lightabout 1,290 tokens
- Runs scripts
- No, instructions only
What it does
Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication skill (which ATTACKS auth); this one legitimately authenticates and hands the session to the rest of the engagement.
Authenticated Session Acquisition
On financial and multi-tenant targets the login is gated by SMS OTP / TOTP MFA that an autonomous run cannot satisfy, so the post-auth surface (BOLA/IDOR/mass-assignment/injection on the real data APIs, session handling, API pivots) silently collapses to pre-auth findings only. This skill's job is narrow and concrete: get one legitimate authenticated session and hand it to the executors as a reusable artifact. It does not attack the auth mechanism, see authentication for that.
The artifact contract (how the session reaches executors)
Emit both, into the engagement's OUTPUT_DIR, referenced BY NAME (never inline secrets, credential-loading.md):
OUTPUT_DIR/<asset>/session/storageState.json, the Playwright storage state (cookies + localStorage) for browser-driven post-auth testing.OUTPUT_DIR/<asset>/session/bearer.txt, the raw access/ID token (+ itsexpires_at) for direct API replay.
Executors consume these exactly like any env-loaded secret: the scope file's creds_env names the realm, and the session path is passed as a file reference, so no token is ever written into a prompt, experiments.md, or attack-chain.md. Re-run this skill when the token expires (record expires_at; refresh rather than re-login where a refresh token exists).
